Skip to content

Commit a76bd4a

Browse files
christophetdchristophetd
authored
New AWS attack technique: Update IAM user login profile #554 (#558)
* New AWS attack technique: Update IAM user login profile (closes #554) * Allow specifying a custom detonation ID * Add better contributing docs * docs generation: sort event names to avoid non-deterministic output * terraform fmt
1 parent 080eec0 commit a76bd4a

18 files changed

+331
-21
lines changed

‎docs/attack-techniques/AWS/aws.credential-access.ec2-steal-instance-credentials.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,15 @@ See also: [Known detection bypasses](https://hackingthe.cloud/aws/avoiding-detec
5454
The following CloudTrail events are generated when this technique is detonated[^1]:
5555

5656

57-
- `ssm:SendCommand`
57+
- `ec2:DescribeInstances`
5858

5959
- `ssm:DescribeInstanceInformation`
6060

61-
- `sts:GetCallerIdentity`
61+
- `ssm:GetCommandInvocation`
6262

63-
- `ec2:DescribeInstances`
63+
- `ssm:SendCommand`
6464

65-
- `ssm:GetCommandInvocation`
65+
- `sts:GetCallerIdentity`
6666

6767

6868
??? "View raw detonation logs"

‎docs/attack-techniques/AWS/aws.defense-evasion.organizations-leave.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,10 @@ Use the CloudTrail event <code>LeaveOrganization</code>.
4949
The following CloudTrail events are generated when this technique is detonated[^1]:
5050

5151

52-
- `sts:AssumeRole`
53-
5452
- `organizations:LeaveOrganization`
5553

54+
- `sts:AssumeRole`
55+
5656

5757
??? "View raw detonation logs"
5858

‎docs/attack-techniques/AWS/aws.execution.ec2-user-data.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -61,14 +61,14 @@ provisioned before instantiation.
6161
The following CloudTrail events are generated when this technique is detonated[^1]:
6262

6363

64-
- `ec2:ModifyInstanceAttribute`
65-
66-
- `ec2:StopInstances`
67-
6864
- `ec2:DescribeInstances`
6965

66+
- `ec2:ModifyInstanceAttribute`
67+
7068
- `ec2:StartInstances`
7169

70+
- `ec2:StopInstances`
71+
7272

7373
??? "View raw detonation logs"
7474

‎docs/attack-techniques/AWS/aws.execution.ssm-start-session.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ Identify, through CloudTrail's <code>StartSession</code> event, when a user is s
6666
The following CloudTrail events are generated when this technique is detonated[^1]:
6767

6868

69-
- `ssm:TerminateSession`
69+
- `ssm:DescribeInstanceInformation`
7070

7171
- `ssm:StartSession`
7272

73-
- `ssm:DescribeInstanceInformation`
73+
- `ssm:TerminateSession`
7474

7575

7676
??? "View raw detonation logs"

‎docs/attack-techniques/AWS/aws.persistence.iam-create-backdoor-role.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -84,10 +84,10 @@ which generates a finding when a role can be assumed from a new AWS account or p
8484
The following CloudTrail events are generated when this technique is detonated[^1]:
8585

8686

87-
- `iam:CreateRole`
88-
8987
- `iam:AttachRolePolicy`
9088

89+
- `iam:CreateRole`
90+
9191

9292
??? "View raw detonation logs"
9393

‎docs/attack-techniques/AWS/aws.persistence.iam-create-user-login-profile.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,11 @@ In particular, it's suspicious when these events occur on IAM users intended to
5858
The following CloudTrail events are generated when this technique is detonated[^1]:
5959

6060

61-
- `sts:GetCallerIdentity`
61+
- `iam:CreateLoginProfile`
6262

6363
- `iam:DeleteLoginProfile`
6464

65-
- `iam:CreateLoginProfile`
65+
- `sts:GetCallerIdentity`
6666

6767

6868
??? "View raw detonation logs"

‎docs/attack-techniques/AWS/aws.persistence.rolesanywhere-create-trust-anchor.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,10 @@ Identify when a trust anchor is created, through CloudTrail's <code>CreateTrustA
5858
The following CloudTrail events are generated when this technique is detonated[^1]:
5959

6060

61-
- `rolesanywhere:CreateTrustAnchor`
62-
6361
- `rolesanywhere:CreateProfile`
6462

63+
- `rolesanywhere:CreateTrustAnchor`
64+
6565

6666
??? "View raw detonation logs"
6767

‎docs/attack-techniques/AWS/aws.privilege-escalation.iam-update-user-login-profile.md

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
title: Change IAM user password
3+
---
4+
5+
# Change IAM user password
6+
7+
8+
<span class="smallcaps w3-badge w3-blue w3-round w3-text-white" title="This attack technique can be detonated multiple times">idempotent</span>
9+
10+
Platform: AWS
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Privilege Escalation
16+
17+
## Description
18+
19+
20+
Establishes persistence by updating a Login Profile on an existing IAM user to change its password. This allows an attacker to hijack
21+
an IAM user with an existing login profile.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>:
24+
25+
- Create an IAM user with a login profile
26+
27+
<span style="font-variant: small-caps;">Detonation</span>:
28+
29+
- Update the user's login profile to change its password
30+
31+
References:
32+
33+
- https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me
34+
- https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/
35+
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
36+
37+
38+
## Instructions
39+
40+
```bash title="Detonate with Stratus Red Team"
41+
stratus detonate aws.privilege-escalation.iam-update-user-login-profile
42+
```
43+
## Detection
44+
45+
46+
Through CloudTrail's <code>UpdateLoginProfile</code> events.
47+
48+
49+
50+
## Detonation logs <span class="smallcaps w3-badge w3-light-green w3-round w3-text-sand">new!</span>
51+
52+
The following CloudTrail events are generated when this technique is detonated[^1]:
53+
54+
55+
- `iam:UpdateLoginProfile`
56+
57+
58+
??? "View raw detonation logs"
59+
60+
```json hl_lines="6"
61+
62+
[
63+
{
64+
"awsRegion": "megov-southcentral-3r",
65+
"eventCategory": "Management",
66+
"eventID": "a46a1a42-9ef1-48d4-9c61-507eb6d4019f",
67+
"eventName": "UpdateLoginProfile",
68+
"eventSource": "iam.amazonaws.com",
69+
"eventTime": "2024-08-28T09:54:40Z",
70+
"eventType": "AwsApiCall",
71+
"eventVersion": "1.09",
72+
"managementEvent": true,
73+
"readOnly": false,
74+
"recipientAccountId": "763751499319",
75+
"requestID": "bd8967e5-b80d-48cd-b8b5-45c9905a4a7f",
76+
"requestParameters": {
77+
"userName": "stratus-red-team-update-login-profile-user"
78+
},
79+
"responseElements": null,
80+
"sourceIPAddress": "212.3.253.233",
81+
"tlsDetails": {
82+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
83+
"clientProvidedHostHeader": "iam.amazonaws.com",
84+
"tlsVersion": "TLSv1.3"
85+
},
86+
"userAgent": "stratus-red-team_33d1bcd6-0716-4e7f-a145-8a75625cf180",
87+
"userIdentity": {
88+
"accessKeyId": "AKIAV1MIS7NGMDMR83FC",
89+
"accountId": "763751499319",
90+
"arn": "arn:aws:iam::763751499319:user/christophe",
91+
"principalId": "AIDAXYBG3LDVX65FGD9O",
92+
"type": "IAMUser",
93+
"userName": "christophe"
94+
}
95+
}
96+
]
97+
```
98+
99+
[^1]: These logs have been gathered from a real detonation of this technique in a test environment using [Grimoire](https://github.com/DataDog/grimoire), and anonymized using [LogLicker](https://github.com/Permiso-io-tools/LogLicker).

‎docs/attack-techniques/AWS/index.md

+2
Original file line numberDiff line numberDiff line change
@@ -121,3 +121,5 @@ Note that some Stratus attack techniques may correspond to more than a single AT
121121

122122
- [Create an IAM Roles Anywhere trust anchor](./aws.persistence.rolesanywhere-create-trust-anchor.md)
123123

124+
- [Change IAM user password](./aws.privilege-escalation.iam-update-user-login-profile.md)
125+

‎docs/attack-techniques/list.md

+1
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ This page contains the list of all Stratus Attack Techniques.
4747
| [Add a Malicious Lambda Extension](./AWS/aws.persistence.lambda-layer-extension.md) | [AWS](./AWS/index.md) | Persistence, Privilege Escalation |
4848
| [Overwrite Lambda Function Code](./AWS/aws.persistence.lambda-overwrite-code.md) | [AWS](./AWS/index.md) | Persistence |
4949
| [Create an IAM Roles Anywhere trust anchor](./AWS/aws.persistence.rolesanywhere-create-trust-anchor.md) | [AWS](./AWS/index.md) | Persistence, Privilege Escalation |
50+
| [Change IAM user password](./AWS/aws.privilege-escalation.iam-update-user-login-profile.md) | [AWS](./AWS/index.md) | Privilege Escalation |
5051
| [Execute Command on Virtual Machine using Custom Script Extension](./azure/azure.execution.vm-custom-script-extension.md) | [Azure](./azure/index.md) | Execution |
5152
| [Execute Commands on Virtual Machine using Run Command](./azure/azure.execution.vm-run-command.md) | [Azure](./azure/index.md) | Execution |
5253
| [Export Disk Through SAS URL](./azure/azure.exfiltration.disk-export.md) | [Azure](./azure/index.md) | Exfiltration |

‎docs/contributing.md

+34
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,40 @@ We welcome pull requests, contributions and feedback! For any bug report or feed
66

77
Stratus Red Team is opinionated in the attack techniques it packages - see [Philosophy](./attack-techniques/philosophy.md). Feel free to open an issue to discuss ideas about new attack techniques. You can see the current backlog using the GitHub issue label [`new-technique`](https://github.com/DataDog/stratus-red-team/issues?q=is%3Aissue+is%3Aopen+label%3Anew-technique).
88

9+
To create a new attack technique:
10+
1. Create a new folder under `v2/internal/attacktechniques/your-cloud/your-mitre-attack-tactic/your-attack-name`
11+
2. Create a `main.go` file that contains the detonation (and optionally, the revert) behavior. See for example [cloudtrail-stop/main.go](https://github.com/DataDog/stratus-red-team/blob/main/v2/internal/attacktechniques/aws/defense-evasion/cloudtrail-stop/main.go)
12+
3. If your attack technique contains pre-requisites, create a `main.tf` file
13+
4. Add your attack technique to the imports of `v2/internal/attacktechniques/main.go`
14+
15+
To generate the logs dataset using [Grimoire](https://github.com/DataDog/grimoire):
16+
1. Install Grimoire
17+
2. Run the following to detonate the attack and retrieve CloudTrail logs:
18+
19+
```bash
20+
# Build your local Stratus Red Team version
21+
make
22+
23+
# Generate cloud audit logs
24+
./bin/stratus warmup your-attack
25+
grimoire shell --command 'export STRATUS_RED_TEAM_DETONATION_ID=$GRIMOIRE_DETONATION_ID; ./bin/stratus detonate your-attack' -o /tmp/your-attack.json
26+
# Press Ctrl+C once you see the expected events
27+
./bin/stratus cleanup your-attack
28+
```
29+
30+
3. Anonymize the logs using [LogLicker](https://github.com/Permiso-io-tools/LogLicker):
31+
32+
```bash
33+
# Note: see https://github.com/Permiso-io-tools/LogLicker/issues/5 for a currently necessary patch
34+
../LogLicker/venv/bin/python ../LogLicker/RunLogLicker.py rawtext -ifp /tmp/your-attack.json -ofp ./docs/detonation-logs/your-attack.json
35+
```
36+
37+
4. Generate the docs:
38+
39+
```bash
40+
make docs
41+
```
42+
943
## Contributing to the core of Stratus Red Team
1044

1145
When contributing to the core of Stratus Red Team (i.e. anything that is not a new attack technique), include unit tests if applicable.

‎docs/detonation-logs/aws.privilege-escalation.iam-update-user-login-profile.json

