bcoles
127 lines
3.9 KiB
Ruby
127 lines
3.9 KiB
Ruby
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
require 'aws-sdk-iam'
|
|
|
|
class MetasploitModule < Msf::Auxiliary
|
|
def initialize(info = {})
|
|
super(
|
|
update_info(
|
|
info,
|
|
'Name' => 'Amazon Web Services IAM credential enumeration',
|
|
'Description' => %q{
|
|
Provided AWS credentials, this module will call the authenticated
|
|
API of Amazon Web Services to list all IAM credentials associated
|
|
with the account
|
|
},
|
|
'Author' => ['Aaron Soto <aaron.soto@rapid7.com>'],
|
|
'License' => MSF_LICENSE,
|
|
'Notes' => {
|
|
'Stability' => [CRASH_SAFE],
|
|
'SideEffects' => [IOC_IN_LOGS],
|
|
'Reliability' => []
|
|
}
|
|
)
|
|
)
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']),
|
|
OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', ''])
|
|
]
|
|
)
|
|
end
|
|
|
|
def handle_aws_errors(error)
|
|
if error.class.module_parents.include?(Aws)
|
|
fail_with(Failure::UnexpectedReply, error.message)
|
|
else
|
|
raise error
|
|
end
|
|
end
|
|
|
|
def describe_iam_users(user)
|
|
print_good " User Name: #{user.user_name}"
|
|
print_good " User ID: #{user.user_id}"
|
|
print_good " Creation Date: #{user.create_date}"
|
|
print_good " Tags: #{user.tags}"
|
|
print_good " Groups: #{user.group_list}"
|
|
print_good " SSH Pub Keys: #{@iam.list_ssh_public_keys(user_name: user.user_name).ssh_public_keys}"
|
|
|
|
policies = user.attached_managed_policies
|
|
if policies.empty?
|
|
print_good ' Policies: []'
|
|
else
|
|
print_good " Policies: #{policies[0].policy_name}"
|
|
policies[1..policies.length].each do |p|
|
|
print_good " #{p.policy_name}"
|
|
end
|
|
end
|
|
|
|
certs = @iam.list_signing_certificates(user_name: user.user_name).certificates
|
|
if certs.empty?
|
|
print_good ' Signing certs: []'
|
|
else
|
|
print_good " Signing certs: #{certs[0].certificate_id} (#{certs[0].status})"
|
|
certs[1..certs.length].each do |c|
|
|
print_good " #{c.certificate_id} (#{c.status})"
|
|
end
|
|
end
|
|
|
|
@users.each do |u|
|
|
if u.user_name == user.user_name
|
|
print_good " Password Used: #{u.password_last_used || '(Never)'}"
|
|
end
|
|
end
|
|
|
|
keys = @iam.list_access_keys(user_name: user.user_name).access_key_metadata
|
|
if keys.empty?
|
|
print_good ' AWS Access Keys: []'
|
|
else
|
|
print_good " AWS Access Keys: #{keys[0].access_key_id} (#{keys[0].status})"
|
|
keys[1..keys.length].each do |k|
|
|
print_good " #{k.access_key_id} (#{k.status})"
|
|
end
|
|
end
|
|
|
|
begin
|
|
console_login = @iam.get_login_profile(user_name: user.user_name).empty? ? 'Disabled' : 'Enabled'
|
|
print_good " Console login: #{console_login}"
|
|
rescue Aws::IAM::Errors::NoSuchEntity
|
|
print_good ' Console login: Disabled'
|
|
end
|
|
|
|
mfa = @iam.list_mfa_devices(user_name: user.user_name).mfa_devices
|
|
mfa_enabled = mfa.empty? ? 'Disabled' : "Enabled on #{mfa[0].enable_date}"
|
|
print_good " Two-factor auth: #{mfa_enabled}"
|
|
|
|
print_status ''
|
|
end
|
|
|
|
def run
|
|
@iam = Aws::IAM::Client.new(
|
|
region: 'us-west-1', # This is meaningless, but required. Thanks AWS.
|
|
access_key_id: datastore['ACCESS_KEY_ID'],
|
|
secret_access_key: datastore['SECRET_ACCESS_KEY']
|
|
)
|
|
|
|
@users = @iam.list_users.users
|
|
creds = @iam.get_account_authorization_details
|
|
|
|
users = creds.user_detail_list
|
|
if users.empty?
|
|
print_status 'No users found.'
|
|
return
|
|
end
|
|
|
|
print_good "Found #{users.count} users."
|
|
users.each do |user|
|
|
describe_iam_users(user)
|
|
end
|
|
rescue StandardError => e
|
|
handle_aws_errors(e)
|
|
end
|
|
end
|