first commit

Necronomicon/Cloud/AWS/Tips and Tricks.md

@@ -0,0 +1,18 @@
+- Virtual Private Cloud (VPC)
+	- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
+	- Example: `curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.html` will automatically route straight to S3 through Amazon's internal network, rather than going through the public internet.
+	- This allows organizations to close access to the internet for instances while still retaining access to AWS services.
+	- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
+	- Can also be used as a C2 channel
+- Evading CloudWatch
+	- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
+		- `aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>`
+	- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
+- Quickly grep Linux files looking for:
+	- AWS keys
+		- `grep -R "AKIA" -4 *`
+	- S3 drivers used in Spark
+		- `egrep -R "s3[a|n]://" *`
+- Dangerous permissions
+	- `PassRole` 
+		- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover.