TerraformGoat Training

Alibaba Cloud

Interesting content can be added

Alibaba Cloud OSS Bucket HTTP transmission startup scenario:

provider "alicloud" {
  profile = "default"
  region  = "cn-beijing"
}

resource "alicloud_oss_bucket" "huoxian_terraformgoat_bucket" {
force_destroy = true
bucket = "huoxian-terraformgoat-bucket-${random_string.random_suffix.result}"
policy = <<POLICY
{
"Version": "1",
"Statement": [{
"Effect": "Allow",
"Action": [
""
],
"Principal": [
""
],
"Resource": [
"acs:oss:::*"
],
"Condition": {
"Bool": {
"acs:SecureTransport": [
"false"
]
}
}
}]
}
POLICY
}

resource "random_string" "random_suffix" {
length = 5
special = false
upper = false

• Insecure transmission：Strategy condition requirementsacs:SecureTransport for false, which means that the request cannot use HTTPS and must use HTTP.

Bucket special policy scenarios:

provider "alicloud" {
  profile = "default"
  region  = "cn-beijing"
}

resource "alicloud_oss_bucket" "Create_Bucket" {
bucket = "hx-cloud-security-${random_string.random_suffix.result}"
acl = "public-read-write"
force_destroy = true
policy = <<POLICY
{
"Version": "1",
"Statement": [{
"Effect": "Allow",
"Action": [
"oss:GetObject",
"oss:GetObjectAcl",
"oss:ListObjects",
"oss:RestoreObject",
"oss:GetVodPlaylist",
"oss:ListObjectVersions",
"oss:GetObjectVersion",
"oss:GetObjectVersionAcl",
"oss:RestoreObjectVersion"
],
"Principal": [
""
],
"Resource": [
"acs:oss:::/"
],
"Condition": {
"StringEquals": {
"acs:UserAgent": [
"test"
]
}
}
}, {
"Effect": "Allow",
"Action": [
"oss:ListObjects",
"oss:GetObject"
],
"Principal": [
""
],
"Resource": [
"acs:oss:::*"
],
"Condition": {
"StringEquals": {
"acs:UserAgent": [
"HxSecurityLab"
]
}
}
}]
}
POLICY
}

resource "random_string" "random_suffix" {
length = 5
special = false
upper = false
}

1. ACL permissions: The bucket's access control list (ACL) is set topublic-read-write, which means anyone can read and write objects in the bucket.

1. Strategy conditions: Two conditions are defined in the strategy, respectively based onacs:UserAgentField:

Alibaba Cloud OSS Bucket server-side encryption without KMS scenario

provider "alicloud" {
  profile = "default"
  region  = "cn-beijing"
}

resource "alicloud_oss_bucket" "huoxian_terraformgoat_bucket" {
acl = "private"
force_destroy = true
bucket = "huoxian-terraformgoat-bucket-${random_string.random_suffix.result}"

server_side_encryption_rule {
sse_algorithm = "AES256"
}
}

resource "random_string" "random_suffix" {
length = 5
special = false
upper = false
}

Generally used for private algorithms and reverse engineering after detection

Alibaba Cloud OSS Bucket server-side KMS encryption does not use BYOK

provider "alicloud" {
  profile = "default"
  region  = "cn-beijing"
}

resource "alicloud_oss_bucket" "huoxian_terraformgoat_bucket" {
acl = "private"
force_destroy = true
bucket = "huoxian-terraformgoat-bucket-${random_string.random_suffix.result}"

server_side_encryption_rule {
sse_algorithm = "KMS"
}
}

resource "random_string" "random_suffix" {
length = 5
special = false
upper = false
}

server_side_encryption_rule {
sse_algorithm = "KMS"
}

• No private key is specified. Use the key managed by Alibaba Cloud. If Alibaba Cloud's key management system is attacked, the bucket will be affected.

• Certain compliance requirements (such as financial, medical, etc. industries) may require the use of BYOK

Alibaba Cloud ECS SSRF vulnerability environment

resource "alicloud_instance" "instance" {
  security_groups            = alicloud_security_group.group.*.id
  instance_type              = data.alicloud_instance_types.types_ds.instance_types.0.id
  image_id                   = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
  instance_name              = "huocorp_terraform_goat_instance"
  vswitch_id                 = alicloud_vswitch.vswitch.id
  system_disk_size           = 20
  internet_max_bandwidth_out = 100
  user_data                  = <<EOF
#!/bin/bash
sudo apt-get -y update
sudo apt-get -y install apache2
sudo apt-get -y install php
sudo apt-get -y install php-curl
sudo sed -i 's/Listen 80/Listen 8080/' /etc/apache2/ports.conf
sudo /etc/init.d/apache2 restart
cd /var/www/html
sudo apt-get -y install wget
sudo wget https://huocorp-oss.oss-cn-beijing.aliyuncs.com/terraform-goat-dependency-files/ssrf-lab.zip
sudo apt-get -y install unzip
sudo unzip ssrf-lab.zip
sudo mv ./ssrf-lab/static/flag69152201.txt /
EOF
  depends_on = [
    alicloud_security_group.group,
    alicloud_vswitch.vswitch,
  ]
}

resource "alicloud_security_group" "group" {
name = "huocorp_terraform_goat_security_group"
vpc_id = alicloud_vpc.vpc.id
depends_on = [
alicloud_vpc.vpc
]
}

resource "alicloud_security_group_rule" "allow_all_tcp" {
type = "ingress"
ip_protocol = "tcp"
nic_type = "intranet"
policy = "accept"
port_range = "8080/8080"
priority = 1
security_group_id = alicloud_security_group.group.id
cidr_ip = "0.0.0.0/0"
depends_on = [
alicloud_security_group.group
]
}

resource "alicloud_vpc" "vpc" {
vpc_name = "huocorp_terraform_goat_vpc"
cidr_block = "172.16.0.0/16"
}

resource "alicloud_vswitch" "vswitch" {
vpc_id = alicloud_vpc.vpc.id
cidr_block = "172.16.0.0/24"
zone_id = "cn-beijing-h"
vswitch_name = "huocorp_terraform_goat_vswitch"
depends_on = [
alicloud_vpc.vpc
]
}

resource "alicloud_ram_role" "role" {
name = "huocorp-terraform-goat-role"
force = true
document = <<EOF
{
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": [
"ecs.aliyuncs.com"
]
}
}
],
"Version": "1"
}
EOF
}

resource "alicloud_ram_policy" "policy" {
policy_name = "AdministratorAccess"
force = true
policy_document = <<EOF
{
"Statement": [
{
"Action": "",
"Effect": "Allow",
"Resource": ""
}
],
"Version": "1"
}
EOF
}

resource "alicloud_ram_role_attachment" "attach" {
role_name = alicloud_ram_role.role.name
instance_ids = alicloud_instance.instance.*.id
depends_on = [
alicloud_instance.instance
]
}

resource "alicloud_ram_role_policy_attachment" "attach" {
policy_name = alicloud_ram_policy.policy.name
policy_type = alicloud_ram_policy.policy.type
role_name = alicloud_ram_role.role.name
depends_on = [
alicloud_ram_policy.policy,
alicloud_ram_role.role
]
}

data "alicloud_instance_types" "types_ds" {
cpu_core_count = 1
memory_size = 1
}


Conveniently build a security verification platform

Alibaba Cloud ECS virtual machine disk encryption is not enabled

It is also a post-utilization, which facilitates the establishment of a secure verification platform.

The attack scenarios for other clouds are similar. Here are some special ones:
awsDelete feature without MFA scenario enabled

AWS EBS volume not in use

Amazon Elastic Block Store (EBS) is a high-performance block storage service designed for use with Amazon EC2 instances. EBS volumes can serve as primary storage devices (such as operating system disks) or additional storage devices (such as data disks) for EC2 instances.

What is an EBS volume?

EBS volumes are persistent block-level storage devices that can be attached to EC2 instances. Each EBS volume is automatically replicated within an Availability Zone to protect against hardware failures and provide high availability and durability. Key features of EBS volumes include:

• persistence: Even if the EC2 instance is terminated, the data in the EBS volume still exists.

• flexibility: Can be expanded or contracted as needed.

• high performance: Offers different performance options such as General Purpose (GP2/GP3), Provisioned IOPS (IO1/IO2), Throughput Optimized (ST1), and Cold HDD (SC1).

What are unused EBS volumes?

Unused EBS volumes are those that are not attached to any EC2 instances. They may be unused for the following reasons:

• The EC2 instance was terminated, but the EBS volume was not deleted.

• The EBS volume is not deleted after the data migration or backup is completed.

• Forgot to delete after temporary use.

Impact of unused EBS volumes

1. cost：

1. Resource waste and leakage

AWS IAM privilege escalation vulnerability environment

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_user" "huoxian_terraform_user" {
name = "huoxian_terraform_test"
}

resource "aws_iam_access_key" "huoxian_terraform_access_key" {
user = aws_iam_user.huoxian_terraform_user.name
depends_on = [aws_iam_user.huoxian_terraform_user]
}

resource "aws_iam_user_policy" "huoxian_terraform_policy" {
name = "IAMFullAccess"
user = aws_iam_user.huoxian_terraform_user.name
depends_on = [aws_iam_user.huoxian_terraform_user]
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:DescribeOrganizationalUnit",
"organizations:DescribePolicy",
"organizations:ListChildren",
"organizations:ListParents",
"organizations:ListPoliciesForTarget",
"organizations:ListRoots",
"organizations:ListPolicies",
"organizations:ListTargetsForPolicy"
],
"Effect": "Allow",
"Resource": ""
}
]
}
EOF
}

data "template_file" "secret" {
template = aws_iam_access_key.huoxian_terraform_access_key.encrypted_secret
}

Azure VM command execution vulnerability environment

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_user" "huoxian_terraform_user" {
name = "huoxian_terraform_test"
}

resource "aws_iam_access_key" "huoxian_terraform_access_key" {
user = aws_iam_user.huoxian_terraform_user.name
depends_on = [aws_iam_user.huoxian_terraform_user]
}

resource "aws_iam_user_policy" "huoxian_terraform_policy" {
name = "IAMFullAccess"
user = aws_iam_user.huoxian_terraform_user.name
depends_on = [aws_iam_user.huoxian_terraform_user]
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:DescribeOrganizationalUnit",
"organizations:DescribePolicy",
"organizations:ListChildren",
"organizations:ListParents",
"organizations:ListPoliciesForTarget",
"organizations:ListRoots",
"organizations:ListPolicies",
"organizations:ListTargetsForPolicy"
],
"Effect": "Allow",
"Resource": ""
}
]
}
EOF
}

data "template_file" "secret" {
template = aws_iam_access_key.huoxian_terraform_access_key.encrypted_secret
}root@5c2e680829bc:/TerraformGoat/aws/iam/privilege_escalation# \cd /TerraformGoat/azure/vm/vm_command_execution
root@5c2e680829bc:/TerraformGoat/azure/vm/vm_command_execution# cd /TerraformGoat/azure/vm/vm_command_execution
root@5c2e680829bc:/TerraformGoat/azure/vm/vm_command_execution# cat main.tf
provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "terraformgoat" {
name = "huoxian-terraform-goat-resources"
location = "West Europe"
}

resource "azurerm_public_ip" "terraformgoat" {
name = "huoxian-terraform-goat-publicip"
resource_group_name = azurerm_resource_group.terraformgoat.name
location = azurerm_resource_group.terraformgoat.location
allocation_method = "Static"
}

resource "azurerm_network_security_group" "terraformgoat" {
name = "huoxian-terraform-goat-security-group"
location = azurerm_resource_group.terraformgoat.location
resource_group_name = azurerm_resource_group.terraformgoat.name
depends_on = [
azurerm_resource_group.terraformgoat,
]

