Closed prsimoes closed 1 year ago
christophetd
commented
2 years ago This happens to be caused by this commit in the terraform-aws-vpc module, which adds a version constraint to use the AWS provider >= 3.73.0, while we have a constraint to use 3.71.x.
Two actions from my side:
christophetd
commented
2 years ago Fix on the way, will be released as part of v2.4.2. Thanks a lot for reporting!
christophetd
commented
2 years ago 
thibon
commented
1 year ago Hi ! Think I have the same problem with the latest version (and with version 2.4.2), both using docker and OS install (MacOS) What is not working? When I try to detonate for example aws.credential-access.ec2-steal-instance-credentials, I get the following error:
> stratus detonate aws.credential-access.ec2-steal-instance-credentials
2023/04/25 11:32:55 Checking your authentication against AWS
2023/04/25 11:32:55 Installing Terraform in /Users/<user>/.stratus-red-team/terraform
2023/04/25 11:32:57 Note: This is a slow attack technique, it might take a long time to warm up or detonate
2023/04/25 11:32:57 Warming up aws.credential-access.ec2-steal-instance-credentials
2023/04/25 11:32:57 Initializing Terraform to spin up technique prerequisites
2023/04/25 11:33:00 Error during warm up. Cleaning up technique prerequisites with terraform destroy
2023/04/25 11:33:00 unable to run terraform apply on prerequisite: unable to Initialize Terraform: exit status 1
Error: Failed to query available provider packages
Could not retrieve the list of available versions for provider hashicorp/aws:
no available releases match the given constraints ~> 3.0, >= 4.35.0What OS are you using? Mac OS X (M1)
What is your Stratus Red Team version? 2.5.2
christophetd
commented
1 year ago Confirmed that this is broken again.
christophetd
commented
1 year ago Caused by this commit of the terraform-aws-vpc module: https://github.com/terraform-aws-modules/terraform-aws-vpc/commit/44e6eaa154a9e78c8d6e86d1c735f95825b270db#diff-dfd5848fa77a04d0343891fe859286cc210473d10f0e62c7f99f0d5ecf1a9927R7
Doesn't seem particularly relevant to bump all Terraform AWS provider versions to 4.x, so I'll work on #191 instead to make sure the version of terraform-aws-vpc is pinned.
christophetd
commented
1 year ago @thibon https://github.com/DataDog/stratus-red-team/pull/342 should solve it, can you build the binary (make) and give it a try? (the newly compiled binary will be at bin/stratus)
thibon
commented
1 year ago Hi @christophetd
Working ! Tried with aws.credential-access.secretsmanager-retrieve-secrets and aws.credential-access.ec2-get-password-data
Just so you know, I had to force the region env var, looks like profile wasn't enough
❯ ./bin/stratus version
dev-snapshot
❯ ./bin/stratus detonate aws.credential-access.ec2-get-password-data
2023/04/26 09:49:40 Checking your authentication against AWS
2023/04/26 09:49:41 Creating /Users/thibaut/.stratus-red-team as it doesn't exist yet
2023/04/26 09:49:41 Installing Terraform in /Users/thibaut/.stratus-red-team/terraform
2023/04/26 09:49:43 Warming up aws.credential-access.ec2-get-password-data
2023/04/26 09:49:43 Initializing Terraform to spin up technique prerequisites
2023/04/26 09:49:48 Applying Terraform to spin up technique prerequisites
2023/04/26 09:49:50 Error during warm up. Cleaning up technique prerequisites with terraform destroy
2023/04/26 09:49:51 unable to run terraform apply on prerequisite: unable to create attack technique prerequisites. Ensure you are authenticated against AWS and have the right permissions to run Stratus Red Team.
Stratus Red Team will display below the error that Terraform returned:
unable to apply Terraform: exit status 1
Error: Missing required argument
on main.tf line 9, in provider "aws":
9: provider "aws" {
The argument "region" is required, but no definition was found.
❯ export AWS_DEFAULT_REGION=us-east-1
❯ ./bin/stratus detonate aws.credential-access.ec2-get-password-data
2023/04/26 09:53:45 Checking your authentication against AWS
2023/04/26 09:53:45 Warming up aws.credential-access.ec2-get-password-data
2023/04/26 09:53:45 Applying Terraform to spin up technique prerequisites
2023/04/26 09:53:50 Running ec2:GetPasswordData on 30 random instance IDs
``Thanks for checking, will merge now.
christophetd
commented
1 year ago Will be shortly released as part of v2.5.3
What is not working? When I try to detonate for example
aws.credential-access.ec2-steal-instance-credentials, I get the following error:I confirmed that I'm authenticated against my AWS account through environment variables and I confirmed I can execute other commands like
aws.defense-evasion.cloudtrail-stop.What OS are you using? Mac OS X
What is your Stratus Red Team version? 2.4.1
Full output?
Files in $HOME/.stratus-red-team?