AWS - STS Persistence
Support HackTricks
구독 플랜을 확인하세요!
💬 Discord 그룹 또는 telegram 그룹에 가입하거나 Twitter 🐦 @hacktricks_live을 팔로우하세요.
PR을 제출하여 해킹 트릭을 공유하세요: HackTricks 및 HackTricks Cloud github 저장소.
STS
더 많은 정보는 다음을 참조하세요:
AWS - STS EnumAssume role token
임시 토큰은 나열할 수 없으므로 활성 임시 토큰을 유지하는 것은 지속성을 유지하는 방법입니다.
aws sts get-session-token --duration-seconds 129600
# With MFA
aws sts get-session-token \
--serial-number <mfa-device-name> \
--token-code <code-from-token>
# Hardware device name is usually the number from the back of the device, such as GAHT12345678
# SMS device name is the ARN in AWS, such as arn:aws:iam::123456789012:sms-mfa/username
# Vritual device name is the ARN in AWS, such as arn:aws:iam::123456789012:mfa/username
Role Chain Juggling
Role chaining은 AWS에서 인정된 기능으로, 종종 은밀한 지속성을 유지하기 위해 사용됩니다. 이는 하나의 역할을 가정한 후 다른 역할을 가정할 수 있는 능력을 포함하며, 잠재적으로 순환 방식으로 초기 역할로 되돌아갈 수 있습니다. 역할이 가정될 때마다 자격 증명의 만료 필드가 새로 고쳐집니다. 따라서 두 역할이 서로를 가정하도록 구성된 경우, 이 설정은 자격 증명의 영구 갱신을 허용합니다.
이 도구를 사용하여 역할 체인을 계속 유지할 수 있습니다:
./aws_role_juggler.py -h
usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]
optional arguments:
-h, --help show this help message and exit
-r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]
Note that the find_circular_trust.py script from that Github repository doesn't find all the ways a role chain can be configured.
PowerShell에서 Role Juggling을 수행하는 코드
```powershell # PowerShell script to check for role juggling possibilities using AWS CLI
Check for AWS CLI installation
if (-not (Get-Command "aws" -ErrorAction SilentlyContinue)) { Write-Error "AWS CLI is not installed. Please install it and configure it with 'aws configure'." exit }
Function to list IAM roles
function List-IAMRoles { aws iam list-roles --query "Roles[*].{RoleName:RoleName, Arn:Arn}" --output json }
Initialize error count
$errorCount = 0
List all roles
$roles = List-IAMRoles | ConvertFrom-Json
Attempt to assume each role
foreach ($role in $roles) { $sessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime) try { $credentials = aws sts assume-role --role-arn $role.Arn --role-session-name $sessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json if ($credentials) { Write-Host "Successfully assumed role: $($role.RoleName)" Write-Host "Access Key: $($credentials.AccessKeyId)" Write-Host "Secret Access Key: $($credentials.SecretAccessKey)" Write-Host "Session Token: $($credentials.SessionToken)" Write-Host "Expiration: $($credentials.Expiration)"
Set temporary credentials to assume the next role
$env:AWS_ACCESS_KEY_ID = $credentials.AccessKeyId $env:AWS_SECRET_ACCESS_KEY = $credentials.SecretAccessKey $env:AWS_SESSION_TOKEN = $credentials.SessionToken
Try to assume another role using the temporary credentials
foreach ($nextRole in $roles) { if ($nextRole.Arn -ne $role.Arn) { $nextSessionName = "RoleJugglingTest-" + (Get-Date -Format FileDateTime) try { $nextCredentials = aws sts assume-role --role-arn $nextRole.Arn --role-session-name $nextSessionName --query "Credentials" --output json 2>$null | ConvertFrom-Json if ($nextCredentials) { Write-Host "Also successfully assumed role: $($nextRole.RoleName) from $($role.RoleName)" Write-Host "Access Key: $($nextCredentials.AccessKeyId)" Write-Host "Secret Access Key: $($nextCredentials.SecretAccessKey)" Write-Host "Session Token: $($nextCredentials.SessionToken)" Write-Host "Expiration: $($nextCredentials.Expiration)" } } catch { $errorCount++ } } }
Reset environment variables
Remove-Item Env:\AWS_ACCESS_KEY_ID Remove-Item Env:\AWS_SECRET_ACCESS_KEY Remove-Item Env:\AWS_SESSION_TOKEN } else { $errorCount++ } } catch { $errorCount++ } }
Output the number of errors if any
if ($errorCount -gt 0) { Write-Host "$errorCount error(s) occurred during role assumption attempts." } else { Write-Host "No errors occurred. All roles checked successfully." }
Write-Host "Role juggling check complete."
</details>
<div data-gb-custom-block data-tag="hint" data-style='success'>
Learn & practice AWS Hacking:<img src="/.gitbook/assets/image.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/image.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/image (2).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/image (2).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
<details>
<summary>Support HackTricks</summary>
* [**구독 플랜**](https://github.com/sponsors/carlospolop)을 확인하세요!
* 💬 [**Discord 그룹**](https://discord.gg/hRep4RUj7f) 또는 [**telegram 그룹**](https://t.me/peass)에 가입하거나 **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)를 팔로우하세요.
* PR을 제출하여 [**HackTricks**](https://github.com/carlospolop/hacktricks) 및 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 저장소에 해킹 트릭을 공유하세요.
</details>
</div>
Last updated