AWS: Leveraging Leaked Credentials for Pwnage

Question to know the project‣There is a leak of .env file, which contains aksk and database keys.

With this information:

We can have a way

1.aws sts get-caller-identity gets the account id

2. Check to see if the database credentials referencing the user are also valid AWS IAM credentials

Running the following command returns account ID 427648302155.

aws sts get-access-key-info --access-key-id AKIAWHEOTHRFVXYV44WP

The login URL for the IAM users in this account will behttps://427648302155.signin.aws.amazon.com/console。

Attempt to log in as IAM user with password successful! Below we see . AWS Secrets Manager is a secret management service that helps secure access to applications, services, and other resources. The service allows easy rotation, management, and retrieval of database credentials, API keys, and other keys throughout their lifecycle.joseDevOps0001!Recently visitedSecrets Manager

Clicking on the service we see two secrets related to the employee database. We are denied access to admin secret, let's check another one. We got all the details needed to connect to the RDS database.

Running the following command in the terminal gives us access.

mysql -h employees.cwqkzlyzmm5z.us-east-1.rds.amazonaws.com -P 3306 -D employees -u reports -p

When executed, we see the following output.show databases;

Issuing then returns the list of tables below.use employeesshow tables;

Once run, we retrieve employee data including their full name, email address, phone number, and salary. The dependents table also lists the people who are dependent on them, which is very sensitive information.select * from employees;