AWS - STS Persistence

Reading time: 4 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

STS

Kwa maelezo zaidi, tembelea:

AWS - STS Enum

Assume role token

Token za muda mfupi hazitaweza kuorodheshwa, hivyo kudumisha token ya muda mfupi iliyo hai ni njia ya kudumisha uvumilivu.

aws sts get-session-token --duration-seconds 129600

# Kwa MFA
aws sts get-session-token \
--serial-number  \
--token-code 

# Jina la kifaa cha vifaa mara nyingi ni nambari kutoka nyuma ya kifaa, kama GAHT12345678
# Jina la kifaa cha SMS ni ARN katika AWS, kama arn:aws:iam::123456789012:sms-mfa/username
# Jina la kifaa cha Virtual ni ARN katika AWS, kama arn:aws:iam::123456789012:mfa/username

Role Chain Juggling

Kufunga majukumu ni kipengele kinachotambulika cha AWS, mara nyingi hutumiwa kwa kudumisha uvumilivu wa siri. Inahusisha uwezo wa kuchukua jukumu ambalo kisha linachukua jingine, huenda ikarejea kwenye jukumu la awali kwa njia ya mzunguko. Kila wakati jukumu linapochukuliwa, uwanja wa muda wa kuisha wa ithibati unarefreshwa. Kwa hivyo, ikiwa majukumu mawili yamewekwa ili kuchukua kila mmoja, mpangilio huu unaruhusu upya wa muda wa ithibati kuwa wa kudumu.

Unaweza kutumia chombo hiki kudumisha mchakato wa kufunga majukumu:

bash
./aws_role_juggler.py -h
usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]

optional arguments:
-h, --help            show this help message and exit
-r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]

caution

Kumbuka kwamba skripti ya find_circular_trust.py kutoka kwenye hifadhi hiyo ya Github haipati njia zote ambazo mnyororo wa jukumu unaweza kuundwa.

Code to perform Role Juggling from PowerShell
bash
# PowerShell script to check for role juggling possibilities using AWS CLI

# Check for AWS CLI installation
if (-not (Get-Command "aws" -ErrorAction SilentlyContinue)) {
Write-Error "AWS CLI is not installed. Please install it and configure it with 'aws configure'."
exit
}

# Function to list IAM roles
function List-IAMRoles {
aws iam list-roles --query "Roles[*].{RoleName:RoleName, Arn:Arn}" --output json
}

# Initialize error count
$errorCount = 0

# List all roles
$roles = List-IAMRoles | ConvertFrom-Json

# Attempt to assume each role
foreach ($role in $roles) {
$sessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime)
try {
$credentials = aws sts assume-role --role-arn $role.Arn --role-session-name $sessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json
if ($credentials) {
Write-Host "Successfully assumed role: $($role.RoleName)"
Write-Host "Access Key: $($credentials.AccessKeyId)"
Write-Host "Secret Access Key: $($credentials.SecretAccessKey)"
Write-Host "Session Token: $($credentials.SessionToken)"
Write-Host "Expiration: $($credentials.Expiration)"

# Set temporary credentials to assume the next role
$env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId
$env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey
$env:AWS_SESSION_TOKEN = $credentials.SessionToken

# Try to assume another role using the temporary credentials
foreach ($nextRole in $roles) {
if ($nextRole.Arn -ne $role.Arn) {
$nextSessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime)
try {
$nextCredentials = aws sts assume-role --role-arn $nextRole.Arn --role-session-name $nextSessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json
if ($nextCredentials) {
Write-Host "Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)"
Write-Host "Access Key: $($nextCredentials.AccessKeyId)"
Write-Host "Secret Access Key: $($nextCredentials.SecretAccessKey)"
Write-Host "Session Token: $($nextCredentials.SessionToken)"
Write-Host "Expiration: $($nextCredentials.Expiration)"
}
} catch {
$errorCount++
}
}
}

# Reset environment variables
Remove-Item Env:\AWS_ACCESS_KEY_ID
Remove-Item Env:\AWS_SECRET_ACCESS_KEY
Remove-Item Env:\AWS_SESSION_TOKEN
} else {
$errorCount++
}
} catch {
$errorCount++
}
}

# Output the number of errors if any
if ($errorCount -gt 0) {
Write-Host "$errorCount error(s) occurred during role assumption attempts."
} else {
Write-Host "No errors occurred. All roles checked successfully."
}

Write-Host "Role juggling check complete."

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks