diff --git a/src/SUMMARY.md b/src/SUMMARY.md index f1d324eb8a..6356215574 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -1045,12 +1045,14 @@ - [AWS - Amazon Connect Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-connect-privesc/README.md) - [AWS - Config Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-config-privesc/README.md) - [AWS - Control Tower Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-control-tower-privesc/README.md) + - [AWS - Customer Profiles Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md) - [AWS - Datapipeline Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc/README.md) - [AWS - DataZone Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-datazone-privesc/README.md) - [AWS - Device Farm Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-device-farm-privesc/README.md) - [AWS - DLM Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-dlm-privesc/README.md) - [AWS - Directory Services Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc/README.md) - [AWS - DynamoDB Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc/README.md) + - [AWS - EBS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md) - [AWS - EC2 Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md) - [AWS - EC2 Image Builder Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-image-builder-privesc/README.md) - [AWS - ECR Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc/README.md) @@ -1061,6 +1063,7 @@ - [AWS - Elastic Beanstalk Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc/README.md) - [AWS - EMR Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc/README.md) - [AWS - EMR Serverless & EMR on EKS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-serverless-privesc/README.md) + - [AWS - Entity Resolution Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md) - [AWS - EventBridge Pipes Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-eventbridge-pipes-privesc/README.md) - [AWS - EventBridge Scheduler Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc/README.md) - [AWS - EventBridge Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-eventbridge-privesc/README.md) @@ -1069,30 +1072,39 @@ - [AWS - Glue Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/README.md) - [AWS - HealthOmics Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-healthomics-privesc/README.md) - [AWS - IAM Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md) + - [AWS - Invoicing and Billing Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md) - [AWS - IoT Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-privesc/README.md) - [AWS - IoT SiteWise Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-sitewise-privesc/README.md) + - [AWS - IoT TwinMaker Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md) + - [AWS - IVS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md) - [AWS - Kinesis Data Streams Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-kinesis-data-streams-privesc/README.md) - [AWS - KMS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc/README.md) - [AWS - Lambda Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md) + - [AWS - Lex V2 Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md) - [AWS - Lightsail Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc/README.md) - [AWS - Macie Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc/README.md) - [AWS - Mainframe Modernization Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mainframe-modernization-privesc/README.md) + - [AWS - Managed Blockchain Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md) - [AWS - Managed Service for Apache Flink Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-flink-privesc/README.md) - [AWS - Mediapackage Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc/README.md) + - [AWS - MemoryDB ACL User Reset Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md) - [AWS - Migration Hub Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-migration-hub-privesc/README.md) - [AWS - Migration Hub Orchestrator Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-migration-hub-orchestrator-privesc/README.md) - [AWS - MQ Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc/README.md) + - [AWS - MSK Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md) - [AWS - OpenSearch Serverless Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-opensearch-serverless-privesc/README.md) - [AWS - Oracle Database@AWS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-odb-privesc/README.md) - [AWS - PassRole to ML/Analytics Data-Access Roles](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ml-dataaccess-passrole-privesc/README.md) - [AWS - Payment Cryptography Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-payment-cryptography-privesc/README.md) - [AWS - PCA Connector for AD Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md) - [AWS - Proton Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-proton-privesc/README.md) + - [AWS - Q Business Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md) - [AWS - QuickSight Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-quicksight-privesc/README.md) - [AWS - RDS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc/README.md) - [AWS - Redshift Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc/README.md) - [AWS - Resilience Hub Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-resilience-hub-privesc/README.md) - [AWS - ARC Region Switch Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-region-switch-privesc/README.md) + - [AWS - Route 53 Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md) - [AWS - Route 53 Domains Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-route53-domains-privesc/README.md) - [AWS - SNS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc/README.md) - [AWS - SQS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc/README.md) @@ -1111,9 +1123,12 @@ - [AWS - Fault Injection Service Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-fis-privesc/README.md) - [AWS - Step Functions Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc/README.md) - [AWS - STS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc/README.md) + - [AWS - Timestream Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md) - [AWS - Transfer Family Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-transfer-family-privesc/README.md) - [AWS - Verified Permissions Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-verified-permissions-privesc/README.md) + - [AWS - Wickr Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md) - [AWS - WorkSpaces Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-privesc/README.md) + - [AWS - WorkSpaces Applications Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-appstream-privesc/README.md) - [AWS - WorkDocs Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md) - [AWS - Services](pentesting-cloud/aws-security/aws-services/README.md) - [AWS - Security Agent Enum](pentesting-cloud/aws-security/aws-services/aws-security-agent-enum.md) diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md index e30d1903db..d81df19495 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md @@ -14,15 +14,15 @@ Customer Profiles has no generic compute primitive and does not return IAM role ## `CreateIntegrationWorkflow` + `iam:PassRole` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/README.md#createintegrationworkflow--iampassrole). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/#createintegrationworkflow--iampassrole). It does not establish another AWS principal or a new IAM permission grant. ## `CreateSegmentSnapshot` + `iam:PassRole` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/README.md#createsegmentsnapshot--iampassrole). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/#createsegmentsnapshot--iampassrole). It does not establish another AWS principal or a new IAM permission grant. ## `AssociateStreamForSegments` + `iam:PassRole` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/README.md#associatestreamforsegments--iampassrole). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/#associatestreamforsegments--iampassrole). It does not establish another AWS principal or a new IAM permission grant. ## Confused-deputy and trust-policy boundary diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md index 2be860dc01..b0c1679aab 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md @@ -12,11 +12,11 @@ For more information about EBS access: ### `ebs:ListSnapshotBlocks`, `ebs:GetSnapshotBlock`, `ec2:DescribeSnapshots` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md#ebslistsnapshotblocks-ebsgetsnapshotblock-ec2describesnapshots). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/#ebslistsnapshotblocks-ebsgetsnapshotblock-ec2describesnapshots). It does not establish another AWS principal or a new IAM permission grant. ### **`ec2:CreateSnapshot`** -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md#ec2createsnapshot). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/#ec2createsnapshot). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md index 045dcca0d6..e3e5378087 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md @@ -12,7 +12,7 @@ For more information about Entity Resolution access: ## Pass a workflow role to read and export identity data -The bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-entity-resolution-post-exploitation/README.md#pass-a-workflow-role-to-read-and-export-identity-data). It does not establish another AWS principal or a new IAM grant. +The bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-entity-resolution-post-exploitation/#pass-a-workflow-role-to-read-and-export-identity-data). It does not establish another AWS principal or a new IAM grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md index ac6bead2fd..5b18bba117 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md @@ -12,27 +12,27 @@ For more information about AWS Invoicing and Billing access: ## No direct IAM role escalation primitive -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#no-direct-iam-role-escalation-primitive). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#no-direct-iam-role-escalation-primitive). It does not establish another AWS principal or a new IAM permission grant. ## Turn cost-view administration into cross-account disclosure -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#turn-cost-view-administration-into-cross-account-disclosure). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#turn-cost-view-administration-into-cross-account-disclosure). It does not establish another AWS principal or a new IAM permission grant. ## Enable previously granted legacy Billing permissions -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#enable-previously-granted-legacy-billing-permissions). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#enable-previously-granted-legacy-billing-permissions). It does not establish another AWS principal or a new IAM permission grant. ## Abuse invoice receiver delegation -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#abuse-invoice-receiver-delegation). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#abuse-invoice-receiver-delegation). It does not establish another AWS principal or a new IAM permission grant. ## The Billing service-linked role is not a general escalation target -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#the-billing-service-linked-role-is-not-a-general-escalation-target). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#the-billing-service-linked-role-is-not-a-general-escalation-target). It does not establish another AWS principal or a new IAM permission grant. ## Related actions that amplify business impact, not IAM authority -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#related-actions-that-amplify-business-impact-not-iam-authority). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#related-actions-that-amplify-business-impact-not-iam-authority). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md index 001df20de4..e28f1fc2fe 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md @@ -12,11 +12,11 @@ For more information about IoT TwinMaker access: ## Connector invocation without direct Lambda permission -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/README.md#connector-invocation-without-direct-lambda-permission). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/#connector-invocation-without-direct-lambda-permission). It does not establish another AWS principal or a new IAM permission grant. ## `UpdateWorkspace` + `iam:PassRole` + connector control -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/README.md#updateworkspace--iampassrole--connector-control). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/#updateworkspace--iampassrole--connector-control). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md index 223cfb7393..2017af2cca 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md @@ -12,27 +12,27 @@ For more information about IVS access: ## `ivs:CreateStreamKey` on `stream-key/*` - Publish to another channel -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/README.md#ivscreatestreamkey-on-stream-key---publish-to-another-channel). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/#ivscreatestreamkey-on-stream-key---publish-to-another-channel). It does not establish another AWS principal or a new IAM permission grant. ## `ivs:GetStreamKey` or `ivs:GetIngestConfiguration` - Convert a read into publishing access -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/README.md#ivsgetstreamkey-or-ivsgetingestconfiguration---convert-a-read-into-publishing-access). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/#ivsgetstreamkey-or-ivsgetingestconfiguration---convert-a-read-into-publishing-access). It does not establish another AWS principal or a new IAM permission grant. ## `ivs:CreateParticipantToken` - Mint stage publish/subscribe access -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/README.md#ivscreateparticipanttoken---mint-stage-publishsubscribe-access). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/#ivscreateparticipanttoken---mint-stage-publishsubscribe-access). It does not establish another AWS principal or a new IAM permission grant. ## `ivs:ImportPublicKey` - Sign tokens for stages account-wide -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/README.md#ivsimportpublickey---sign-tokens-for-stages-account-wide). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/#ivsimportpublickey---sign-tokens-for-stages-account-wide). It does not establish another AWS principal or a new IAM permission grant. ## `ivs:ImportPlaybackKeyPair` - Bypass private-channel playback decisions -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/README.md#ivsimportplaybackkeypair---bypass-private-channel-playback-decisions). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/#ivsimportplaybackkeypair---bypass-private-channel-playback-decisions). It does not establish another AWS principal or a new IAM permission grant. ## `ivs:StartComposition` - Send a stage to an unauthorized channel -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/README.md#ivsstartcomposition---send-a-stage-to-an-unauthorized-channel). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ivs-post-exploitation/#ivsstartcomposition---send-a-stage-to-an-unauthorized-channel). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md index de0c4b865e..d382d25661 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md @@ -12,11 +12,11 @@ For more information about Amazon Lex V2 access: ## `lex:CreateBot`/`lex:UpdateBot` + `iam:PassRole` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-lex-v2-post-exploitation/README.md#lexcreatebotlexupdatebot--iampassrole). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-lex-v2-post-exploitation/#lexcreatebotlexupdatebot--iampassrole). It does not establish another AWS principal or a new IAM permission grant. ## Existing hook as a confused business-authority boundary -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-lex-v2-post-exploitation/README.md#existing-hook-as-a-confused-business-authority-boundary). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-lex-v2-post-exploitation/#existing-hook-as-a-confused-business-authority-boundary). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md index 49edee688d..291b3d5e41 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md @@ -12,7 +12,7 @@ For more information about Managed Blockchain access: ## Invite an attacker account into a Hyperledger Fabric network -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-managed-blockchain-post-exploitation/README.md#invite-an-attacker-account-into-a-hyperledger-fabric-network). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-managed-blockchain-post-exploitation/#invite-an-attacker-account-into-a-hyperledger-fabric-network). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md index 7a65a90cc7..efb04a1750 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md @@ -14,7 +14,7 @@ For service context and enumeration commands, see [aws-memorydb-enum.md](../../a ### Post-exploitation: replace an ACL user's password with `memorydb:UpdateUser` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-memorydb-post-exploitation/README.md#post-exploitation-replace-an-acl-users-password-with-memorydbupdateuser). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-memorydb-post-exploitation/#post-exploitation-replace-an-acl-users-password-with-memorydbupdateuser). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md index b0a4389262..f10422358c 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md @@ -12,7 +12,7 @@ For more information about MSK access: ### `kafka:UpdateSecurity` to expose private topics without credentials -This bounded service or data operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-msk-post-exploitation/README.md#kafkaupdatesecurity-to-expose-private-topics-without-credentials). It does not grant the caller another principal or an additional permission. +This bounded service or data operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-msk-post-exploitation/#kafkaupdatesecurity-to-expose-private-topics-without-credentials). It does not grant the caller another principal or an additional permission. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md index 88675d4655..3a000e20c2 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md @@ -14,7 +14,7 @@ For service context and enumeration commands, see [AWS - Q Business Enum](../../ ## Plugin configuration hijack and action execution -The bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-q-business-post-exploitation/README.md#plugin-configuration-hijack-and-action-execution). It does not establish another AWS principal or a new IAM grant. +The bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-q-business-post-exploitation/#plugin-configuration-hijack-and-action-execution). It does not establish another AWS principal or a new IAM grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md index ea358337d3..f8cca70ea2 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md @@ -12,11 +12,11 @@ For more information about Timestream access: ## `timestream:CreateScheduledQuery` + `iam:PassRole` — run SQL and downstream writes as a scheduled-query role -The bounded scheduled-query data operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-timestream-post-exploitation/README.md#timestreamcreatescheduledquery--iampassrole--run-sql-and-downstream-writes-as-a-scheduled-query-role). It does not give the caller the passed role credentials or a new IAM grant. +The bounded scheduled-query data operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-timestream-post-exploitation/#timestreamcreatescheduledquery--iampassrole--run-sql-and-downstream-writes-as-a-scheduled-query-role). It does not give the caller the passed role credentials or a new IAM grant. ## `timestream:ExecuteScheduledQuery` — trigger an already stored role workflow -The fixed-workflow invocation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-timestream-post-exploitation/README.md#timestreamexecutescheduledquery--trigger-an-already-stored-role-workflow). +The fixed-workflow invocation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-timestream-post-exploitation/#timestreamexecutescheduledquery--trigger-an-already-stored-role-workflow). ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md index d11e65cba2..e6704121a9 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md @@ -14,7 +14,7 @@ For service context and enumeration commands, see [AWS - Wickr Enum](../../aws-s ## `wickr:CreateDataRetentionBotChallenge` — take over the data-retention bot -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-wickr-post-exploitation/README.md#wickrcreatedataretentionbotchallenge--take-over-the-data-retention-bot). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-wickr-post-exploitation/#wickrcreatedataretentionbotchallenge--take-over-the-data-retention-bot). It does not establish another AWS principal or a new IAM permission grant. ## References diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md index cdbfb5748d..1338523608 100644 --- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md @@ -12,7 +12,7 @@ For more information about Route53 access: ### `route53:CreateHostedZone`, `route53:ChangeResourceRecordSets`, `acm-pca:IssueCertificate`, `acm-pca:GetCertificate`, `ec2:DescribeVpcs` -This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-route53-dns-takeover-post-exploitation/README.md#route53createhostedzone-route53changeresourcerecordsets-acm-pcaissuecertificate-acm-pcagetcertificate-ec2describevpcs). It does not establish another AWS principal or a new IAM permission grant. +This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-route53-dns-takeover-post-exploitation/#route53createhostedzone-route53changeresourcerecordsets-acm-pcaissuecertificate-acm-pcagetcertificate-ec2describevpcs). It does not establish another AWS principal or a new IAM permission grant. #### Exploitation diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md index 6299d9bf81..80a2484e6e 100644 --- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md +++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-storage-unauth.md @@ -67,6 +67,30 @@ Import-Module .\MicroBurst\MicroBurst.psm1 -Verbose Invoke-EnumerateAzureSubDomains -Base corp -Verbose ``` +### Orphaned account names in direct Blob URLs + +A consumer can reference `https://.blob.core.windows.net//` directly, without a custom domain. If the original account was deleted and another subscription can register its name, the new owner can recreate the requested container and blob path. The old URL can then return the new owner's bytes.[[8]](#references) Unlike [dangling-CNAME takeover](az-subdomain-takeover-unauth.md), the stale reference itself points to the Azure-managed hostname. A name-availability result is only a candidate: confirm that the account can be created and that the exact old URL retrieves the new blob before claiming impact.[[8]](#references)[[9]](#references) + +For an authorized proof, extract the account, container, and blob path from a stale reference. If the consumer fetches without credentials, allow anonymous reads on the account and blob-level public access on the container.[[4]](#references) Create a harmless file at the **same path**, preserving any directory components in the blob name.[[8]](#references)[[11]](#references) Container ACL changes require key or SAS authorization rather than Entra ID alone; the example uses key mode on the account you control.[[4]](#references)[[10]](#references) + +```bash +az storage account check-name --name "$account" +az storage account create -n "$account" -g "$rg" -l "$location" --sku Standard_LRS --allow-blob-public-access true +az storage container create --account-name "$account" -n "$container" --public-access blob --auth-mode key +az storage blob upload --account-name "$account" -c "$container" -n "$blob" -f ./proof.js --content-type application/javascript --auth-mode key +curl -i "https://${account}.blob.core.windows.net/${container}/${blob}" +``` + +A returned JavaScript blob runs in the embedding page's context only when the page loads it as a script and browser policy permits it. A downloaded PowerShell file likewise needs a consumer that **executes** it; requests alone do not prove RCE. CSS, configuration, and package blobs have different effects according to how each consumer uses them. The original research confirmed live script references with an IP-restricted, harmless console logger rather than exposing visitors to an active payload.[[8]](#references) + +After enabling Blob service diagnostic logs to an Azure Log Analytics workspace, query `StorageBlobLogs` to find requested paths and active consumers.[[8]](#references)[[12]](#references) `ReferrerHeader` can expose sensitive values carried in referring URLs, so treat these logs as sensitive.[[8]](#references)[[13]](#references) Claiming the account alone does not populate this table; configure diagnostics first.[[12]](#references) + +```kusto +StorageBlobLogs +| where TimeGenerated > ago(1d) +| project TimeGenerated, Uri, OperationName, StatusCode, CallerIpAddress, UserAgentHeader, ReferrerHeader +``` + ## References - [1] [MicroBurst: Invoke-EnumerateAzureBlobs.ps1](https://github.com/NetSPI/MicroBurst/blob/master/Misc/Invoke-EnumerateAzureBlobs.ps1) @@ -76,5 +100,11 @@ Invoke-EnumerateAzureSubDomains -Base corp -Verbose - [5] [List Blobs (REST API) - Azure Storage](https://learn.microsoft.com/en-us/rest/api/storageservices/list-blobs) - [6] [Grant limited access to Azure Storage resources using shared access signatures (SAS)](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) - [7] [Azure Storage Explorer - Microsoft Azure](https://azure.microsoft.com/en-us/features/storage-explorer/) +- [8] [Ghosts in the Cloud: Hijacking Orphaned Azure Blob Storage](https://research.eye.security/ghosts-in-the-cloud-hijacking-orphaned-azure-blob-storage/) +- [9] [az storage account - Azure CLI](https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest) +- [10] [az storage container - Azure CLI](https://learn.microsoft.com/en-us/cli/azure/storage/container?view=azure-cli-latest) +- [11] [az storage blob - Azure CLI](https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest) +- [12] [Best practices for monitoring Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-storage-monitoring-scenarios) +- [13] [StorageBlobLogs table reference](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/storagebloblogs) {{#include ../../../banners/hacktricks-training.md}}