gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/pentesting-cloud/aws-security/aws-privilege-escalation/

Browse Source
This commit is contained in:
Translator
2025-02-15 01:16:08 +00:00
parent 7aa473dc6b
commit 490891af24
3 changed files with 29 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/SUMMARY.md
+4 -2
View File
@@ -292,6 +292,7 @@
- [AWS - KMS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md)
- [AWS - Lambda Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md)
- [AWS - Lightsail Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md)
- [AWS - Macie Enum](pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc.md)
- [AWS - Mediapackage Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md)
- [AWS - MQ Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md)
- [AWS - MSK Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md)
@@ -320,7 +321,6 @@
- [AWS - Firewall Manager Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md)
- [AWS - GuardDuty Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md)
- [AWS - Inspector Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md)
- [AWS - Macie Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-macie-enum.md)
- [AWS - Security Hub Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md)
- [AWS - Shield Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md)
- [AWS - Trusted Advisor Enum](pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md)
@@ -354,6 +354,7 @@
- [AWS - KMS Enum](pentesting-cloud/aws-security/aws-services/aws-kms-enum.md)
- [AWS - Lambda Enum](pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md)
- [AWS - Lightsail Enum](pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md)
- [AWS - Macie Enum](pentesting-cloud/aws-security/aws-services/aws-macie-enum.md)
- [AWS - MQ Enum](pentesting-cloud/aws-security/aws-services/aws-mq-enum.md)
- [AWS - MSK Enum](pentesting-cloud/aws-security/aws-services/aws-msk-enum.md)
- [AWS - Organizations Enum](pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md)
@@ -399,6 +400,7 @@
- [Az - Tokens & Public Applications](pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md)
- [Az - Enumeration Tools](pentesting-cloud/azure-security/az-enumeration-tools.md)
- [Az - Unauthenticated Enum & Initial Entry](pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md)
- [Az - Container Registry Unauth](pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-container-registry-unauth.md)
- [Az - OAuth Apps Phishing](pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-oauth-apps-phishing.md)
- [Az - Storage Unauth](pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md)
- [Az - VMs Unauth](pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-vms-unauth.md)
@@ -413,7 +415,7 @@
- [Az - Azure App Services](pentesting-cloud/azure-security/az-services/az-app-services.md)
- [Az - Cloud Shell](pentesting-cloud/azure-security/az-services/az-cloud-shell.md)
- [Az - Container Registry](pentesting-cloud/azure-security/az-services/az-container-registry.md)
- [Az - Container Registry](pentesting-cloud/azure-security/az-services/az-container-instances.md)
- [Az - Container Instances](pentesting-cloud/azure-security/az-services/az-container-instances.md)
- [Az - CosmosDB](pentesting-cloud/azure-security/az-services/az-cosmosDB.md)
- [Az - Intune](pentesting-cloud/azure-security/az-services/intune.md)
- [Az - File Shares](pentesting-cloud/azure-security/az-services/az-file-shares.md)
src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc.md
+25 -13
View File
@@ -1,25 +1,37 @@
# Amazon Macie - Bypass `Reveal Sample` Integrity Check
# AWS - Macie Privesc
AWS Macie ni huduma ya usalama inayogundua kiotomatiki data nyeti ndani ya mazingira ya AWS, kama vile akidi, taarifa za kibinafsi zinazoweza kutambulika (PII), na data nyingine za siri. Wakati Macie inatambua akidi nyeti, kama vile funguo za siri za AWS zilizohifadhiwa katika S3 bucket, inaunda matokeo yanayomruhusu mmiliki kuona "kielelezo" cha data iliyogunduliwa. Kwa kawaida, mara tu faili nyeti inapondolewa kutoka S3 bucket, inatarajiwa kwamba siri haiwezi tena kupatikana.
{{#include ../../../banners/hacktricks-training.md}}
Hata hivyo, **bypass** imegundulika ambapo mshambuliaji mwenye ruhusa za kutosha anaweza **ku-upload tena faili yenye jina sawa** lakini ikiwa na data tofauti, zisizo nyeti. Hii inasababisha Macie kuhusisha faili iliyopakiwa upya na matokeo ya awali, ikimruhusu mshambuliaji kutumia **kipengele cha "Reveal Sample"** kutoa siri iliyogunduliwa hapo awali. Tatizo hili linaweka hatari kubwa ya usalama, kwani siri ambazo zilidhaniwa kufutwa zinabaki kupatikana kupitia njia hii.
## Macie
<img src="https://github.com/user-attachments/assets/c44228ae-12cd-41bd-9a04-57f503a63281" height="800" width="auto"/>
Kwa maelezo zaidi kuhusu Macie angalia:
## Steps To Reproduce:
{{#ref}}
../aws-services/aws-macie-enum.md
{{#endref}}
1. Upload a file (e.g., `test-secret.txt`) to an S3 bucket with sensitive data, such as an AWS secret key. Wait for AWS Macie to scan and generate a finding.
### Amazon Macie - Pita `Reveal Sample` Ukaguzi wa Uaminifu
2. Navigate to AWS Macie Findings, locate the generated finding, and use the **Reveal Sample** feature to view the detected secret.
AWS Macie ni huduma ya usalama inayogundua kiotomatiki data nyeti ndani ya mazingira ya AWS, kama vile akidi, taarifa zinazoweza kutambulika binafsi (PII), na data nyingine za siri. Wakati Macie inatambua akidi nyeti, kama vile funguo za siri za AWS zilizohifadhiwa katika S3 bucket, inaunda ugunduzi unaomruhusu mmiliki kuona "kielelezo" cha data iliyogunduliwa. Kwa kawaida, mara faili nyeti inapondolewa kutoka S3 bucket, inatarajiwa kuwa siri hiyo haiwezi tena kupatikana.
3. Delete `test-secret.txt` from the S3 bucket and verify that it no longer exists.
Hata hivyo, **pita** imegundulika ambapo mshambuliaji mwenye ruhusa za kutosha anaweza **ku-upload tena faili yenye jina sawa** lakini ikiwa na data tofauti, zisizo nyeti. Hii inasababisha Macie kuhusisha faili iliyopakiwa upya na ugunduzi wa awali, ikiruhusu mshambuliaji kutumia **kipengele cha "Reveal Sample"** kutoa siri iliyogunduliwa awali. Tatizo hili linaweka hatari kubwa ya usalama, kwani siri ambazo zilidhaniwa kufutwa zinabaki kupatikana kupitia njia hii.
4. Create a new file named `test-secret.txt` with dummy data and re-upload it to the same S3 bucket using **attacker's account**.
![flow](https://github.com/user-attachments/assets/7b83f2d3-1690-41f1-98cc-05ccd0154a66)
5. Return to AWS Macie Findings, access the original finding, and click **Reveal Sample** again.
**Hatua za Kurudia:**
6. Observe that Macie still reveals the original secret, despite the file being deleted and replaced with different content **from different accounts, in our case it will be the attacker's account**.
1. Pakiwa faili (mfano, `test-secret.txt`) kwenye S3 bucket yenye data nyeti, kama funguo ya siri ya AWS. Subiri AWS Macie ikague na kuunda ugunduzi.
## Summary:
2. Tembelea AWS Macie Findings, pata ugunduzi ulioanzishwa, na tumia kipengele cha **Reveal Sample** kuona siri iliyogunduliwa.
Uthibitisho huu unaruhusu mshambuliaji mwenye ruhusa za kutosha za AWS IAM kurejesha siri zilizogunduliwa hapo awali hata baada ya faili ya awali kufutwa kutoka S3. Ikiwa funguo ya siri ya AWS, token ya ufikiaji, au akidi nyingine nyeti inafichuliwa, mshambuliaji anaweza kutumia kasoro hii kuirejesha na kupata ufikiaji usioidhinishwa kwa rasilimali za AWS. Hii inaweza kusababisha kupanda kwa ruhusa, ufikiaji usioidhinishwa wa data, au kuathiri zaidi mali za wingu, na kusababisha uvunjaji wa data na usumbufu wa huduma.
3. Futa `test-secret.txt` kutoka S3 bucket na thibitisha kuwa haipo tena.
4. Unda faili mpya yenye jina `test-secret.txt` ikiwa na data za dummy na uipakie tena kwenye S3 bucket hiyo hiyo ukitumia **akaunti ya mshambuliaji**.
5. Rudi kwenye AWS Macie Findings, pata ugunduzi wa awali, na bonyeza **Reveal Sample** tena.
6. Angalia kuwa Macie bado inaonyesha siri ya awali, licha ya faili kufutwa na kubadilishwa na maudhui tofauti **kutoka kwa akaunti tofauti, katika kesi yetu itakuwa akaunti ya mshambuliaji**.
**Muhtasari:**
Ukiukaji huu unaruhusu mshambuliaji mwenye ruhusa za kutosha za AWS IAM kurejesha siri zilizogunduliwa awali hata baada ya faili ya awali kufutwa kutoka S3. Ikiwa funguo ya siri ya AWS, token ya ufikiaji, au akidi nyingine nyeti inafichuliwa, mshambuliaji anaweza kutumia kasoro hii kuirejesha na kupata ufikiaji usioidhinishwa kwa rasilimali za AWS. Hii inaweza kusababisha kupanda kwa ruhusa, ufikiaji usioidhinishwa wa data, au kuathiri zaidi mali za wingu, na kusababisha uvunjaji wa data na usumbufu wa huduma.
src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-macie-enum.md
-116
View File
@@ -1,116 +0,0 @@
# AWS - Macie Enum
## AWS - Macie Enum
{{#include ../../../../banners/hacktricks-training.md}}
## Macie
Amazon Macie inajitokeza kama huduma iliyoundwa ili **kutambua, kuainisha, na kubaini data** ndani ya akaunti ya AWS. Inatumia **machine learning** ili kuendelea kufuatilia na kuchambua data, ikilenga hasa kutambua na kutoa tahadhari dhidi ya shughuli zisizo za kawaida au za kutatanisha kwa kuchunguza **cloud trail event** data na mifumo ya tabia za watumiaji.
Vipengele Muhimu vya Amazon Macie:
1. **Mapitio ya Data ya Kazi**: Inatumia machine learning kukagua data kwa njia ya kazi mbalimbali zinapotokea ndani ya akaunti ya AWS.
2. **Utambuzi wa Anomalies**: Inatambua shughuli zisizo za kawaida au mifumo ya ufikiaji, ikizalisha tahadhari ili kupunguza hatari za uwezekano wa kufichika kwa data.
3. **Ufuatiliaji Endelevu**: Inafuatilia na kutambua data mpya katika Amazon S3, ikitumia machine learning na akili bandia kubadilika kulingana na mifumo ya ufikiaji wa data kwa muda.
4. **Uainishaji wa Data kwa NLP**: Inatumia usindikaji wa lugha asilia (NLP) kuainisha na kutafsiri aina mbalimbali za data, ikitoa alama za hatari ili kuipa kipaumbele matokeo.
5. **Ufuatiliaji wa Usalama**: Inatambua data nyeti za usalama, ikiwa ni pamoja na funguo za API, funguo za siri, na taarifa za kibinafsi, kusaidia kuzuia kufichika kwa data.
Amazon Macie ni **huduma ya kikanda** na inahitaji 'AWSMacieServiceCustomerSetupRole' IAM Role na AWS CloudTrail iliyoanzishwa kwa ajili ya utendaji.
### Mfumo wa Tahadhari
Macie inagawanya tahadhari katika makundi yaliyoainishwa kama:
- Ufikiaji wa Anonymized
- Uzingatiaji wa Data
- Kupoteza Kiwango
- Kuinua Mamlaka
- Ransomware
- Ufikiaji wa Kutatanisha, nk.
