search

RhinoSecurityLabs / pacu

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-framework/
BSD 3-Clause "New" or "Revised" License
4.3k stars 689 forks source link

Validate target-instances for systemsmanager__rce_ec2 #419

Closed h00die closed 4 months ago

h00die commented 4 months ago

When providing an invalidly formatted target-instances, systemsmanager__rce_ec2 crashes with a python error instead of providing useful feedback to the user. This PR fixes that to ensure parsing of the values returns an expected size (value).

Before PR

Pacu (example:example) > run systemsmanager__rce_ec2 --target-instances "i-11a11a1a111111a11" --command "whoami" --ip-name "arn:aws:iam::1111111111:example"

  Running module systemsmanager__rce_ec2...

[2024-05-17 17:23:47] Pacu encountered an error while running the previous command. Check /home/user/.local/share/pacu/example/error_log.txt for technical details. [LOG LEVEL: MINIMAL]

    <class 'ValueError'>: not enough values to unpack (expected 2, got 1)

After PR

Pacu (example:example) > run systemsmanager__rce_ec2 --target-instances "i-11a11a1a111111a11" --command "whoami" --ip-name "arn:aws:iam::1111111111:example"

[systemsmanager__rce_ec2]   Unable to validate provided target_instances. Ensure they match the format instance-id@region. Error: not enough values to unpack (expected 2, got 1)
DaveYesland commented 4 months ago

Good call, thanks for the contribution.