search

EdOverflow / can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.
Creative Commons Attribution 4.0 International
4.59k stars 690 forks source link

Amazon S3 proofs #36

Open PatrikHudak opened 5 years ago

PatrikHudak commented 5 years ago

Service name

Amazon (AWS) S3

Proof

Amazon S3 service is indeed vulnerable. Amazon S3 follows pretty much the same concept of virtual hosting as other cloud providers. S3 buckets might be configured as website hosting to serve static content as web servers. If the canonical domain name has website in it, the S3 bucket is specified as Website hosting. I suspect that non-website and website configured buckets are handled by separate load balancers, and therefore they don't work with each other. The only difference will be in the bucket creation where correct website flag needs to be set if necessary. Step-by-step process:

  1. Go to S3 panel
  2. Click Create Bucket
  3. Set Bucket name to source domain name (i.e., the domain you want to take over)
  4. Click Next multiple times to finish
  5. Open the created bucket
  6. Click Upload
  7. Select the file which will be used for PoC (HTML or TXT file). I recommend naming it differently than index.html; you can use poc (without extension)
  8. In Permissions tab select Grant public read access to this object(s)
  9. After upload, select the file and click More -> Change metadata
  10. Click Add metadata, select Content-Type and value should reflect the type of document. If HTML, choose text/html, etc.
  11. (Optional) If the bucket was configured as a website
    1. Switch to Properties tab
    2. Click Static website hosting
    3. Select Use this bucket to host a website
    4. As an index, choose the file that you uploaded
    5. Click Save

To verify the domain, I run:

http -b GET http://{SOURCE DOMAIN NAME} | grep -E -q '<Code>NoSuchBucket</Code>|<li>Code: NoSuchBucket</li>' && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible"

Note that there are two possible error pages depending on the bucket settings (set as website hosting or not).

Some reports on H1, claiming S3 buckets:

Documentation

There are several formats of domains that Amazon uses for S3 (RegExp):

Note that there are cases where only raw domain (e.g. s3.amazon.com) is included in CNAME and takeover is still possible.

(Documentation taken from https://0xpatrik.com/takeover-proofs/)

radiustama77 commented 1 year ago

Hello everyone,

I can confirm this takeover is still possible, adding some details:

  • If you get an error as 'the bucket .... already exists' --> it's not vulnerable.
  • A CNAME pointing to a AWS domain name is not necessary. I took a bucket that was pointing to several IP addresses. The relevant part is the response fingerprint.
  • The error with Code: IncorrectEndpoint can be fixed removing and creating the bucket in another region. It takes around 1 hour for the bucket to be removed, before that you won't be able to create it. Use AWS Cli to automate this part.
  • If you are getting Access denied errors, check this guide

i try to take subdomain from s3 bucket, if i try access subdomain ex : sub.domain.com always return error 403. but if i access sub.domain.com/index.html it can be open normally. whats the problem?

gister9000 commented 1 year ago

@radiustama77 AWS has very granular permission controls. Opening sub.domain.com/ needs s3:ListBucket permission which you don't have. However, you do have permission to s3:GetObject so if you can guess the name of the file, you will be able to get it. Based on the behavior you described, subdomain takeover is not possible. Also, it seems that bucket files are intended to be public based on 'index.html' filename implications. You may try brute-forcing for filenames and see if you get something sensitive (with gobuster for example).

radiustama77 commented 1 year ago

@radiustama77 AWS has very granular permission controls. Opening sub.domain.com/ needs s3:ListBucket permission which you don't have. However, you do have permission to s3:GetObject so if you can guess the name of the file, you will be able to get it. Based on the behavior you described, subdomain takeover is not possible. Also, it seems that bucket files are intended to be public based on 'index.html' filename implications. You may try brute-forcing for filenames and see if you get something sensitive (with gobuster for example).

what i mean is, i already can takeover several subdomain. but for some subdomain, whenever i try to access with subdomain.example.com it return to error 403 access denied. But if i access it with subdomain.example.com/index.html it works and normal.

GDATTACKER-RESEARCHER commented 1 year ago

@radiustama77 AWS has very granular permission controls. Opening sub.domain.com/ needs s3:ListBucket permission which you don't have. However, you do have permission to s3:GetObject so if you can guess the name of the file, you will be able to get it. Based on the behavior you described, subdomain takeover is not possible. Also, it seems that bucket files are intended to be public based on 'index.html' filename implications. You may try brute-forcing for filenames and see if you get something sensitive (with gobuster for example).

what i mean is, i already can takeover several subdomain. but for some subdomain, whenever i try to access with subdomain.example.com it return to error 403 access denied. But if i access it with subdomain.example.com/index.html it works and normal.

That's because you have not specified index files in static hosting which you need to for index page. Else it keep coming up with error 403

radiustama77 commented 1 year ago

@GDATTACKER-RESEARCHER I already specified the index file in static hosting. the url from s3 amazon work properly too like subdomain.s3-website-us-east-1.amazonaws.com but error still happened when i try to access via subdomain.example.com

0xpr4bin commented 1 year ago

It means that the ,bucket is not available for takeovers. 123Capture

GDATTACKER-RESEARCHER commented 1 year ago

It means that the ,bucket is not available for takeovers. 123Capture

Yes it is not possible to claim this one as it's already in use just the permissions for static hosting has been disabled

t101804 commented 1 year ago

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL in s3 bucket, i'm facing this problem. What's solution for this ? Screenshot_1

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

how to know the region?

knowthetech commented 1 year ago

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL in s3 bucket, i'm facing this problem. What's solution for this ? Screenshot_1

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

how to know the region?

simply change the region to us-west-2 in your case for domain girishsarwal.me

t101804 commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

t101804 commented 1 year ago

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL in s3 bucket, i'm facing this problem. What's solution for this ? Screenshot_1

@soynek did you ever find a solution to this? If so, how did you fix it?

In your case us-west-2 is region

how to know the region?

simply change the region to us-west-2 in your case for domain girishsarwal.me

image like in this how i can get the correct region to create a bucket with this domains

knowthetech commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

t101804 commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

image what the common methods? to get the region

knowthetech commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

image what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

t101804 commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

image what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

i check the ip for my site with the ping , and then use method like you do to check ip ranges in the amazon prefix but didnt found how i can get the region ? if the ip not avalaibe in that data you send

GDATTACKER-RESEARCHER commented 1 year ago

Using other bucket used by websites's default location, using the ip ranges of bucket, use aws-cli to know region etc

GDATTACKER-RESEARCHER commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

image what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

i check the ip for my site with the ping , and then use method like you do to check ip ranges in the amazon prefix but didnt found how i can get the region ? if the ip not avalaibe in that data you send

Ip range is available if you know networking you should know easily your ip range is mentioned there.

t101804 commented 1 year ago

girishsarwal.me

yeah i mean how to know the region of the domain?

simply try common methods if not possible by that you need to change regions after every 2 hours until you get right one

image what the common methods? to get the region

simply you can also reffer ip history to find the exact ip range matching your vulnerable domain ip https://ip-ranges.amazonaws.com/ip-ranges.json

i check the ip for my site with the ping , and then use method like you do to check ip ranges in the amazon prefix but didnt found how i can get the region ? if the ip not avalaibe in that data you send

Ip range is available if you know networking you should know easily your ip range is mentioned there.

example this endpass.com this i lookup ip and got 104.21.37.171 after that i check in iprange prefix amazon but still didnt find , can you give advice?

knowthetech commented 1 year ago

why you need script for it when you can do manually.

4nibhal commented 10 months ago

Hi guys, is this still vulnerable? I get an error that the bucket name is already taken.🤔

six2dez commented 8 months ago

Hi guys I found the following scenario:

  1. subdomain.example.com returning NoSuchBucket

  2. dig cname subdomain.example.com returns:

> dig cname subdomain.example.com                                                                   

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> cname subdomain.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43658
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;subdomain.example.com. IN  CNAME

;; ANSWER SECTION:
subdomain.example.com. 3600 IN  CNAME   RANDOM_NAME_SEQUENCE.s3.amazonaws.com.

;; Query time: 31 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Thu Nov 02 10:55:24 CET 2023
;; MSG SIZE  rcvd: 131

  1. Checked bucket region by curl -sI RANDOM_NAME_SEQUENCE.s3.amazonaws.com | grep bucket-region

  2. Claimed and created an S3 bucket with the name RANDOM_NAME_SEQUENCE.s3.amazonaws.com on the region from the previous step and uploaded a poc to RANDOM_NAME_SEQUENCE.s3.amazonaws.com/poc, made it public, both the bucket and the poc file.

  3. Navigated to https://RANDOM_NAME_SEQUENCE.s3.amazonaws.com/poc and the file shows properly.

  4. subdomain.example.com/poc still shows NoSuchBucket.

Also tried the to create the bucket as static website hosting. Does anyone found this scenario or know what's happening here?

C0oki3s commented 8 months ago

@six2dez please refer to this issue https://github.com/EdOverflow/can-i-take-over-xyz/issues/361 I have faced similar kind of scenario hope it will be useful

cyberduck404 commented 6 months ago 
Bucket with the same name already exists

Is this edge case now?

GDATTACKER-RESEARCHER commented 6 months ago 
Bucket with the same name already exists

Is this edge case now?

No

crazymonk007 commented 1 month ago

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL in s3 bucket, i'm facing this problem. What's solution for this ? Screenshot_1

@soynek did you ever find a solution to this? If so, how did you fix it?

Bucket region mismatch change region

@GDATTACKER-RESEARCHER how can you find out which one you need to change to out of the 22 options?

Different ways depend on case by case bases by ping, other buckets in use by site, cname etc

Could you explainin a little more detail. Iam facing the same problem

While working on a bug bounty, I found that a subdomain was vulnerable to subdomain takeover via an AWS S3 bucket. I created a bucket with the same name and uploaded an HTML file to take over the subdomain. However, when I visited the domain after creating the bucket, I encountered the following error:


400 Bad Request

Code: IncorrectEndpoint

Message: The specified bucket exists in another region. Please direct requests to the specified endpoint.

Endpoint: [bite-lt.pms-ou.aon.com.s3-website-us-west-2.amazonaws.com](http://bite-lt.pms-ou.aon.com.s3-website-us-west-2.amazonaws.com/)

RequestId: WAD8676JGAR3HYMJ

HostId: mQPpVkRu9vHxhHiWKBoZu/9/c9RG5EXzr+eLtWB29RiRFQzMZ4ib6hl0mhcIa31IwD+Wj7EFims=

The error indicates that us-west-2 is the incorrect endpoint, meaning I created the bucket in the wrong region. To identify the correct region, I used nslookup and dig, which provided me with the following IPs:

Could you please guide me on how to determine the correct AWS region to create the bucket in order to successfully take over the domain?