Skip to content

Latest commit

 

History

History
195 lines (129 loc) · 7.34 KB

aws-lightsail-privesc.md

File metadata and controls

195 lines (129 loc) · 7.34 KB
Raw

AWS - Lightsail Privesc

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
{% endhint %}

Lightsail

For more information about Lightsail check:

{% content-ref url="../aws-services/aws-lightsail-enum.md" %} aws-lightsail-enum.md {% endcontent-ref %}

{% hint style="warning" %} It’s important to note that Lightsail doesn’t use IAM roles belonging to the user but to an AWS managed account, so you can’t abuse this service to privesc. However, sensitive data such as code, API keys and database info could be found in this service. {% endhint %}

lightsail:DownloadDefaultKeyPair

This permission will allow you to get the SSH keys to access the instances:

aws lightsail download-default-key-pair

Potential Impact: Find sensitive info inside the instances.

lightsail:GetInstanceAccessDetails

This permission will allow you to generate SSH keys to access the instances:

aws lightsail get-instance-access-details --instance-name <instance_name>

Potential Impact: Find sensitive info inside the instances.

lightsail:CreateBucketAccessKey

This permission will allow you to get a key to access the bucket:

aws lightsail create-bucket-access-key --bucket-name <name>

Potential Impact: Find sensitive info inside the bucket.

lightsail:GetRelationalDatabaseMasterUserPassword

This permission will allow you to get the credentials to access the database:

aws lightsail get-relational-database-master-user-password --relational-database-name <name>

Potential Impact: Find sensitive info inside the database.

lightsail:UpdateRelationalDatabase

This permission will allow you to change the password to access the database:

{% code overflow="wrap" %}

aws lightsail update-relational-database --relational-database-name <name> --master-user-password <strong_new_password>

{% endcode %}

If the database isn't public, you could also make it public with this permissions with

{% code overflow="wrap" %}

aws lightsail update-relational-database --relational-database-name <name> --publicly-accessible

{% endcode %}

Potential Impact: Find sensitive info inside the database.

lightsail:OpenInstancePublicPorts

This permission allow to open ports to the Internet

aws lightsail open-instance-public-ports \
    --instance-name MEAN-2 \
    --port-info fromPort=22,protocol=TCP,toPort=22

Potential Impact: Access sensitive ports.

lightsail:PutInstancePublicPorts

This permission allow to open ports to the Internet. Note taht the call will close any port opened not specified on it.

aws lightsail put-instance-public-ports \
    --instance-name MEAN-2 \
    --port-infos fromPort=22,protocol=TCP,toPort=22

Potential Impact: Access sensitive ports.

lightsail:SetResourceAccessForBucket

This permissions allows to give an instances access to a bucket without any extra credentials

{% code overflow="wrap" %}

aws set-resource-access-for-bucket \
    --resource-name <instance-name> \
    --bucket-name <bucket-name> \
    --access allow

{% endcode %}

Potential Impact: Potential new access to buckets with sensitive information.

lightsail:UpdateBucket

With this permission an attacker could grant his own AWS account read access over buckets or even make the buckets public to everyone:

# Grant read access to exterenal account
aws update-bucket --bucket-name <value> --readonly-access-accounts <external_account>

# Grant read to the public
aws update-bucket --bucket-name <value> --access-rules getObject=public,allowPublicOverrides=true

# Bucket private but single objects can be public
aws update-bucket --bucket-name <value> --access-rules getObject=private,allowPublicOverrides=true

Potential Impact: Potential new access to buckets with sensitive information.

lightsail:UpdateContainerService

With this permissions an attacker could grant access to private ECRs from the containers service

aws update-container-service \
    --service-name <name> \
    --private-registry-access ecrImagePullerRole={isActive=boolean}

Potential Impact: Get sensitive information from private ECR

lightsail:CreateDomainEntry

An attacker with this permission could create subdomain and point it to his own IP address (subdomain takeover), or craft a SPF record that allows him so spoof emails from the domain, or even set the main domain his own IP address.

aws lightsail create-domain-entry \
    --domain-name example.com \
    --domain-entry name=dev.example.com,type=A,target=192.0.2.0

Potential Impact: Takeover a domain

lightsail:UpdateDomainEntry

An attacker with this permission could create subdomain and point it to his own IP address (subdomain takeover), or craft a SPF record that allows him so spoof emails from the domain, or even set the main domain his own IP address.

aws lightsail update-domain-entry \
    --domain-name example.com \
    --domain-entry name=dev.example.com,type=A,target=192.0.2.0

Potential Impact: Takeover a domain

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
{% endhint %}