Secrets in the cloud #189

j0eblow · 2023-05-09T19:14:15Z

have fun

jdearmas

I'm blocked on completing the scenario. Can you add more detail/commands to the cheat sheet?

jdearmas · 2023-05-18T18:08:47Z

scenarios/secrets_in_the_cloud/manifest.yml

@@ -0,0 +1,13 @@
+---


Can you add a single comment at the top of the file that explains what this file does in plain English?

For example:
# This 'manifest.yml' file provides configuration variables for the Cloudgoat scenario.

jdearmas · 2023-05-18T18:09:07Z

scenarios/secrets_in_the_cloud/start.sh

@@ -0,0 +1,2 @@
+#!/bin/bash


Can you add a single comment at the almost top of the file that explains what this file does in plain English?

unnecessary file for my scenario so I deleted it.

jdearmas · 2023-05-18T18:09:16Z

scenarios/secrets_in_the_cloud/terraform/dynamodb.tf

@@ -0,0 +1,51 @@
+locals { 


Can you add a single comment at the top of the file that explains what this file does in plain English?

Example:

# This is a Terraform file that creates three resources: # 1. An AWS DynamoDB Table # 2. An AWS DynamoDB Entry (for the Access ID) # 3. An AWS DynamoDB Entry (for the Secret Key)

jdearmas · 2023-05-18T18:09:27Z

scenarios/secrets_in_the_cloud/terraform/ec2_instance.tf

@@ -0,0 +1,95 @@
+data "aws_ami" "amazon_linux_2" {


Can you add a single comment at the top of the file that explains what this file does in plain English?

Example:

# This is a Terraform file that creates several AWS EC2 resources: # 1. A Data Source for an AWS Amazon Machine Image. # 2. A TLS Private Key Resource # 3. An AWS Key Pair Resource # 4. An AWS Instance Resource # 5. An AWS Security Group Resource

jdearmas · 2023-05-18T18:09:39Z

scenarios/secrets_in_the_cloud/terraform/iam.tf

@@ -0,0 +1,199 @@
+resource "aws_iam_user" "low_priv_user" {


Can you add a single comment at the top of the file that explains what this file does in plain English?

Example:

# This Terraform file creates several resources for AWS Identity and Access Management (IAM): # - An IAM User # - An IAM Access Key # # For AWS Simple Storage Service (S3): # - An IAM Policy # - An IAM User Policy Attachment # # For AWS Lambda: # - An IAM Policy # - An IAM User Policy Attachment # - An IAM Role Policy # # For AWS DynamoDB: # - An IAM Policy # - An IAM Role # - An IAM Role Policy Attachment # - An IAM Instance Profile # # For AWS Secrets Manager: # - An IAM User # - An IAM Access Key # - An IAM Role # - An IAM User Policy

jdearmas · 2023-05-19T18:28:31Z

scenarios/secrets_in_the_cloud/terraform/iam.tf

-resource "aws_iam_instance_profile" "ec2_instance_profile" {
-  name = "EC2InstanceProfile"
-  role = aws_iam_role.ec2_dynamodb_role.name
+resource "aws_iam_instance_profile" "dynamodb_instance_profile" {


The example comment from my initial review should be updated to reflect this change.

jdearmas · 2023-05-19T18:31:24Z

scenarios/secrets_in_the_cloud/README.md

+8. After enumerating the EC2 metadata service, the attacker decides to list available DynamoDB tables and discovers a table containing IAM user credentials specific to the scenario.
+9. Utilizing the newly acquired IAM user credentials, the attacker retrieves the final secret from the Secrets Manager, successfully completing the scenario.
+
+A cheat sheet for the scenario is available [here](./cheat_sheet.md).


What's with the ^M?

yea, that's super weird. Might be related to terminal or some random key press I did. It can be deleted.

this should be fixed now.

jdearmas · 2023-05-19T21:22:49Z

scenarios/secrets_in_the_cloud/terraform/user_data.tpl

@@ -142,3 +137,13 @@ vault kv put secret/tylers_seekrit value='TylerTantalizingTacosTangleToucans'
 vault kv put secret/brads_seekrit value='BradBefriendsBouncingBlueberryBison'
 export SSH_PRIVATE_KEY="${private_key}"
 vault kv put secret/id_rsa value="$SSH_PRIVATE_KEY"
+
+# Update MOTD with a hint


What is MOTD?

https://en.wikipedia.org/wiki/Message_of_the_day - basically the message users see when they log on.

jdearmas · 2023-05-19T21:25:31Z

scenarios/secrets_in_the_cloud/README.md

+2. The attacker enumerates the web application and uncovers an admin page that prompts for an API key.
+3. While examining the admin page's HTML comments, the attacker finds information about environment variables and a HashiCorp endpoint.
+4. By enumerating the scenario's Lambda function, the attacker locates the web application's API key and uses it to obtain the HashiCorp vault token.
+5. The attacker exploits the vault token to log in to the HashiCorp endpoint and acquires the id_rsa key, which grants SSH access to the EC2 instance hosting the web application.


