Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes •

xebia.com
Michał Brygidyn
AWS Ambassador
AWS Community Builder
Cloud Hacking Scenarios
ContainerDay Security 2023
Hamburg – 8.03.2023

xebia.com
Source code
1. Just view the source code J
– Comments
– JavaScript
Step 1
HTML

xebia.com
Source code
1. Just view the source code J
– Comments
– JavaScript
Step 1
AWS
─ Administrator Access
J
Step 2
HTML – AWS

xebia.com
What went wrong?
Code, build, forget, repeat…
Sensitive data left in code
─ “for the next team to let them know how it works”
─ “because that’s how I use variables in my JavaScript”

xebia.com
Public GitHub repo
1. Config file with
encrypted variables
2. Java class with a
decrypt function
and.. a secret key
Step 1
GitHub

xebia.com
Public GitHub repo
1. Config file with
encrypted variables
decrypt function
and.. a secret key
Office365
1. Teams:
─ “Hello CxO J”
2. SharePoint:
─ PDF with a Jira
configuration guide…
─ … including login and
password
Step 1 Step 2
GitHub – Office 365

xebia.com
Public GitHub repo
1. Config file with
encrypted variables
decrypt function
and.. a secret key
Office365
1. Teams:
2. SharePoint:
─ PDF with a Jira
password
Jira
Project “AWS”:
─ Task to create IAM
User for an external
service
─ Plaintext AWS Access
and Secret keys in
comments
Step 1 Step 2 Step 3
GitHub – Office 365 – Jira

xebia.com
Public GitHub repo
1. Config file with
encrypted variables
decrypt function
and.. a secret key
Office365
1. Teams:
2. SharePoint:
─ PDF with a Jira
password
Jira
Project “AWS”:
─ Task to create IAM
User for an external
service
─ Plaintext AWS Access
and Secret keys in
comments
AWS
J
Step 1 Step 2 Step 3 Step 4
GitHub – Office 365 – Jira – AWS

xebia.com
─ Config files
─ Encryption keys
─ Git history
Hardcoded
sensitive data
─ To many viewers
─ Valid credentials in
documentation
─ Using own personal/business
account in scripts
Lack of security
awareness
─ Public repository
─ Risky credentials sharing
Bad tools
selection
What went wrong?

xebia.com
Symfony Profiler
A publicly available
development tool:
─ Plaintext credentials
in Server Parameters
in Requests history
─ parameters.yml
preview
Step 1
Symfony Profiler

xebia.com
Symfony Profiler
development tool:
in Requests history
─ parameters.yml
preview
Internal app
1. Admin credentials:
─ Dev Environment
─ Prod Environment
2. SSO to multiple apps:
─ Production CRM
─ Webmail
Step 1 Step 2
Symfony Profiler – Internal Apps

xebia.com
Symfony Profiler
development tool:
in Requests history
─ parameters.yml
preview
Internal app
─ Dev Environment
─ Production CRM
─ Webmail
Webmail
1. AWS Invoices &
Trusted Advisor emails
2. Reset password for
AWS Root account
Symfony Profiler – Internal Apps

xebia.com
Symfony Profiler
development tool:
in Requests history
─ parameters.yml
preview
Internal app
─ Dev Environment
─ Production CRM
─ Webmail
Webmail
1. AWS Invoices &
Trusted Advisor emails
2. Reset password for
AWS Root account
AWS Root Account
─ No MFA
─ Organization
Management Account
on all member
accounts
J
Symfony Profiler – Internal Apps – AWS

xebia.com
─ Prod database on a non-prod
─ Same credentials across
multiple environments
─ A single cloud subscription
for all envs / apps / clients
Prod data on a
non-prod env
─ Not enforced
─ Shared credentials
No MFA
─ “All for one, and one for all”
─ Shared account/password
─ Very old passwords
Critical services using the
same shared email
What went wrong?

xebia.com
Kubernetes API
A publicly exposed
Kubernetes API with
disabled RBAC:
─ Base64 Secrets
─ Plaintext ConfigMaps
─ Pods list and
configuration
Step 1
Kubernetes

xebia.com
Kubernetes API
A publicly exposed
Kubernetes API with
disabled RBAC:
─ Base64 Secrets
─ Pods list and
configuration
K8s Secrets
1. AWS Access Keys:
─ S3 access only
2. Jenkins admin
credentials
Step 1 Step 2
Kubernetes

xebia.com
Kubernetes API
A publicly exposed
Kubernetes API with
disabled RBAC:
─ Base64 Secrets
─ Pods list and
configuration
K8s Secrets
1. AWS Access Keys:
─ S3 access only
2. Jenkins admin
credentials
Jenkins app
1. AWS Access Keys in
different Workspaces:
─ SQS access
─ Lambda access
2. GitHub credentials in
Jenkins Credentials
3. AWS CLI calls in jobs
console logs
Kubernetes – Jenkins

xebia.com
Kubernetes API
A publicly exposed
Kubernetes API with
disabled RBAC:
─ Base64 Secrets
─ Pods list and
configuration
K8s Secrets
1. AWS Access Keys:
─ S3 access only
2. Jenkins admin
credentials
Jenkins app
1. AWS Access Keys in
different Workspaces:
─ SQS access
─ Lambda access
2. GitHub credentials in
Jenkins Credentials
3. AWS CLI calls in jobs
console logs
Kubectl exec
Bash on Jenkins pod:
─ AWS IAM Role with
Administrator Access
J
Kubernetes – Jenkins – AWS

xebia.com
─ Lack of knowledge
─ Limited scope of
penetration testing
─ Risky design
Public resources
─ Admin access for all!
─ Unprotected CICD tools
─ Running apps as Root
Principle of
Least Privilege
─ No RBAC
─ Unencrypted data
─ No firewall
Disabled
security features
What went wrong?

xebia.com
And more…
Slides still not ready J

xebia.com
– Outdated software running on cloud servers (open proxy)
Other ways “in”

xebia.com
– Admin credentials logged during the installation
Other ways “in”

xebia.com
– Misconfigured vhosts → Directory indexing
Other ways “in”

xebia.com
– Misconfigured vhosts → Directory indexing
– Debug pages and connection strings (Python Django)
Other ways “in”

xebia.com
AWS Backdoors
A small teaser of my next presentation

xebia.com
- Create a public EC2
with IAM Role
- Add a local user to
any running public
EC2
Group 1:
EC2
AWS Backdoors – Ideas

xebia.com
with IAM Role
any running public
EC2
- Create a new
IAM User
- Create an additional
access/secret key
for any existing
IAM User
Group 1:
EC2
Group 2:
IAM User

xebia.com
with IAM Role
any running public
EC2
- Create a new
IAM User
access/secret key
for any existing
IAM User
- Trust relation with
an external account
- Create new policy
version
- Replace a role for
any service
Group 1:
EC2
Group 2:
IAM User
Group 3:
IAM Role

xebia.com
with IAM Role
any running public
EC2
- Create a new
IAM User
access/secret key
for any existing
IAM User
- Trust relation with
an external account
- Create new policy
version
- Replace a role for
any service
- Change / Remove
Security Group
rule(s)
- VPC Peering with a
rogue external VPC
- Transit gateway
attachment
Group 1:
EC2
Group 2:
IAM User
Group 3:
IAM Role
Group 4:
Network access

xebia.com
― Lambda + CloudWatch / API Gateway / direct link
― Step Functions
― CodeBuild
― PowerUser + IAMFull instead of
AdministratorAccess
― Same context (EC2 keys used on the EC2 only)
AWS Backdoors – Survival
Self-Healing Detection prevention

xebia.com
Thank you!
michal.brygidyn@xebia.com
LinkedIn.com /in/michalbrygidyn/

Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes •

Recommended

Recommended

More Related Content

Similar to Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes •

Similar to Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes • (20)

More from ContainerDay Security 2023

More from ContainerDay Security 2023 (11)

Recently uploaded

Recently uploaded (20)

Cloud Hacking Scenarios by Michał Brygidyn Mar. 10, 2023 • 0 likes •