AWS PwnLab: Summary of Remaining Techniques

Loot an exposed RDS instance:

1. Scan portp3306,5432,1433,1521

1. blasting

Hijack public RDS snapshots:

Discover public snapshots：

• Using AWS CLI commandsaws rds describe-db-snapshots and aws rds describe-db-cluster-snapshotsFind public RDS snapshots.

• pass -snapshot-type public --include-publicParameters filter out public snapshots.

1. Restore public snapshot：

1. Access the restored database：

1. Obtain sensitive information：

defensive measures

1. Avoid public snapshots：

1. Monitoring and Alerting：

1. Permission management：

Hijack public EBS snapshots

1. Discover public snapshots：

1. Verify the publicity of a snapshot：

1. Create an EC2 instance and mount a public snapshot：

1. Access mounted volumes：

1. Obtain sensitive information：

defensive measures

1. Avoid public snapshots：

1. Monitoring and Alerting：

1. Permission management：

Obtain AWS credentials and obtain S3 data after directory traversal

1. port scan：

1. Website analysis：

1. Directory traversal vulnerability：

1. Get AWS credentials：

1. Access AWS S3 bucket：

aksk leaked in git repository

1. Clone repository：

1. Scan for sensitive information：

1. Get AWS credentials：

1. Access AWS S3 bucket：

1. Get database connection information：

Historical warehouse submissions can scan a lot of information, and even black box source code leaks

Access confidential information with S3 Bucket version control

1. Access target IP：

1. View bucket version：

1. Get old version files：

1. Extract sensitive information：

1. Access sensitive files：

Brute force cracking of S3 buckets

1. Discover S3 bucket：

1. Fuzzing other buckets：

1. Get SSM parameters：

Revealing the secrets in CodeCommit and Docker

Image scanning and credential discovery

• Target: Review Huge Logistics' public code repository for credentials or sensitive information that may have been overlooked.

• tool: use docker scoutTools to analyze Docker images.

• step:

2. Leverage credentials to access AWS resources

• Target: Leverage discovered credentials to access AWS resources for lateral and vertical movement.

• tool: use aws-enumeratorTool enumerates AWS permissions.

• step:

3. Access S3 bucket

• Target: Leverage new AWS credentials to access S3 bucket and obtain sensitive information.

• tool: Access an S3 bucket using the AWS CLI.

• step:

For more details please refer to:Uncover Secrets in CodeCommit and Docker,b | tari Blog

SSRF to Pwned

A brief description of the attack idea

1. Initial information collection

• Target: Assess the security of the Huge Logistics website and investigate potential risks to its cloud infrastructure.

• tool: use whoisTool to view IP information.

• step:

2. Discovering public S3 buckets

• Target: Find and access Huge Logistics' public S3 buckets.

• tool: Use the AWS CLI.

• step:

3. Exploiting SSRF vulnerability to access metadata

• Target: Exploiting a Server Side Request Forgery (SSRF) vulnerability to access AWS metadata.

• tool: Modify website request parameters.

• step:

4. Obtain sensitive information

• Target: Download and view sensitive files in the bucket.

• tool: Use the AWS CLI.

• step: