Scenario | ecs_privesc_evade_protection #233

West-wise · 2023-10-29T06:55:52Z

Add a new scenario which abuses an ECS & reverse shell to escalate privileges.

andrew-aiken

Will add some more once I get the change to go through the scenario

andrew-aiken · 2023-10-31T13:04:53Z

scenarios/ecs_privesc_evade_protection/terraform/lambda.tf

+  source_arn    = aws_cloudwatch_event_rule.guardduty_events.arn
+}
+
+resource "null_resource" "lambda_zip" {


Please switch this to use the archive provider.

https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file

andrew-aiken · 2023-10-31T13:05:55Z

scenarios/ecs_privesc_evade_protection/assets/flag.txt

@@ -0,0 +1 @@
+cg-secret-bob12-gC9!+Xy#QJ37fa@H3D7Kd@2*a&#+Tp%


Assets used by the scenario should be moved to under the terraform directory. Like done here

andrew-aiken · 2023-10-31T13:07:15Z

scenarios/ecs_privesc_evade_protection/README.md

+- The attacker exploits vulnerabilities in a web service to access the EC2's credentials.
+- The attacker defines and executes an ECS task with the authority of the web developer to privesc or bypass mitigations. Perform a reverse shell attack to access the container been created.
+- The attacker accesses S3 at the container to bypass GuardDuty detection. Gets the Secret String and exits the scenario.
+


Create a manifest.yml file.
example

andrew-aiken · 2023-10-31T13:08:50Z

scenarios/ecs_privesc_evade_protection/README.md

+- The attacker exploits vulnerabilities in a web service to access the EC2's credentials.
+- The attacker defines and executes an ECS task with the authority of the web developer to privesc or bypass mitigations. Perform a reverse shell attack to access the container been created.
+- The attacker accesses S3 at the container to bypass GuardDuty detection. Gets the Secret String and exits the scenario.
+


Once we have the size & difficulty, add you scenario to the main readme file.

andrew-aiken · 2023-10-31T13:14:51Z

scenarios/ecs_privesc_evade_protection/terraform/outputs.tf

+}
+
+# Wait a little for ec2 be created in ASG.
+resource "time_sleep" "wait_for_instance" {


Move the resources and data to dedicated files

andrew-aiken · 2023-10-31T13:28:06Z

scenarios/ecs_privesc_evade_protection/terraform/provider.tf

@@ -0,0 +1,4 @@
+provider "aws" {


Add required providers for aws, time, and null (archive see other comment)

https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.4.0/docs/rules/terraform_required_providers.md

andrew-aiken · 2023-10-31T13:28:17Z

scenarios/ecs_privesc_evade_protection/terraform/provider.tf

@@ -0,0 +1,4 @@
+provider "aws" {


Add required version (or minimum)

https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.4.0/docs/rules/terraform_required_version.md

Missing commit about user-email input for SES is reflected.

PR requirements reflected.

3iuy-prog · 2023-11-01T18:27:48Z

We have addressed all the requirements. Please let us know if there are any other requests or suggestions. :)

Add vpc.tf & resolve an issue about tf version.

3iuy-prog · 2023-11-05T19:08:32Z

Terraform version >= 2.0 was definitely a misnomer.
According to Hasicorp, the latest version of terraform is 1.6.3.
The version has been modified accordingly.

and I added vpc.tf reflecting the feedback.
=> https://discord.com/channels/969671994599669760/1168866493451214859/1170108321819275334

andrew-aiken · 2023-11-05T21:25:03Z

scenarios/ecs_privesc_evade_protection/cheat_sheet.md

+```
+http://<ec2_ip_address>/?url=http://[::ffff:a9fe:a9fe]/latest/meta-data/iam/security-credentials/<role>
+aws configure --profile attacker
+echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials`echo "aws_session_token = <token>" >> ~/.aws/credentials


Should there be this many echo commands?

andrew-aiken · 2023-11-05T21:33:12Z

The following data sources are now unused

data.aws_vpc.default
data.aws_subnets.all_subnets

I would also recommend adding a required version for the archive & time providers

andrew-aiken · 2023-11-05T21:41:29Z

Have the scenario create the CloudWatch group that the lambda will write to. Then when the scenario is destroyed it is also cleaned up

…>" >> ~/.aws/credentials`

- data "aws_vpc" "default" - data "aws_subnets" "all_subnets"

- flag.txt is now for easy path. - secret-string.txt is for hard path. - refresh README.md & cheat_sheet.md.

3iuy-prog · 2023-11-09T00:49:03Z

I was thinking about adding an easy path and decided to create a separate secret-string file for each path.
S3 is now accessible with web credentials, and users can also see both secret files. However, users can only read the contents of the easy-path file.
Users must do ECS Privesc to read the Hard Path file.

This reverts commit caa3f79.

