AWS - CloudFormation & Codestar Enum

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

CloudFormation

AWS CloudFormation is a service designed to streamline the management of AWS resources. It enables users to focus more on their applications running in AWS by minimizing the time spent on resource management. The core feature of this service is the template—a descriptive model of the desired AWS resources. Once this template is provided, CloudFormation is responsible for the provisioning and configuration of the specified resources. This automation facilitates a more efficient and error-free management of AWS infrastructure.

Enumeration

# Stacks
aws cloudformation list-stacks
aws cloudformation describe-stacks # You could find sensitive information here
aws cloudformation list-stack-resources --stack-name <name>

## Show params and outputs 
aws cloudformation describe-stacks | jq ".Stacks[] | .StackId, .StackName, .Parameters, .Outputs"

# Export
aws cloudformation list-exports
aws cloudformation list-imports --export-name <x_name>

# Stack Sets
aws cloudformation list-stack-sets
aws cloudformation describe-stack-set --stack-set-name <name>
aws cloudformation list-stack-instances --stack-set-name <name>
aws cloudformation list-stack-set-operations --stack-set-name <name>
aws cloudformation list-stack-set-operation-results --stack-set-name <name> --operation-id <id>

Privesc

In the following page you can check how to abuse cloudformation permissions to escalate privileges:

pageAWS - Cloudformation Privesc

Post-Exploitation

Check for secrets or sensitive information in the template, parameters & output of each CloudFormation

Codestar

AWS CodeStar is a service for creating, managing, and working with software development projects on AWS. You can quickly develop, build, and deploy applications on AWS with an AWS CodeStar project. An AWS CodeStar project creates and integrates AWS services for your project development toolchain. Depending on your choice of AWS CodeStar project template, that toolchain might include source control, build, deployment, virtual servers or serverless resources, and more. AWS CodeStar also manages the permissions required for project users (called team members).

Enumeration

# Get projects information
aws codestar list-projects
aws codestar describe-project --id <project_id>
aws codestar list-resources --project-id <project_id>
aws codestar list-team-members --project-id <project_id>

 aws codestar list-user-profiles
 aws codestar describe-user-profile --user-arn <arn>

Privesc

In the following page you can check how to abuse codestar permissions to escalate privileges:

pageAWS - Codestar Privesc

References

• https://docs.aws.amazon.com/cloudformation/

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.