Release Blog: [Do you feel in Control: An analysis of AWS CloudControl API as an attack tool]
CloudConqueror is a 4 parter tool, which provides simulation of all the techniques specified on the research.
The features tool will be offering are:
- Resource Listing, by utilizing
cloudcontrol:ListResourcesandcloudcontrol:GetResource - Resource Name Bruteforce, by utilizing
cloudcontrol:GetResource - Persistence by creating an IAM User or Role with an inline policy that only allows access through
CloudControl - Listing of CloudControl events on the account
CloudConqueror is built in Python3, and a file containing the required libraries (requirements.txt) is found inside the main folder of the tool. To install the tool locally, either using a Virtual Environment (python-venv) or installing the libraries on the system directly, the only installation needed is to install the libraries inside requirements.txt.
(venv) ~$ python3 -m pip install -r requirements.txt
Requirement already satisfied: boto3 in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 1)) (1.40.5)
Requirement already satisfied: termcolor in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 2)) (3.1.0)
Requirement already satisfied: botocore in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 3)) (1.40.5)
Requirement already satisfied: tabulate in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 4)) (0.9.0)
Requirement already satisfied: prettytable in ./venv/lib/python3.12/site-packages (from -r requirements.txt (line 5)) (3.16.0)
Requirement already satisfied: jmespath<2.0.0,>=0.7.1 in ./venv/lib/python3.12/site-packages (from boto3->-r requirements.txt (line 1)) (1.0.1)
Requirement already satisfied: s3transfer<0.14.0,>=0.13.0 in ./venv/lib/python3.12/site-packages (from boto3->-r requirements.txt (line 1)) (0.13.1)
Requirement already satisfied: python-dateutil<3.0.0,>=2.1 in ./venv/lib/python3.12/site-packages (from botocore->-r requirements.txt (line 3)) (2.9.0.post0)
Requirement already satisfied: urllib3!=2.2.0,<3,>=1.25.4 in ./venv/lib/python3.12/site-packages (from botocore->-r requirements.txt (line 3)) (2.5.0)
Requirement already satisfied: wcwidth in ./venv/lib/python3.12/site-packages (from prettytable->-r requirements.txt (line 5)) (0.2.13)
Requirement already satisfied: six>=1.5 in ./venv/lib/python3.12/site-packages (from python-dateutil<3.0.0,>=2.1->botocore->-r requirements.txt (line 3)) (1.17.0)Then, the tool can be executed using python:
(venv) ~$ python3 CloudConqueror.py -h
---------------------------------------------------------------------------------
_____ _ _ _____
/ ____| | | |/ ____|
| | | | ___ _ _ __| | | ___ _ __ __ _ _ _ ___ _ __ ___ _ __
| | | |/ _ \| | | |/ _` | | / _ \| '_ \ / _` | | | |/ _ \ '__/ _ \| '__|
| |____| | (_) | |_| | (_| | |___| (_) | | | | (_| | |_| | __/ | | (_) | |
\_____|_|\___/ \__,_|\__,_|\_____\___/|_| |_|\__, |\__,_|\___|_| \___/|_|
| |
|_|
---------------------------------------------------------------------------------
by gl4ssesbo1 @ Exaforce
---------------------------------------------------------------------------------
usage: CloudConqueror.py [-h] {LISTRESOURCES,BRUTEFORCERESOURCES,IAMPERSISTENCE,CHECKUSAGE} ...
CloudConqueror
positional arguments:
{LISTRESOURCES,BRUTEFORCERESOURCES,IAMPERSISTENCE,CHECKUSAGE}
Select the attack to execute on the target
LISTRESOURCES Bruteforce AWS Resources by utilizing cloudcontrol:ListResources and cloudcontrol:GetResource
BRUTEFORCERESOURCES
Bruteforce AWS Resources by utilizing cloudcontrol:GetResource
IAMPERSISTENCE Persist on the Account using an IAM User or Role and a Policy which only allows access through CloudControl API.
CHECKUSAGE Search through AWS CloudTrail Logs using cloudtrail:LookupEvents to find occurrences of bruteforce
options:
-h, --help show this help message and exit
CloudConqueror contains a Dockerfile, using it a Docker image can be created and the tool be executed from there. To install the docker image, just run docker build on the directory of the tool.
~$ docker build -t cloudconqueror .
Sending build context to Docker daemon 99.07MB
Step 1/7 : FROM python:3.10
3.10: Pulling from library/python
80b7316254b3: Pull complete
36e4db86de6e: Pull complete
8ea45766c644: Pull complete
3cb1455cf185: Pull complete
013acb959c95: Pull complete
ee334269ae4f: Pull complete
3eca4263ed42: Pull complete
Digest: sha256:4585309097d523698d382a2de388340896e021319b327e2d9c028f3b4c316138
Status: Downloaded newer image for python:3.10
---> d565b0a5e178
Step 2/7 : WORKDIR /cloudconqueror
---> Running in e2e79b4829a4
---> Removed intermediate container e2e79b4829a4
---> 6f7ef917c82b
Step 3/7 : COPY . .
--snip--
Successfully built 559c27b10eae
Successfully tagged cloudconqueror:latestThen, to execute the tool, simply run the container using docker run. It is recommended to mount the local AWS Profile Directory (~/.aws directory) so the tool can retrieve the stored awscli sessions and the folder output from the tool’s base directory.
~$ docker run -v ~/.aws:/root/.aws -v ./output:/cloudconqueor/output -it cloudconqueror -h
---------------------------------------------------------------------------------
_____ _ _ _____
/ ____| | | |/ ____|
| | | | ___ _ _ __| | | ___ _ __ __ _ _ _ ___ _ __ ___ _ __
| | | |/ _ \| | | |/ _` | | / _ \| '_ \ / _` | | | |/ _ \ '__/ _ \| '__|
| |____| | (_) | |_| | (_| | |___| (_) | | | | (_| | |_| | __/ | | (_) | |
\_____|_|\___/ \__,_|\__,_|\_____\___/|_| |_|\__, |\__,_|\___|_| \___/|_|
| |
|_|
---------------------------------------------------------------------------------
by gl4ssesbo1 @ Exaforce
---------------------------------------------------------------------------------
usage: CloudConqueror.py [-h] {LISTRESOURCES,BRUTEFORCERESOURCES,IAMPERSISTENCE,CHECKUSAGE} ...
CloudConqueror
positional arguments:
{LISTRESOURCES,BRUTEFORCERESOURCES,IAMPERSISTENCE,CHECKUSAGE}
Select the attack to execute on the target
LISTRESOURCES Bruteforce AWS Resources by utilizing cloudcontrol:ListResources and cloudcontrol:GetResource
BRUTEFORCERESOURCES
Bruteforce AWS Resources by utilizing cloudcontrol:GetResource
IAMPERSISTENCE Persist on the Account using an IAM User or Role and a Policy which only allows access through CloudControl API.
CHECKUSAGE Search through AWS CloudTrail Logs using cloudtrail:LookupEvents to find occurrences of bruteforce
options:
-h, --help show this help message and exit
CloudConqueror uses cloudcontrol:ListResources to list resources of a specific type on the account. After listing the resources and getting their identifier, it will attempt to run cloudcontrol:GetResource for each of them, to get their properties. The only inputs the tool needs, is an AWS stored profile on awscli directory, and the type of resource to list.
All the resource types are listed as choices on the tool’s --resource-type flag, which will filter out resources which are not managed by AWS CloudControl API.
One of the techniques discussed on this article, was the ability to use cloudcontrol:GetResource API call, on a list of potential resource names, to find if one of them exists. So basically, an authenticated name fuzzing of resources on the account.
The BRUTEFORCE command of the tool will require the attacker to provide an AWS Profile, the resource type, an AWS region and a list of resource names and go through each of them, running cloudcontrol:GetResource and returning the existent resources with their properties.
An attacker can create an IAM Policy, that only allows access through CloudControl API and then attach it to an IAM User, Group or Role, in order to persist using them, Just like mentioned on the section “How effective can AWS CloudControl API be as an attack tool”.
CloudConqueror’s IAMPERSISTENCE command will use that technique to create a user or a role (by default named CCUser or CCRole if not defined by the attacker) and assign an Inline Policy called CCInlinePolicy on them with a Policy Definition same as the one on the section “How effective can AWS CloudControl API be as an attack tool”.
Lastly, the tool’s CHECKUSAGE command will use cloudtrail:LookupEvents to search for execution of CloudControl APIon the account and output a table and CSV out of them.
The output CSV will be stored on the directory path output//cloudcontrol-events.csv on the tool’s directory.
| Author Name | Author Handle |
|---|---|
| Bleon Proko | @gl4ssesbo1 |
This project is licensed under the Apache License.