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
[
2+
{
3+
"awsRegion": "megov-southcentral-3r",
4+
"eventCategory": "Management",
5+
"eventID": "a46a1a42-9ef1-48d4-9c61-507eb6d4019f",
6+
"eventName": "UpdateLoginProfile",
7+
"eventSource": "iam.amazonaws.com",
8+
"eventTime": "2024-08-28T09:54:40Z",
9+
"eventType": "AwsApiCall",
10+
"eventVersion": "1.09",
11+
"managementEvent": true,
12+
"readOnly": false,
13+
"recipientAccountId": "763751499319",
14+
"requestID": "bd8967e5-b80d-48cd-b8b5-45c9905a4a7f",
15+
"requestParameters": {
16+
"userName": "stratus-red-team-update-login-profile-user"
17+
},
18+
"responseElements": null,
19+
"sourceIPAddress": "212.3.253.233",
20+
"tlsDetails": {
21+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
22+
"clientProvidedHostHeader": "iam.amazonaws.com",
23+
"tlsVersion": "TLSv1.3"
24+
},
25+
"userAgent": "stratus-red-team_33d1bcd6-0716-4e7f-a145-8a75625cf180",
26+
"userIdentity": {
27+
"accessKeyId": "AKIAV1MIS7NGMDMR83FC",
28+
"accountId": "763751499319",
29+
"arn": "arn:aws:iam::763751499319:user/christophe",
30+
"principalId": "AIDAXYBG3LDVX65FGD9O",
31+
"type": "IAMUser",
32+
"userName": "christophe"
33+
}
34+
}
35+
]

‎docs/index.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,13 @@ AWS:
329329
- Privilege Escalation
330330
platform: AWS
331331
isIdempotent: false
332+
- id: aws.privilege-escalation.iam-update-user-login-profile
333+
name: Change IAM user password
334+
isSlow: false
335+
mitreAttackTactics:
336+
- Privilege Escalation
337+
platform: AWS
338+
isIdempotent: true
332339
EKS:
333340
Lateral Movement:
334341
- id: eks.lateral-movement.create-access-entry

‎v2/internal/attacktechniques/aws/privilege-escalation/change-iam-user-password/main.go

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package aws
2+
3+
import (
4+
"context"
5+
_ "embed"
6+
"errors"
7+
"github.com/aws/aws-sdk-go-v2/service/iam"
8+
"github.com/datadog/stratus-red-team/v2/internal/utils"
9+
"github.com/datadog/stratus-red-team/v2/pkg/stratus"
10+
"github.com/datadog/stratus-red-team/v2/pkg/stratus/mitreattack"
11+
"log"
12+
)
13+
14+
//go:embed main.tf
15+
var tf []byte
16+
17+
func init() {
18+
stratus.GetRegistry().RegisterAttackTechnique(&stratus.AttackTechnique{
19+
ID: "aws.privilege-escalation.iam-update-user-login-profile",
20+
FriendlyName: "Change IAM user password",
21+
Description: `
22+
Establishes persistence by updating a Login Profile on an existing IAM user to change its password. This allows an attacker to hijack
23+
an IAM user with an existing login profile.
24+
25+
Warm-up:
26+
27+
- Create an IAM user with a login profile
28+
29+
Detonation:
30+
31+
- Update the user's login profile to change its password
32+
33+
References:
34+
35+
- https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me
36+
- https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/
37+
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
38+
`,
39+
Detection: `
40+
Through CloudTrail's <code>UpdateLoginProfile</code> events.
41+
`,
42+
Platform: stratus.AWS,
43+
IsIdempotent: true,
44+
MitreAttackTactics: []mitreattack.Tactic{mitreattack.PrivilegeEscalation},
45+
PrerequisitesTerraformCode: tf,
46+
Detonate: detonate,
47+
})
48+
}
49+
50+
func detonate(params map[string]string, providers stratus.CloudProviders) error {
51+
iamClient := iam.NewFromConfig(providers.AWS().GetConnection())
52+
userName := params["user_name"]
53+
newPassword := utils.RandomString(16) + ".#1Aa" // extra characters to ensure we meet password requirements, no matter the password policy
54+
55+
log.Println("Changing console password for IAM user " + userName)
56+
_, err := iamClient.UpdateLoginProfile(context.Background(), &iam.UpdateLoginProfileInput{
57+
UserName: &userName,
58+
Password: &newPassword,
59+
})
60+
if err != nil {
61+
return errors.New("unable to update IAM login profile: " + err.Error())
62+
}
63+
64+
accountId, _ := utils.GetCurrentAccountId(providers.AWS().GetConnection())
65+
log.Println("Updated console password for user")
66+
loginUrl := "https://" + accountId + ".signin.aws.amazon.com/console"
67+
log.Println("You can log in at: " + loginUrl)
68+
log.Println("User name: " + userName)
69+
log.Println("Password: " + newPassword)
70+
71+
return nil
72+
}

0 commit comments

Comments
 (0)