1.4 KiB
1.4 KiB
- Virtual Private Cloud (VPC)
- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
- Example:
curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.htmlwill automatically route straight to S3 through Amazon's internal network, rather than going through the public internet. - This allows organizations to close access to the internet for instances while still retaining access to AWS services.
- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
- Can also be used as a C2 channel
- Evading CloudWatch
- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>
- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
- Quickly grep Linux files looking for:
- AWS keys
grep -R "AKIA" -4 *
- S3 drivers used in Spark
egrep -R "s3[a|n]://" *
- AWS keys
- Dangerous permissions
PassRole- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover.