AWS - SES Enum

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

기본 정보

Amazon Simple Email Service (Amazon SES)는 이메일 송수신을 위해 설계되었습니다. 사용자가 트랜잭션, 마케팅 또는 알림 이메일을 효율적이고 안전하게 대규모로 보낼 수 있게 해줍니다. 다른 AWS 서비스와 잘 통합되어 모든 규모의 비즈니스를 위한 이메일 통신 관리를 위한 강력한 솔루션을 제공합니다.

도메인 또는 이메일 주소와 같은 아이덴티티를 등록해야 SES와 상호작용할 수 있습니다 (예: 이메일 송수신).

SMTP 사용자

AWS API를 사용하지 않고 (또는 추가로) AWS의 SMTP 서버에 연결하여 작업을 수행할 수 있습니다. 이를 위해 다음과 같은 정책을 가진 사용자를 생성해야 합니다:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ses:SendRawEmail",
"Resource": "*"
}
]
}

그런 다음, 사용자의 API key와 secret을 수집하고 다음을 실행합니다:

git clone https://github.com/lisenet/ses-smtp-converter.git
cd ./ses-smtp-converter
chmod u+x ./ses-smtp-conv.sh
./ses-smtp-conv.sh <AccessKeyId> <SecretAccessKey>

It's also possible to do this from the AWS console web.

Enumeration

SES에는 2개의 API가 있습니다: **ses**와 sesv2. 일부 작업은 두 API에 모두 있으며, 다른 작업은 둘 중 하나에만 있습니다.

# Get info about the SES account
aws sesv2 get-account
aws ses get-account-sending-enabled # Check if enabled

# Get registered domains and email addresses (identities)
aws ses list-identities
aws sesv2 list-email-identities
aws sesv2 get-email-identity --email-identity <identity> #Get at once all the attributes

# Get Resource Policies applied in the identity
aws ses list-identity-policies --identity <identity>
aws ses get-identity-policies --identity <identity> --policy-names <policy>
aws sesv2 get-email-identity-policies --email-identity <identity>

# Get attributes of the identity
## Check if verified
aws ses get-identity-verification-attributes --identities <identity>
## DKIM settings, relevant for identities that are domains not emails
aws ses get-identity-dkim-attributes --identities <identity>
## Get what happnes if the send mail from the identity fails
aws ses get-identity-mail-from-domain-attributes --identities <identity>
## otifications attributes
aws ses get-identity-notification-attributes --identities <identity>

# Get email templates
aws ses list-templates
aws ses get-template --template-name <name>
aws sesv2 list-email-templates
aws sesv2 get-email-template --template-name <name>

# Get custom verification email templates
## This is the email sent when an identity is verified, it can be customized
aws ses list-custom-verification-email-templates
aws sesv2 list-custom-verification-email-templates
aws ses get-custom-verification-email-template --template-name <name>
aws sesv2 get-custom-verification-email-template --template-name <name>

# Get receipt rule sets
## Receipt rules indicate how to handle incoming mail by executing an ordered list of actions
aws ses list-receipt-rule-sets
aws ses describe-receipt-rule-set --rule-set-name <name>
aws ses describe-receipt-rule-set --rule-set-name <name> --rule-name <name>
## Metadata and receipt rules for the receipt rule set that is currently active
aws ses describe-active-receipt-rule-set

# Get suppressed destinations
aws sesv2 list-suppressed-destinations
aws sesv2 get-suppressed-destination --email-address <email>

# Get configuration sets
## These are set of rules applied to the identities related to the configuration set
aws ses list-configuration-sets
aws sesv2 list-configuration-sets
aws ses describe-configuration-set --configuration-set-name <name> --configuration-set-attribute-names eventDestinations trackingOptions deliveryOptions reputationOptions
aws sesv2 get-configuration-set --configuration-set-name <name>
aws sesv2 get-configuration-set-event-destinations --configuration-set-name <name>

# Get Contacts list
aws sesv2 list-contact-lists
aws sesv2 list-contacts --contact-list-name <name>
aws sesv2 get-contact-list --contact-list-name <name>
aws sesv2 get-contact --contact-list-name <name> --email-address <name>

# Private IPs
aws sesv2 list-dedicated-ip-pools
aws sesv2 get-dedicated-ip-pool --pool-name <name>
aws sesv2 get-dedicated-ips --pool-name <name> #Only valid if ScalingMode is Standard
aws sesv2 get-dedicated-ip --ip <ip>

# Misc
## Get send quota
aws ses get-send-quota
## Get statistics
aws ses get-send-statistics

Post Exploitation

AWS - SES Post Exploitation

AWS 해킹 학습 및 연습:HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 학습 및 연습: HackTricks Training GCP Red Team Expert (GRTE)

HackTricks 지원

• 구독 플랜을 확인하세요!

• 💬 Discord 그룹 또는 telegram 그룹에 가입하거나 Twitter 🐦 @hacktricks_live을 팔로우하세요.

• PR을 제출하여 HackTricks 및 HackTricks Cloud github 저장소에 해킹 트릭을 공유하세요.