mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-27 21:23:07 -08:00
102 lines
5.5 KiB
Markdown
102 lines
5.5 KiB
Markdown
# AWS - CloudFormation & Codestar Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## CloudFormation
|
|
|
|
AWS CloudFormation is a service designed to **streamline the management of AWS resources**. It enables users to focus more on their applications running in AWS by **minimizing the time spent on resource management**. The core feature of this service is the **template**—a descriptive model of the desired AWS resources. Once this template is provided, CloudFormation is responsible for the **provisioning and configuration** of the specified resources. This automation facilitates a more efficient and error-free management of AWS infrastructure.
|
|
|
|
### Enumeration
|
|
|
|
```bash
|
|
# Stacks
|
|
aws cloudformation list-stacks
|
|
aws cloudformation describe-stacks # You could find sensitive information here
|
|
aws cloudformation list-stack-resources --stack-name <name>
|
|
aws cloudformation get-template --stack-name cloudformationStack
|
|
aws cloudformation describe-stack-events --stack-name cloudformationStack
|
|
|
|
## Show params and outputs
|
|
aws cloudformation describe-stacks | jq ".Stacks[] | .StackId, .StackName, .Parameters, .Outputs"
|
|
|
|
# Export
|
|
aws cloudformation list-exports
|
|
aws cloudformation list-imports --export-name <x_name>
|
|
|
|
# Stack Sets
|
|
aws cloudformation list-stack-sets
|
|
aws cloudformation describe-stack-set --stack-set-name <name>
|
|
aws cloudformation list-stack-instances --stack-set-name <name>
|
|
aws cloudformation list-stack-set-operations --stack-set-name <name>
|
|
aws cloudformation list-stack-set-operation-results --stack-set-name <name> --operation-id <id>
|
|
```
|
|
|
|
### Privesc
|
|
|
|
In the following page you can check how to **abuse cloudformation permissions to escalate privileges**:
|
|
|
|
{% content-ref url="../aws-privilege-escalation/aws-cloudformation-privesc/" %}
|
|
[aws-cloudformation-privesc](../aws-privilege-escalation/aws-cloudformation-privesc/)
|
|
{% endcontent-ref %}
|
|
|
|
### Post-Exploitation
|
|
|
|
Check for **secrets** or sensitive information in the **template, parameters & output** of each CloudFormation
|
|
|
|
## Codestar
|
|
|
|
AWS CodeStar is a service for creating, managing, and working with software development projects on AWS. You can quickly develop, build, and deploy applications on AWS with an AWS CodeStar project. An AWS CodeStar project creates and **integrates AWS services** for your project development toolchain. Depending on your choice of AWS CodeStar project template, that toolchain might include source control, build, deployment, virtual servers or serverless resources, and more. AWS CodeStar also **manages the permissions required for project users** (called team members).
|
|
|
|
### Enumeration
|
|
|
|
```bash
|
|
# Get projects information
|
|
aws codestar list-projects
|
|
aws codestar describe-project --id <project_id>
|
|
aws codestar list-resources --project-id <project_id>
|
|
aws codestar list-team-members --project-id <project_id>
|
|
|
|
aws codestar list-user-profiles
|
|
aws codestar describe-user-profile --user-arn <arn>
|
|
```
|
|
|
|
### Privesc
|
|
|
|
In the following page you can check how to **abuse codestar permissions to escalate privileges**:
|
|
|
|
{% content-ref url="../aws-privilege-escalation/aws-codestar-privesc/" %}
|
|
[aws-codestar-privesc](../aws-privilege-escalation/aws-codestar-privesc/)
|
|
{% endcontent-ref %}
|
|
|
|
## References
|
|
|
|
* [https://docs.aws.amazon.com/cloudformation/](https://docs.aws.amazon.com/cloudformation/)
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|