greetings to everyone i am muhammad
al-dub from kuwait and today i'm going
to talk to you about aid by sports
exploitation using the
tool called park so
first of all that's me muhammad al-dub
from kuwait
i'm an independent security consultant
in kuwait i worked on creating kuwait's
national infrastructure for bki
cryptography smart cars authentication
so i've been there you know in the
government kitchen doing nationals size
projects even though national sites for
kuwait is still pretty small then i
delivered security training the
workshops in session in the topics about
cloud security api security application
security
and black hat for example in all around
the world now focusing on that security
of apis and
modern cloud applications
now
to make a long story short
before i uh
i actually start i want to share my
resources so i'd like to share my
resources before i actually start
those two books have been really great
in in learning about aws security and
aws
exploitation and post exploitation so i
do definitely recommend you check out
these two books uh you might
so
okay so as i said
these two books are a great resource for
adlai security i do definitely recommend
you check them out and also this is a
tribute to a great friend of the edward
security community uh spencer gates uh
he passed away uh this year
unfortunately uh spencer did a lot to
the awa security community and did a lot
to me personally in terms of advanced
security research uh answering my
questions uh so uh you will be missed
dearly spencer and spencer is actually
isaac actually was one of the people who
worked on the uh parkour uh eight-based
exploitation tool
so
uh now why should we attack edwards
services because adlis is the cloud the
king of cloud services with the market
share of more than like more than half
of the of the market uh edward services
are documented and whites are bred so
they run the gamut from simple stuff
like s3 buckets to ground satellite
stations all the way to aws infini
infinidash
just kidding about the last one uh so so
many services in aws so you need to be
really aware of uh how big your attack
service is as far as running mls and aws
cloud infrastructure now
uh let's talk about ec2 instances
attacking easter instances is nothing
special so you attack it like you attack
any other like application or server on
the internet so exploit vulnerabilities
in running diamonds like rdb exploits
trying to exploit applications running
on top of it especially web applications
so things like uh os command os command
injection remote like a remote file
includes ssrf
to access internal resources however
these ec2 instances can have some
special properties that make attacking
them a bit more special so for example
the internal metadata service that runs
in in this internal uh private ib inside
each each instance can be accessed using
vulnerabilities like ssrf or lfi or even
remote code execution uh internally the
service can be used to expose aws
credentials for the instance that's
running and the for example the user
data startup scripts
can be downloaded in order to discover
sensitive data so the user data startup
script is a script that you can uh
run
or set to bootstrap any running is to
instance when it starts it runs that
user data script for example updating
stuff uh pulling the latest source code
from from github things like that so
sometimes they have interesting or
sensitive data inside of these
credentials inside of these startup
scripts
the abs volume that's attached to
instance can be for example detached and
reattached to an attacker controlled ec2
instance so an attacker for example
could uh try to uh uh reattach that uh
instance to his uh that actually bs
volume is like a like a cloud uh flash
drive like a cloud hard disk so you can
just reattach it uh or copy it and
attach it to your own instance then you
can just browse around inside and see
what kind of interesting stuff you can
find for example if you're running an
instance
that is running windows active directory
and tracker could use that to copy the
hash files into the s.d.i dit database
that contains all the hashes for those
for that active directory interestingly
for idlis also an uh also a very
interesting opportunity for embezzlement
so for example a rogue admin or maybe a
compromised account could create a very
expensive ami ami is an amazon image and
there are there's like like a
marketplace for images that you can
purchase for example any of the popular
uh software uh uh
tools that you want are also could
potentially be available as an uh
an image in the marketplace so instead
of you buying like a regular license for
a software you actually uh buy a
subscription to use that software inside
aws so advice runs an instance that runs
that license software for you uh so you
pay for adblastic at the cost of running
the
cloud servers and you pay for the
software uh company or the the owner of
that software a license to use that
software so uh
you could for example
create a very expensive am ami image and
put it in the marketplace and then uh