security_rule {
name = "huoxian-terraform-goat-security-group-rule"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "8080"
destination_port_range = ""
source_address_prefix = ""
destination_address_prefix = "*"
}
}

resource "azurerm_virtual_network" "terraformgoat" {
name = "huoxian-terraform-goat-network"
address_space = ["10.0.0.0/16"]
location = azurerm_resource_group.terraformgoat.location
resource_group_name = azurerm_resource_group.terraformgoat.name
depends_on = [
azurerm_resource_group.terraformgoat,
]
}

resource "azurerm_subnet" "terraformgoat" {
name = "huoxian-terraform-goat-internal"
resource_group_name = azurerm_resource_group.terraformgoat.name
virtual_network_name = azurerm_virtual_network.terraformgoat.name
address_prefixes = ["10.0.2.0/24"]
depends_on = [
azurerm_resource_group.terraformgoat,
azurerm_virtual_network.terraformgoat
]
}

resource "azurerm_network_interface" "terraformgoat" {
name = "huoxian-terraform-goat-nic"
location = azurerm_resource_group.terraformgoat.location
resource_group_name = azurerm_resource_group.terraformgoat.name
depends_on = [
azurerm_resource_group.terraformgoat,
azurerm_public_ip.terraformgoat,
azurerm_subnet.terraformgoat
]

ip_configuration {
name = "huoxian-terraform-goat-internal"
subnet_id = azurerm_subnet.terraformgoat.id
private_ip_address_allocation = "Dynamic"
public_ip_address_id = azurerm_public_ip.terraformgoat.id
}
}

resource "azurerm_linux_virtual_machine" "terraformgoat" {
name = "huoxian-terraform-goat-machine"
resource_group_name = azurerm_resource_group.terraformgoat.name
location = azurerm_resource_group.terraformgoat.location
size = "Standard_B1ls"
admin_username = "huoxian"
admin_password = "HuoXian@${random_string.random_suffix.result}"
disable_password_authentication = false
user_data = "IyEvYmluL2Jhc2gKc3VkbyBhcHQtZ2V0IC15IHVwZGF0ZQpzdWRvIGFwdC1nZXQgLXkgaW5zdGFsbCBhcGFjaGUyCnN1ZG8gYXB0LWdldCAteSBpbnN0YWxsIHBocApzdWRvIGFwdC1nZXQgLXkgaW5zdGFsbCBwaHAtY3VybApzdWRvIHNlZCAtaSAncy9MaXN0ZW4gODAvTGlzdGVuIDgwODAvJyAvZXRjL2FwYWNoZTIvcG9ydHMuY29uZgpzdWRvIC9ldGMvaW5pdC5kL2FwYWNoZTIgcmVzdGFydApjZCAvdmFyL3d3dy9odG1sCnN1ZG8gYXB0LWdldCAteSBpbnN0YWxsIHdnZXQKc3VkbyB3Z2V0IGh0dHBzOi8vaHVvY29ycC1vc3Mub3NzLWNuLWJlaWppbmcuYWxpeXVuY3MuY29tL3RlcnJhZm9ybS1nb2F0LWRlcGVuZGVuY3ktZmlsZXMvY29tbWFuZC1leGVjdXRpb24tbGFiLnppcApzdWRvIGFwdC1nZXQgLXkgaW5zdGFsbCB1bnppcApzdWRvIHVuemlwIGNvbW1hbmQtZXhlY3V0aW9uLWxhYi56aXAKc3VkbyBtdiAuL2NvbW1hbmQtZXhlY3V0aW9uLWxhYi9zdGF0aWMvZmxhZzY5MTUyMjAxLnR4dCAv"
network_interface_ids = [
azurerm_network_interface.terraformgoat.id,
]
depends_on = [
azurerm_resource_group.terraformgoat,
azurerm_network_interface.terraformgoat
]

os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}

source_image_reference {
publisher = "Canonical"
offer = "UbuntuServer"
sku = "18.04-LTS"
version = "latest"
}
}

resource "random_string" "random_suffix" {
length = 6
special = false
upper = false
}

Conveniently create security verification scenarios