Pentesting Cloud Methodology

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Basic Methodology

Kila cloud ina tabia zake za kipekee lakini kwa ujumla kuna mambo machache ya kawaida ambayo pentester anapaswa kuangalia wakati wa kujaribu mazingira ya cloud:

• Benchmark checks

• Hii itakusaidia kuelewa ukubwa wa mazingira na huduma zinazotumika

• Itakuruhusu pia kupata makosa ya haraka kwani unaweza kufanya sehemu kubwa ya majaribio haya kwa kutumia zana za kiotomatiki

• Services Enumeration

• Huenda usipate makosa mengi zaidi hapa ikiwa umefanya majaribio ya benchmark kwa usahihi, lakini unaweza kupata baadhi ambayo hayakuangaliwa katika majaribio ya benchmark.

• Hii itakuruhusu kujua nini hasa kinatumika katika mazingira ya cloud

• Hii itasaidia sana katika hatua zinazofuata

• Check exposed assets

• Hii inaweza kufanywa wakati wa sehemu ya awali, unahitaji kugundua kila kitu ambacho kinaweza kuwa wazi kwa Mtandao kwa namna fulani na jinsi kinavyoweza kufikiwa.

• Hapa ninachukua miundombinu iliyofichuliwa kwa mikono kama vile mifano yenye kurasa za wavuti au port nyingine zinazofichuliwa, na pia kuhusu huduma nyingine za cloud zinazoweza kusanidiwa kuwa wazi (kama vile DBs au buckets)

• Kisha unapaswa kuangalia kama rasilimali hiyo inaweza kufichuliwa au la (habari za siri? udhaifu? makosa katika huduma iliyofichuliwa?)

• Check permissions

• Hapa unapaswa kugundua ruhusa zote za kila jukumu/katumizi ndani ya cloud na jinsi zinavyotumika

• Je, kuna akaunti nyingi zenye mamlaka makubwa (kontrol kila kitu)? Funguo zilizozalishwa hazitumiki?... Sehemu kubwa ya ukaguzi huu inapaswa kuwa imefanywa katika majaribio ya benchmark tayari

• Ikiwa mteja anatumia OpenID au SAML au federation nyingine unaweza kuhitaji kuwauliza kwa maelezo zaidi kuhusu jinsi kila jukumu linavyotolewa (sio sawa kwamba jukumu la admin linatolewa kwa mtumiaji 1 au 100)

• Sio vya kutosha kugundua ni watumiaji gani wana mamlaka ya admin "*:*". Kuna ruhusa nyingi zingine ambazo kulingana na huduma zinazotumika zinaweza kuwa nyeti sana.

• Zaidi ya hayo, kuna njia za potential privesc za kufuata kwa kutumia ruhusa. Mambo haya yote yanapaswa kuzingatiwa na njia nyingi za privesc kadri iwezekanavyo zinapaswa kuripotiwa.

• Check Integrations

• Ni uwezekano mkubwa kwamba michakato ya ushirikiano na clouds nyingine au SaaS inatumika ndani ya mazingira ya cloud.

• Kwa michakato ya ushirikiano ya cloud unayoangalia na jukwaa lingine unapaswa kutangaza nani ana ufikiaji wa (ku)tumika ushirikiano huo na unapaswa kuuliza ni kiasi gani kitendo kinachofanywa ni nyeti. Kwa mfano, nani anaweza kuandika katika bucket ya AWS ambapo GCP inapata data (uliza ni kiasi gani kitendo hicho ni nyeti katika GCP kinachoshughulikia data hiyo).

• Kwa michakato ya ushirikiano ndani ya cloud unayoangalia kutoka kwa majukwaa ya nje, unapaswa kuuliza nani ana ufikiaji wa nje wa (ku)tumika ushirikiano huo na kuangalia jinsi data hiyo inavyotumika. Kwa mfano, ikiwa huduma inatumia picha ya Docker iliyohifadhiwa katika GCR, unapaswa kuuliza nani ana ufikiaji wa kuibadilisha na ni taarifa zipi nyeti na ufikiaji zitakazopatikana kwa picha hiyo itakapotekelezwa ndani ya cloud ya AWS.

Multi-Cloud tools

Kuna zana kadhaa ambazo zinaweza kutumika kujaribu mazingira tofauti ya cloud. Hatua za usakinishaji na viungo vitatajwa katika sehemu hii.

PurplePanda

Zana ya kutambua makosa mabaya na njia za privesc katika clouds na kati ya clouds/SaaS.

Install

# You need to install and run neo4j also
git clone https://github.com/carlospolop/PurplePanda
cd PurplePanda
python3 -m venv .
source bin/activate
python3 -m pip install -r requirements.txt
export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
python3 main.py -h # Get help

GCP

export GOOGLE_DISCOVERY=$(echo 'google:
- file_path: ""

- file_path: ""
service_account_id: "[e-mail]"' | base64)

python3 main.py -a -p google #Get basic info of the account to check it's correctly configured
python3 main.py -e -p google #Enumerate the env

Prowler

Inasaidia AWS, GCP & Azure. Angalia jinsi ya kuunda mipangilio ya kila mtoa huduma katika https://docs.prowler.cloud/en/latest/#aws

# Install
pip install prowler
prowler -v

# Run
prowler <provider>
# Example
prowler aws --profile custom-profile [-M csv json json-asff html]

# Get info about checks & services
prowler <provider> --list-checks
prowler <provider> --list-services

CloudSploit

AWS, Azure, Github, Google, Oracle, Alibaba

Sakinisha

# Install
git clone https://github.com/aquasecurity/cloudsploit.git
cd cloudsploit
npm install
./index.js -h
## Docker instructions in github

GCP

## You need to have creds for a service account and set them in config.js file
./index.js --cloud google --config </abs/path/to/config.js>

ScoutSuite

AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud Infrastructure

Sakinisha

mkdir scout; cd scout
virtualenv -p python3 venv
source venv/bin/activate
pip install scoutsuite
scout --help
## Using Docker: https://github.com/nccgroup/ScoutSuite/wiki/Docker-Image

GCP

scout gcp --report-dir /tmp/gcp --user-account --all-projects
## use "--service-account KEY_FILE" instead of "--user-account" to use a service account

SCOUT_FOLDER_REPORT="/tmp"
for pid in $(gcloud projects list --format="value(projectId)"); do
echo "================================================"
echo "Checking $pid"
mkdir "$SCOUT_FOLDER_REPORT/$pid"
scout gcp --report-dir "$SCOUT_FOLDER_REPORT/$pid" --no-browser --user-account --project-id "$pid"
done

Steampipe

Sakinisha

Pakua na sakinisha Steampipe (https://steampipe.io/downloads). Au tumia Brew:

brew tap turbot/tap
brew install steampipe

GCP

# Install gcp plugin
steampipe plugin install gcp

# Use https://github.com/turbot/steampipe-mod-gcp-compliance.git
git clone https://github.com/turbot/steampipe-mod-gcp-compliance.git
cd steampipe-mod-gcp-compliance
# To run all the checks from the dashboard
steampipe dashboard
# To run all the checks from rhe cli
steampipe check all

Angalia Miradi Yote

Ili kuangalia miradi yote unahitaji kuunda faili la gcp.spc linaloashiria miradi yote ya kupima. Unaweza kufuata maelekezo kutoka kwa skripti ifuatayo.

FILEPATH="/tmp/gcp.spc"
rm -rf "$FILEPATH" 2>/dev/null

# Generate a json like object for each project
for pid in $(gcloud projects list --format="value(projectId)"); do
echo "connection \"gcp_$(echo -n $pid | tr "-" "_" )\" {
plugin  = \"gcp\"
project = \"$pid\"
}" >> "$FILEPATH"
done

# Generate the aggragator to call
echo 'connection "gcp_all" {
plugin      = "gcp"
type        = "aggregator"
connections = ["gcp_*"]
}' >> "$FILEPATH"

echo "Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generated"

Ili kuangalia maelezo mengine ya GCP (yenye manufaa kwa kuorodhesha huduma) tumia: https://github.com/turbot/steampipe-mod-gcp-insights

Ili kuangalia msimbo wa Terraform GCP: https://github.com/turbot/steampipe-mod-terraform-gcp-compliance

Viongezeo zaidi vya GCP vya Steampipe: https://github.com/turbot?q=gcp

AWS

# Install aws plugin
steampipe plugin install aws

# Modify the spec indicating in "profile" the profile name to use
nano ~/.steampipe/config/aws.spc

# Get some info on how the AWS account is being used
git clone https://github.com/turbot/steampipe-mod-aws-insights.git
cd steampipe-mod-aws-insights
steampipe dashboard

# Get the services exposed to the internet
git clone https://github.com/turbot/steampipe-mod-aws-perimeter.git
cd steampipe-mod-aws-perimeter
steampipe dashboard

# Run the benchmarks
git clone https://github.com/turbot/steampipe-mod-aws-compliance
cd steampipe-mod-aws-compliance
steampipe dashboard # To see results in browser
steampipe check all --export=/tmp/output4.json

To check Terraform AWS code: https://github.com/turbot/steampipe-mod-terraform-aws-compliance

More AWS plugins of Steampipe: https://github.com/orgs/turbot/repositories?q=aws

cs-suite

AWS, GCP, Azure, DigitalOcean. Inahitaji python2.7 na inaonekana haijatunzwa.

Nessus

Nessus ina Ukaguzi wa Miundombinu ya Wingu skana inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Mipangilio ya ziada katika Azure inahitajika kupata Kitambulisho cha Mteja.

cloudlist

Cloudlist ni chombo cha wingu nyingi kwa kupata Mali (Majina ya mwenyeji, Anwani za IP) kutoka kwa Watoa Huduma za Wingu.

Cloudlist

cd /tmp
wget https://github.com/projectdiscovery/cloudlist/releases/latest/download/cloudlist_1.0.1_macOS_arm64.zip
unzip cloudlist_1.0.1_macOS_arm64.zip
chmod +x cloudlist
sudo mv cloudlist /usr/local/bin

Tab ya Pili

## For GCP it requires service account JSON credentials
cloudlist -config </path/to/config>

cartography

Cartography ni chombo cha Python kinachounganisha mali za miundombinu na uhusiano kati yao katika mtazamo wa grafu wa kueleweka unaoendeshwa na hifadhidata ya Neo4j.

Install

# Installation
docker image pull ghcr.io/lyft/cartography
docker run --platform linux/amd64 ghcr.io/lyft/cartography cartography --help
## Install a Neo4j DB version 3.5.*

GCP

docker run --platform linux/amd64 \
--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \
-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \
-e NEO4j_PASSWORD="s3cr3t" \
ghcr.io/lyft/cartography  \
--neo4j-uri bolt://host.docker.internal:7687 \
--neo4j-password-env-var NEO4j_PASSWORD \
--neo4j-user neo4j


# It only checks for a few services inside GCP (https://lyft.github.io/cartography/modules/gcp/index.html)
## Cloud Resource Manager
## Compute
## DNS
## Storage
## Google Kubernetes Engine
### If you can run starbase or purplepanda you will get more info

starbase

Starbase inakusanya mali na uhusiano kutoka kwa huduma na mifumo ikiwa ni pamoja na miundombinu ya wingu, programu za SaaS, udhibiti wa usalama, na zaidi katika muonekano wa grafu wa kueleweka unaoegemezwa na hifadhidata ya Neo4j.

Install

# You are going to need Node version 14, so install nvm following https://tecadmin.net/install-nvm-macos-with-homebrew/
npm install --global yarn
nvm install 14
git clone https://github.com/JupiterOne/starbase.git
cd starbase
nvm use 14
yarn install
yarn starbase --help
# Configure manually config.yaml depending on the env to analyze
yarn starbase setup
yarn starbase run

# Docker
git clone https://github.com/JupiterOne/starbase.git
cd starbase
cp config.yaml.example config.yaml
# Configure manually config.yaml depending on the env to analyze
docker build --no-cache -t starbase:latest .
docker-compose run starbase setup
docker-compose run starbase run

GCP

## Config for GCP
### Check out: https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md
### It requires service account credentials

integrations:
-
name: graph-google-cloud
instanceId: testInstanceId
directory: ./.integrations/graph-google-cloud
gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
config:
SERVICE_ACCOUNT_KEY_FILE: '{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}'
PROJECT_ID: ""
FOLDER_ID: ""
ORGANIZATION_ID: ""
CONFIGURE_ORGANIZATION_PROJECTS: false

storage:
engine: neo4j
config:
username: neo4j
password: s3cr3t
uri: bolt://localhost:7687
#Consider using host.docker.internal if from docker

SkyArk

Gundua watumiaji wenye mamlaka zaidi katika mazingira ya AWS au Azure yaliyoskanwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell.

Import-Module .\SkyArk.ps1 -force
Start-AzureStealth

# in the Cloud Console
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1')
Scan-AzureAdmins

Cloud Brute

Chombo cha kutafuta miundombinu, faili, na programu za kampuni (lengo) kwenye watoa huduma wakuu wa wingu (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).

CloudFox

• CloudFox ni chombo cha kutafuta njia za shambulio zinazoweza kutumika katika miundombinu ya wingu (kwa sasa inasaidia tu AWS & Azure na GCP inakuja).

• Ni chombo cha kuhesabu ambacho kinakusudia kukamilisha pentesting ya mikono.

• Hakiundui au kubadilisha data yoyote ndani ya mazingira ya wingu.

Orodha zaidi za zana za usalama wa wingu

• https://github.com/RyanJarv/awesome-cloud-sec

Google

GCP

GCP Pentesting

Workspace

GWS - Workspace Pentesting

AWS

AWS Pentesting

Azure

Azure Pentesting

Mchoro wa Shambulio

Stormspotter inaunda “mchoro wa shambulio” wa rasilimali katika usajili wa Azure. Inawawezesha timu za red na wapentester kuona uso wa shambulio na fursa za kuhamasisha ndani ya mpangilio, na inawapa nguvu walinzi wako kuweza kujiandaa haraka na kuweka kipaumbele katika kazi za majibu ya tukio.

Office365

Unahitaji Global Admin au angalau Global Admin Reader (lakini kumbuka kwamba Global Admin Reader ina mipaka kidogo). Hata hivyo, mipaka hiyo inaonekana katika baadhi ya moduli za PS na inaweza kupitishwa kwa kufikia vipengele kupitia programu ya wavuti.

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au fuata sisi kwenye Twitter 🐦 @hacktricks_live.

• Shiriki hila za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.