AWS - SES Post Exploitation

Tip

Jifunze na ufanye mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na ufanye mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Jifunze na ufanye mazoezi ya Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Saidia HackTricks

• Angalia the subscription plans!
• Jiunge na 💬 Discord group au the telegram group au utufuate kwenye Twitter 🐦 @hacktricks_live.
• Shiriki hacking tricks kwa kutuma PRs kwa HackTricks and HackTricks Cloud github repos.

SES

Kwa maelezo zaidi angalia:

AWS - SES Enum

ses:SendEmail

Tuma barua pepe.

aws ses send-email --from sender@example.com --destination file://emails.json --message file://message.json
aws sesv2 send-email --from sender@example.com --destination file://emails.json --message file://message.json

Bado haijajaribiwa.

ses:SendRawEmail

Tuma barua pepe.

aws ses send-raw-email --raw-message file://message.json

Bado inahitaji kujaribiwa.

ses:SendTemplatedEmail

Tuma barua pepe kwa kutumia templeti.

aws ses  send-templated-email --source <value> --destination <value> --template <value>

Bado haijajaribiwa.

ses:SendBulkTemplatedEmail

Tuma barua pepe kwa anwani nyingi

aws ses send-bulk-templated-email --source <value> --template <value>

Bado haijajaribiwa.

ses:SendBulkEmail

Tuma barua pepe kwa wapokeaji wengi.

aws sesv2 send-bulk-email --default-content <value> --bulk-email-entries <value>

ses:SendBounce

Tuma bounce email kwa barua pepe uliopokelewa (ikionyesha kuwa barua pepe haikuweza kupokelewa). Hii inaweza kufanywa tu hadi 24h baada ya kupokea barua pepe.

aws ses send-bounce --original-message-id <value> --bounce-sender <value> --bounced-recipient-info-list <value>

Bado haijajaribiwa.

ses:SendCustomVerificationEmail

Hii itatuma barua pepe ya uthibitisho iliyobinafsishwa. Huenda uhitaji ruhusa pia kuunda kiolezo cha barua pepe.

aws ses send-custom-verification-email --email-address <value> --template-name <value>
aws sesv2 send-custom-verification-email --email-address <value> --template-name <value>

Bado inahitaji kujaribiwa.

WorkMail pivot to bypass SES sandbox

Wakati ses:GetAccount inaonyesha akaunti bado iko katika SES sandbox na ses:ListIdentities inarudisha hakuna watuma waliothibitishwa, washambuliaji wanaweza pivot to WorkMail kutuma mara moja (hakuna sandbox na quotas za default zilizo juu) kwa kuunda orgs, kuthibitisha domains, na kusajili mailboxes.

Readme

References

• Threat Actors Using AWS WorkMail in Phishing Campaigns

Tip

Jifunze na ufanye mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na ufanye mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Jifunze na ufanye mazoezi ya Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Saidia HackTricks

• Angalia the subscription plans!
• Jiunge na 💬 Discord group au the telegram group au utufuate kwenye Twitter 🐦 @hacktricks_live.
• Shiriki hacking tricks kwa kutuma PRs kwa HackTricks and HackTricks Cloud github repos.