Howlsec
HOWLSEC
offensive security
// notes/ Cloud (AWS)
☁️

AWS Cloud Enumeration

External-to-internal AWS recon — S3, IAM, and account enumeration.

#aws#s3#iam#cloud

AWS Cloud Enumeration

AWS

can you quickly explain the most important components of AWS are from the POV of a pentester?

  1. AWS Identity and Access Management (IAM) - This service allows you to manage users and their access to resources within your AWS account. It's important to secure access to your IAM resources, as they control who can access other resources within your AWS account.

  2. Amazon Elastic Compute Cloud (EC2) - EC2 is a core component of AWS, allowing you to launch virtual servers in the cloud. These servers can be used to host websites, applications, and other resources. It's important to secure access to your EC2 instances and ensure that they are properly configured to prevent unauthorized access.

  3. Amazon Simple Storage Service (S3) - S3 is a scalable, high-speed storage service that can be used to store a wide variety of data types. It's important to properly secure access to your S3 buckets and ensure that they are configured with the appropriate access controls.

  4. Amazon Relational Database Service (RDS) - RDS is a managed database service that makes it easy to set up, operate, and scale a relational database in the cloud. It's important to secure access to your RDS databases and ensure that they are properly configured to prevent unauthorized access.

  5. AWS Virtual Private Cloud (VPC) - VPC allows you to create a virtual network in the cloud, where you can launch resources in a logically isolated area. It's important to secure access to your VPC and ensure that it is properly configured to prevent unauthorized access to your resources.

Cheat sheets: https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/AWS.md https://www.youtube.com/watch?v=u_3cV0pzptY&t=881s

As a pentester, you'll likely be interested in the following AWS services:

  1. Elastic Compute Cloud (EC2): Allows users to rent virtual computers on which to run their own computer applications.

  2. Simple Storage Service (S3): Object storage with a simple web service interface.

  3. Identity and Access Management (IAM): Allows you to manage access to AWS services and resources securely.

  4. Virtual Private Cloud (VPC): Virtual networking environment.

  5. Elastic Block Store (EBS): Block storage volumes for use with EC2 instances.

  6. CloudTrail: It helps to monitor the user activity and API usage.

Yes, Kubernetes (often shortened to "K8s") is often used with Amazon Elastic Compute Cloud (EC2).

Yes, it is becoming more common for web applications to be deployed using containers. The 2 most popular contain solutions are dockerer and kubernetes. Docker within kubernetes most common solution

Enumeration

nslookup flaws.cloud

hostname 52.218.228.122

aws s3 ls s3://flaws.cloud --region us-west-2 --no-sign-request

curl flaws.cloud.s3.amazonaws.com | xmllint -format curl flaws.cloud.s3.amazonaws.com | xmllint -format -

mkdir .aws gedit .aws/credentials

If you find credentials, make account and see account properties: aws configure --profile havoc aws --profile havoc sts get-caller-identity

unnamed_0f5ccf7d1d9549da8d61d71938c77aab unnamed_b7700d40124041b880f497b7238a948e

Leaked Credentials

https://github.com/trufflesecurity/trufflehog (truffleHog, finds leaked keys and credentials across github)

S3 Buckets

https://github.com/nahamsec/lazys3 (find s3 buckets)

scanning cloud ranges

https://sansorg.egnyte.com/dl/pudbaSq8aA/CloudScanningforVulnerabilityDiscovery.pdf_

https://www.sans.org/blog/cloud-scanning-vulnerability-discovery/ https://www.youtube.com/watch?v=Izy9APT5e7I### (cloud scanning sans)

Privilege Escalation

https://github.com/salesforce/cloudsplaining (useful for privilege escalation) https://github.com/WithSecureLabs/awspx (graphing like bloodhound, useful for privilege escalation. check effective admin and inbound paths)

Scoping_Client Discussion

  • Are you using multiple AWS accounts for this environment?

  • How many?

  • Are you interested in having them all tested, or just a portion?

  • What kind of access will be provided to the environment?

  • What/how many AWS services are you using?

  • How many regions do your resources span across?

  • How many EC2 instances/Lambda functions are in use?

  • How many IAM users, roles, and groups do you have?

  • How do your users access your environment? (regular IAM users, SSO |

  • AssumeRole, and so on)

  • Is this a red team style engagement where our activity will be actively monitored and defended against by a blue team?

  • Is this just an audit of configuration?

  • Is this a go as far as possible type of engagement without an activate defense against us?

Beyond that, is the client supplying us credentials? If so, credentials for how many users and what information do we get about them? If not, should we be social engineering to gain access?

Other important questions may include the following:

  • Is this a test/development/production environment?
  • Is there anything we should not touch in the environment?
  • Are there other users who are actively using this environment?

Cloud

Learning Resources:

Cloud: https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology https://www.getsecureworld.com/blog/best-tools-for-cloud-penetration-testing/ https://www.getastra.com/blog/security-audit/cloud-penetration-testing/

Learning playlists: https://www.youtube.com/watch?v=ffBcIkjumBc&list=PLfQxJ109X71-Vvnrlp4BIO-v17it_KFSX&index=1 https://youtu.be/fiSJQfiS21c?t=4838 https://www.youtube.com/watch?v=aqumgrSBDM4 https://www.youtube.com/watch?v=lOhvIooWzOg https://m.youtube.com/watch?v=njsNy2bNuT8 https://www.youtube.com/playlist?list=PLaF-mVL3srXy4qhzqfPozYzIs4Rq-oNKI https://www.youtube.com/watch?v=na3xYFzZQ3s&t=251s https://www.youtube.com/watch?v=G9z6HOTV0Hg&t=195s https://www.youtube.com/watch?v=i8lG5HGzMZ8 https://www.youtube.com/watch?v=zap0ov5uTxs&list=PLGsELqvei1dbQO3bBLpsD5MwiBo-U_zxh

Tools: https://github.com/nahamsec/lazys3 (find s3 buckets) https://github.com/trufflesecurity/trufflehog (truffleHog, finds leaked keys and credentials across github) https://github.com/RhinoSecurityLabs/pacu (enum and exploitation framework, think msf) https://github.com/prowler-cloud/prowler (checks for many misconfigurations) https://github.com/salesforce/cloudsplaining (useful for privilege escalation) https://github.com/WithSecureLabs/awspx (graphing like bloodhound, useful for privilege escalation. check effective admin and inbound paths)

Metadata

https://gist.github.com/jhaddix/78cece26c91c6263653f31ba453e273b

This technique is beautiful if you find ssrf on webapp or get shell

OWASP Cloud Top 10

https://owasp.org/www-project-cloud-native-application-security-top-10/

Webapp -_ cloud

unnamed_be06ea1ed4ad48c5bf69548b47094b8f unnamed_ab0aa886e2a1460eae212c83a926360b