mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-27 13:13:06 -08:00
127 lines
6.0 KiB
Markdown
127 lines
6.0 KiB
Markdown
# AWS - STS Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## STS
|
|
|
|
**AWS Security Token Service (STS)** is primarily designed to issue **temporary, limited-privilege credentials**. These credentials can be requested for **AWS Identity and Access Management (IAM)** users or for authenticated users (federated users).
|
|
|
|
Given that STS's purpose is to **issue credentials for identity impersonation**, the service is immensely valuable for **escalating privileges and maintaining persistence**, even though it might not have a wide array of options.
|
|
|
|
### Assume Role Impersonation
|
|
|
|
The action [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) provided by AWS STS is crucial as it permits a principal to acquire credentials for another principal, essentially impersonating them. Upon invocation, it responds with an access key ID, a secret key, and a session token corresponding to the specified ARN.
|
|
|
|
For Penetration Testers or Red Team members, this technique is instrumental for privilege escalation (as elaborated [**here**](../aws-privilege-escalation/aws-sts-privesc.md#sts-assumerole)). However, it's worth noting that this technique is quite conspicuous and may not catch an attacker off guard.
|
|
|
|
#### Assume Role Logic
|
|
|
|
In order to assume a role in the same account if the **role to assume is allowing specifically a role ARN** like in:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "arn:aws:iam::<acc_id>:role/priv-role"
|
|
},
|
|
"Action": "sts:AssumeRole",
|
|
"Condition": {}
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The role **`priv-role`** in this case, **doesn't need to be specifically allowed** to assume that role (with that allowance is enough).
|
|
|
|
However, if a role is allowing an account to assume it, like in:
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "arn:aws:iam::<acc_id>:root"
|
|
},
|
|
"Action": "sts:AssumeRole",
|
|
"Condition": {}
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
The role trying to assume it will need a **specific `sts:AssumeRole` permission** over that role **to assume it**.
|
|
|
|
If you try to assume a **role** **from a different account**, the **assumed role must allow it** (indicating the role **ARN** or the **external account**), and the **role trying to assume** the other one **MUST** to h**ave permissions to assume it** (in this case this isn't optional even if the assumed role is specifying an ARN).
|
|
|
|
### Enumeration
|
|
|
|
```bash
|
|
# Get basic info of the creds
|
|
aws sts get-caller-identity
|
|
aws sts get-access-key-info --access-key-id <AccessKeyID>
|
|
|
|
# Get CLI a session token with current creds
|
|
## Using CLI creds
|
|
## You cannot get session creds using session creds
|
|
aws sts get-session-token
|
|
## MFA
|
|
aws sts get-session-token --serial-number <arn_device> --token-code <otp_code>
|
|
```
|
|
|
|
### Privesc
|
|
|
|
In the following page you can check how to **abuse STS permissions to escalate privileges**:
|
|
|
|
{% content-ref url="../aws-privilege-escalation/aws-sts-privesc.md" %}
|
|
[aws-sts-privesc.md](../aws-privilege-escalation/aws-sts-privesc.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Post Exploitation
|
|
|
|
{% content-ref url="../aws-post-exploitation/aws-sts-post-exploitation.md" %}
|
|
[aws-sts-post-exploitation.md](../aws-post-exploitation/aws-sts-post-exploitation.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Persistence
|
|
|
|
{% content-ref url="../aws-persistence/aws-sts-persistence.md" %}
|
|
[aws-sts-persistence.md](../aws-persistence/aws-sts-persistence.md)
|
|
{% endcontent-ref %}
|
|
|
|
## References
|
|
|
|
* [https://blog.christophetd.fr/retrieving-aws-security-credentials-from-the-aws-console/?utm\_source=pocket\_mylist](https://blog.christophetd.fr/retrieving-aws-security-credentials-from-the-aws-console/?utm_source=pocket_mylist)
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|