This reverts commit 41a4730.

andrew-aiken

LGTM

@jdearmas could you review this. There also is a thread in discord about this scenario

…c_evade_protection # Conflicts: # README.md

andrew-aiken · 2023-12-19T18:52:42Z

scenarios/ecs_privesc_evade_protection/terraform/cloudtrail.tf

@@ -0,0 +1,6 @@
+# Using CloudTrail for GuardDuty
+resource "aws_cloudtrail" "cloudtrail" {


Add a depends on for the bucket policy aws_s3_bucket_policy.trail_bucket_policy

andrew-aiken · 2023-12-19T19:09:37Z

scenarios/ecs_privesc_evade_protection/terraform/ecr.tf

+  provisioner "local-exec" {
+    when       = create
+    on_failure = fail
+    command    = "python ./push-dockerfile.py --dockerfile_path ../assets/ssrf-web/ --repository ${aws_ecr_repository.repository.name} --region ${var.region} --profile ${var.profile} --image_tag latest"


Switch out python to python3 not all systems come with python/ an alias to 3 (osx)

Python3 is already defined to be used in cloudgoat.py

The files could also be made executable and then define the env in the top of the files

andrew-aiken · 2023-12-19T19:09:44Z

scenarios/ecs_privesc_evade_protection/terraform/ecr.tf

+  provisioner "local-exec" {
+    when       = destroy
+    on_failure = fail
+    command    = "python ./pop-dockerfile.py --repository ${self.triggers.repository_name} --region ${self.triggers.region} --profile ${self.triggers.profile} --image_tag all"


Same as above

andrew-aiken · 2023-12-19T19:23:35Z

scenarios/ecs_privesc_evade_protection/terraform/push-dockerfile.py

+
+def docker_build_and_push(repository_uri, image_tag, path):
+    # Build the Docker image
+    subprocess.run(f"docker build -t {repository_uri}:{image_tag} {path}", shell=True, check=True)


Add --platform linux/amd64 to the build subprocess, I'm on a apple silicon machine which is based on arm

Logs from the ecs server

[root@ip-192-168-150-41 ~]# docker logs 6d265c0e1c35 exec /usr/local/bin/docker-php-entrypoint: exec format error

andrew-aiken · 2023-12-19T19:29:27Z

scenarios/ecs_privesc_evade_protection/terraform/pop-dockerfile.py

+import subprocess
+
+
+def get_docker_login_cmd(client, region):


Is this function necessary for removing the images from ecr?

andrew-aiken · 2023-12-19T19:34:42Z

README.md

@@ -227,16 +227,13 @@ Starting with access the "ruse" EC2 the user leverages the instace profile to ba

 [Visit Scenario Page.](scenarios/ecs_efs_attack/README.md)

-### glue_privesc(Large / Moderate)
+### ecs_privesc_evade_protection (Medium / Moderate)


Overwriting glue_privesc

andrew-aiken · 2023-12-19T19:35:43Z

scenarios/ecs_privesc_evade_protection/README.md

@@ -0,0 +1,61 @@
+# Scenario: ecs_privesc_evade_protection


Could you make a note that this scenario needs docker to run

andrew-aiken

Submitted some changes

…de_protection

3iuy-prog · 2023-12-24T04:56:36Z

All changes are submitted. :)

andrew-aiken · 2023-12-24T22:28:42Z

941aa82

The change to the platform are still building as arm, the ECS tasks then fails.

I think the only thing needed to be added is the platform tag to force it to be amd64

docker_build_cmd = f"docker build --platform=linux/amd64 -t {repository_uri}:{image_tag} {path}"

Everything else looks great 🙌

…de_protection

Add new scenario/ecs_privesc_evade_protection

a8a4468

West-wise changed the title ~~Add new scenario/ecs_privesc_evade_protection~~ Scenario | ecs_privesc_evade_protection Oct 31, 2023

andrew-aiken suggested changes Oct 31, 2023

View reviewed changes

3iuy-prog and others added 2 commits November 2, 2023 03:20

PR requirements reflected.

e4442be

Missing commit about user-email input for SES is reflected.

Merge pull request #1 from BoB12-C-G-V/scenario/ecs_privesc_modify

7af9730

PR requirements reflected.

trickdeath0 mentioned this pull request Nov 4, 2023

Problem creating ec2 instance on cloud_breach_s3 #234

Closed

3iuy-prog and others added 2 commits November 6, 2023 03:58

Add vpc.tf & resolve an issue about tf version.

a361539

Merge pull request #2 from BoB12-C-G-V/scenario/ecs_privesc_modify

22d8842

Add vpc.tf & resolve an issue about tf version.

andrew-aiken reviewed Nov 5, 2023

View reviewed changes

3iuy-prog added 5 commits November 6, 2023 13:07

Remove duplicate writes of commands `echo "aws_session_token = <token…

dfa19cc

…>" >> ~/.aws/credentials`

remove unused data sources.

63f7f2a

- data "aws_vpc" "default" - data "aws_subnets" "all_subnets"

Add required_providers for archive & time.

bc94bfc

Define CloudWatch Lambda Log Group.

1c121f7

Add Easy Path.

c38018f

- flag.txt is now for easy path. - secret-string.txt is for hard path. - refresh README.md & cheat_sheet.md.

West-wise and others added 7 commits November 14, 2023 13:14

add Summary in Main README.md

41a4730

fix typo

caa3f79

Revert "fix typo"

49bdb81

This reverts commit caa3f79.

Revert "add Summary in Main README.md"

cb5d2b8

This reverts commit 41a4730.

Remove horizontal line in scenario/ecs_privesc_evade_protecton/README.md

8c01e74

Edit root README.md

daf3680

Allow ecs:ListClusters for role "cg_web_developer_policy"

fe7156d

andrew-aiken approved these changes Nov 14, 2023

View reviewed changes

Merge remote-tracking branch 'origin/master' into scenario/ecs_prives…

fbd6278

…c_evade_protection # Conflicts: # README.md

3iuy-prog force-pushed the scenario/ecs_privesc_evade_protection branch from 3c01de3 to 0dca220 Compare December 13, 2023 12:04

Update scenario's cheat_sheet.md.

928ad74

3iuy-prog force-pushed the scenario/ecs_privesc_evade_protection branch from 0dca220 to 928ad74 Compare December 13, 2023 12:10

3iuy-prog added 6 commits December 15, 2023 00:33

Using ECR instead of Docker Hub.

f55b48d

Remove comments about docker hub.

01f4083

Update script to make hcl can handle docker path.

5c9cd5b

Remove env setting on script.

585b491

Once the scripts would be fail, make tf fail.

93c6496

If the docker push fails, try pushing it up to 3 times again.

6016473

andrew-aiken reviewed Dec 19, 2023

View reviewed changes

andrew-aiken suggested changes Dec 19, 2023

View reviewed changes

3iuy-prog and others added 7 commits December 21, 2023 18:32

Merge branch 'RhinoSecurityLabs:master' into scenario/ecs_privesc_eva…

8a9849d

…de_protection

change command python to python3 in local-exec

f9c56e3

add depends on for s3 policy in cloudtrail.tf

e99042f

check architecture and add "--platform=linux/arm64" for arm.

941aa82

Remove docker login in pop-dockfile.py.

e712529

Restore describe about glue_privesc in README.md

fafbf7f

Add a note about docker.

0578065

build the container with Linux/amd64 by force.

60605db

andrew-aiken approved these changes Dec 29, 2023

View reviewed changes

3iuy-prog and others added 3 commits April 22, 2024 23:31

Merge branch 'RhinoSecurityLabs:master' into scenario/ecs_privesc_eva…

e0d3bf1

…de_protection

fix scenario create command in README.md

13a9e96

set timeout to curl to make less down the web container

b305d81

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Scenario | ecs_privesc_evade_protection #233

Scenario | ecs_privesc_evade_protection #233

West-wise commented Oct 29, 2023

andrew-aiken left a comment

andrew-aiken Oct 31, 2023

andrew-aiken Oct 31, 2023

andrew-aiken Oct 31, 2023

andrew-aiken Oct 31, 2023

andrew-aiken Oct 31, 2023

andrew-aiken Oct 31, 2023

andrew-aiken Oct 31, 2023

3iuy-prog commented Nov 1, 2023

3iuy-prog commented Nov 5, 2023

andrew-aiken Nov 5, 2023

andrew-aiken commented Nov 5, 2023

andrew-aiken commented Nov 5, 2023

3iuy-prog commented Nov 9, 2023 •

edited

Loading

andrew-aiken left a comment •

edited

Loading

andrew-aiken Dec 19, 2023

andrew-aiken Dec 19, 2023

andrew-aiken Dec 19, 2023

andrew-aiken Dec 19, 2023

andrew-aiken Dec 19, 2023

andrew-aiken Dec 19, 2023

andrew-aiken Dec 19, 2023

andrew-aiken left a comment

3iuy-prog commented Dec 24, 2023

andrew-aiken commented Dec 24, 2023 •

edited

Loading

		@@ -0,0 +1 @@
		cg-secret-bob12-gC9!+Xy#QJ37fa@H3D7Kd@2*a&#+Tp%

		@@ -0,0 +1,6 @@
		# Using CloudTrail for GuardDuty
		resource "aws_cloudtrail" "cloudtrail" {

Scenario | ecs_privesc_evade_protection #233

Are you sure you want to change the base?

Scenario | ecs_privesc_evade_protection #233

Conversation

West-wise commented Oct 29, 2023

andrew-aiken left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

3iuy-prog commented Nov 1, 2023

3iuy-prog commented Nov 5, 2023

Choose a reason for hiding this comment

andrew-aiken commented Nov 5, 2023

andrew-aiken commented Nov 5, 2023

3iuy-prog commented Nov 9, 2023 • edited Loading

andrew-aiken left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrew-aiken left a comment

Choose a reason for hiding this comment

3iuy-prog commented Dec 24, 2023

andrew-aiken commented Dec 24, 2023 • edited Loading

3iuy-prog commented Nov 9, 2023 •

edited

Loading

andrew-aiken left a comment •

edited

Loading

andrew-aiken commented Dec 24, 2023 •

edited

Loading