AWS

Authentication

  • Run the following command and enter ACCESS KEY ID and SECRET ACCESS KEY

aws configure
aws configure --profile <profile_name>
aws sts get-caller-identity
export AWS_SESSION_TOKEN=
export AWS_SECRET_ACCESS_KEY=
export AWS_ACCESS_KEY_ID=

The credentials we get from CloudShell expire after 15 minutes by default / design. After getting the credentials, you may need to get and set new credentials again as you work through the remainder of the lab.

TOKEN=$(curl -X PUT localhost:1338/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
curl localhost:1338/latest/meta-data/container/security-credentials -H "X-aws-ec2-metadata-token: $TOKEN"

  • SSRF

http://169.254.169.254/

  • XXE

file:///proc/self/environ

Note that immediately following the AWS access key is the SHLVL=0 parameter. When you copy the AWS access key ID value, make sure that you don't copy the SHLVL label. Also the AWS session token is in base64 format and you should copy the trailing = or == .

  • If new env, use cloudfox

https://github.com/BishopFox/cloudfox/releases
cloudfox aws all-checks -p default

  • aws-enum

  • IAM

  • Services

  • Password spray

PreviousGCPNextAzure

Last updated