AWS - EC2 无需认证枚举

Tip

学习和实践 AWS 黑客技术：HackTricks Training AWS Red Team Expert (ARTE)
学习和实践 GCP 黑客技术：HackTricks Training GCP Red Team Expert (GRTE) 学习和实践 Azure 黑客技术：HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks

EC2 & Related Services

请在下列页面查看有关此内容的更多信息：

AWS - EC2, EBS, ELB, SSM, VPC & VPN Enum

Public Ports

可能将虚拟机的任意端口暴露到互联网。根据暴露端口上运行的服务内容，攻击者可能会滥用它。

SSRF

Cloud SSRF - HackTricks

Public AMIs & EBS Snapshots

AWS 允许授予任何人下载 AMIs 和 Snapshots 的权限。你可以很容易地从自己的账号列出这些资源：

# Public AMIs
aws ec2 describe-images --executable-users all

## Search AMI by ownerID
aws ec2 describe-images --executable-users all --query 'Images[?contains(ImageLocation, `967541184254/`) == `true`]'

## Search AMI by substr ("shared" in the example)
aws ec2 describe-images --executable-users all --query 'Images[?contains(ImageLocation, `shared`) == `true`]'

# Public EBS snapshots (hard-drive copies)
aws ec2 describe-snapshots --restorable-by-user-ids all
aws ec2 describe-snapshots --restorable-by-user-ids all | jq '.Snapshots[] | select(.OwnerId == "099720109477")'

如果你发现一个任何人都可以还原的 snapshot，请务必查看 AWS - EBS Snapshot Dump 以获取有关 downloading and looting the snapshot 的说明。

Public URL template

# EC2
ec2-{ip-seperated}.compute-1.amazonaws.com
# ELB
http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443
https://{user_provided}-{random_id}.{region}.elb.amazonaws.com

枚举带有 public IP 的 EC2 实例

aws ec2 describe-instances --query "Reservations[].Instances[?PublicIpAddress!=null].PublicIpAddress" --output text

Tip

学习和实践 AWS 黑客技术：HackTricks Training AWS Red Team Expert (ARTE)
学习和实践 GCP 黑客技术：HackTricks Training GCP Red Team Expert (GRTE) 学习和实践 Azure 黑客技术：HackTricks Training Azure Red Team Expert (AzRTE)

支持 HackTricks