Pivoting in Amazon Clouds
summary
A remote file include on a front-end EC2 lets an attacker proxy requests to 169.254 metadata and pull user-data and instance profile credentials; released tools (nimbostratus, dump_credentials, dump_permissions, nimbostratus-target) automate enumeration and abuse. With stolen keys the demo reads SQS, injects a crafted Celery pickle remote code execution task to pop a reverse shell on a worker, uses lax IAM (iam: on ) to create admin keys, and clones an RDS snapshot to extract otherwise-restricted database contents.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:09HTTP request vulnerability
- 3:27Change URL parameter
- 4:17Instance metadata
- 5:48AMI
- 7:01Python
- 9:38Nimbostratus
- 11:20User Data
- 15:13Source Code Review
- 16:00Amazon Cloud Architecture
- 17:23Instance Profiles
- 20:28Credentials
- 21:06Dump Permissions
- 22:24SQS
- 24:52Salary
- 29:15Serializer
- 31:36Salary Pickle
- 32:31Executing arbitrary commands
- 33:06Worker credentials
- 37:26IAM
- 38:35IAM API
- 39:00Create IAM User
- 41:41Create Snapshot
- 45:51Source Code
- 48:23Thank You
- 48:55Questions
