18 lines
1.4 KiB
Markdown
18 lines
1.4 KiB
Markdown
- Virtual Private Cloud (VPC)
|
|
- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
|
|
- Example: `curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.html` will automatically route straight to S3 through Amazon's internal network, rather than going through the public internet.
|
|
- This allows organizations to close access to the internet for instances while still retaining access to AWS services.
|
|
- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
|
|
- Can also be used as a C2 channel
|
|
- Evading CloudWatch
|
|
- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
|
|
- `aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>`
|
|
- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
|
|
- Quickly grep Linux files looking for:
|
|
- AWS keys
|
|
- `grep -R "AKIA" -4 *`
|
|
- S3 drivers used in Spark
|
|
- `egrep -R "s3[a|n]://" *`
|
|
- Dangerous permissions
|
|
- `PassRole`
|
|
- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover. |