GITBOOK-645: change request with no subject merged in GitBook

fborsani · Apr 30, 2024 · 124b867 · 124b867
1 parent 5898b2a
commit 124b867
Show file tree

Hide file tree

Showing 4 changed files with 164 additions and 14 deletions.
diff --git a/SUMMARY.md b/SUMMARY.md
@@ -31,7 +31,9 @@
 * [AWS Commands](cloud-aws/aws-commands.md)
 * [Enumeration](cloud-aws/enumeration.md)
 * [Public S3 Bucket Exploits](cloud-aws/public-s3-bucket-exploits.md)
-* [EC2](cloud-aws/ec2.md)
+* [EC2](cloud-aws/ec2/README.md)
+  * [cloud-init Exploits](cloud-aws/ec2/cloud-init-exploits.md)
+  * [Unencrypted EBS](cloud-aws/ec2/unencrypted-ebs.md)
 
 ## Networking
 

diff --git a/cloud-aws/ec2.md → cloud-aws/ec2/README.md b/cloud-aws/ec2.md → cloud-aws/ec2/README.md
@@ -1,7 +1,5 @@
 # EC2
 
-
-
 ## Connect to instance
 
 ### Direct SSH or RDP
@@ -46,36 +44,104 @@ This method of authentication allows a user to authenticate on the EC2 instance
 
 ## IMDS
 
-### Get instance information
+### IMDS vs IMDSv2
+
+#### Authentication
+
+While in IMDS it is possible to send a request without authentication, IMDSv2 requires to perform an authentication step and obtain a taken before sending API requests.
 
-Get current role
+This code will request a token and store it into a variable. The TTL header can be set to any value in seconds.
 
+```bash
+IMDS_TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
 ```
-curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ 
+
+#### Enable IMDSv2
+
+Enable IMDv2 for current instance
+
+```
+aws ec2 modify-instance-metadata-options --instance-id <instance id> --http-tokens required --region <region>
 ```
 
-Get instance ID
+One line command with required calls included
 
 ```
-curl -s http://169.254.169.254/latest/meta-data/instance-id
+aws ec2 modify-instance-metadata-options --instance-id $(curl -s http://169.254.169.254/latest/meta-data/instance-id) --http-tokens required --region $(curl -s http://169.254.169.254/latest/meta-data/placement/region)
 ```
 
-Get instance region
+### Get instance information
+
+#### Get current role
 
+{% tabs %}
+{% tab title="IMDS" %}
+```bash
+curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ 
 ```
+{% endtab %}
+
+{% tab title="IMDSv2" %}
+```bash
+curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/ 
+```
+{% endtab %}
+{% endtabs %}
+
+#### Get instance ID
+
+{% tabs %}
+{% tab title="IMDS" %}
+```bash
+curl -s http://169.254.169.254/latest/meta-data/instance-id
+```
+{% endtab %}
+
+{% tab title="IMDSv2" %}
+```bash
+curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/instance-id
+```
+{% endtab %}
+{% endtabs %}
+
+#### Get instance region
+
+{% tabs %}
+{% tab title="IMDS" %}
+```bash
 curl -s http://169.254.169.254/latest/meta-data/placement/region
 ```
+{% endtab %}
 
-### Enable IMDSv2
+{% tab title="IMDSv2" %}
+```bash
+curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/placement/region
+```
+{% endtab %}
+{% endtabs %}
 
-Enable IMDv2 for current instance
+#### Get instance Availability Zone
 
+{% tabs %}
+{% tab title="IMDS" %}
+```bash
+curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone
 ```
-aws ec2 modify-instance-metadata-options --instance-id <instance id> --http-tokens required --region <region>
+{% endtab %}
+
+{% tab title="IMDSv2" %}
+```bash
+curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/placement/availability-zone
 ```
+{% endtab %}
+{% endtabs %}
 
-One line command with required calls included
+## Cloudshell Enumeration
+
+Network information. Can be filtered by instance id or by entry index
 
 ```
-aws ec2 modify-instance-metadata-options --instance-id $(curl -s http://169.254.169.254/latest/meta-data/instance-id) --http-tokens required --region $(curl -s http://169.254.169.254/latest/meta-data/placement/region)
+aws ec2 describe-network-interfaces    #display all
+aws ec2 describe-network-interfaces --filters "Name=attachment.instance-id,Values=<instance id>"
+aws ec2 describe-network-interfaces | jq '.NetworkInterfaces[0]'
 ```
diff --git a/cloud-aws/ec2/cloud-init-exploits.md b/cloud-aws/ec2/cloud-init-exploits.md
@@ -0,0 +1,39 @@
+# cloud-init Exploits
+
+## UserData section exploits
+
+### Enumeration
+
+#### On current EC2 instance
+
+Read the following file. Requires sudo or root privileges
+
+```
+sudo cat /var/lib/cloud/instance/scripts/part-001
+```
+
+Query IMDS
+
+```
+IMDS_TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+ec2_instance_id=$( curl -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" -s http://169.254.169.254/latest/meta-data/instance-id )
+ec2_region=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/placement/region)
+aws ec2 describe-instance-attribute --attribute userData --instance-id $ec2_instance_id--region $ec2_region --query UserData --output text  | base64 -d
+```
+
+#### Cloudshell
+
+```
+aws ec2 describe-instance-attribute --attribute userData --instance-id <instance id> --region <region> --query UserData --output text
+```
+
+### Sensitive data
+
+pass
+
+### Code Execution Persistence
+
+pass
+
+
+
diff --git a/cloud-aws/ec2/unencrypted-ebs.md b/cloud-aws/ec2/unencrypted-ebs.md
@@ -0,0 +1,43 @@
+# Unencrypted EBS
+
+## Cloudshell snapshot enumeration
+
+```
+aws ec2 describe-snapshots    #All
+aws ec2 describe-snapshots --snapshot-ids <id>    #by snap id
+aws ec2 describe-snapshots --filters "Name=volume-id,Values=<volume id>" #by volume id
+```
+
+Find unencrypted snapshots
+
+```
+aws ec2 describe-snapshots --filters "Name=encrypted,Values=false"
+```
+
+## Mount EBS in instance and access data
+
+To access the snapshot we need to mount it in a controlled EC2 instance. After logging in execute the following steps.
+
+Enumerate the current EC2 instance id, region and availability zone. See[ IMDS section](./#imds) for documentation.
+
+Create a new volume from the target EBS. Save the volume id because we'll need it in the next step
+
+```
+aws ec2 create-volume --snapshot-id <target snapshot id> --volume-type gp3 --region <ec2 region> --availability-zone <ec2 az id>
+```
+
+Attach the volume to the EC2 instance
+
+```
+aws ec2 attach-volume --region us-east-1 --device /dev/sdh --instance-id <instance id> --volume-id <created volume id>
+```
+
+Verify that the volume has been mounted successfully and create a mount point. Even if the command succeeds it takes a while to attach the volume to the instance. If you don't see the new disk wait a couple of minutes
+
+```
+sudo fdisk -l    #we expect to see a new disk
+
+sudo mkdir /snapshot-recovery
+sudo mount /dev/nvme1n1 /snapshot-recovery
+cd /snapshot-recovery
+```