Skip to content

Commit 5466683

Browse files
kmcquadekmcquade
committed
Add table of contents to each of the risk descriptions. This will work for private beta until we can move to ReadTheDocs
1 parent 7eaea19 commit 5466683

18 files changed

+131
-6
lines changed

‎docs/risks/acm-pca.md

+9-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# ACM Private Certificate Authority (PCA)
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [References](#references)
7+
38
## Steps to Reproduce
49

510
* ‼️ If you are using the Terraform demo infrastructure, you must take some follow-up steps after provisioning the resources in order to be able to expose the demo resource. This is due to how ACM PCA works. For instructions, see the [Appendix on ACM PCA Activation](../appendices/acm-pca-activation.md)
@@ -59,13 +64,13 @@ TODO
5964
* **Trusted Accounts Only**: Ensure that AWS PCA Certificates are only shared with trusted accounts, and that the trusted accounts truly need access to the Certificates.
6065
* **Ensure access is necessary**: For any trusted accounts that do have access, ensure that the access is absolutely necessary.
6166
* **Restrict access to IAM permissions that could lead to exposing usage of your private CAs**: Tightly control access to the following IAM actions:
62-
- [acm-pca:GetPolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetPolicy.html): _Description_
63-
- [acm-pca:PutPolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_PutPolicy.html): _Description_
64-
- [acm-pca:DeletePolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DeletePolicy.html): _Description_
67+
- [acm-pca:GetPolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetPolicy.html): Retrieves the policy on an ACM Private CA._
68+
- [acm-pca:PutPolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_PutPolicy.html): _Puts a policy on an ACM Private CA._
69+
- [acm-pca:DeletePolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_DeletePolicy.html): _Deletes the policy for an ACM Private CA._
6570

6671
Also, consider using [Cloudsplaining](https://github.com/salesforce/cloudsplaining/#cloudsplaining) to identify violations of least privilege in IAM policies. This can help limit the IAM principals that have access to the actions that could perform Resource Exposure activities. See the example report [here](https://opensource.salesforce.com/cloudsplaining/)
6772

68-
## Resources
73+
## References
6974

7075
* [Attaching a Resource-based Policy for Cross Account Access in ACM PCA](https://docs.aws.amazon.com/acm-pca/latest/userguide/pca-rbp.html)
7176
* [GetPolicy](https://docs.aws.amazon.com/acm-pca/latest/APIReference/API_GetPolicy.html)

‎docs/risks/amis.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# EC2 AMIs (Machine Images)
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/ebs.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# EBS Snapshot Exposure
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/ecr.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Elastic Container Registries (ECR)
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/efs.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Elastic File Systems (EFS)
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
> Note: The Terraform demo infrastructure will output the EFS File System ID. If you are using the Terraform demo infrastructure, you must leverage the file system ID in the `--name` parameter.

‎docs/risks/es.md

+26
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,33 @@
11
# ElasticSearch Domains
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
> Note: The **Network Configuration** settings in ElasticSearch clusters offer two options - **VPC Access** or **Public access**. If VPC access is used, modification of the resource-based policy - whether using `endgame` or the CLI exploitation method - will not result in access to the internet. `endgame` only modifies the resource-based policy for the ElasticSearch cluster, so this will only expose ElasticSearch clusters that are set to **Public access*.
410
511
## Steps to Reproduce
612

13+
* To expose the resource using `endgame`, run the following from the victim account:
14+
15+
```bash
16+
export EVIL_PRINCIPAL=arn:aws:iam::999988887777:user/evil
17+
18+
endgame expose --service elasticsearch --name test-resource-exposure
19+
```
20+
21+
* To get the content of the resource-based policy for ElasticSearch domain config, run the following command from the victim account:
22+
23+
```bash
24+
aws es describe-elasticsearch-domain-config --domain-name test-resource-exposure
25+
```
26+
727
## Example
828

