From 48a69fb503599bc513da36b96350bb30f0105c37 Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 24 Jun 2025 14:06:51 +0000 Subject: [PATCH] Translated ['src/pentesting-cloud/aws-security/aws-privilege-escalation/ --- .../aws-iam-roles-anywhere-privesc.md | 42 --------------- .../aws-sts-privesc.md | 53 ++++++++++++++++--- 2 files changed, 46 insertions(+), 49 deletions(-) delete mode 100644 src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md deleted file mode 100644 index 75f2d0a62..000000000 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md +++ /dev/null @@ -1,42 +0,0 @@ -# AWS - IAM Roles Anywhere Privesc - -{{#include ../../../../banners/hacktricks-training.md}} - -AWS IAM RolesAnywhere inaruhusu kazi zinazofanyika nje ya AWS kuchukua majukumu ya IAM kwa kutumia vyeti vya X.509. Lakini wakati sera za kuamini hazijapangwa vizuri, zinaweza kutumika vibaya kwa ajili ya kupandisha hadhi. - -Sera hii haina vizuizi kuhusu ni vipi kiunganishi cha kuamini au sifa za cheti zinazoruhusiwa. Kama matokeo, cheti chochote kilichounganishwa na kiunganishi chochote cha kuamini katika akaunti kinaweza kutumika kuchukua jukumu hili. -```json -{ -"Version": "2012-10-17", -"Statement": [ -{ -"Effect": "Allow", -"Principal": { -"Service": "rolesanywhere.amazonaws.com" -}, -"Action": [ -"sts:AssumeRole", -"sts:SetSourceIdentity", -"sts:TagSession" -] -} -] -} - -``` -Ili kupata privesc, `aws_signing_helper` inahitajika kutoka https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html - -Kisha kwa kutumia cheti halali, mshambuliaji anaweza kuhamasisha katika jukumu la juu la mamlaka. -```bash -aws_signing_helper credential-process \ ---certificate readonly.pem \ ---private-key readonly.key \ ---trust-anchor-arn arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/ta-id \ ---profile-arn arn:aws:rolesanywhere:us-east-1:123456789012:profile/default \ ---role-arn arn:aws:iam::123456789012:role/Admin -``` -### Marejeleo - -- https://www.ruse.tech/blogs/aws-roles-anywhere-privilege-escalation/ - -{{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md index 163ce4662..1b7b2d0b8 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md @@ -6,7 +6,7 @@ ### `sts:AssumeRole` -Kila jukumu linaumbwa na **sera ya kuamini jukumu**, sera hii inaonyesha **nani anaweza kuchukua jukumu lililoundwa**. Ikiwa jukumu kutoka **akaunti ile ile** linasema kwamba akaunti inaweza kulichukua, inamaanisha kwamba akaunti hiyo itakuwa na uwezo wa kufikia jukumu hilo (na kwa uwezekano **privesc**). +Kila jukumu linaumbwa na **sera ya kuamini jukumu**, sera hii inaonyesha **nani anaweza kuchukua jukumu lililoundwa**. Ikiwa jukumu kutoka kwa **akaunti ile ile** linasema kwamba akaunti inaweza kulichukua, inamaanisha kwamba akaunti hiyo itakuwa na uwezo wa kufikia jukumu hilo (na kwa uwezekano **privesc**). Kwa mfano, sera ifuatayo ya kuamini jukumu inaonyesha kwamba mtu yeyote anaweza kulichukua, hivyo basi **mtumiaji yeyote ataweza privesc** kwa ruhusa zinazohusiana na jukumu hilo. ```json @@ -30,7 +30,7 @@ aws sts assume-role --role-arn $ROLE_ARN --role-session-name sessionname **Madhara Yanayoweza Kutokea:** Privesc kwa jukumu. > [!CAUTION] -> Kumbuka kwamba katika kesi hii ruhusa `sts:AssumeRole` inahitaji kuwa **imeonyeshwa katika jukumu la kutumia vibaya** na sio katika sera inayomilikiwa na mshambuliaji.\ +> Kumbuka kwamba katika kesi hii ruhusa `sts:AssumeRole` inahitaji kuwa **imeonyeshwa katika jukumu la kutumia vibaya** na si katika sera inayomilikiwa na mshambuliaji.\ > Kwa ubaguzi mmoja, ili **kuchukua jukumu kutoka akaunti tofauti** akaunti ya mshambuliaji **pia inahitaji** kuwa na **`sts:AssumeRole`** juu ya jukumu. ### **`sts:GetFederationToken`** @@ -39,7 +39,7 @@ Kwa ruhusa hii inawezekana kuzalisha akidi za kujifanya kuwa mtumiaji yeyote: ```bash aws sts get-federation-token --name ``` -Hii ndiyo njia ambayo ruhusa hii inaweza kutolewa kwa usalama bila kutoa ufikiaji wa kujifanya kuwa watumiaji wengine: +Hii ndiyo njia ambayo ruhusa hii inaweza kutolewa kwa usalama bila kutoa ufikiaji wa kujifanya kama watumiaji wengine: ```json { "Version": "2012-10-17", @@ -57,7 +57,7 @@ Hii ndiyo njia ambayo ruhusa hii inaweza kutolewa kwa usalama bila kutoa ufikiaj Sera ya kuaminiana na jukumu hili inatoa **watumiaji walioidhinishwa kupitia SAML ufikiaji wa kujifanya kuwa jukumu hilo.** -Mfano wa sera ya kuaminiana yenye ruhusa hii ni: +Mfano wa sera ya kuaminiana na ruhusa hii ni: ```json { "Version": "2012-10-17", @@ -90,17 +90,56 @@ onelogin-aws-assume-role --onelogin-subdomain mettle --onelogin-app-id 283740 -- ### `sts:AssumeRoleWithWebIdentity` -Ruhusa hii inatoa ruhusa ya kupata seti ya akreditivu za usalama za muda kwa **watumiaji ambao wamethibitishwa katika programu za simu, wavuti, EKS...** na mtoa huduma wa utambulisho wa wavuti. [Jifunze zaidi hapa.](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) +Ruhusa hii inatoa ruhusa ya kupata seti ya akreditif za usalama za muda kwa **watumiaji ambao wamethibitishwa katika programu za simu, wavuti, EKS...** na mtoa huduma wa utambulisho wa wavuti. [Jifunze zaidi hapa.](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) -Kwa mfano, ikiwa **akaunti ya huduma ya EKS** inapaswa kuwa na uwezo wa **kujifanya kama jukumu la IAM**, itakuwa na tokeni katika **`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`** na inaweza **kuchukua jukumu na kupata akreditivu** ikifanya kitu kama: +Kwa mfano, ikiwa **akaunti ya huduma ya EKS** inapaswa kuwa na uwezo wa **kujifanya kama jukumu la IAM**, itakuwa na token katika **`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`** na inaweza **kuchukua jukumu na kupata akreditif** ikifanya kitu kama: ```bash aws sts assume-role-with-web-identity --role-arn arn:aws:iam::123456789098:role/ --role-session-name something --web-identity-token file:///var/run/secrets/eks.amazonaws.com/serviceaccount/token # The role name can be found in the metadata of the configuration of the pod ``` -### Unyanyasaji wa Shirikisho +### Federation Abuse {{#ref}} ../aws-basic-information/aws-federation-abuse.md {{#endref}} +### IAM Roles Anywhere Privesc + +AWS IAM RolesAnywhere inaruhusu kazi za nje ya AWS kuchukua majukumu ya IAM kwa kutumia vyeti vya X.509. Lakini wakati sera za kuamini hazijapangwa vizuri, zinaweza kutumika vibaya kwa ajili ya kupandisha hadhi. + +Sera hii haina vizuizi juu ya ni vipi kiunganishi cha kuamini au sifa za cheti zinazoruhusiwa. Kama matokeo, cheti chochote kilichounganishwa na kiunganishi chochote cha kuamini katika akaunti kinaweza kutumika kuchukua jukumu hili. +```json +{ +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"Service": "rolesanywhere.amazonaws.com" +}, +"Action": [ +"sts:AssumeRole", +"sts:SetSourceIdentity", +"sts:TagSession" +] +} +] +} + +``` +Ili kupata haki za juu, `aws_signing_helper` inahitajika kutoka https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html + +Kisha kwa kutumia cheti halali, mshambuliaji anaweza kuhamasisha katika jukumu lenye haki za juu. +```bash +aws_signing_helper credential-process \ +--certificate readonly.pem \ +--private-key readonly.key \ +--trust-anchor-arn arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/ta-id \ +--profile-arn arn:aws:rolesanywhere:us-east-1:123456789012:profile/default \ +--role-arn arn:aws:iam::123456789012:role/Admin +``` +### Marejeleo + +- [https://www.ruse.tech/blogs/aws-roles-anywhere-privilege-escalation](https://www.ruse.tech/blogs/aws-roles-anywhere-privilege-escalation) + {{#include ../../../banners/hacktricks-training.md}}