AWS

AWS account information enumeration

AWS CLI access

The AWS Command Line Interface (AWS CLI) can be used to access AWS resources through a command line utility. To setup the AWS CLI environment, notably the configuration of credentials, the aws configure command may be used.

The aws configure will ask for the following information, that will be stored (in clear-text) in the config and credentials files (by default in a .aws folder in the current's user home directory):

  • Access key ID

  • Secret access key

  • AWS default region

  • Output format

To create a Access key ID and secret access key, refer to the AWS official documentation.

Manual enumeration with AWS CLI

The following commands can be used to retrieve basic information about the AWS account:

# Retrieves information about the IAM entity usage (number of users, groups, roles, etc.).
aws iam get-credential-report

# Lists the IAM users, with their creation date and password last used timestamp.
aws iam list-users

# Lists the users'access keys, with their status and creation date.
aws iam list-access-keys

# Lists the IAM groups (collection of IAM users that can be associated with specific permissions).
aws iam list-groups

# Retrieves the groups associated with a given user.
aws iam list-groups-for-user --user-name "<USERNAME>"

# Lists the IAM roles (an IAM identity that can be associated with specific permissions. An IAM role can be assumed can users allowed to do so).
aws iam list-roles

# Lists all the IAM policies (an IAM policy grants IAM identities - users, groups, or roles - to resources. Permissions in the policies determine whether an IAM principal (user or role) request is allowed or denied.)
aws iam list-policies

# Lists all the IAM policy names and ARN.
aws iam list-policies --query 'Policies[*].[PolicyName, Arn]' --output text

# Lists the metadata of the specified IAM policy.
aws iam list-policies --query 'Policies[?PolicyName==`<POLICY_NAME>`]'

# Retrieves the IAM policies associated with the specified user / group / role.
# Inline IAM policies embedded in the specified IAM user.
aws iam list-user-policies --user-name "<USERNAME>"
# IAM policies attached to the specified IAM user.
aws iam list-group-policies --group-name "<GROUPNAME>"
aws iam list-role-policies --role-name "<ROLENAME>"

# Lists all the IAM users, groups, and roles that the specified policy is attached to.
# Example policy ARN: arn:aws:iam::aws:policy/service-role/AWSApplicationMigrationReplicationServerPolicy
aws iam list-entities-for-policy --policy-arn "<POLICY_ARN>"

# Lists the version associated with an IAM policy.
aws iam list-policy-versions --policy-arn "<POLICY_ARN>"

# Retrieves the permissions associated with an IAM policy (and policy version).
aws iam get-policy-version --policy-arn "<POLICY_ARN>" --version-id "<v1 | POLICY_VERSION_ID>"

# Lists the S3 buckets in the account.
aws s3 ls

# Retrieves more detailed (compared to s3 ls) information on a bucket (and bucket files).
aws s3api list-objects --bucket <BUCKET_NAME>

# Download / upload files from / to a S3 bucket.
# Source / destination for s3://<BUCKET> or local path.
aws s3 cp [--recursive] <SOURCE> <DEST>

Automated enumeration with ScoutSuite

Scout Suite leverage the API provided by AWS (as well as other possible Cloud providers) to automatically enumerate the configuration of the account. It can be used to quickly gather information on the attack surface of the AWS account across all regions.

python3 scout.py aws [--access-key-id <ACCESS_KEY_ID>] [--secret-access-key <ACCESS_KEY_SECRET>]

AWS logs overview

A number of log sources are available in AWS that can be useful for incident response purposes:

AWS logs collection

Multi-regions CloudTrail logs export

The awsCloudTrailDownload.py Python script can be used to download the CloudTrail logs across all regions.

python awsCloudTrailDownload.py

Automated logs export with Invictus-AWS

The Invictus-AWS Python script can be used to retrieve information about the environment (service usage and configuration) and export logs from a number of sources (CloudTrail, CloudWatch, S3 Access Logs, ...) to an S3 bucket. Invictus-AWS is region bound.

# Configures the required API access.
aws configure

# Exports the configuration and logs from the specified region (such as "us-east-1").
python3 invictus-aws.py --region=<REGION>

# Downlaods locally the exported / collected elements from invictus-aws.py.
aws s3 cp --recursive s3://<INVICTUS_BUCKET> <EXPORT_FOLDER>

CloudWatch logs export with awslogs

The awslogs utility can be used to access and filter the AWS CloudWatch logs. awslogs requires the permissions associated with the CloudWatchLogsReadOnlylAccess policy.

awslogs <get | groups | streams> [--aws-region "<AWS_REGION>"] [--aws-access-key-id "<ACCESS_KEY_ID>"] [--aws-secret-access-key "<ACCESS_KEY_SECRET>"]

# Lists the existing logs groups.
awslogs groups

# Lists the streams in the specified log group.
awslogs streams <LOG_GROUP>

# Retrieves the logs in all or the specified log group / stream.
# The start / end filtering support multiple filtering options: DD/MM/YYYY HH:mm, <INT><m | h | d | w>.
awslogs get <ALL | LOG_GROUP> <ALL | LOG_GROUP_STREAM> -s <START> -e <END>

CloudTrail logs analysis

CloudTrail key fields

CloudTrail notable API / events

CloudTrail logs manual analysis with jq

The jq utility supports querying JSON formatted data and can be used to select and filter events from CloudTrail exported logs.

The following queries illustrate how jq can be used to select, order, and filter events from CloudTrail JSON logs:

# The following queries assume that the exported events are placed in a top-level "Records" field.

# Select the specified fields (eventTime, eventName, awsRegion, sourceIPAddress, and userIdentity).
jq '.Records[] | {eventTime, eventName, awsRegion, sourceIPAddress, userIdentity}' <JSON_FILE | *>

# Sorts events by their timestamp.
jq '.Records | sort_by(.eventTime)[]' <JSON_FILE | *>

# Select events between two timestamps.
jq ".Records | sort_by(.eventTime)[] | select(.eventTime | . == null or (fromdateiso8601 > $(TZ=UTC date -d"YYYY-MM-DDTHH:MM" +%s) and fromdateiso8601 < $(TZ=UTC date -d"YYYY-MM-DDTHH:MM" +%s)))" <JSON_FILE | *>

# Select the event that modified the account state.
jq '.Records[] | select(.readOnly == false)' <JSON_FILE | *>

# Select the specified event linked to the specified source IP address.
jq '.Records[] | select(.sourceIPAddress == <IP>)' <JSON_FILE | *>

# Select the events that contains the "Get" or "List" keyword.
jq '.Records[] | select(.eventName | match("Get|List"))'

# Select the events conducted by a given principal.
jq '.Records | sort_by(.eventTime)[] | select(.userIdentity.principalId | match("<USERNAME>")?)' *

# Count the occurrence by source IP address in a collection of CloudTrail export files.
echo 'def counter(stream):
  reduce stream as $s ({}; .[$s|tostring] += 1);

counter(.Records[].sourceIPAddress)
| to_entries[]
| {sourceIPAddress: (.key), Count: .value, file: input_filename}' > ip_count.jq
jq -f ip_count.jq *

References

https://www.youtube.com/watch?v=VLIFasM8VbY

https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/logging-and-events.html

https://www.chrisfarris.com/post/aws-ir/

https://www.datadoghq.com/blog/monitoring-cloudtrail-logs/

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html

https://www.wiz.io/blog/hunting-for-signs-of-persistence-in-the-cloud-an-ir-guide

https://docs.datadoghq.com/fr/security/default_rules/#cat-cloud-siem-log-detection

https://docs.sekoia.io/xdr/features/collect/integrations/cloud_and_saas/aws/aws_cloudtrail/

https://docs.aws.amazon.com/fr_fr/lambda/latest/dg/logging-using-cloudtrail.html

https://easttimor.github.io/aws-incident-response/

https://stackoverflow.com/questions/61257189/ec2-instance-connect-and-iam-public-keys

https://docs.datadoghq.com/fr/security/default_rules/aws-bucket-acl-made-public/

https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting/aws-privilege-escalation/aws-iam-privesc

https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/

https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a

Last updated