Pentesting Cloud Methodology

Reading time: 12 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Basic Methodology

Kila wingu lina tabia zake za kipekee lakini kwa ujumla kuna mambo machache ya kawaida ambayo pentester anapaswa kuangalia wakati wa kupima mazingira ya wingu:

Ukaguzi wa Benchmark
Hii itakusaidia kuelewa ukubwa wa mazingira na huduma zinazotumika
Itakuruhusu pia kupata makosa ya haraka kwani unaweza kufanya sehemu kubwa ya majaribio haya kwa kutumia zana za kiotomatiki
Uainishaji wa Huduma
Huenda usipate makosa mengi zaidi hapa ikiwa umefanya majaribio ya benchmark kwa usahihi, lakini unaweza kupata baadhi ambayo hayakuangaliwa katika majaribio ya benchmark.
Hii itakuruhusu kujua nini hasa kinatumika katika mazingira ya wingu
Hii itasaidia sana katika hatua zinazofuata
Angalia mali zilizo wazi
Hii inaweza kufanywa wakati wa sehemu ya awali, unahitaji kugundua kila kitu ambacho kinaweza kuwa wazi kwa Mtandao kwa namna fulani na jinsi kinavyoweza kufikiwa.
Hapa ninachukua miundombinu iliyofichuliwa kwa mikono kama vile mifano yenye kurasa za wavuti au port nyingine zinazofichuliwa, na pia kuhusu huduma za wingu zinazodhibitiwa ambazo zinaweza kuwekwa wazi (kama vile DBs au ndoo)
Kisha unapaswa kuangalia kama rasilimali hiyo inaweza kufichuliwa au la (habari za siri? udhaifu? makosa katika huduma iliyofichuliwa?)
Angalia ruhusa
Hapa unapaswa kugundua ruhusa zote za kila jukumu/katumizi ndani ya wingu na jinsi zinavyotumika
Je, kuna akaunti nyingi zenye mamlaka makubwa (kudhibiti kila kitu)? Funguo zilizozalishwa hazitumiki?... Sehemu kubwa ya ukaguzi huu inapaswa kuwa imefanywa katika majaribio ya benchmark tayari
Ikiwa mteja anatumia OpenID au SAML au shirikisho lingine unaweza kuhitaji kuwauliza kwa maelezo zaidi kuhusu jinsi kila jukumu linavyotolewa (sio sawa kwamba jukumu la admin linatolewa kwa mtumiaji 1 au 100)
Sio vya kutosha kugundua ni watumiaji gani wana ruhusa za admin "*:*". Kuna ruhusa nyingine nyingi ambazo kulingana na huduma zinazotumika zinaweza kuwa nyeti sana.
Zaidi ya hayo, kuna njia za privesc zinazoweza kufuatwa kwa kutumia ruhusa. Mambo haya yote yanapaswa kuzingatiwa na njia nyingi za privesc kadri iwezekanavyo zinapaswa kuripotiwa.
Angalia Mshikamano
Ni uwezekano mkubwa kwamba mshikamano na mawingu mengine au SaaS yanatumika ndani ya mazingira ya wingu.
Kwa mshikamano wa wingu unachokagua na jukwaa lingine unapaswa kutaarifu nani ana ufaccess (kuutumia) mshikamano huo na unapaswa kuuliza ni kiasi gani kitendo kinachofanywa ni nyeti.
Kwa mfano, nani anaweza kuandika katika ndoo ya AWS ambapo GCP inapata data (uliza ni kiasi gani kitendo hicho ni nyeti katika GCP kinachoshughulikia data hiyo).
Kwa mshikamano ndani ya wingu unachokagua kutoka kwa majukwaa ya nje, unapaswa kuuliza nani ana ufaccess kwa nje (kuutumia) mshikamano huo na kuangalia jinsi data hiyo inavyotumika.
Kwa mfano, ikiwa huduma inatumia picha ya Docker iliyohifadhiwa katika GCR, unapaswa kuuliza nani ana ufaccess wa kuibadilisha na ni taarifa zipi nyeti na ufaccess zitakazopatikana kwa picha hiyo itakapotekelezwa ndani ya wingu la AWS.

Multi-Cloud tools

Kuna zana kadhaa ambazo zinaweza kutumika kupima mazingira tofauti ya wingu. Hatua za usakinishaji na viungo vitatajwa katika sehemu hii.

PurplePanda

Zana ya kutambua makosa mabaya ya usanidi na njia za privesc katika mawingu na kati ya mawingu/SaaS.

bash

# You need to install and run neo4j also
git clone https://github.com/carlospolop/PurplePanda
cd PurplePanda
python3 -m venv .
source bin/activate
python3 -m pip install -r requirements.txt
export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
python3 main.py -h # Get help

bash

export GOOGLE_DISCOVERY=$(echo 'google:
- file_path: ""

- file_path: ""
service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"' | base64)

python3 main.py -a -p google #Get basic info of the account to check it's correctly configured
python3 main.py -e -p google #Enumerate the env

Prowler

Inasaidia AWS, GCP & Azure. Angalia jinsi ya kuunda kila mtoa huduma katika https://docs.prowler.cloud/en/latest/#aws

bash

# Install
pip install prowler
prowler -v

# Run
prowler <provider>
# Example
prowler aws --profile custom-profile [-M csv json json-asff html]

# Get info about checks & services
prowler <provider> --list-checks
prowler <provider> --list-services

CloudSploit

AWS, Azure, Github, Google, Oracle, Alibaba

bash

# Install
git clone https://github.com/aquasecurity/cloudsploit.git
cd cloudsploit
npm install
./index.js -h
## Docker instructions in github

bash

## You need to have creds for a service account and set them in config.js file
./index.js --cloud google --config </abs/path/to/config.js>

ScoutSuite

AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud Infrastructure

bash

mkdir scout; cd scout
virtualenv -p python3 venv
source venv/bin/activate
pip install scoutsuite
scout --help
## Using Docker: https://github.com/nccgroup/ScoutSuite/wiki/Docker-Image

bash

scout gcp --report-dir /tmp/gcp --user-account --all-projects
## use "--service-account KEY_FILE" instead of "--user-account" to use a service account

SCOUT_FOLDER_REPORT="/tmp"
for pid in $(gcloud projects list --format="value(projectId)"); do
echo "================================================"
echo "Checking $pid"
mkdir "$SCOUT_FOLDER_REPORT/$pid"
scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid"
done

Steampipe

Pakua na usakinishe Steampipe (https://steampipe.io/downloads). Au tumia Brew:

brew tap turbot/tap
brew install steampipe

bash

# Install gcp plugin
steampipe plugin install gcp

# Use https://github.com/turbot/steampipe-mod-gcp-compliance.git
git clone https://github.com/turbot/steampipe-mod-gcp-compliance.git
cd steampipe-mod-gcp-compliance
# To run all the checks from the dashboard
steampipe dashboard
# To run all the checks from rhe cli
steampipe check all

Angalia Miradi Yote

Ili kuangalia miradi yote unahitaji kuunda faili la gcp.spc linaloashiria miradi yote ya kupima. Unaweza kufuata tu maelekezo kutoka kwa skripti ifuatayo.

bash

FILEPATH="/tmp/gcp.spc"
rm -rf "$FILEPATH" 2>/dev/null

# Generate a json like object for each project
for pid in $(gcloud projects list --format="value(projectId)"); do
echo "connection \"gcp_$(echo -n $pid | tr "-" "_" )\" {
plugin  = \"gcp\"
project = \"$pid\"
}" >> "$FILEPATH"
done

# Generate the aggragator to call
echo 'connection "gcp_all" {
plugin      = "gcp"
type        = "aggregator"
connections = ["gcp_*"]
}' >> "$FILEPATH"

echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generated"

Ili kuangalia maelezo mengine ya GCP (yenye manufaa kwa kuorodhesha huduma) tumia: https://github.com/turbot/steampipe-mod-gcp-insights

Ili kuangalia msimbo wa Terraform GCP: https://github.com/turbot/steampipe-mod-terraform-gcp-compliance

Viongezeo zaidi vya GCP vya Steampipe: https://github.com/turbot?q=gcp

bash

# Install aws plugin
steampipe plugin install aws

# Modify the spec indicating in "profile" the profile name to use
nano ~/.steampipe/config/aws.spc

# Get some info on how the AWS account is being used
git clone https://github.com/turbot/steampipe-mod-aws-insights.git
cd steampipe-mod-aws-insights
steampipe dashboard

# Get the services exposed to the internet
git clone https://github.com/turbot/steampipe-mod-aws-perimeter.git
cd steampipe-mod-aws-perimeter
steampipe dashboard

# Run the benchmarks
git clone https://github.com/turbot/steampipe-mod-aws-compliance
cd steampipe-mod-aws-compliance
steampipe dashboard # To see results in browser
steampipe check all --export=/tmp/output4.json

Ili kuangalia msimbo wa Terraform AWS: https://github.com/turbot/steampipe-mod-terraform-aws-compliance

Viongezeo zaidi vya AWS vya Steampipe: https://github.com/orgs/turbot/repositories?q=aws

cs-suite

AWS, GCP, Azure, DigitalOcean.
Inahitaji python2.7 na inaonekana haina matengenezo.

Nessus

Nessus ina Ukaguzi wa Miundombinu ya Wingu inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Mipangilio ya ziada katika Azure inahitajika ili kupata Client Id.

cloudlist

Cloudlist ni chombo cha wingu nyingi kwa kupata Mali (Majina ya Kikoa, Anwani za IP) kutoka kwa Watoa Huduma za Wingu.

bash

cd /tmp
wget https://github.com/projectdiscovery/cloudlist/releases/latest/download/cloudlist_1.0.1_macOS_arm64.zip
unzip cloudlist_1.0.1_macOS_arm64.zip
chmod +x cloudlist
sudo mv cloudlist /usr/local/bin

bash

## For GCP it requires service account JSON credentials
cloudlist -config </path/to/config>

cartography

Cartography ni chombo cha Python kinachounganisha mali za miundombinu na uhusiano kati yao katika mtazamo wa grafu wa kueleweka unaoendeshwa na hifadhidata ya Neo4j.

bash

# Installation
docker image pull ghcr.io/lyft/cartography
docker run --platform linux/amd64 ghcr.io/lyft/cartography cartography --help
## Install a Neo4j DB version 3.5.*

bash

docker run --platform linux/amd64 \
--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \
-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \
-e NEO4j_PASSWORD="s3cr3t" \
ghcr.io/lyft/cartography  \
--neo4j-uri bolt://host.docker.internal:7687 \
--neo4j-password-env-var NEO4j_PASSWORD \
--neo4j-user neo4j


# It only checks for a few services inside GCP (https://lyft.github.io/cartography/modules/gcp/index.html)
## Cloud Resource Manager
## Compute
## DNS
## Storage
## Google Kubernetes Engine
### If you can run starbase or purplepanda you will get more info

Starbase inakusanya mali na uhusiano kutoka kwa huduma na mifumo ikiwa ni pamoja na miundombinu ya wingu, programu za SaaS, udhibiti wa usalama, na zaidi katika muonekano wa grafu unaoeleweka unaoungwa mkono na hifadhidata ya Neo4j.

bash

# You are going to need Node version 14, so install nvm following https://tecadmin.net/install-nvm-macos-with-homebrew/
npm install --global yarn
nvm install 14
git clone https://github.com/JupiterOne/starbase.git
cd starbase
nvm use 14
yarn install
yarn starbase --help
# Configure manually config.yaml depending on the env to analyze
yarn starbase setup
yarn starbase run

# Docker
git clone https://github.com/JupiterOne/starbase.git
cd starbase
cp config.yaml.example config.yaml
# Configure manually config.yaml depending on the env to analyze
docker build --no-cache -t starbase:latest .
docker-compose run starbase setup
docker-compose run starbase run

yaml

## Config for GCP
### Check out: https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md
### It requires service account credentials

integrations:
- name: graph-google-cloud
instanceId: testInstanceId
directory: ./.integrations/graph-google-cloud
gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
config:
SERVICE_ACCOUNT_KEY_FILE: "{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}"
PROJECT_ID: ""
FOLDER_ID: ""
ORGANIZATION_ID: ""
CONFIGURE_ORGANIZATION_PROJECTS: false

storage:
engine: neo4j
config:
username: neo4j
password: s3cr3t
uri: bolt://localhost:7687
#Consider using host.docker.internal if from docker

SkyArk

Gundua watumiaji wenye mamlaka zaidi katika mazingira ya AWS au Azure yaliyoskanwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell.

bash

Import-Module .\SkyArk.ps1 -force
Start-AzureStealth

# in the Cloud Console
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1')
Scan-AzureAdmins

Cloud Brute

Chombo cha kutafuta miundombinu ya kampuni (lengo), faili, na programu kwenye watoa huduma wakuu wa wingu (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).

CloudFox

CloudFox ni chombo cha kutafuta njia za shambulio zinazoweza kutumika katika miundombinu ya wingu (kwa sasa inasaidia tu AWS & Azure na GCP inakuja).
Ni chombo cha kuhesabu ambacho kinakusudia kukamilisha pentesting ya mikono.
Hakiundui au kubadilisha data yoyote ndani ya mazingira ya wingu.

Orodha zaidi za zana za usalama wa wingu

https://github.com/RyanJarv/awesome-cloud-sec

Google

GCP

GCP Pentesting

Workspace

GWS - Workspace Pentesting

AWS

AWS Pentesting

Azure

Azure Pentesting

Mchoro wa Shambulio

Stormspotter inaunda “mchoro wa shambulio” wa rasilimali katika usajili wa Azure. Inawawezesha timu za red na wapimaji wa pentesting kuona uso wa shambulio na fursa za kuhamasisha ndani ya mpangilio, na inawapa nguvu walinzi wako kuweza kujiandaa haraka na kuweka kipaumbele kazi za majibu ya tukio.

Office365

Unahitaji Global Admin au angalau Global Admin Reader (lakini kumbuka kwamba Global Admin Reader ina mipaka kidogo). Hata hivyo, mipaka hiyo inaonekana katika baadhi ya moduli za PS na inaweza kupitishwa kwa kufikia vipengele kupitia programu ya wavuti.

tip

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

HackTricks Cloud