AWS - IAM, Identity Center & SSO Enum

Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

Ikiwa unataka kuona kampuni yako ikitangazwa kwenye HackTricks au kupakua HackTricks kwa PDF Angalia MIPANGO YA KUJIUNGA!
Pata bidhaa rasmi za PEASS & HackTricks
Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee
Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

IAM

Unaweza kupata maelezo ya IAM katika:

pageAWS - Basic Information

Uorodheshaji

Mamlaka kuu zinazohitajika:

iam:ListPolicies, iam:GetPolicy na iam:GetPolicyVersion
iam:ListRoles
iam:ListUsers
iam:ListGroups
iam:ListGroupsForUser
iam:ListAttachedUserPolicies
iam:ListAttachedRolePolicies
iam:ListAttachedGroupPolicies
iam:ListUserPolicies na iam:GetUserPolicy
iam:ListGroupPolicies na iam:GetGroupPolicy
iam:ListRolePolicies na iam:GetRolePolicy

# All IAMs
## Retrieves  information about all IAM users, groups, roles, and policies
## in your Amazon Web Services account, including their relationships  to
## one another. Use this operation to obtain a snapshot of the configura-
## tion of IAM permissions (users, groups, roles, and  policies)  in  your
## account.
aws iam get-account-authorization-details

# List users
aws iam list-users
aws iam list-ssh-public-keys #User keys for CodeCommit
aws iam get-ssh-public-key --user-name <username> --ssh-public-key-id <id> --encoding SSH #Get public key with metadata
aws iam list-service-specific-credentials #Get special permissions of the IAM user over specific services
aws iam get-user --user-name <username> #Get metadata of user, included permissions boundaries
aws iam list-access-keys #List created access keys
## inline policies
aws iam list-user-policies --user-name <username> #Get inline policies of the user
aws iam get-user-policy --user-name <username> --policy-name <policyname> #Get inline policy details
## attached policies
aws iam list-attached-user-policies --user-name <username> #Get policies of user, it doesn't get inline policies

# List groups
aws iam list-groups #Get groups
aws iam list-groups-for-user --user-name <username> #Get groups of a user
aws iam get-group --group-name <name> #Get group name info
## inline policies
aws iam list-group-policies --group-name <username> #Get inline policies of the group
aws iam get-group-policy --group-name <username> --policy-name <policyname> #Get an inline policy info
## attached policies
aws iam list-attached-group-policies --group-name <name> #Get policies of group, it doesn't get inline policies

# List roles
aws iam list-roles #Get roles
aws iam get-role --role-name <role-name> #Get role
## inline policies
aws iam list-role-policies --role-name <name> #Get inline policies of a role
aws iam get-role-policy --role-name <name> --policy-name <name> #Get inline policy details
## attached policies
aws iam list-attached-role-policies --role-name <role-name> #Get policies of role, it doesn't get inline policies

# List policies
aws iam list-policies [--only-attached] [--scope Local]
aws iam list-policies-granting-service-access --arn <identity> --service-namespaces <svc> # Get list of policies that give access to the user to the service
## Get policy content
aws iam get-policy --policy-arn <policy_arn>
aws iam list-policy-versions --policy-arn <arn>
aws iam get-policy-version --policy-arn <arn:aws:iam::975426262029:policy/list_apigateways> --version-id <VERSION_X>

# Enumerate providers
aws iam list-saml-providers
aws iam get-saml-provider --saml-provider-arn <ARN>
aws iam list-open-id-connect-providers
aws iam get-open-id-connect-provider --open-id-connect-provider-arn <ARN>

# Password Policy
aws iam get-account-password-policy

# MFA
aws iam list-mfa-devices
aws iam list-virtual-mfa-devices

Kupiga nguvu ruhusa

Ikiwa una nia ya ruhusa zako mwenyewe lakini huna ufikiaji wa kuuliza IAM unaweza daima kuzipiga nguvu.

bf-aws-permissions

Zana bf-aws-permissions ni skripti ya bash ambayo itaendeshwa kwa kutumia wasifu ulioonyeshwa wote list*, describe*, get* hatua inayoweza kupatikana kutumia ujumbe wa msaada wa aws cli na kurudisha utekelezaji mafanikio.

# Bruteforce permissions
bash bf-aws-permissions.sh -p default > /tmp/bf-permissions-verbose.txt

bf-aws-perms-simulate

Chombo bf-aws-perms-simulate kinaweza kupata ruhusa zako za sasa (au za wakala wengine) ikiwa una ruhusa ya iam:SimulatePrincipalPolicy.

# Ask for permissions
python3 aws_permissions_checker.py --profile <AWS_PROFILE> [--arn <USER_ARN>]

Perms2ManagedPolicies

Ikiwa umepata baadhi ya ruhusa ambazo mtumiaji wako anayo, na unadhani zinatolewa na jukumu la AWS lililosimamiwa (na sio la desturi). Unaweza kutumia zana aws-Perms2ManagedRoles kuchunguza majukumu yote ya AWS yaliyosimamiwa yanayotoa ruhusa ulizoona unazo.

# Run example with my profile
python3 aws-Perms2ManagedPolicies.py --profile myadmin --permissions-file example-permissions.txt

Inawezekana "kujua" kama ruhusa unazomiliki zimetolewa na jukumu lililosimamiwa na AWS ikiwa unaona kwamba una ruhusa juu ya huduma ambazo hazitumiki kwa mfano.

Cloudtrail2IAM

CloudTrail2IAM ni chombo cha Python kinachochambua kumbukumbu za AWS CloudTrail ili kutoa na kufupisha hatua zilizofanywa na kila mtu au tu mtumiaji au jukumu fulani. Chombo hicho kitachambua kila kumbukumbu ya cloudtrail kutoka kwenye kisanduku kilichotajwa.

git clone https://github.com/carlospolop/Cloudtrail2IAM
cd Cloudtrail2IAM
pip install -r requirements.txt
python3 cloudtrail2IAM.py --prefix PREFIX --bucket_name BUCKET_NAME --profile PROFILE [--filter-name FILTER_NAME] [--threads THREADS]

Ikiwa unapata .tfstate (faili za hali ya Terraform) au faili za CloudFormation (hizi kawaida ni faili za yaml zilizoko ndani ya ndoo yenye kipimo cha cf-templates), unaweza pia kusoma ili kupata usanidi wa aws na kujua ni ruhusa zipi zimewekwa kwa nani.

enumera-iam

Ili kutumia zana https://github.com/andresriancho/enumerate-iam kwanza unahitaji kupakua vituo vyote vya API vya AWS, kutoka kwenye vituo hivyo script generate_bruteforce_tests.py itapata vituo vyote vya "list_", "describe_", na "get_". Na mwishowe, itajaribu kupata ufikiaji wao kwa kutumia sifa zilizotolewa na kuonyesha ikiwa ilifanya kazi.

(Kulingana na uzoefu wangu zana inakwama wakati fulani, angalia marekebisho haya kujaribu kusahihisha hilo).

Kulingana na uzoefu wangu zana hii ni kama ile ya awali lakini inafanya kazi vibaya zaidi na kuangalia ruhusa chache zaidi.

# Install tool
git clone git@github.com:andresriancho/enumerate-iam.git
cd enumerate-iam/
pip install -r requirements.txt

# Download API endpoints
cd enumerate_iam/
git clone https://github.com/aws/aws-sdk-js.git
python3 generate_bruteforce_tests.py
rm -rf aws-sdk-js
cd ..

# Enumerate permissions
python3 enumerate-iam.py --access-key ACCESS_KEY --secret-key SECRET_KEY [--session-token SESSION_TOKEN] [--region REGION]

weirdAAL

Unaweza pia kutumia zana weirdAAL. Zana hii itachunguza operesheni kadhaa za kawaida kwenye huduma kadhaa za kawaida (itachunguza idhini za uorodheshaji na pia idhini za privesc). Lakini itachunguza tu uchunguzi uliopangwa (njia pekee ya kuchunguza vitu zaidi ni kwa kuandika vipimo zaidi).

# Install
git clone https://github.com/carnal0wnage/weirdAAL.git
cd weirdAAL
python3 -m venv weirdAAL
source weirdAAL/bin/activate
pip3 install -r requirements.txt

# Create a .env file with aws credentials such as
[default]
aws_access_key_id = <insert key id>
aws_secret_access_key = <insert secret key>

# Setup DB
python3 create_dbs.py

# Invoke it
python3 weirdAAL.py -m ec2_describe_instances -t ec2test # Just some ec2 tests
python3 weirdAAL.py -m recon_all -t MyTarget # Check all permissions
# You will see output such as:
# [+] elbv2 Actions allowed are [+]
# ['DescribeLoadBalancers', 'DescribeAccountLimits', 'DescribeTargetGroups']

Vifaa vya Kuboresha kufuatilia ruhusa

# Export env variables
./index.js --console=text --config ./config.js --json /tmp/out-cloudsploit.json

# Filter results removing unknown
jq 'map(select(.status | contains("UNKNOWN") | not))' /tmp/out-cloudsploit.json | jq 'map(select(.resource | contains("N/A") | not))' > /tmp/out-cloudsploit-filt.json

# Get services by regions
jq 'group_by(.region) | map({(.[0].region): ([map((.resource | split(":"))[2]) | unique])})' ~/Desktop/pentests/cere/greybox/core-dev-dev-cloudsploit-filtered.json

# https://github.com/turbot/steampipe-mod-aws-insights
steampipe check all --export=json

# https://github.com/turbot/steampipe-mod-aws-perimeter
# In this case you cannot output to JSON, so heck it in the dashboard
steampipe dashboard

<YourTool>

Hakuna zana yoyote kati ya zilizotangulia inayoweza kuchunguza karibu ruhusa zote, kwa hivyo kama unajua zana bora tuma PR!

Upatikanaji usiothibitishwa

pageAWS - IAM & STS Unauthenticated Enum

Kupandisha Hadhi

Kwenye ukurasa ufuatao unaweza kuangalia jinsi ya kutumia ruhusa za IAM kupandisha hadhi:

pageAWS - IAM Privesc

Uchimbaji wa Baada ya Uvamizi wa IAM

pageAWS - IAM Post Exploitation

Uthabiti wa IAM

pageAWS - IAM Persistence

Kituo cha Utambulisho cha IAM

Unaweza kupata maelezo ya Kituo cha Utambulisho cha IAM hapa:

pageAWS - Basic Information

Unganisha kupitia SSO na CLI

# Connect with sso via CLI aws configure sso
aws configure sso

[profile profile_name]
sso_start_url = https://subdomain.awsapps.com/start/
sso_account_id = <account_numbre>
sso_role_name = AdministratorAccess
sso_region = us-east-1

Uchambuzi

Vipengele kuu vya Kituo cha Utambulisho ni:

Watumiaji na vikundi
Seti za Ruhusa: Zina sera zilizowekwa
Akaunti za AWS

Kisha, mahusiano huanzishwa ili watumiaji/vikundi wawe na Seti za Ruhusa juu ya Akaunti za AWS.

Tafadhali kumbuka kuwa kuna njia 3 za kuambatanisha sera kwa Seti ya Ruhusa. Kuambatanisha sera zilizosimamiwa na AWS, Sera zilizosimamiwa na Mteja (sera hizi zinahitaji kuundwa katika akaunti zote ambazo Seti ya Ruhusa inaathiri), na sera za ndani (zilizoelezwa hapo).

# Check if IAM Identity Center is used
aws sso-admin list-instances

# Get Permissions sets. These are the policies that can be assigned
aws sso-admin list-permission-sets --instance-arn <instance-arn>
aws sso-admin describe-permission-set --instance-arn <instance-arn> --permission-set-arn <perm-set-arn>

## Get managed policies of a permission set
aws sso-admin list-managed-policies-in-permission-set --instance-arn <instance-arn> --permission-set-arn <perm-set-arn>
## Get inline policies of a permission set
aws sso-admin get-inline-policy-for-permission-set --instance-arn <instance-arn> --permission-set-arn <perm-set-arn>
## Get customer managed policies of a permission set
aws sso-admin list-customer-managed-policy-references-in-permission-set --instance-arn <instance-arn> --permission-set-arn <perm-set-arn>
## Get boundaries of a permission set
aws sso-admin get-permissions-boundary-for-permission-set --instance-arn <instance-arn> --permission-set-arn <perm-set-arn>

## List accounts a permission set is affecting
aws sso-admin list-accounts-for-provisioned-permission-set --instance-arn <instance-arn> --permission-set-arn <perm-set-arn>
## List principals given a permission set in an account
aws sso-admin list-account-assignments --instance-arn <instance-arn> --permission-set-arn <perm-set-arn> --account-id <account_id>

# Get permissions sets affecting an account
aws sso-admin list-permission-sets-provisioned-to-account --instance-arn <instance-arn> --account-id <account_id>

# List users & groups from the identity store
aws identitystore list-users --identity-store-id <store-id>
aws identitystore list-groups --identity-store-id <store-id>
## Get members of groups
aws identitystore list-group-memberships --identity-store-id <store-id> --group-id <group-id>
## Get memberships or a user or a group
aws identitystore list-group-memberships-for-member --identity-store-id <store-id> --member-id <member-id>

Uchambuzi wa Kienyeji

Inawezekana kuunda ndani ya folda $HOME/.aws faili la config kwa ajili ya kusanidi maelezo yanayopatikana kupitia SSO, kwa mfano:

[default]
region = us-west-2
output = json

[profile my-sso-profile]
sso_start_url = https://my-sso-portal.awsapps.com/start
sso_region = us-west-2
sso_account_id = 123456789012
sso_role_name = MySSORole
region = us-west-2
output = json

[profile dependent-profile]
role_arn = arn:aws:iam::<acc-id>:role/ReadOnlyRole
source_profile = Hacktricks-Admin

Mipangilio hii inaweza kutumika na amri:

# Login in ms-sso-profile
aws sso login --profile my-sso-profile
# Use dependent-profile
aws s3 ls --profile dependent-profile

Wakati wasifu kutoka SSO unapotumiwa kupata baadhi ya habari, sifa hizo zinahifadhiwa kwenye faili ndani ya folda $HOME/.aws/sso/cache. Hivyo basi zinaweza kusomwa na kutumiwa kutoka hapo.

Zaidi ya hayo, sifa zaidi zinaweza kuhifadhiwa kwenye folda $HOME/.aws/cli/cache. Folda hii ya cache hutumiwa hasa unapokuwa ukifanya kazi na profaili za AWS CLI zinazotumia sifa za mtumiaji wa IAM au kudai majukumu kupitia IAM (bila SSO). Mfano wa mipangilio:

[profile crossaccountrole]
role_arn = arn:aws:iam::234567890123:role/SomeRole
source_profile = default
mfa_serial = arn:aws:iam::123456789012:mfa/saanvi
external_id = 123456

Uthabiti

Unda mtumiaji na umpe ruhusa zake

# Create user identitystore:CreateUser
aws identitystore create-user --identity-store-id <store-id> --user-name privesc --display-name privesc --emails Value=sdkabflvwsljyclpma@tmmbt.net,Type=Work,Primary=True --name Formatted=privesc,FamilyName=privesc,GivenName=privesc
## After creating it try to login in the console using the selected username, you will receive an email with the code and then you will be able to select a password

Unda kikundi na umpatie ruhusa na umweke mtumiaji aliye chini ya udhibiti
Toa ruhusa ziada kwa mtumiaji aliye chini ya udhibiti au kikundi
Kwa chaguo-msingi, ni watumiaji tu wenye ruhusa kutoka kwenye Akaunti ya Usimamizi ndio watakaoweza kupata na kudhibiti Kituo cha Utambulisho cha IAM.

Hata hivyo, niwezekanavyo kupitia Msimamizi wa Kuwakilisha kuruhusu watumiaji kutoka kwenye akaunti tofauti kuisimamia. Hawatapata ruhusa sawa kabisa, lakini wataweza kutekeleza shughuli za usimamizi.

PreviousAWS - Kinesis Data Firehose Enum NextAWS - KMS Enum

Last updated 1 month ago

IAM

Uorodheshaji

Kupiga nguvu ruhusa

bf-aws-permissions

bf-aws-perms-simulate

Perms2ManagedPolicies

Cloudtrail2IAM

enumera-iam

weirdAAL

Vifaa vya Kuboresha kufuatilia ruhusa

<YourTool>

Upatikanaji usiothibitishwa

Kupandisha Hadhi

Uchimbaji wa Baada ya Uvamizi wa IAM

Uthabiti wa IAM

Kituo cha Utambulisho cha IAM

Unganisha kupitia SSO na CLI

Uchambuzi

Uchambuzi wa Kienyeji

Upatikanaji usiothibitishwa

Kupandisha Mamlaka

Baada ya Uvamizi

Uthabiti

Unda mtumiaji na umpe ruhusa zake