Tahadhari hizi zinatoa maelezo ya kina na ufafanuzi wa matokeo kwa ajili ya majibu na ufumbuzi mzuri.
### Vipengele vya Dashibodi
Dashibodi inagawanya data katika sehemu mbalimbali, ikiwa ni pamoja na:
- Vitu vya S3 (kwa muda, ACL, PII)
- Matukio/matumizi ya CloudTrail yenye hatari kubwa
- Mahali pa Shughuli
- Aina za utambulisho wa mtumiaji wa CloudTrail, na zaidi.
### Uainishaji wa Watumiaji
Watumiaji wanaainishwa katika ngazi kulingana na kiwango cha hatari cha simu zao za API:
- **Platinum**: Simu za API zenye hatari kubwa, mara nyingi zikiwa na mamlaka ya admin.
- **Gold**: Simu za API zinazohusiana na miundombinu.
- **Silver**: Simu za API zenye hatari ya kati.
- **Bronze**: Simu za API zenye hatari ndogo.
### Aina za Utambulisho
Aina za utambulisho zinajumuisha Root, IAM user, Assumed Role, Federated User, AWS Account, na AWS Service, zikionyesha chanzo cha maombi.
### Uainishaji wa Data
Uainishaji wa data unajumuisha:
- Aina ya Maudhui: Kulingana na aina ya maudhui iliyogunduliwa.
- Kiambatisho cha Faili: Kulingana na kiambatisho cha faili.
- Mada: Imeainishwa kwa maneno muhimu ndani ya faili.
- Regex: Imeainishwa kulingana na mifumo maalum ya regex.
Hatari ya juu kati ya makundi haya inamua kiwango cha hatari cha faili.
### Utafiti na Uchambuzi
Kazi ya utafiti ya Amazon Macie inaruhusu maswali maalum katika data yote ya Macie kwa uchambuzi wa kina. Filters zinajumuisha Data ya CloudTrail, mali za S3 Bucket, na Vitu vya S3. Aidha, inasaidia kuwalika akaunti nyingine kushiriki Amazon Macie, ikirahisisha usimamizi wa data wa pamoja na ufuatiliaji wa usalama.
### Enumeration
```
# Get buckets
aws macie2 describe-buckets
# Org config
aws macie2 describe-organization-configuration
# Get admin account (if any)
aws macie2 get-administrator-account
aws macie2 list-organization-admin-accounts # Run from the management account of the org
# Get macie account members (run this form the admin account)
aws macie2 list-members
# Check if automated sensitive data discovey is enabled
aws macie2 get-automated-discovery-configuration
# Get findings
aws macie2 list-findings
aws macie2 get-findings --finding-ids <ids>
aws macie2 list-findings-filters
aws macie2 get -findings-filters --id <id>
# Get allow lists
aws macie2 list-allow-lists
aws macie2 get-allow-list --id <id>
# Get different info
aws macie2 list-classification-jobs
aws macie2 list-classification-scopes
aws macie2 list-custom-data-identifiers
```
#### Post Exploitation
> [!TIP]
> Kutoka kwa mtazamo wa mshambuliaji, huduma hii haijatengenezwa kugundua mshambuliaji, bali kugundua taarifa nyeti katika faili zilizohifadhiwa. Hivyo, huduma hii inaweza **kusaidia mshambuliaji kupata taarifa nyeti** ndani ya mabakuli.\
> Hata hivyo, labda mshambuliaji anaweza pia kuwa na hamu ya kuingilia kati ili kuzuia mwathirika kupata arifa na kuiba taarifa hiyo kwa urahisi.
TODO: PRs are welcome!
## References
- [https://cloudacademy.com/blog/introducing-aws-security-hub/](https://cloudacademy.com/blog/introducing-aws-security-hub/)
{{#include ../../../../banners/hacktricks-training.md}}