WDavid404
commented
2 weeks ago 24.3. Reconnaissance via Cloud Service Provider's API
- Obtain information from publicly shared resources
- Obtain account IDs from public S3 buckets
- Enumerate IAM users in other accounts
24.3.1. Preparing the Lab - Configure AWS CLI
### install awscli
sudo apt update
sudo apt install -y awscli
### To use the profile, we'll need to add the --profile attacker argument to every AWS command we run.
aws configure --profile attacker
### Let's test this by running the aws --profile attacker sts get-caller-identity command.
aws --profile attacker sts get-caller-identityaws configure list-profiles
aws configure --profile attacker list
24.3.2. Publicly Shared Resources
We'll focus on the following commonly used resources:
- Publicly-shared Amazon Machine Images (AMIs)
- Publicly-shared Elastic Block Storage (EBS) snapshots
- Relational Databases (RDS) snapshots These shared resources commonly don't have a domain name or URL address to access them, so we'll need to use the CSP's API to request them.
### "ec2 describe-images" will list all the images that the account can read. The command below is to shows a list of public AMIs owned by Amazon.
aws --profile attacker ec2 describe-images --owners amazon --executable-users all
### use filter
aws --profile attacker ec2 describe-images --executable-users all --filters "Name=description,Values=*Offseclab*"
aws --profile attacker ec2 describe-images --executable-users all --filters "Name=name,Values=*Offseclab*"
aws --profile attacker ec2 describe-snapshots --filters "Name=description,Values=*offseclab*"Q3:
aws --profile attacker ec2 describe-snapshots --filters "Name=volume-size,Values=1" --owner-ids self
24.3.3. Obtaining Account IDs from S3 Buckets
How we can abuse the API features and capabilities to obtain the target's account ID from a publicly-shared S3 bucket or object?
example:
To list bucket name
curl -s www.offseclab.io | grep -o -P 'offseclab-assets-public-\w{8}'
aws --profile attacker s3 ls offseclab-assets-public-owqpisxp
create an IAM
aws --profile attacker iam create-user --user-name enum
aws --profile attacker iam create-access-key --user-name enumaws configure --profile enum
aws sts get-caller-identity --profile enum
Getting AccountID from a Public S3 Bucket or Object.
Write a policy that will allow for listing the content of the bucket and reading objects inside it.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowResourceAccount",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetObject"
],
"Resource": "*",
"Condition": {
"StringLike": {"s3:ResourceAccount": ["0*"]} <---start with 0
}
}
]
}attach this policy to enum user
aws --profile attacker iam put-user-policy \
--user-name enum \
--policy-name s3-read \
--policy-document file://policy-s3-read.jsoncheck it
aws --profile attacker iam list-user-policies --user-name enum
⬆️ According to the policy we set, the user will be able to read the content of the bucket only if the account ID where the bucket resides starts with "0". In our lab, our account is "123456789012". It doesn't start with "0", so we'll get an AccessDenied error when trying to list the bucket. If we change the policy in the file and apply it again to the enum user, we'll be able to list the bucket. This time it works because our account starts with the digit "1". Once we know that the policy starts with a digit, we can move to the next one by modifying the condition of the policy.
24.3.4. Enumerating IAM Users in Other Accounts
To enumerates internal IAM identities when we know the AWS account ID of the target.
Typically, we use the AWS Resource Name (ARN) to specify an IAM identity, as shown below:
"Principal": {
"AWS": ["arn:aws:iam::AccountID:user/user-name"]
}
e.g.
"Principal": {
"AWS": ["arn:aws:iam::123456789012:user/cloudadmin"]
}
Step1. Create an S3 bucket inside our attacker's account:
aws s3 mb s3://offseclab-dummy-bucket-$RANDOM-$RANDOM-$RANDOM will create a bucket with the name offseclab-dummy-bucket
By default, the newly-created bucket is private. Now we are going to define a policy document in which we'll grant read permission only to a specific IAM user in the target account.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUserToListBucket",
"Effect": "Allow",
"Resource": "arn:aws:s3:::offseclab-dummy-bucket-28967-25641-13328",
"Principal": {
"AWS": ["arn:aws:iam::123456789012:user/cloudadmin"]
},
"Action": "s3:ListBucket"
}
]
}
### attach policy to the s3 bucket created (must use the prefix file:// to instruct AWS CLI to read the policy from that file.)
`aws --profile attacker s3api put-bucket-policy --bucket offseclab-dummy-bucket-28967-25641-13328 --policy file://grant-s3-bucket-read.json`
--> If no error returns, it means that the "cloudadmin" user exists in the target account.
### copy the policy to create a new one - but this time, we'll grant privileges to a nonexistent principal.
cp grant-s3-bucket-read.json grant-s3-bucket-read-userDoNotExist.json
### edit it: cat grant-s3-bucket-read-userDoNotExist.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUserToListBucket",
"Effect": "Allow",
"Resource": "arn:aws:s3:::offseclab-dummy-bucket-28967-25641-13328",
"Principal": {
"AWS": ["arn:aws:iam::123456789012:user/nonexistant"]
},
"Action": "s3:ListBucket"
}
]
}
aws --profile attacker s3api put-bucket-policy --bucket offseclab-dummy-bucket-28967-25641-13328 --policy file://grant-s3-bucket-read-userDoNotExist.json
--> it returns: An error occurred (MalformedPolicy) when calling the PutBucketPolicy operation: Invalid principal in policy --> The username "nonexistant" didn't exit.Have a list of potential role name for brute forcing
echo -n "lab_admin
security_auditor
content_creator
student_access
lab_builder
instructor
network_config
monitoring_logging
backup_restore
content_editor" > /tmp/role-names.txtStep2 Use a popular tool named pacu that can automate this technique of user and role enumeration
sudo apt install pacu
we'll run pacu without any other argument to start it in interactive mode.
### import the attacker profile
Pacu (offseclab:No Keys Set) > import_keys attacker
Imported keys as "imported-attacker"
Pacu (offseclab:imported-attacker) >
### Listing Modules in pacu
Pacu (offseclab:imported-attacker) > ls
...
[Category: RECON_UNAUTH]
iam__enum_roles
iam__enum_users
...
### Running the enum_roles Module in pacu
Pacu (offseclab:imported-attacker) > run iam__enum_roles --word-list /tmp/role-names.txt --account-id 123456789012
24.2. Reconnaissance of Cloud Resources on the Internet
Goal: to find publicly-accessible resources as well as resources that weren't meant to be publicly-accessible (typically due to misconfigurations).
Modifying /etc/resolv.conf to Add a New Nameserver
Note: better to use firefox browser. found that Chromium browser didn't work with our addede nameserver.
24.2.2. Domain and Subdomain Reconnaissance
Use auto tool:
dnsenum offseclab.io --threads 10024.2.3. Service-specific Domains
Using browser developer tools on network tab, we can know some images were from s3.amazonaws.com e.g. From the path offseclab-assets-public-axevtewi/sites/www/images/amethyst.png, we can learn that the S3 bucket name is offseclab-assets-public-axevtewi and the object key is sites/www/images/ruby-expanded.png.
We'll remove the object key from the URL like the following: http://domain/bucket_name, then browse to that URL. --> if misconfiguration in the bucket , we can get some info that not intended for public.
Refer: Custom URLs of All The Three Major CSPs
Auto tool: cloud_enum: e.g. run a quickscan for the bucket named "offseclab-assets-private-axevtewi"
cloud_enum -k offseclab-assets-public-axevtewi --quickscan --disable-azure --disable-gcpExtend key for other env.
Q3
cloud_enum -k offseclab-ruby-jroupdcc -qs --disable-azure --disable-gcp-->cloud_enum -k offseclab-Emerald-jroupdcc -qs --disable-azure --disable-gcp-->Visiting http://offseclab-emerald-jroupdcc.s3.amazonaws.com/ --> Access denied Visiting http://offseclab-emerald-jroupdcc.s3.amazonaws.com/proof.txt --> Got it