AWS - Codestar Privesc

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Codestar

Unaweza kupata maelezo zaidi kuhusu codestar katika:

codestar:CreateProject, codestar:AssociateTeamMember

iam:PassRole, codestar:CreateProject

Kwa ruhusa hizi unaweza kutumia codestar IAM Role kufanya vitendo vya kiholela kupitia cloudformation template. Angalia ukurasa ufuatao:

iam:PassRole, codestar:CreateProject

codestar:CreateProject, codestar:AssociateTeamMember

Teknolojia hii inatumia codestar:CreateProject kuunda mradi wa codestar, na codestar:AssociateTeamMember kumfanya mtumiaji wa IAM kuwa mmiliki wa mradi mpya wa CodeStar, ambayo itawapa sera mpya yenye ruhusa chache za ziada.

bash
PROJECT_NAME="supercodestar"

aws --profile "$NON_PRIV_PROFILE_USER" codestar create-project \
--name $PROJECT_NAME \
--id $PROJECT_NAME

echo "Waiting 1min to start the project"
sleep 60

USER_ARN=$(aws --profile "$NON_PRIV_PROFILE_USER" opsworks describe-my-user-profile | jq .UserProfile.IamUserArn | tr -d '"')

aws --profile "$NON_PRIV_PROFILE_USER" codestar associate-team-member \
--project-id $PROJECT_NAME \
--user-arn "$USER_ARN" \
--project-role "Owner" \
--remote-access-allowed

Ikiwa wewe ni mwanachama wa mradi tayari unaweza kutumia ruhusa codestar:UpdateTeamMember kuboresha nafasi yako kuwa mmiliki badala ya codestar:AssociateTeamMember.

Athari Zinazoweza Kutokea: Privesc kwa sera ya codestar iliyoundwa. Unaweza kupata mfano wa sera hiyo katika:

codestar:CreateProject, codestar:AssociateTeamMember

codestar:CreateProjectFromTemplate

  1. Unda Mradi Mpya:
  • Tumia hatua codestar:CreateProjectFromTemplate kuanzisha uundaji wa mradi mpya.
  • Baada ya uundaji kufanikiwa, ufikiaji unapatikana moja kwa moja kwa cloudformation:UpdateStack.
  • Ufikiaji huu unalenga stack inayohusiana na nafasi ya CodeStarWorker-<generic project name>-CloudFormation IAM.
  1. Sasisha Stack Inayolengwa:
  • Kwa ruhusa za CloudFormation zilizotolewa,endelea kusasisha stack iliyoainishwa.
  • Jina la stack kawaida litafuata moja ya mifumo miwili:
  • awscodestar-<generic project name>-infrastructure
  • awscodestar-<generic project name>-lambda
  • Jina halisi linategemea templeti iliyochaguliwa (ukirejelea skripti ya mfano ya unyakuzi).
  1. Ufikiaji na Ruhusa:
  • Baada ya sasisho, unapata uwezo uliopewa nafasi ya CloudFormation IAM inayohusiana na stack.
  • Kumbuka: Hii haipati ruhusa kamili za msimamizi kwa asili. Rasilimali zingine zisizo na mpangilio ndani ya mazingira zinaweza kuhitajika ili kuongeza ruhusa zaidi.

Kwa maelezo zaidi angalia utafiti wa asili: https://rhinosecuritylabs.com/aws/escalating-aws-iam-privileges-undocumented-codestar-api/.
Unaweza kupata unyakuzi katika https://github.com/RhinoSecurityLabs/Cloud-Security-Research/blob/master/AWS/codestar_createprojectfromtemplate_privesc/CodeStarPrivEsc.py

Athari Zinazoweza Kutokea: Privesc kwa nafasi ya cloudformation IAM.

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks