Automated analysis of AWS infrastructures Supervisor: Cedric van - - PowerPoint PPT Presentation

▶
automated analysis of aws infrastructures
SMART_READER_LITE
LIVE PREVIEW

Automated analysis of AWS infrastructures Supervisor: Cedric van - - PowerPoint PPT Presentation

Feb 25, 2024 447 likes •756 views

Peter Bennink 3rd of July, 2018 MSc System & Network Engineering Automated analysis of AWS infrastructures Supervisor: Cedric van Bockhaven - Peter Bennink 3rd of July, 2018 Background ... a secure cloud services platform, offering

slide-1
SLIDE 1

Peter Bennink 3rd of July, 2018

Automated analysis of AWS infrastructures

Supervisor: Cedric van Bockhaven - MSc System & Network Engineering

slide-2
SLIDE 2

Peter Bennink 3rd of July, 2018

2

“... a secure cloud services platform, offering compute power, database storage, content delivery and other functionality …”

Background

slide-3
SLIDE 3

Peter Bennink 3rd of July, 2018

3

EC2 (Elastic Compute Cloud) RDS (Relational Database Service) S3 (Simple Storage Service)

Background

slide-4
SLIDE 4

Peter Bennink 3rd of July, 2018

4

VPC Security groups IAM

Background

slide-5
SLIDE 5

Peter Bennink 3rd of July, 2018

5

VPC Security groups IAM

Background

slide-6
SLIDE 6

Peter Bennink 3rd of July, 2018

6

IAM

  • Access keys
  • Policies
  • Users
  • Groups
  • Roles

Background

slide-7
SLIDE 7

Peter Bennink 3rd of July, 2018

7

IAM > Policies

  • Effect (Allow/Deny)
  • Action
  • Resource

Background

slide-8
SLIDE 8

Peter Bennink 3rd of July, 2018

Introduction

  • You’ve infiltrated an AWS infrastructure, now what?
  • Expanding access
  • Knowledge of inaccessible components
  • Visualization

8

slide-9
SLIDE 9

Peter Bennink 3rd of July, 2018

9

Background

Bloodhound Active Directory

slide-10
SLIDE 10

Peter Bennink 3rd of July, 2018 Research question

Given an infiltrated AWS component, what part of the related infrastructure would an automated tool be able to index?

10

slide-11
SLIDE 11

Peter Bennink 3rd of July, 2018

11

1. Analysis 2. Development 3. Testing

Methodology

slide-12
SLIDE 12

Peter Bennink 3rd of July, 2018

12

1. Analysis 2. Development 3. Testing

Methodology

slide-13
SLIDE 13

Peter Bennink 3rd of July, 2018

13

IAM

  • Resource-level permissions
  • *:Describe*
  • *:List*

Analysis

slide-14
SLIDE 14

Peter Bennink 3rd of July, 2018

14

IAM > Policies

  • Effect (Allow/Deny)
  • Action
  • Resource

Background

slide-15
SLIDE 15

Peter Bennink 3rd of July, 2018

15

IAM

  • Resource-level permissions
  • *:Describe*
  • *:List*

Analysis

slide-16
SLIDE 16

Peter Bennink 3rd of July, 2018

16

Metadata server

  • EC2
  • 169.254.169.254

Analysis

slide-17
SLIDE 17

Peter Bennink 3rd of July, 2018

Functionality

17

Metadata crawler

Captures everything on the metadata server… … including security credentials

slide-18
SLIDE 18

Peter Bennink 3rd of July, 2018

Functionality

Permission bruteforcer

Checks what commands access keys can use

18

Infrastructure analyser

Uses access of key(s) to create mapping of infrastructure

slide-19
SLIDE 19

Peter Bennink 3rd of July, 2018

19

slide-20
SLIDE 20

Peter Bennink 3rd of July, 2018

Development

20

  • Neo4j
  • boto3
  • py2neo
slide-21
SLIDE 21

Peter Bennink 3rd of July, 2018

Conclusion

21

  • Very useful for expanding

access & escalating privilege

  • Resource-level permissions
  • Diversity of keys more

important than privilege in terms of enumeration

https://gitlab.com/PeterBennink/aws-infrastructure-analysis

slide-22
SLIDE 22

Peter Bennink 3rd of July, 2018

Discussion/Future work

22

Expandable in an infinite number of ways

slide-23
SLIDE 23

Peter Bennink 3rd of July, 2018

Discussion/Future work

23

  • Linkurious (visualization)

Expandable in an infinite number of ways

slide-24
SLIDE 24

Peter Bennink 3rd of July, 2018

Discussion/Future work

24

  • Linkurious (visualization)
  • STS

Expandable in an infinite number of ways

slide-25
SLIDE 25

Peter Bennink 3rd of July, 2018

Discussion/Future work

25

  • Linkurious (visualization)
  • STS
  • More AWS services/commands

Expandable in an infinite number of ways

slide-26
SLIDE 26

Peter Bennink 3rd of July, 2018

Discussion/Future work

26

  • Linkurious (visualization)
  • STS
  • More AWS services/commands
  • Automated infiltration

Expandable in an infinite number of ways

slide-27
SLIDE 27

Peter Bennink 3rd of July, 2018

Discussion/Future work

27

  • Linkurious (visualization)
  • STS
  • More AWS services/commands
  • Automated infiltration
  • Nmapping subnets

Expandable in an infinite number of ways

slide-28
SLIDE 28

Peter Bennink 3rd of July, 2018

Discussion/Future work

28

  • Linkurious (visualization)
  • STS
  • More AWS services/commands
  • Automated infiltration
  • Nmapping subnets
  • Resource-level permission bruteforcer

Expandable in an infinite number of ways

slide-29
SLIDE 29

Peter Bennink 3rd of July, 2018

Thank you. Any questions?

29 https://gitlab.com/PeterBennink/aws-infrastructure-analysis