Skip to content

Commit 7075585

Browse files
kmcquadekmcquade
authored
Merge pull request #45 from salesforce/fix/GH-01-risk-documentation-updates
Add Risk Remediation Guidance for all supported services
2 parents fe02fc7 + 3fa3605 commit 7075585

27 files changed

+811
-143
lines changed

‎README.md

+36-62
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,9 @@ Use a one-liner command to backdoor an AWS account's resources with a rogue AWS
44

55
[![continuous-integration](https://github.com/salesforce/endgame/workflows/continuous-integration/badge.svg?)](https://github.com/salesforce/endgame/actions?query=workflow%3Acontinuous-integration)
66
[![Documentation Status](https://readthedocs.org/projects/endgame/badge/?version=latest)](https://endgame.readthedocs.io/en/latest/?badge=latest)
7-
[![Join the chat at https://gitter.im/salesforce/policy_sentry](https://badges.gitter.im/salesforce/endgame.svg)](https://gitter.im/salesforce/endgame?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
7+
[![Join the chat at https://gitter.im/salesforce/endgame](https://badges.gitter.im/salesforce/endgame.svg)](https://gitter.im/salesforce/endgame?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
88
[![Twitter](https://img.shields.io/twitter/url/https/twitter.com/kmcquade3.svg?style=social&label=Follow%20the%20author)](https://twitter.com/kmcquade3)
9-
10-
[//]: [![Downloads](https://pepy.tech/badge/endgame)](https://pepy.tech/project/endgame)
9+
[![Downloads](https://pepy.tech/badge/endgame)](https://pepy.tech/project/endgame)
1110

1211
![](./docs/images/endgame.gif)
1312

@@ -31,28 +30,31 @@ endgame expose --service s3 --name computers-were-a-mistake
3130

3231
## Supported Backdoors
3332

34-
`endgame` can create backdoors for resources in any of the services listed below. While AWS Access Analyzer is meant to detect exposed resources of these types, it currently only supports 7/18 of the services that `endgame` attacks.
35-
36-
| Backdoor Resource Type | Support | [AWS Access Analyzer Support][1] |
37-
|-------------------------------|---------|------------------------- |
38-
| ACM PCA | ✅ | ❌ |
39-
| CloudWatch Resource Policies | ✅ | ❌ |
40-
| EC2 AMIs | ✅ | ❌ |
41-
| EBS Snapshots | ✅ | ❌ |
42-
| ECR Repositories | ✅ | ❌ |
43-
| EFS File Systems | ✅ | ❌ |
44-
| ElasticSearch Domains | ✅ | ❌ |
45-
| Glacier Vault Access Policies | ✅ | ❌ |
46-
| IAM Roles | ✅ | ✅ |
47-
| KMS Keys | ✅ | ✅ |
48-
| Lambda Functions | ✅ | ✅ |
49-
| Lambda Layers | ✅ | ✅ |
50-
| RDS Snapshots | ✅ | ❌ |
51-
| S3 Buckets | ✅ | ✅ |
52-
| Secrets Manager Secrets | ✅ | ✅ |
53-
| SES Identity Policies | ✅ | ❌ |
54-
| SQS Queues | ✅ | ✅ |
55-
| SNS Topics | ✅ | ❌ |
33+
`endgame` can create backdoors for resources in any of the services listed below.
34+
35+
> ‼️ **Note**: At the time of this writing, [AWS Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html) does **NOT** support auditing **11 out of the 18 services** that `endgame` attacks. Given that Access Analyzer is intended to detect this exact kind of violation, we kindly suggest to the AWS Team that they support all resources that can be attacked using `endgame`. 😊
36+
37+
38+
| Backdoor Resource Type | Support | [AWS Access Analyzer Support][1] |
39+
|------------------------------------|---------|----------------------------------|
40+
| ACM Private CAs | ✅ | ❌ |
41+
| CloudWatch Resource Policies | ✅ | ❌ |
42+
| EBS Volume Snapshots | ✅ | ❌ |
43+
| EC2 Amazon Machine Images (AMIs) | ✅ | ❌ |
44+
| ECR Container Repositories | ✅ | ❌ |
45+
| EFS File Systems | ✅ | ❌ |
46+
| ElasticSearch Domains | ✅ | ❌ |
47+
| Glacier Vault Access Policies | ✅ | ❌ |
48+
| IAM Roles | ✅ | ✅ |
49+
| KMS Keys | ✅ | ✅ |
50+
| Lambda Functions | ✅ | ✅ |
51+
| Lambda Layers | ✅ | ✅ |
52+
| RDS Snapshots | ✅ | ❌ |
53+
| S3 Buckets | ✅ | ✅ |
54+
| Secrets Manager Secrets | ✅ | ✅ |
55+
| SES Sender Authorization Policies | ✅ | ❌ |
56+
| SQS Queues | ✅ | ✅ |
57+
| SNS Topics | ✅ | ❌ |
5658

5759
## Tutorial
5860

@@ -78,13 +80,13 @@ Now you should be able to execute `endgame` from command line by running `endgam
7880
* To enable Bash completion, put this in your `~/.bashrc`:
7981

8082
```bash
81-
eval "$(_CLOUDSPLAINING_COMPLETE=source cloudsplaining)"
83+
eval "$(_ENDGAME_COMPLETE=source endgame)"
8284
```
8385

8486
* To enable ZSH completion, put this in your `~/.zshrc`:
8587

8688
```bash
87-
eval "$(_CLOUDSPLAINING_COMPLETE=source_zsh cloudsplaining)"
89+
eval "$(_ENDGAME_COMPLETE=source_zsh endgame)"
8890
```
8991

9092
### Setup
@@ -181,40 +183,11 @@ endgame smash --service all --undo
181183
make terraform-destroy
182184
```
183185
184-
## Current Resource Support Statuses
185-
186-
### Backdoors via Resource-based Policies
187-
188-
| Backdoor Resource Type | Support | [AWS Access Analyzer Support][1] |
189-
|-------------------------------|---------|------------------------- |
190-
| ACM PCA | ✅ | ❌ |
191-
| CloudWatch Resource Policies | ✅ | ❌ |
192-
| ECR Repositories | ✅ | ❌ |
193-
| EFS File Systems | ✅ | ❌ |
194-
| ElasticSearch Domains | ✅ | ❌ |
195-
| Glacier Vault Access Policies | ✅ | ❌ |
196-
| IAM Roles | ✅ | ✅ |
197-
| KMS Keys | ✅ | ✅ |
198-
| Lambda Functions | ✅ | ✅ |
199-
| Lambda Layers | ✅ | ✅ |
200-
| S3 Buckets | ✅ | ✅ |
201-
| Secrets Manager Secrets | ✅ | ✅ |
202-
| SES Identity Policies | ✅ | ❌ |
203-
| SQS Queues | ✅ | ✅ |
204-
| SNS Topics | ✅ | ❌ |
205-
206-
### Backdoors via Sharing APIs
207-
208-
| Backdoored Resource Type | Support Status |
209-
|-------------------------------|----------------|
210-
| EC2 AMIs | ✅ |
211-
| EBS Snapshots | ✅ |
212-
| RDS Snapshots | ✅ |
213-
| RDS DB Cluster Snapshots | ❌ |
214-
215186
## IAM Permissions
216187
217-
The following IAM Permissions are used to create these backdoors:
188+
The IAM Permissions listed below are used to create these backdoors.
189+
190+
> **NOTE**: You don't need **all** of these permissions to run the tool. You just need enough from each service. So, `s3:ListAllMyBuckets`, `s3:GetBucketPolicy`, and `s3:PutBucketPolicy` are all the permissions needed to leverage this tool to expose S3 buckets.
218191

219192
```json
220193
{
@@ -228,9 +201,12 @@ The following IAM Permissions are used to create these backdoors:
228201
"acm-pca:GetPolicy",
229202
"acm-pca:ListCertificateAuthorities",
230203
"acm-pca:PutPolicy",
204+
"ec2:DescribeImageAttribute",
205+
"ec2:DescribeImages",
231206
"ec2:DescribeSnapshotAttribute",
232207
"ec2:DescribeSnapshots",
233208
"ec2:ModifySnapshotAttribute",
209+
"ec2:ModifyImageAttribute",
234210
"ecr:DescribeRepositories",
235211
"ecr:DeleteRepositoryPolicy",
236212
"ecr:GetRepositoryPolicy",
@@ -269,8 +245,8 @@ The following IAM Permissions are used to create these backdoors:
269245
"rds:DescribeDbSnapshotAttributes",
270246
"rds:ModifyDbSnapshotAttribute",
271247
"rds:ModifyDbClusterSnapshotAttribute",