purchase that from accounts that you
compromise uh or maybe a rogue admin
doing that to to build the enterprise
from inside every device itself so as
far as building is concerned this is
coming from the your monthly aws bill
anyway
let's talk about
so park in arabic means lightning you
know cloud and lightning so bark is the
word for in arabic for lightning
the reason i built baroque is to serve
my own needs while doing cloud
penetration testing cloud security
consulting so sometimes in a cloud
engagement you find the aws api keys uh
somewhere for example an ssr
vulnerability you find that you you
social engineer an an admin uh you you
for example find it somewhere in the
source code of an application or web
application at the configuration file
for example so you obtain those api's
keys and they can you be used to attack
other idealized services for example you
can put that if the
api key in the or command line and or
programming languages like for example
the bottle 3 sdk for python anyway
i developed this toolbox to serve a
special a specific need which is that
when you're running an ec2 instance
uh suppose the institutions is all
running and you want to have access
inside
and you don't have the uh
the ssh key that was uh set for that
ec2 instance how can you
uh ssh or maybe have a shell on that
running instance from the aws avi keys
that you have
you can't really have like direct
access to those uh running ec2 servers
if you don't have the ssh key unless you
use the ssm service
which is the uh
session management service inside inside
amazon that server is interesting
because it supposes many apis including
an api that actually allows you to run
commands inside running instances given
of course uh they are running with with
the with a particular set of permissions
so
interestingly that was a very manual
process to do so i built park to
automate that aspect uh so buck is
actually
able to dump aws saved credentials from
aw secrets manager and parameter store
remotely control ec2 instances linux or
windows without having the access to the
ssh key and get a for example get them
exploited reverse shells or regular bash
shells on ec2 instances
dumb metadata of ec2 instances and user
data dump lamp the code and lambda
function environmental variables
and also if you want play with park it
has a training mode
that allows you to test it without
messing with production environment so
that's how it looks like the training
mode is you just go to the to the menu
inside training mode and then you say
start it will create like a a temporary
role for you an instance for you and
once it's done with the training mode it
will destroy all these resources it
created for the training mode so you can
just play with it safely without having
to play with the current running
instances and of course you can just one
of the payloads available in sandbark is
to run metasploit uh meteor protector
payloads on the uh running ec2 servers
uh so once for example we're going to
show this one actually a live demo uh
and also can dump adobe's uh password
secrets and parameters from the
parameter store and the aws secrets
manager which usually contains database
passwords keys under interesting stuff
like that uh when you start running
barcode you say advice attack surface to
check what kind of stuff you have
on the functions ac2 instances security
groups and then you see details about
these then you can launch further demos
on them
now i'm going to show you the the demo
for park so let me show you my uh
my kali terminal
hopefully that's a very very uh uh uh
very very clear
so i'm going to say
to run back now berkeley can run back
with different options so i'm going to
show you the the the option the help
options for work
uh of course you know all the ascii art
needed stuff uh so you can run to the
profile that you currently are already
configured in your in your terminal or
you can
set a certain key id
to supply the key and the secret
and the session token for example if you
got the uh credentials from
vulnerability on an ec2
instance now i'm going to run park
so now first of all uh many options you
see two attacks uh dumping secrets
training mode uh uh uh
and security groups for example but
before all of that we have to run the
attack surface uh
let's say command to check what kind of
stuff we have in this targeted list
account so i'm going to say
back surface
and now it's going to through all of the
available regions inside amazon cloud to
check all of the available instances of
the available available uh security
groups and then once it finds anything
interesting it will show it to you for
example this security group has the
following ips uh the sector group allows
everyone to connect and then it will go
and search for other stuff like for
example lambda functions uh uh ac2
instances through all of the regions
available uh and of course
is there any way you can get make a bit
larger for the people who are watching
sure sure sure okay sure
so now let's going to check uh ec2 uh
instances in all regions so for example
this is a asia-pacific region uh uh i