After starting the scenario and using the cheat sheet, I'm unable to identify the HashiCorp endpoint. Can you add the steps need to identify the HashiCorp endpoint?

updated step 3 to clarify the port number and location of the endpoint.

jdearmas · 2023-05-19T21:26:07Z

scenarios/secrets_in_the_cloud/README.md

+3. While examining the admin page's HTML comments, the attacker finds information about environment variables and a HashiCorp endpoint.
+4. By enumerating the scenario's Lambda function, the attacker locates the web application's API key and uses it to obtain the HashiCorp vault token.
+5. The attacker exploits the vault token to log in to the HashiCorp endpoint and acquires the id_rsa key, which grants SSH access to the EC2 instance hosting the web application.
+6. Intrigued by the login message, the attacker queries the EC2 metadata service and discovers that IMDSv2 is in use.


Can you add the commands needed to perform these steps in the cheat sheet?

I think we decided to skip this one

I made some changes to the README walk through and the cheat sheet so they're more descriptive.

jdearmas

This new scenario works.

jdearmas · 2023-06-01T02:02:16Z

scenarios/secrets_in_the_cloud/README.md

@@ -35,12 +35,12 @@ As an IAM user with limited privileges, the attacker initiates their journey by

 1. As the IAM user "low-priv-user", the attacker explores the AWS environment, discovering an S3 bucket containing the URL to a web application hosted on an EC2 instance.
 2. The attacker enumerates the web application and uncovers an admin page that prompts for an API key.
-3. While examining the admin page's HTML comments, the attacker finds information about environment variables and a HashiCorp endpoint.
+3. While examining the admin page's HTML comments, the attacker finds information about environment variables and a HashiCorp endpoint (located on port 8200 of the EC2 instance).
 4. By enumerating the scenario's Lambda function, the attacker locates the web application's API key and uses it to obtain the HashiCorp vault token.
 5. The attacker exploits the vault token to log in to the HashiCorp endpoint and acquires the id_rsa key, which grants SSH access to the EC2 instance hosting the web application.


Can you add the link to where the user will need to download the vault command to the cheat sheet? https://developer.hashicorp.com/vault/downloads

Downloading this tool might be tricky for Docker-only users (aka me). I'll look into how to get around it and add the steps here.

I had to download and mount into the docker container this zip file (https://releases.hashicorp.com/vault/1.13.2/vault_1.13.2_linux_amd64.zip). I would add it as a note for docker-users.

andrew-aiken

Suggested some changes.

Also running a terraform fmt will cleanup some of the formatting issues.

andrew-aiken · 2025-01-15T20:01:02Z

scenarios/secrets_in_the_cloud/terraform/ec2_instance.tf

+  owners = ["amazon"]
+}
+
+provider "tls" {}


The provider should be moved into the provider.tf file

j0eblow · 2025-01-20T19:33:24Z

scenarios/secrets_in_the_cloud/terraform/ec2_instance.tf

+
+resource "aws_instance" "web_app" {
+  ami           = data.aws_ami.amazon_linux_2.id
+  instance_type = "t2.micro"


Thanks for the suggestion! While t3.micro is slightly cheaper, it’s not free-tier eligible in most regions, unlike t2.micro, which might be better for CloudGoat’s learning and testing use cases.

andrew-aiken · 2025-01-15T20:04:23Z

scenarios/secrets_in_the_cloud/terraform/lambda_function.tf

+  filename         = "lambda_function_payload.zip"
+  source_code_hash = filebase64sha256("lambda_function_payload.zip")
+
+  runtime = "python3.8"


Python version should be updated to latest (python3.13)

andrew-aiken · 2025-01-15T20:05:08Z

scenarios/secrets_in_the_cloud/terraform/lambda_function_payload.zip

The Terraform should manage the zipping of the code

andrew-aiken · 2025-01-15T20:08:33Z

scenarios/secrets_in_the_cloud/terraform/provider.tf

@@ -0,0 +1,6 @@
+# This Terraform file initializes the Terraform AWS provider (aka plugin).


Default AWS tags and provider versions should be defined

Example

andrew-aiken · 2025-01-15T20:09:06Z

scenarios/secrets_in_the_cloud/terraform/s3_bucket.tf

+# - An AWS S3 Bucket 
+# - An AWS S3 Object
+
+locals {


Merge local blocks

scenarios/secrets_in_the_cloud/terraform/secrets_manager.tf

andrew-aiken · 2025-01-15T20:10:29Z

scenarios/secrets_in_the_cloud/terraform/user_data.tpl

@@ -0,0 +1,165 @@
+#!/bin/bash


Optional
Move to a templates directory like how ansible does it

andrew-aiken · 2025-01-15T20:11:17Z

scenarios/secrets_in_the_cloud/terraform/variables.tf

@@ -0,0 +1,42 @@
+# This Terraform file creates the following variables:


Add variable description and types.
You can probably copy this from another scenario that has then updated

j0eblow · 2025-01-21T02:54:49Z

Hi all, I ran into an issue while working on this pull request. I accidentally synced my fork with the upstream repository, which caused the branch originally associated with this PR to lose the changes. To recover, I created a new branch (restore-changes) and pushed all the updated changes there.

You can find the updated branch here: https://github.com/j0eblow/cloudgoat/tree/restore-changes

Please let me know how you’d prefer to proceed, whether I should update this pull request with the recovered changes or create a new pull request.

…heat sheet, and updated the global readme to reflect the addition of the new scenario.

Replaced [id] with [web_app_id]

Better word choice for step 5

jdearmas

Hello Mr. Backus,

I sincerely hope this finds you well! I've reviewed, tested, and approve your pull request to create the new Cloudgoat scenario "Secrets in the cloud". Thank you very much for your time, effort, and patience!

j0eblow · 2025-01-24T05:03:11Z

Hello Mr. Backus,

I sincerely hope this finds you well! I've reviewed, tested, and approve your pull request to create the new Cloudgoat scenario "Secrets in the cloud". Thank you very much for your time, effort, and patience!

Thank you, Mr. De Armas! I truly appreciate your time and effort in reviewing and approving the pull request. It means a lot and I’m glad to have contributed to CloudGoat!

jdearmas requested changes May 19, 2023

View reviewed changes

j0eblow requested a review from jdearmas May 24, 2023 09:35

jdearmas previously approved these changes Jun 5, 2023

View reviewed changes

j0eblow dismissed jdearmas’s stale review via 9096961 January 13, 2025 16:55

andrew-aiken suggested changes Jan 15, 2025

View reviewed changes

nobodynate assigned jdearmas Jan 16, 2025

nobodynate added the new scenario A new vulnerable Cloudgoat scenario label Jan 16, 2025

j0eblow and others added 8 commits January 23, 2025 12:38

Add new CloudGoat scenario: Secrets in the Cloud

80169ff

Updated scenario hints and more.

bb6499b

Updated role, profile, etc. for EC2 instance.

9ec0a25

Finishing touches for release. Added scenario readme, path diagram, c…

c8a3457

…heat sheet, and updated the global readme to reflect the addition of the new scenario.

Changes made after John's first review

91f9d2d

Update cheat_sheet.md

ac8caf2

Replaced [id] with [web_app_id]

Update README.md

1990661

Better word choice for step 5

Update secrets in the cloud scenario

3d7b2af

jdearmas force-pushed the secrets_in_the_cloud branch from 9096961 to 3d7b2af Compare January 23, 2025 19:57

jdearmas approved these changes Jan 23, 2025

View reviewed changes

jdearmas merged commit c5a5abc into RhinoSecurityLabs:master Jan 23, 2025

andrew-aiken mentioned this pull request Jan 29, 2025

Update Secrets in the Cloud Terraform #297

Open

		@@ -0,0 +1,6 @@
		# This Terraform file initializes the Terraform AWS provider (aka plugin).

		@@ -0,0 +1,42 @@
		# This Terraform file creates the following variables:

Secrets in the cloud #189

Secrets in the cloud #189

Conversation

j0eblow commented May 9, 2023

jdearmas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

j0eblow May 23, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jdearmas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrew-aiken left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

This comment was marked as resolved.

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

j0eblow commented Jan 21, 2025

jdearmas left a comment

Choose a reason for hiding this comment

j0eblow commented Jan 24, 2025

j0eblow May 23, 2023 •

edited

Loading