29+
The response will contain a field titled `AccessPolicies`. AccessPolicies will contain content that resembles the below. Observe that the victim resource (`arn:aws:es:us-east-1:999988887777:domain/test-resource-exposure`) allows access to `*` principals, indicating a successful compromise.
30+
931
```json
1032
{
1133
"Version": "2012-10-17",
@@ -24,6 +46,10 @@
2446

2547
## Exploitation
2648

49+
```
50+
TODO
51+
```
52+
2753
## Remediation
2854

2955
> ‼️ **Note**: At the time of this writing, AWS Access Analyzer does **NOT** support auditing of this resource type to prevent resource exposure. **We kindly suggest to the AWS Team that they support all resources that can be attacked using this tool**. 😊

‎docs/risks/glacier.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Glacier Vault
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/iam-roles.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# IAM Roles (via AssumeRole)
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/kms.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# KMS Keys
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/lambda-functions.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Lambda Function Cross-Account Access
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
AWS Lambda Permission Policies (aka resource-based policies) can allow functions to be invoked from AWS accounts other than the one it is running in.
410

511
Compromised Lambda functions are a known attack path for [Privilege Escalation](https://resources.infosecinstitute.com/topic/cloudgoat-walkthrough-lambda-privilege-escalation/) and other nefarious use cases. While the impact often depends on the context of the Lambdas itself, Lambda functions often modify AWS infrastructure or have data plane access. Abusing these capabilities could compromise the confidentiality and integrity of the resources in the account.

‎docs/risks/lambda-layers.md

+5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Lambda Layers
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [References](#references)
7+
38
## Steps to Reproduce
49

510
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/logs.md

+5
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22

33
CloudWatch Resource Policies allow other AWS services or IAM Principals to put log events into the account.
44

5+
* [Steps to Reproduce](#steps-to-reproduce)
6+
* [Exploitation](#exploitation)
7+
* [Remediation](#remediation)
8+
* [References](#references)
9+
510
## Steps to Reproduce
611

712
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/rds-snapshots.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# RDS Snapshots
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/s3.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# S3 Buckets
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/secretsmanager.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Secrets Manager
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* **Option 1**: To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/ses.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# SES Sender Authorization Policies
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
SES Sending Authorization Policies can be used to add a rogue IAM user as a [Delegate sender](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-authorization-delegate-sender-tasks.html). This can result in a malicous user sending an email on behalf of your organization, which could lead to phishing attacks against customers or employees, as well as a loss of consumer trust and reputation loss.
410

511
### How it works

‎docs/risks/sns.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# SNS
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:

‎docs/risks/sqs.md

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# SQS
22

3+
* [Steps to Reproduce](#steps-to-reproduce)
4+
* [Exploitation](#exploitation)
5+
* [Remediation](#remediation)
6+
* [Basic Detection](#basic-detection)
7+
* [References](#references)
8+
39
## Steps to Reproduce
410

511
* To expose the resource using `endgame`, run the following from the victim account:
@@ -46,8 +52,8 @@ TODO
4652
* **Ensure access is necessary**: For any trusted accounts that do have access, ensure that the access is absolutely necessary.
4753
* **AWS Access Analyzer**: Leverage AWS Access Analyzer to report on external access to SQS Queues. See [the AWS Access Analyzer documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html) for more details.
4854
* **Restrict access to IAM permissions that could lead to exposure of your SQS Queues**: Tightly control access to the following IAM actions:
49-
- [sqs:AddPermission](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_AddPermission.html): _Description_
50-
- [sqs:RemovePermission](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_RemovePermission.html): _Description_
55+
- [sqs:AddPermission](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_AddPermission.html): _Adds a permission to a queue for a specific principal._
56+
- [sqs:RemovePermission](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_RemovePermission.html): _Revokes any permissions in the queue policy that matches the specified Label parameter._
5157
- [sqs:GetQueueAttributes](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html): _Gets attributes for the specified queue. This includes retrieving the list of principals who are authorized to access the queue._
5258
- [sqs:GetQueueUrl](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueUrl.html): _Returns the URL of an existing queue._
5359
- [sqs:ListQueues](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueues.html): _Returns a list of your queues._

0 commit comments

Comments
 (0)