272-
"s3:ListAllMyBuckets",
273248
"s3:GetBucketPolicy",
249+
"s3:ListAllMyBuckets",
274250
"s3:PutBucketPolicy",
275251
"secretsmanager:GetResourcePolicy",
276252
"secretsmanager:DeleteResourcePolicy",
@@ -297,8 +273,6 @@ The following IAM Permissions are used to create these backdoors:
297273
}
298274
```
299275

300-
You don't need **all** of these permissions to run the tool. You just need enough from each service. So, `s3:ListAllMyBuckets`, `s3:GetBucketPolicy`, and `s3:PutBucketPolicy` are all the permissions needed to leverage this tool to expose S3 buckets.
301-
302276
## Contributing
303277

304278
## Testing

‎docs/contributing/testing.md

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Testing
2+
3+
## Unit tests
4+
5+
* Run [pytest](https://docs.pytest.org/en/stable/) with the following:
6+
7+
```bash
8+
make test
9+
```
10+
11+
## Security tests
12+
13+
* Run [bandit](https://bandit.readthedocs.io/en/latest/) with the following:
14+
15+
```bash
16+
make security-test
17+
```
18+
19+
## Integration tests
20+
21+
After making any modifications to the program, you can run a full-fledged integration test, using this program against your own test infrastructure in AWS.
22+
23+
* First, set your environment variables
24+
25+
```bash
26+
# Set the environment variable for the username that you will create a backdoor for.
27+
export EVIL_PRINCIPAL="arn:aws:iam::999988887777:user/evil"
28+
export AWS_REGION="us-east-1"
29+
export AWS_PROFILE="default"
30+
```
31+
32+
* Then run the full-fledged integration test:
33+
34+
```bash
35+
make integration-test
36+
```
37+
38+
This does the following:
39+
* Sets up your local dev environment (see `setup-dev`) in the `Makefile`
40+
* Creates the Terraform infrastructure (see `terraform-demo` in the `Makefile`)
41+
* Runs `list-resources`, `exploit --dry-run`, and `expose` against this live infrastructure
42+
* Destroys the Terraform infrastructure (see `terraform-destroy` in the `Makefile`)
43+
44+
Note that the `expose` command will not expose the resources to the world - it will only expose them to your rogue user, not to the world.

‎docs/iam-permissions.md

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# IAM Permissions
2+
3+
The IAM Permissions listed below are used to create these backdoors.
4+
5+
> **NOTE**: You don't need **all** of these permissions to run the tool. You just need enough from each service. So, `s3:ListAllMyBuckets`, `s3:GetBucketPolicy`, and `s3:PutBucketPolicy` are all the permissions needed to leverage this tool to expose S3 buckets.
6+
7+
8+
```json
9+
{
10+
"Version": "2012-10-17",
11+
"Statement": [
12+
{
13+
"Sid": "IAmInevitable",
14+
"Effect": "Allow",
15+
"Action": [
16+
"acm-pca:DeletePolicy",
17+
"acm-pca:GetPolicy",
18+
"acm-pca:ListCertificateAuthorities",
19+
"acm-pca:PutPolicy",
20+
"ec2:DescribeImageAttribute",
21+
"ec2:DescribeImages",
22+
