AWS - STS Persistence

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

STS

Vir meer inligting, sien:

AWS - STS Enum

Assume role token

Temporary tokens kan nie gelys word nie, dus is die behoud van ’n aktiewe temporary token ’n manier om persistence te behou.

aws sts get-session-token --duration-seconds 129600

# With MFA
aws sts get-session-token \
--serial-number  \
--token-code 

# Hardware device name is usually the number from the back of the device, such as GAHT12345678
# SMS device name is the ARN in AWS, such as arn:aws:iam::123456789012:sms-mfa/username
# Vritual device name is the ARN in AWS, such as arn:aws:iam::123456789012:mfa/username


Role Chain Juggling


Role chaining is ’n erkende AWS-funksie wat dikwels gebruik word om stealth persistence te onderhou. Dit behels die vermoĂ« om ’n role te assume wat dan ’n ander assume, en moontlik op ’n sikliese wyse na die aanvanklike role terugkeer. Elke keer ’n role assumed word, word die credentials se expiration veld vernuwe. Gevolglik, as twee roles gekonfigureer is om mekaar wedersyds te assume, laat hierdie opstelling die voortdurende vernuwing van credentials toe.


You can use this tool to keep the role chaining going:


./aws_role_juggler.py -h
usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]

optional arguments:
-h, --help            show this help message and exit
-r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]





Caution


Let wel dat die find_circular_trust.py script van daardie Github repository nie alle maniere waarop ’n rolketting gekonfigureer kan word, vind nie.





Kode om Role Juggling vanaf PowerShell uit te voer
```bash
# PowerShell script to check for role juggling possibilities using AWS CLI

Check for AWS CLI installation


if (-not (Get-Command “aws” -ErrorAction SilentlyContinue)) {
Write-Error “AWS CLI is not installed. Please install it and configure it with ‘aws configure’.”
exit
}


Function to list IAM roles


function List-IAMRoles {
aws iam list-roles –query “Roles[*].{RoleName:RoleName, Arn:Arn}” –output json
}


Initialize error count


$errorCount = 0


List all roles


$roles = List-IAMRoles | ConvertFrom-Json


Attempt to assume each role


foreach ($role in $roles) {
$sessionName = “RoleJugglingTest-” + (Get-Date -Format FileDateTime)
try {
$credentials = aws sts assume-role –role-arn $role.Arn –role-session-name $sessionName –query “Credentials” –output json 2>$null | ConvertFrom-Json
if ($credentials) {
Write-Host “Successfully assumed role: $($role.RoleName)”
Write-Host “Access Key: $($credentials.AccessKeyId)”
Write-Host “Secret Access Key: $($credentials.SecretAccessKey)”
Write-Host “Session Token: $($credentials.SessionToken)”
Write-Host “Expiration: $($credentials.Expiration)”


Set temporary credentials to assume the next role


$env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId
$env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey
$env:AWS_SESSION_TOKEN = $credentials.SessionToken


Try to assume another role using the temporary credentials


foreach ($nextRole in $roles) {
if ($nextRole.Arn -ne $role.Arn) {
$nextSessionName = “RoleJugglingTest-” + (Get-Date -Format FileDateTime)
try {
$nextCredentials = aws sts assume-role –role-arn $nextRole.Arn –role-session-name $nextSessionName –query “Credentials” –output json 2>$null | ConvertFrom-Json
if ($nextCredentials) {
Write-Host “Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)”
Write-Host “Access Key: $($nextCredentials.AccessKeyId)”
Write-Host “Secret Access Key: $($nextCredentials.SecretAccessKey)”
Write-Host “Session Token: $($nextCredentials.SessionToken)”
Write-Host “Expiration: $($nextCredentials.Expiration)”
}
} catch {
$errorCount++
}
}
}


Reset environment variables


Remove-Item Env:\AWS_ACCESS_KEY_ID
Remove-Item Env:\AWS_SECRET_ACCESS_KEY
Remove-Item Env:\AWS_SESSION_TOKEN
} else {
$errorCount++
}
} catch {
$errorCount++
}
}


Output the number of errors if any


if ($errorCount -gt 0) {
Write-Host “$errorCount error(s) occurred during role assumption attempts.”
} else {
Write-Host “No errors occurred. All roles checked successfully.”
}


Write-Host “Role juggling check complete.”


</details>

> [!TIP]
> Leer & oefen AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://hacktricks-training.com/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Leer & oefen GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://hacktricks-training.com/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Leer & oefen Az Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://hacktricks-training.com/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>Ondersteun HackTricks</summary>
>
> - Kyk na die [**subscription plans**](https://github.com/sponsors/carlospolop)!
> - **Sluit aan by die** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) of die [**telegram group**](https://t.me/peass) of **volg** ons op **Twitter** 🐩 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
> - **Deel hacking tricks deur PRs in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
>
> </details>