AWS - Elastic Beanstalk Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Elastic Beanstalk

Amazon Elastic Beanstalk inatoa jukwaa rahisi kwa kupeleka, kusimamia, na kupanua programu za wavuti na huduma. Inasaidia lugha mbalimbali za programu na mifumo, kama Java, .NET, PHP, Node.js, Python, Ruby, na Go, pamoja na kontena za Docker. Huduma hii inafaa na seva zinazotumika sana ikiwa ni pamoja na Apache, Nginx, Passenger, na IIS.

Elastic Beanstalk inatoa njia rahisi na inayoweza kubadilika ya kupeleka programu zako kwenye wingu la AWS, bila haja ya kuwa na wasiwasi kuhusu miundombinu ya msingi. Inashughulikia kwa otomatiki maelezo ya ugavi wa uwezo, usawa wa mzigo, kupanua, na uangalizi wa afya ya programu, ikikuruhusu uelekeze kwenye kuandika na kupeleka msimbo wako.

Miundombinu inayoundwa na Elastic Beanstalk inasimamiwa na Makundi ya Autoscaling katika EC2 (ikiwa na usawa wa mzigo). Hii inamaanisha kwamba mwishoni mwa siku, ikiwa utavunja mwenyeji, unapaswa kujua kuhusu EC2:

AWS - EC2, EBS, ELB, SSM, VPC & VPN Enum

Zaidi ya hayo, ikiwa Docker inatumika, inawezekana kutumia ECS.

AWS - EKS Enum

Application & Environments

Katika AWS Elastic Beanstalk, dhana za "programu" na "mazingira" zina madhumuni tofauti na zina majukumu tofauti katika mchakato wa kupeleka.

Application

• Programu katika Elastic Beanstalk ni konteina ya kimantiki kwa msimbo wa chanzo wa programu yako, mazingira, na mipangilio. Inakusanya pamoja toleo tofauti za msimbo wa programu yako na inakuruhusu kuzisimamia kama kitu kimoja.

• Unapounda programu, unatoa jina na maelezo, lakini hakuna rasilimali zinazotolewa katika hatua hii. ni njia tu ya kuandaa na kusimamia msimbo wako na rasilimali zinazohusiana.

• Unaweza kuwa na matoleo mengi ya programu ndani ya programu. Kila toleo linahusiana na toleo maalum la msimbo wako, ambalo linaweza kupelekwa kwenye mazingira moja au zaidi.

Environment

• Mazingira ni kigezo kilichotolewa cha programu yako kinachofanya kazi kwenye miundombinu ya AWS. Hapa ndipo msimbo wa programu yako unapopelekwa na kutekelezwa. Elastic Beanstalk inatoa rasilimali zinazohitajika (mfano, EC2 instances, load balancers, auto-scaling groups, databases) kulingana na mipangilio ya mazingira.

• Kila mazingira inafanya kazi na toleo moja la programu yako, na unaweza kuwa na mazingira mengi kwa madhumuni tofauti, kama vile maendeleo, majaribio, hatua, na uzalishaji.

• Unapounda mazingira, unachagua jukwaa (mfano, Java, .NET, Node.js, nk) na aina ya mazingira (mfano, seva ya wavuti au mfanyakazi). Unaweza pia kubadilisha mipangilio ya mazingira ili kudhibiti vipengele mbalimbali vya miundombinu na mipangilio ya programu.

2 types of Environments

1. Web Server Environment: Imeundwa ili kuhifadhi na kuhudumia programu za wavuti na APIs. Programu hizi kwa kawaida hushughulikia maombi ya HTTP/HTTPS yanayoingia. Mazingira ya seva ya wavuti yanatoa rasilimali kama EC2 instances, load balancers, na auto-scaling groups ili kushughulikia trafiki inayokuja, kusimamia uwezo, na kuhakikisha upatikanaji wa juu wa programu.

2. Worker Environment: Imeundwa ili kushughulikia kazi za nyuma, ambazo mara nyingi ni za muda mrefu au zinahitaji rasilimali nyingi ambazo hazihitaji majibu ya haraka kwa wateja. Mazingira ya mfanyakazi yanatoa rasilimali kama EC2 instances na auto-scaling groups, lakini hayana usawa wa mzigo kwani hayashughulii maombi ya HTTP/HTTPS moja kwa moja. Badala yake, inatumia kazi kutoka kwenye Amazon Simple Queue Service (SQS) queue, ambayo inafanya kazi kama buffer kati ya mazingira ya mfanyakazi na kazi inazoshughulikia.

Security

Unapounda App katika Beanstalk kuna chaguzi 3 muhimu sana za usalama za kuchagua:

• EC2 key pair: Hii itakuwa funguo ya SSH ambayo itakuwa na uwezo wa kufikia EC2 instances zinazofanya kazi programu

• IAM instance profile: Hii ni profil ya instance ambayo instances zitakuwa nayo (IAM privileges)

• Jukumu lililotolewa kiotomatiki linaitwa aws-elasticbeanstalk-ec2-role na lina ufikiaji wa kuvutia juu ya ECS yote, SQS yote, DynamoDB elasticbeanstalk na elasticbeanstalk S3 kwa kutumia sera za AWS zinazodhibitiwa: AWSElasticBeanstalkWebTier, AWSElasticBeanstalkMulticontainerDocker, AWSElasticBeanstalkWorkerTier.

• Service role: Hii ni jukumu ambalo huduma ya AWS itatumia kutekeleza vitendo vyote vinavyohitajika. Kwa ufahamu wangu, mtumiaji wa kawaida wa AWS hawezi kufikia jukumu hilo.

• Jukumu hili lililotolewa na AWS linaitwa aws-elasticbeanstalk-service-role na linatumia sera za AWS zinazodhibitiwa AWSElasticBeanstalkEnhancedHealth na AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy

Kwa kawaida metadata version 1 imezimwa:

Exposure

Data za Beanstalk zinahifadhiwa katika S3 bucket yenye jina lifuatalo: elasticbeanstalk-<region>-<acc-id>(ikiwa iliumbwa kwenye AWS console). Ndani ya bucket hii utaona msimbo wa chanzo wa programu uliopakiwa.

URL ya tovuti iliyoundwa ni http://<webapp-name>-env.<random>.<region>.elasticbeanstalk.com/

Ikiwa unapata ufikiaji wa kusoma juu ya bucket, unaweza kusoma msimbo wa chanzo na hata kupata akidi nyeti juu yake

ikiwa unapata ufikiaji wa kuandika juu ya bucket, unaweza kubadilisha msimbo wa chanzo ili kuvunja IAM role ambayo programu inatumia wakati inatekelezwa tena.

Enumeration

# Find S3 bucket
ACCOUNT_NUMBER=<account_number>
for r in us-east-1 us-east-2 us-west-1 us-west-2 ap-south-1 ap-south-2 ap-northeast-1 ap-northeast-2 ap-northeast-3 ap-southeast-1 ap-southeast-2 ap-southeast-3 ca-central-1 eu-central-1 eu-central-2 eu-west-1 eu-west-2 eu-west-3 eu-north-1 sa-east-1 af-south-1 ap-east-1 eu-south-1 eu-south-2 me-south-1 me-central-1; do aws s3 ls elasticbeanstalk-$r-$ACCOUNT_NUMBER 2>/dev/null && echo "Found in: elasticbeanstalk-$r-$ACCOUNT_NUMBER"; done

# Get apps and URLs
aws elasticbeanstalk describe-applications # List apps
aws elasticbeanstalk describe-application-versions # Get apps & bucket name with source code
aws elasticbeanstalk describe-environments # List envs
aws elasticbeanstalk describe-environments | grep -E "EndpointURL|CNAME"
aws elasticbeanstalk describe-configuration-settings --application-name <app_name> --environment-name <env_name>
aws elasticbeanstalk describe-environment-resources --environment-name <env_name> # Get env info such as SQS used queues
aws elasticbeanstalk describe-instances-health --environment-name <env_name> # Get the instances of an environment

# Get events
aws elasticbeanstalk describe-events

Upatikanaji Usioidhinishwa

AWS - Elastic Beanstalk Unauthenticated Enum

Kudumu

AWS - Elastic Beanstalk Persistence

Privesc

AWS - Elastic Beanstalk Privesc

Baada ya Kutekeleza

AWS - Elastic Beanstalk Post Exploitation

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.