think this is maybe canada uh south asia
as well maybe or maybe i know this is i
think maybe sao paulo or was it
anyway so it's going through all the
regions now one by one
it could take uh uh some time us was too
so it's it tries to do an extensive
attack surface check on all the
available uh instances and uh uh
resources that we have for example so in
here it found some lambda functions uh
here it found
some ec2 instances running so i can say
for example show me all the lambda
functions
now i have all my i can check the help
menu so i can check for example for the
current security groups that are
available in in all of the regions and
all of the rules so i can check for
anything that's maybe suspicious or
interesting certain ib addresses for
example
and then i can also check for example to
dump the secrets in this account
it would also go and dump all the
secrets from
from the parameter store and the secret
manager from all the aws regions uh uh
then it will if it finds anything
interesting it will pause it to you and
also will store it for you as a
reference so you don't have to like for
example check the output for this for
this command all the time uh now of
course
uh while it uh
it tries to keep on running maybe you
can check the instantistic stuff we have
before
uh
actually trying to pull me down all the
way so anyway
uh uh
we will see an example of of how we can
actually run uh like uh
pass an
uh payload from uh uh using the aws
services the ls session manager so
interesting the adverse session manager
is an uh service inside amazon itself so
as far as we are concerned this attack
looks to come from inside amazon itself
from inside the ssm service itself
that's the the one that's actually
running those commands now interestingly
it found many interesting secrets inside
passwords for databases
api keys
of course you can always show what you
have collected using the command show
secrets so it shows you all the secrets
that it has found in your account now
let's say for example lambda functions
may want to actually download a lambda
function that i have found to download
its source code check what kind of stuff
it contains so here it's going to check
to me all the available love the
functions i have i have this lambda
function this lambda function this
lambda function i could for example give
it a name of one of the louder functions
to download
i'm going to say download this function
to me and then it's going to show me an
address a url that can actually use to
download stuff so if i go for example
and download uh this url let's go to to
download the function for me i can just
open it try to open what kind of details
it's it has inside of it so for example
this is the actual lambda code itself uh
that's running in this
in this uh lambda uh function so i can
check this out for anything interesting
or maybe vulnerabilities so i can try to
to exploit them now interestingly
going back to what we had in in in in
our work tool let's now do the ac2
attacks
so i'm going to sit to list all the
instances i found
and i'm going to run one of the ec2
attacks against against all these
instances so i could for example target
all the instances i have or maybe just
one of them so i'm going to use option
two then i can just post or maybe tab
complete the
instance that i want to target
based on its id
so i'm going to target this one it's a
linux instance and it's uh the profile
this is the profile name that's running
uh under inside it so then i have many
options i can run any command they want
i can have a reverse shell i can have i
can ask you to to visit url i can
download the metadata inside it i can
display a file for example if i want to
run a command i'm going to choose number
five enter the command to run maybe who
who am i for example
so probably it's going to run as root
and that's interesting this this attack
runs as root so the ssm manager inside
aws when it pushes those commands to run
on those running ec2 instances even if
you don't have the ssr key it runs them
as root so that's uh you know an extra
privilege for you so and this and the
output is is root now let's run another
attack so you if we get if we can get
the interpreter shell against that
running instance so i'm going to choose
it's it's its id
and won't choose the uh
number four for the metasploit
now it says give me the remote ib you
want to connect back to so i'm going to
give it the internal ib for my uh for my
cali for my calorie machine and then i'm
going to to use the sport and then it
wants to ask what kind of uh
payload do you want to run so i'm going
to choose payload number one so it's now
it says if you want you can just paste
this command in your in your kali server
but i have already my listener running
my listener is is already ready to me
waiting for it and that's the command
that's being sent
that's the command that's being sent to
the instance so it's a it's a python
command to actually exploit this now it
should be running we should have we
should have a session in a short while
okay so now
