AWS - STS Persistence

Tip

学习并练习 AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
学习并练习 GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
学习并练习 Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks

STS

更多信息请参阅：

AWS - STS Enum

Assume role token

Temporary tokens cannot be listed, so maintaining an active temporary token is a way to maintain persistence.

aws sts get-session-token --duration-seconds 129600

# With MFA
aws sts get-session-token \
--serial-number  \
--token-code 

# Hardware device name is usually the number from the back of the device, such as GAHT12345678
# SMS device name is the ARN in AWS, such as arn:aws:iam::123456789012:sms-mfa/username
# Vritual device name is the ARN in AWS, such as arn:aws:iam::123456789012:mfa/username


Role Chain Juggling


Role chaining is an acknowledged AWS feature, 通常用于保持隐蔽的 persistence。它涉及能够 assume a role which then assumes another，并可能以 cyclical manner 的方式回到初始 role。每次 role 被 assumed 时，credentials 的 expiration 字段都会被刷新。因此，如果两个 role 被配置为相互 assume 对方，该配置就能实现凭证的永久续期。


You can use this tool to keep the role chaining going:


./aws_role_juggler.py -h
usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]

optional arguments:
-h, --help            show this help message and exit
-r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]





Caution


请注意，来自该 Github 仓库的 find_circular_trust.py 脚本并不能发现角色链可配置的所有方式。





用于从 PowerShell 执行 Role Juggling 的代码
```bash
# PowerShell script to check for role juggling possibilities using AWS CLI

Check for AWS CLI installation


if (-not (Get-Command “aws” -ErrorAction SilentlyContinue)) {
Write-Error “AWS CLI is not installed. Please install it and configure it with ‘aws configure’.”
exit
}


Function to list IAM roles


function List-IAMRoles {
aws iam list-roles –query “Roles[*].{RoleName:RoleName, Arn:Arn}” –output json
}


Initialize error count


$errorCount = 0


List all roles


$roles = List-IAMRoles | ConvertFrom-Json


Attempt to assume each role


foreach ($role in $roles) {
$sessionName = “RoleJugglingTest-” + (Get-Date -Format FileDateTime)
try {
$credentials = aws sts assume-role –role-arn $role.Arn –role-session-name $sessionName –query “Credentials” –output json 2>$null | ConvertFrom-Json
if ($credentials) {
Write-Host “Successfully assumed role: $($role.RoleName)”
Write-Host “Access Key: $($credentials.AccessKeyId)”
Write-Host “Secret Access Key: $($credentials.SecretAccessKey)”
Write-Host “Session Token: $($credentials.SessionToken)”
Write-Host “Expiration: $($credentials.Expiration)”


Set temporary credentials to assume the next role


$env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId
$env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey
$env:AWS_SESSION_TOKEN = $credentials.SessionToken


Try to assume another role using the temporary credentials


foreach ($nextRole in $roles) {
if ($nextRole.Arn -ne $role.Arn) {
$nextSessionName = “RoleJugglingTest-” + (Get-Date -Format FileDateTime)
try {
$nextCredentials = aws sts assume-role –role-arn $nextRole.Arn –role-session-name $nextSessionName –query “Credentials” –output json 2>$null | ConvertFrom-Json
if ($nextCredentials) {
Write-Host “Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)”
Write-Host “Access Key: $($nextCredentials.AccessKeyId)”
Write-Host “Secret Access Key: $($nextCredentials.SecretAccessKey)”
Write-Host “Session Token: $($nextCredentials.SessionToken)”
Write-Host “Expiration: $($nextCredentials.Expiration)”
}
} catch {
$errorCount++
}
}
}


Reset environment variables


Remove-Item Env:\AWS_ACCESS_KEY_ID
Remove-Item Env:\AWS_SECRET_ACCESS_KEY
Remove-Item Env:\AWS_SESSION_TOKEN
} else {
$errorCount++
}
} catch {
$errorCount++
}
}


Output the number of errors if any


if ($errorCount -gt 0) {
Write-Host “$errorCount error(s) occurred during role assumption attempts.”
} else {
Write-Host “No errors occurred. All roles checked successfully.”
}


Write-Host “Role juggling check complete.”


</details>

> [!TIP]
> 学习并练习 AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://hacktricks-training.com/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> 学习并练习 GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://hacktricks-training.com/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> 学习并练习 Az Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://hacktricks-training.com/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>支持 HackTricks</summary>
>
> - 查看 [**subscription plans**](https://github.com/sponsors/carlospolop)!
> - **加入** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) 或者 [**telegram group**](https://t.me/peass) 或 **关注** 我们的 **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
> - **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库 提交 PRs 来分享 hacking tricks。
>
> </details>