"ec2:DescribeSnapshotAttribute",
23+
"ec2:DescribeSnapshots",
24+
"ec2:ModifySnapshotAttribute",
25+
"ec2:ModifyImageAttribute",
26+
"ecr:DescribeRepositories",
27+
"ecr:DeleteRepositoryPolicy",
28+
"ecr:GetRepositoryPolicy",
29+
"ecr:SetRepositoryPolicy",
30+
"elasticfilesystem:DescribeFileSystems",
31+
"elasticfilesystem:DescribeFileSystemPolicy",
32+
"elasticfilesystem:PutFileSystemPolicy",
33+
"es:DescribeElasticsearchDomainConfig",
34+
"es:ListDomainNames",
35+
"es:UpdateElasticsearchDomainConfig",
36+
"glacier:GetVaultAccessPolicy",
37+
"glacier:ListVaults",
38+
"glacier:SetVaultAccessPolicy",
39+
"iam:GetRole",
40+
"iam:ListRoles",
41+
"iam:UpdateAssumeRolePolicy",
42+
"kms:GetKeyPolicy",
43+
"kms:ListKeys",
44+
"kms:ListAliases",
45+
"kms:PutKeyPolicy",
46+
"lambda:AddLayerVersionPermission",
47+
"lambda:AddPermission",
48+
"lambda:GetPolicy",
49+
"lambda:GetLayerVersionPolicy",
50+
"lambda:ListFunctions",
51+
"lambda:ListLayers",
52+
"lambda:ListLayerVersions",
53+
"lambda:RemoveLayerVersionPermission",
54+
"lambda:RemovePermission",
55+
"logs:DescribeResourcePolicies",
56+
"logs:DeleteResourcePolicy",
57+
"logs:PutResourcePolicy",
58+
"rds:DescribeDbClusterSnapshots",
59+
"rds:DescribeDbClusterSnapshotAttributes",
60+
"rds:DescribeDbSnapshots",
61+
"rds:DescribeDbSnapshotAttributes",
62+
"rds:ModifyDbSnapshotAttribute",
63+
"rds:ModifyDbClusterSnapshotAttribute",
64+
"s3:GetBucketPolicy",
65+
"s3:ListAllMyBuckets",
66+
"s3:PutBucketPolicy",
67+
"secretsmanager:GetResourcePolicy",
68+
"secretsmanager:DeleteResourcePolicy",
69+
"secretsmanager:ListSecrets",
70+
"secretsmanager:PutResourcePolicy",
71+
"ses:DeleteIdentityPolicy",
72+
"ses:GetIdentityPolicies",
73+
"ses:ListIdentities",
74+
"ses:ListIdentityPolicies",
75+
"ses:PutIdentityPolicy",
76+
"sns:AddPermission",
77+
"sns:ListTopics",
78+
"sns:GetTopicAttributes",
79+
"sns:RemovePermission",
80+
"sqs:AddPermission",
81+
"sqs:GetQueueUrl",
82+
"sqs:GetQueueAttributes",
83+
"sqs:ListQueues",
84+
"sqs:RemovePermission"
85+
],
86+
"Resource": "*"
87+
}
88+
]
89+
}
90+
```
91+

‎docs/installation.md

+30-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,30 @@
1-
# Installation
1+
# Installation
2+
3+
* pip3
4+
5+
```bash
6+
pip3 install --user endgame
7+
```
8+
9+
* Homebrew (this will not work until the repository is public)
10+
11+
```bash
12+
brew tap salesforce/endgame https://github.com/salesforce/endgame
13+
brew install endgame
14+
```
15+
16+
Now you should be able to execute `endgame` from command line by running `endgame --help`.
17+
18+
#### Shell Completion
19+
20+
* To enable Bash completion, put this in your `~/.bashrc`:
21+
22+
```bash
23+
eval "$(_ENDGAME_COMPLETE=source endgame)"
24+
```
25+
26+
* To enable ZSH completion, put this in your `~/.zshrc`:
27+
28+
```bash
29+
eval "$(_ENDGAME_COMPLETE=source_zsh endgame)"
30+
```

0 commit comments

Comments
 (0)