now i'm praying that it's it all works
sessions
okay and we have a session okay so
let's check this session
sessions dash i and then
search number one
and then we can see that we already have
a session inside
so i can for example maybe run some
commands like vs
to check all of the of the uh uh
processes running on that aec2 on that
server
uh so
we can see for example our uh command
that actually run the the the the the
payload is the ssm manager that's
running uh so now it's uh of course it
timed out here because this is this
command is taking a long time to return
because it's captured the the session
already but otherwise it's just going
normal so for example i can just you
know uh
see the help me on my metric shell and
they can for example get a shell inside
so now i have a shell inside the server
who are my roots
maybe if config to check if i'm running
actually inside an ec2 an ec2 server so
interestingly that's my
aec2 image that's running
for example i can
maybe backdoor curl against the metadata
internal service which we discussed
before
see if we can
ask this one
it responds to us and yes it does
respond so this is obviously an ec2
server that's actually running for us
now
i can run other types of attack attacks
for example i can try to
download the
metadata inside it for example or maybe
ask it to
run any command they want or a regular
reverse shell so maybe display file to
run to display the ttc password file
so now it's going to to to to send the
command to this instance and then it's
going to display the file that's
actually so that obviously it worked now
it actually launched that command to
show the hc password file on that remote
ec2 instance even though i don't have
any access to it normally i don't have
the ssh key for that but we're doing the
access from inside in place and using
the ssm
feature inside a device and even though
it's a well documented feature many many
security admins in edwards don't know
about it so if
unless you actually actually know what
you're looking for this command will
look like as if it was coming from
inside aws so it's not coming from
outside so maybe people might not find
it you know might not look for it
properly in in in their logging systems
uh so that's something to to care about
if you're running easy any cloud let's
say environment now if i were to run
this against like a bunch of vc2
instances all of them maybe i have like
10 ec2 instances i can just choose
number one it will say do you want to do
this on all instances yes i want what
kind of uh thing do you want to do i'm
going to actually run the command which
is uh for example a
cat etc
uh password now it's going to run it on
all on all targets it's going to give me
a command for linux instances and for
windows because they could be they could
be different forward for for instance
i'm going to say from the number who am
i and then it says
that now it's going to launch the attack
on all of them if you want to check the
results of those attacks on all of these
instances maybe 10 or 20 instances you
can check the the command results option
so i'm going to say command results yes
sorry i'm continuously interrupting you
apologies uh it's now at uh 39 minutes
past so just to give you okay
so you have about five minutes
excellent excellent yes excellent so now
if i check the command result option
it's going to say command id and then
for the for this particular instance the
command result is success and then it's
going to give me the command output so
whatever commands i can run on all of
the instances that i have it will go to
this will go and they should run that
command on all of these instances and
then to go to report to me the output
for that command so obviously the bulk
can help you launching attacks against
many instances at the same time or one
particular instance that you want and
the attacks are very let's say
customized you can use some of the ready
ones or you can just run any command
that you want by yourself so uh in a
nutshell that's what that's what uh burp
is
i can also show you the training
mode but it's going to take a few
minutes so otherwise those are the the
the the available uh features inside
lambda sidebar so far and of course i'm
going to keep on you know working on it
so for example next four part is to do
more lambda focused attacks you see in
the attack where we downloaded the
lambda function i'm going to add one
where you can actually upload or
backdoor the lambda function uh do some
persistence and backdooring to add for
example add
utilize or maybe abuse the trust
relationships between accounts or maybe
open up some security groups and also
enable third marty a third-party model
supports and also a web interface api so
if you would like if you think park is
interesting to to help you in your
inventory testing inside abs maybe you
can contribute at this add this at this
uh
url
i'm not going to bite i'm going to be
very very very pleased with your
contributions to bach now uh uh i'm
finished and now it's time for questions
so if you have any questions i'll be
more than
ready to answer