Kila wingu lina tabia zake za kipekee lakini kwa ujumla kuna mambo machache ya kawaida ambayo pentester anapaswa kuangalia wakati wa kujaribu mazingira ya wingu:
Ukaguzi wa Benchmark
Hii itakusaidia kuelewa ukubwa wa mazingira na huduma zinazotumika
Itakuruhusu pia kupata makosa ya haraka kwani unaweza kufanya sehemu kubwa ya majaribio haya kwa kutumia zana za kiotomatiki
Uhesabuji wa Huduma
Huenda usipate makosa mengi zaidi hapa ikiwa umefanya majaribio ya benchmark kwa usahihi, lakini unaweza kupata baadhi ambayo hayakuangaliwa katika majaribio ya benchmark.
Hii itakuruhusu kujua nini hasa kinatumika katika mazingira ya wingu
Hii itasaidia sana katika hatua zinazofuata
Angalia mali zilizo wazi
Hii inaweza kufanywa wakati wa sehemu ya awali, unahitaji kugundua kila kitu ambacho kinaweza kuwa wazi kwa Mtandao kwa namna fulani na jinsi kinavyoweza kufikiwa.
Hapa ninachukua miundombinu iliyofichuliwa kwa mikono kama vile mifano yenye kurasa za wavuti au port nyingine zinazofichuliwa, na pia kuhusu huduma nyingine za wingu zinazoweza kusanidiwa kuwa wazi (kama vile DBs au ndoo)
Kisha unapaswa kuangalia kama rasilimali hiyo inaweza kufichuliwa au la (habari za siri? udhaifu? makosa katika huduma iliyofichuliwa?)
Angalia ruhusa
Hapa unapaswa kugundua ruhusa zote za kila jukumu/katumizi ndani ya wingu na jinsi zinavyotumika
Akaunti nyingi zenye mamlaka makubwa (kudhibiti kila kitu)? Funguo zilizozalishwa hazitumiki?... Sehemu kubwa ya ukaguzi huu inapaswa kuwa imefanywa katika majaribio ya benchmark tayari
Ikiwa mteja anatumia OpenID au SAML au muungano mwingine unaweza kuhitaji kuwauliza kwa maelezo zaidi kuhusu jinsi kila jukumu linavyotolewa (sio sawa kwamba jukumu la admin linatolewa kwa mtumiaji 1 au 100)
Sio vya kutosha kugundua ni watumiaji gani wana ruhusa za admin "*:*". Kuna ruhusa nyingi zingine ambazo kulingana na huduma zinazotumika zinaweza kuwa nyeti sana.
Zaidi ya hayo, kuna njia za privesc zinazoweza kufuatwa kwa kutumia ruhusa. Mambo haya yote yanapaswa kuzingatiwa na njia nyingi za privesc kadri iwezekanavyo zinapaswa kuripotiwa.
Angalia Mshikamano
Ni uwezekano mkubwa kwamba mshikamano na mawingu mengine au SaaS yanatumika ndani ya mazingira ya wingu.
Kwa mshikamano wa wingu unachokagua na jukwaa lingine unapaswa kutangaza nani ana ufikiaji wa (ku)tumika mshikamano huo na unapaswa kuuliza ni kiasi gani kitendo kinachofanywa ni nyeti.
Kwa mfano, nani anaweza kuandika katika ndoo ya AWS ambapo GCP inapata data (uliza ni kiasi gani kitendo hicho ni nyeti katika GCP kinachoshughulikia data hiyo).
Kwa mshikamano ndani ya wingu unachokagua kutoka kwa majukwaa ya nje, unapaswa kuuliza nani ana ufikiaji wa nje wa (ku)tumika mshikamano huo na kuangalia jinsi data hiyo inavyotumika.
Kwa mfano, ikiwa huduma inatumia picha ya Docker iliyohifadhiwa katika GCR, unapaswa kuuliza nani ana ufikiaji wa kuibadilisha na ni taarifa zipi nyeti na ufikiaji zitakazopatikana kwa picha hiyo itakapotekelezwa ndani ya wingu la AWS.
Multi-Cloud tools
Kuna zana kadhaa ambazo zinaweza kutumika kujaribu mazingira tofauti ya wingu. Hatua za usakinishaji na viungo vitatolewa katika sehemu hii.
Zana ya kutambua makosa mabaya ya usanidi na njia za privesc katika mawingu na kati ya mawingu/SaaS.
# You need to install and run neo4j alsogitclonehttps://github.com/carlospolop/PurplePandacdPurplePandapython3-mvenv.sourcebin/activatepython3-mpipinstall-rrequirements.txtexport PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"python3main.py-h# Get help
export GOOGLE_DISCOVERY=$(echo'google:- file_path: ""- file_path: ""service_account_id: "some-sa-email@sidentifier.iam.gserviceaccount.com"'|base64)python3main.py-a-pgoogle#Get basic info of the account to check it's correctly configuredpython3main.py-e-pgoogle#Enumerate the env
# Installpipinstallprowlerprowler-v# Runprowler<provider># Exampleprowleraws--profilecustom-profile [-M csvjsonjson-asffhtml]# Get info about checks & servicesprowler<provider>--list-checksprowler<provider>--list-services
mkdirscout; cdscoutvirtualenv-ppython3venvsourcevenv/bin/activatepipinstallscoutsuitescout--help## Using Docker: https://github.com/nccgroup/ScoutSuite/wiki/Docker-Image
scoutgcp--report-dir/tmp/gcp--user-account--all-projects## use "--service-account KEY_FILE" instead of "--user-account" to use a service accountSCOUT_FOLDER_REPORT="/tmp"for pid in $(gcloudprojectslist--format="value(projectId)"); doecho"================================================"echo"Checking $pid"mkdir"$SCOUT_FOLDER_REPORT/$pid"scoutgcp--report-dir"$SCOUT_FOLDER_REPORT/$pid"--no-browser--user-account--project-id"$pid"done
# Install gcp pluginsteampipeplugininstallgcp# Use https://github.com/turbot/steampipe-mod-gcp-compliance.gitgitclonehttps://github.com/turbot/steampipe-mod-gcp-compliance.gitcdsteampipe-mod-gcp-compliance# To run all the checks from the dashboardsteampipedashboard# To run all the checks from rhe clisteampipecheckall
Angalia Miradi Yote
Ili kuangalia miradi yote unahitaji kuunda faili la gcp.spc linaloashiria miradi yote ya kupima. Unaweza kufuata maelekezo kutoka kwa skripti ifuatayo.
FILEPATH="/tmp/gcp.spc"rm-rf"$FILEPATH"2>/dev/null# Generate a json like object for each projectfor pid in $(gcloudprojectslist--format="value(projectId)"); doecho"connection \"gcp_$(echo-n $pid |tr "-" "_" )\" {plugin = \"gcp\"project = \"$pid\"}">>"$FILEPATH"done# Generate the aggragator to callecho'connection "gcp_all" {plugin = "gcp"type = "aggregator"connections = ["gcp_*"]}'>>"$FILEPATH"echo"Copy $FILEPATH in ~/.steampipe/config/gcp.spc if it was correctly generated"
# Install aws pluginsteampipeplugininstallaws# Modify the spec indicating in "profile" the profile name to usenano~/.steampipe/config/aws.spc# Get some info on how the AWS account is being usedgitclonehttps://github.com/turbot/steampipe-mod-aws-insights.gitcdsteampipe-mod-aws-insightssteampipedashboard# Get the services exposed to the internetgitclonehttps://github.com/turbot/steampipe-mod-aws-perimeter.gitcdsteampipe-mod-aws-perimetersteampipedashboard# Run the benchmarksgitclonehttps://github.com/turbot/steampipe-mod-aws-compliancecdsteampipe-mod-aws-compliancesteampipedashboard# To see results in browsersteampipecheckall--export=/tmp/output4.json
AWS, GCP, Azure, DigitalOcean.
Inahitaji python2.7 na inaonekana haijatunzwa.
Nessus
Nessus ina Ukaguzi wa Miundombinu ya Wingu skana inayounga mkono: AWS, Azure, Office 365, Rackspace, Salesforce. Mipangilio ya ziada katika Azure inahitajika ili kupata Kitambulisho cha Mteja.
Cartography ni chombo cha Python kinachounganisha mali za miundombinu na uhusiano kati yao katika mtazamo wa grafu wa kueleweka unaoendeshwa na hifadhidata ya Neo4j.
# Installationdockerimagepullghcr.io/lyft/cartographydockerrun--platformlinux/amd64ghcr.io/lyft/cartographycartography--help## Install a Neo4j DB version 3.5.*
dockerrun--platformlinux/amd64 \--volume "$HOME/.config/gcloud/application_default_credentials.json:/application_default_credentials.json" \-e GOOGLE_APPLICATION_CREDENTIALS="/application_default_credentials.json" \-e NEO4j_PASSWORD="s3cr3t" \ghcr.io/lyft/cartography \--neo4j-uri bolt://host.docker.internal:7687 \--neo4j-password-env-var NEO4j_PASSWORD \--neo4j-user neo4j# It only checks for a few services inside GCP (https://lyft.github.io/cartography/modules/gcp/index.html)## Cloud Resource Manager## Compute## DNS## Storage## Google Kubernetes Engine### If you can run starbase or purplepanda you will get more info
Starbase inakusanya mali na uhusiano kutoka kwa huduma na mifumo ikiwa ni pamoja na miundombinu ya wingu, programu za SaaS, udhibiti wa usalama, na zaidi katika muonekano wa grafu wa kueleweka unaoegemea kwenye hifadhidata ya Neo4j.
# You are going to need Node version 14, so install nvm following https://tecadmin.net/install-nvm-macos-with-homebrew/npminstall--globalyarnnvminstall14gitclonehttps://github.com/JupiterOne/starbase.gitcdstarbasenvmuse14yarninstallyarnstarbase--help# Configure manually config.yaml depending on the env to analyzeyarnstarbasesetupyarnstarbaserun# Dockergitclonehttps://github.com/JupiterOne/starbase.gitcdstarbasecpconfig.yaml.exampleconfig.yaml# Configure manually config.yaml depending on the env to analyzedockerbuild--no-cache-tstarbase:latest.docker-composerunstarbasesetupdocker-composerunstarbaserun
## Config for GCP### Check out: https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md### It requires service account credentialsintegrations:-name:graph-google-cloudinstanceId:testInstanceIddirectory:./.integrations/graph-google-cloudgitRemoteUrl:https://github.com/JupiterOne/graph-google-cloud.gitconfig:SERVICE_ACCOUNT_KEY_FILE:'{Check https://github.com/JupiterOne/graph-google-cloud/blob/main/docs/development.md#service_account_key_file-string}'PROJECT_ID:""FOLDER_ID:""ORGANIZATION_ID:""CONFIGURE_ORGANIZATION_PROJECTS:falsestorage:engine:neo4jconfig:username:neo4jpassword:s3cr3turi:bolt://localhost:7687#Consider using host.docker.internal if from docker
Gundua watumiaji wenye mamlaka zaidi katika mazingira ya AWS au Azure yaliyoskanwa, ikiwa ni pamoja na AWS Shadow Admins. Inatumia powershell.
Import-Module .\SkyArk.ps1 -forceStart-AzureStealth# in the Cloud ConsoleIEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/cyberark/SkyArk/master/AzureStealth/AzureStealth.ps1')Scan-AzureAdmins
Chombo cha kutafuta miundombinu, faili, na programu za kampuni (lengo) kwenye watoa huduma wakuu wa wingu (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).
Stormspotterinaunda “mchoro wa shambulio” wa rasilimali katika usajili wa Azure. Inawawezesha timu za red na wapentester kuona uso wa shambulio na fursa za kuhamasisha ndani ya mpangilio, na inawapa nguvu walinzi wako kuweza kujiandaa haraka na kuweka kipaumbele katika kazi za majibu ya tukio.
Office365
Unahitaji Global Admin au angalau Global Admin Reader (lakini kumbuka kwamba Global Admin Reader ina mipaka kidogo). Hata hivyo, mipaka hiyo inaonekana katika baadhi ya moduli za PS na inaweza kupitishwa kwa kufikia vipengele kupitia programu ya wavuti.
