"Attacking AWS: the full cyber kill chain" - Paweł Rzepa
While it is quite common practice to do periodic security assessments of local network, it is really rare to find a company who puts the same effort for testing the security in their cloud. According to Gartner report: through 2022, at least 95% of cloud security failures will be the customer’s fault. This is why we have to understand what new threats and risks appeared with the cloud and how should we change our attitude to testing cloud security. The goal of my presentation is to show how security assessment of cloud infrastructure is different from testing environments in classic architecture. I'll demonstrate a hypothetical attack on a company which is fully deployed in the AWS environment. I’m going to show whole kill chain starting from presenting cloud-applicable reconnaissance techniques. Then I’ll attack the Jenkins server hosted on EC2 instance to access its metadata and steal the access keys. Using the assigned role, I’ll access another AWS service to escalate privileges to administrator and then present how to hide fingerprints in CloudTrail service. Finally, I’ll demonstrate various techniques of silent exfiltrating data from AWS environment, setting up persistent access and describe other potential, cloud-specific threats, e.g. cryptojacking. The presentation shows practical aspects of attacking cloud services and each step of the kill chain will be presented in a form of live demo. On the examples of presented attacks, I’ll show how to use AWS exploitation framework Pacu and other handy scripts. The form of the demo will be unusual and unique, because it’ll be interactive. All demo videos will be deployed in a cloud and the audience using their mobile phones will decide about each step of the attack.
Recommended
Recommended
More Related Content
Recently uploaded
Recently uploaded (20)
Featured
Featured (20)
"Attacking AWS: the full cyber kill chain" - Paweł Rzepa
- 1. Attacking AWS: the full cyber kill chain Pawel Rzepa
- 2. www.securing.biz #whoami • Senior Security Consultant in - Pentesting - Cloud security assessment • Blog: https://medium.com/@rzepsky • Twitter: @Rzepsky
- 8. www.securing.biz Somewhere in the other end of the Internet...
- 10. Identify the IP owner www.securing.biz Public AWS IP ranges: https://amzn.to/2EbvP0J Or use AWS EC2 reachability test: https://bit.ly/30274Ag
- 11. www.securing.biz
- 13. Demo: https://vimeo.com/334856278 www.securing.biz Ooops… other services are also available!
- 14. What is metadata? • Data about your instance • It's a link-local address, accessible ONLY from your instance! • May include access keys to Instance Profile: www.securing.biz http://169.254.169.254/latest/meta-data/iam/security-credentials/ http://169.254.169.254/latest/meta-data/
- 16. www.securing.biz
- 18. www.securing.biz
- 19. Enumerate permissions www.securing.biz You need the following permissions to display your permissions: iam:ListAttachedUserPolicies iam:GetUserPolicy ...little chances to see them in Instance Profile :/
- 21. Enumerate, enumerate, enumerate! Pacu (Domain Analytics:ec2_pivot) > run ec2__enum (...) Pacu (Domain Analytics:ec2_pivot) > data EC2 (...) VS www.securing.biz
- 22. There's a stopped instance (i-08d6cf0eaf210a552) with instance-profile/admin attached! www.securing.biz What can we find out there?
- 26. www.securing.biz ports 1-65535 from 0.0.0.0/0 SSRF/RCE admin User Data reverse shell getting administrator access webserver_role
- 27. Staying under the hoodStaying under the hood
- 28. CloudTrail by default monitors all regions
- 29. CloudTrail: ways to hide your fingerprints
- 31. Persist access • Bind shell in User Data with backdoor in Security Groups • Lambda backdoor which creates IAM user when specific CloudWatch Event occurs) • Add extra keys to existing user www.securing.biz
- 33. Demo: https://vimeo.com/334856167 www.securing.biz Without monitoring it’s hard to detect a 2nd key pair… even for legit administrator :O
- 34. Let's switch perspective to the blue team www.securing.biz
- 35. Analysing what went wrong • Vulnerable, publicly available web application • "Test" instance with admin permissions (possible privilege escalation) • Missing monitoring services of sensitive actions (e.g. using Instance Profile's keys outside the instance, modifying CloudTrail's settings, creating additional keys etc.) • Improperly configured CloudTrail Service (missing log encryption, missing log replication to the bucket under different AWS account) as well as Security Groups www.securing.biz
- 36. • Are there any extra, undocumented resources? • Is the system architecture free from design flaws? Cloud security assessment: architecture review www.securing.biz
- 37. Cloud security assessment: configuration review • Are all cloud services configured in compliance with best practices? www.securing.biz
- 38. • Are your applications free from vulnerabilities like RCE/SSRF/XXE etc.? • Is the Serverless code secure (e.g. free from "event injections")? Cloud security assessment: pentesting sensitive services www.securing.biz
- 39. • Do you monitor sensitive actions? • Do you have defined incident response procedure? Cloud security assessment: verifying monitoring processes www.securing.biz
- 40. Cloud security assessment in practice • Vulnerable, publicly available web application • "Test" instance with admin permissions (possible privilege escalation) • Missing monitoring services of sensitive actions (e.g. using Instance Profile's keys outside the instance, modifying CloudTrail's settings, creating additional keys etc.) • Improperly configured CloudTrail Service (missing log encryption, missing log replication to the bucket under different AWS account) as well as Security Groups www.securing.biz
- 41. „Through 2022, at least 95% of cloud security failures will be the customer’s fault” www.securing.biz Gartner's report, source: https://www.gartner.com/smarterwithgartner/is-the-cloud-secure/
- 42. CloudGoat: https://bit.ly/2TKxczt CloudGoat walkthrough: https://bit.ly/2u4QYXO Pacu: https://bit.ly/2SYJKyX KrkAnalytica CTF: https://bit.ly/2ZFF9Gh 7-Step Guide to SecuRing your AWS Kingdom: https://bit.ly/2EN7yAs CloudMapper: https://bit.ly/2NV6zSY Prowler: https://bit.ly/2kxy879 www.securing.biz Extras
- 43. If so, contact me on: pawel.rzepa@securing.pl Do you have any questions? Could you give me any feedback?