Control AWS and GCP services with WeirdAAL

Download this presentation
https://tinyurl.com/weirdAAL-cactuscon18

WeirdAAL
(AWS Attack Library)
Chris Gates, Ken Johnson
CactusCon 2018

whoami
Chris Gates - Staff Security Engineer - Cruise Automation
Twitter: @carnal0wnage
Blog: carnal0wnage.attackresearch.com
Talks: slideshare.net/chrisgates

whoami
Ken Johnson - AppSec - GitHub
Twitter: @cktricky
YouTube: https://www.youtube.com/c/absoluteappsec
Talks: slideshare.net/KenJohnson61/

We’ve been talking about this...
LasCon 2014 - DevOops, I did it Again
https://www.youtube.com/watch?v=i8SnLXwlBWM

… and talking...
DevOpsDays DC 2015
https://vimeo.com/137691444

...and talking some more...
DevOops Redux - AppSec USA 2016
https://bit.ly/2qYe29y

… still going...
RSA Conference 2017
https://bit.ly/2HOZ0N4

OKAY, WE GET IT ALREADY! (do you, though?)
DevOops Redux - CERN 2017 &
InsomniaHack 2017
https://cds.cern.ch/record/2256987

So what has happened during this time?
2014 - Code Spaces

… le sigh (horrorshow is right)
2015 - Systema Software

… surely its getting better? Nope
2017 - Deep Root Analytics / America?

This is why we drink
2018 - MBM Company, Tesla

So what did we decide to do about it?

WeirdAAL
● WeirdAAL (AWS Attack Library)
● https://github.com/carnal0wnage/w
eirdAAL
● Python3
● Relies heavily on boto3 library

WeirdAAL
Two Goals:
1. Answer what can I do with this AWS Keypair [blackbox]
2. Be a repository of useful functions (offensive & defensive) to
interact with AWS services.

WeirdAAL
Prior work
1. CG’s aws_interrogate (vaporware)
2. https://github.com/dagrz/aws_pwn & his medium posts
3. https://github.com/bchew/dynamodump
4. https://github.com/ThreatResponse/aws_ir
5. https://github.com/nccgroup/Scout2
6. https://github.com/RhinoSecurityLabs/pacu [post | concurrent]

Setup / Usage / Boto3
● Supports boto3 and aws credentials format
○ Using boto3 allows us to natively support STS tokens
○ Put your creds in .env folder in WeirdAAL home

● Targets
○ Passes a -t (target) value to track your work
○ Can have multiple AWS keys in a target
● Modules
○ Modules passed via -m to do various tasks
○ python3 weirdAAL.py -m dynamodb_list_tables -t demo
○ Coverage for many services but not all (so far)
■ EC2, Lambda, s3, dynamodb, iam, etc
● Built in proxy support via boto3

*New* we now list modules by cloud service

What Can I Do With This AWS Key Pair?
AWS offers no easy way (blackbox)
If you have IAM you can look at running services manually or check billing.
Tedious & No Fun
(135 services in boto3 1.7.4)

Our solution, ask every service if we have permission to use it (recon_all)

Recon_all demo

Recon_all demo (recap)
Hit up every AWS service we can ask a **generic** question to
** required no args or specifics about that account
Log to DB for use later and automation
Todo: Evasion? Timing? Does anyone look or care?

Recon_all demo (gotchas)
● Root keys that have invalid billing info give you:
“SubscriptionRequiredException” or “OptInRequired” boto3 errors
● Root keys that are in good standing give you everything available :-/

In previous talks, we discussed
monitoring. Now we show you
how to burn all that to the
ground.

Starting with SNS…
List topics

List subscribers to a
topic

Or… just delete the
Topic. Now nobody
knows what you’re
doing :-)

Config service has rules.
You’ll see why cloudtrail
is important

We can list the config rules of course (for every region):

But what about deleting rules? Yeah, we’ve got that too :-)

Or just delete the whole recording altogether - BEFORE

Let’s go ahead and just delete Config’s recorder altogether, shall we? First list them...

Now, delete it :-)

Welp, no more Config alerts… or Config at all, really

IAM_Pwn
Found a key with IAM/Root?
Let’s automate the takeover / make
backdoor accounts

IAM_Pwn demo

IAM_Pwn demo - List users

IAM_Pwn demo - User details IAM console

IAM_Pwn demo - delete MFA device

IAM_Pwn demo - change console password

IAM_Pwn demo - create access/secret key

IAM_Pwn demo - delete access/secret key

IAM_Pwn demo - make backdoor account

IAM_Pwn (recap)
Deleted 2FA
Add console user / add new keys
Backdoor admin user
Hack all the thingz

IAM_Pwn (story time)
Made backdoor account in pentest, proved lack of logging and policy
enforcement

Logging / IR

Lambda -
list_functions

Lambda - get_function

Thankfully, lambda serverless arch and KMS means no more creds in code right?

Nope :-)

Lambda
http://boto3.readthedocs.io/en/latest/reference/services/lambda.html#Lambda.Client.update_function_code

It’s cool I have cloudtrail configured….

Stop Cloudtrail logging (ref: https://danielgrzelak.com/disrupting-aws-logging-a42e437d6594)
Identify existing CloudTrail trails

Stop Cloudtrail logging
Use TrailARN to stop CloudTrail with stop_logging function

Delete Cloudtrail Trail
Use TrailARN to stop CloudTrail with delete_trail function

Delete Cloudtrail Trail

EC2 get_console_screenshot

EC2 get_console_output

EC2 get_console_output_all

EC2 & Lucidcharts

Just plain mean…. ec2_stop_instances

Useful Functions & Libs
Grew tired of stackoverflowing
everything
Ideally, grab useful functions and
throw together quick python script
to knock out your task
Uses libs for actions that need more
control/finesse/data passed

Used WeirdAAL at work to get public EC2 instances quickly so we can do
external pentesting
-impossible to know given the large range of AWS IP space

Pydoc friendly (work in progress)

WeirdAAL
(AWS Awesome Attack Library)
Now with GCP :-)

WeirdAAL - GCP
Third Goal:
3. Be a repository of useful functions (offensive & defensive) to
interact with GCP services.

WeirdAAL - GCP
Documentation SUCKS
Take in a service account keyfile (json)
Brute force what services that keyfile has access to use
libs/modules structure is/will be the same
Currently a separate branch while we tidy it up
https://github.com/carnal0wnage/weirdAAL/tree/gcp_testing

WeirdAAL - GCP
Does work though

Contact Info
Chris Gates Slides
Twitter: @carnal0wnage https://tinyurl.com/weirdAAL
Ken Johnson Code:
Twitter: @cktricky https://github.com/carnal0wnage/weirdAAL

Control AWS and GCP services with WeirdAAL

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Control AWS and GCP services with WeirdAAL

Similar to Control AWS and GCP services with WeirdAAL (20)

More from Chris Gates

More from Chris Gates (20)

Recently uploaded

Recently uploaded (20)

Control AWS and GCP services with WeirdAAL