CounterHack / HolidayHack2020

SANS Holiday Hack Challenge 2020
13 stars 1 forks source link

S3 Bucket "does not exist" #23

Open rot169 opened 3 years ago

rot169 commented 3 years ago

Several reports of "Bucket does not exist" from within the Terminal, despite the correct name being specified. Bucket is accessible from browser outside of Terminal. AWS possibly now blocking access from some Terminal IPs due to scanning activity...?

joswr1ght commented 3 years ago

This issue has been evasive. I just did a scan from an in-game terminal with 100+ names and it worked as expected. Can we get some screenshots or other supporting information to help troubleshoot? Does curl https://wrapper3000.s3.amazonaws.com/ return an error of some sort?

rot169 commented 3 years ago

image

Curl not installed on that docker image :(

joswr1ght commented 3 years ago

OK, I'll fix that and add curl. Can you send me the wordlist that produces this failed detect? cat words >/dev/tcp/68.15.34.115/11111 will do it. Thank you!

rot169 commented 3 years ago

Wordlist sent

joswr1ght commented 3 years ago

Thank you, received. The wordlist is indeed correct.

$ xxd wordlist
00000000: 6b72 696e 676c 6563 6173 746c 650a 7772  kringlecastle.wr
00000010: 6170 7065 7233 3030 300a 5772 6170 7065  apper3000.Wrappe
00000020: 7233 3030 300a 7361 6e74 610a            r3000.santa.

Cut-and-paste into a terminal I just opened and it discovered the bucket OK.

Where in the world are you @rot169? Can you also open the terminal and run the following Perl command and send me back the IP address of the AWS server resolved?

perl -e 'use Socket; $ip=gethostbyname("wrapper3000.s3.amazonaws.com"); print(inet_ntoa($ip));'

Thank you!

rot169 commented 3 years ago

I'm based in the UK. I also tried with each of the --region options but had the same result.

IP from above command is: 52.217.13.60

No sign of curl in the image yet btw...

androsn commented 3 years ago

same issue here: ip 52.216.141.36

DataWearsAHood commented 3 years ago

Same issue, though intermittent.

rot169 commented 3 years ago

$ curl https://wrapper3000.s3.amazonaws.com/

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>NoSuchBucket</Code><Message>The specified bucket does not exist</Message><BucketName>wrapper3000</BucketName><RequestId>F32F6F42C9D23376</RequestId><HostId>DQ2Miogik3q9TXCvMgl85IjeujZhzTMsgCTEBycTf0CXXSQy1kSWcHgfa6EmHRpe/xLRFgMc6ok=</HostId></Error>
joswr1ght commented 3 years ago

Thanks for testing and providing notes everyone! I'm befuddled by this. For the IP addresses supplied by @androsn and @rot169 it works OK on my side:

~ $ ping -c 1 wrapper3000.s3.amazonaws.com | head -2
PING s3-1-w.amazonaws.com (52.216.131.139): 56 data bytes
64 bytes from 52.216.131.139: icmp_seq=0 ttl=48 time=16.697 ms
~ $ curl --silent https://notareals3bucketname.s3.amazonaws.com/ | xmllint -format - | grep -E "Name|Error"<Error>
  <BucketName>notareals3bucketname</BucketName>
</Error>
~ $ curl --silent https://wrapper3000.s3.amazonaws.com/ | xmllint -format - | grep -E "Name|Error"
  <Name>wrapper3000</Name>

This is what I expect it to do. Using the alternate IP's supplied earlier in this ticket:

~ $ sudo vi /etc/hosts # remove old IP
~ $ echo 52.216.141.36 wrapper3000.s3.amazonaws.com | sudo tee -a /etc/hosts
52.216.141.36 wrapper3000.s3.amazonaws.com
~ $ ping -c 1 wrapper3000.s3.amazonaws.com | head -2
PING wrapper3000.s3.amazonaws.com (52.216.141.36): 56 data bytes
64 bytes from 52.216.141.36: icmp_seq=0 ttl=38 time=22.726 ms
~ $ curl --silent https://wrapper3000.s3.amazonaws.com/ | xmllint -format - | grep -E "Name|Error"
  <Name>wrapper3000</Name>

I'm not disputing the problem, just documenting notes as we try to work out what's happening here. Thank you for reporting this and for your help troubleshooting! We'll continue to look into why this is happening and try to figure out a resolution.

rot169 commented 3 years ago

Could the issue be the IP of the terminal instances? I.e., only a particular range of IPs have been blocked by AWS?

joswr1ght commented 3 years ago

The current consensus is that Amazon is not returning consistent results, potentially the impact of rate limiting, but inconsistently across servers. We're looking into options to figure out how to make this work. Stay tuned!