AWS - S3 Privesc
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
s3:PutBucketNotification, s3:PutObject, s3:GetObjectAn attacker with those permissions over interesting buckets might be able to hijack resources and escalate privileges.
For example, an attacker with those permissions over a cloudformation bucket called "cf-templates-nohnwfax6a6i-us-east-1" will be able to hijack the deployment. The access can be given with the following policy:
And the hijack is possible because there is a small time window from the moment the template is uploaded to the bucket to the moment the template is deployed. An attacker might just create a lambda function in his account that will trigger when a bucket notification is sent, and hijacks the content of that bucket.
The Pacu module cfn__resouce_injection can be used to automate this attack.
For mor informatino check the original research: https://rhinosecuritylabs.com/aws/cloud-malware-cloudformation-injection/
s3:PutObject, s3:GetObjectThese are the permissions to get and upload objects to S3. Several services inside AWS (and outside of it) use S3 storage to store config files. An attacker with read access to them might find sensitive information on them. An attacker with write access to them could modify the data to abuse some service and try to escalate privileges. These are some examples:
If an EC2 instance is storing the user data in a S3 bucket, an attacker could modify it to execute arbitrary code inside the EC2 instance.
s3:PutBucketPolicyAn attacker, that needs to be from the same account, if not the error The specified method is not allowed will trigger, with this permission will be able to grant himself more permissions over the bucket(s) allowing him to read, write, modify, delete and expose buckets.
s3:GetBucketAcl, s3:PutBucketAclAn attacker could abuse these permissions to grant him more access over specific buckets. Note that the attacker doesn't need to be from the same account. Moreover the write access
s3:GetObjectAcl, s3:PutObjectAclAn attacker could abuse these permissions to grant him more access over specific objects inside buckets.
s3:GetObjectAcl, s3:PutObjectVersionAclAn attacker with these privileges is expected to be able to put an Acl to an specific object version
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
