Skip to content

Commit a912e7f

Browse files
adanalvarezchristophetd
adanalvarez
and
christophetd
authored
New attack technique: Usage of SendSerialConsoleSSHPublicKey on multiple instances (#599)
* add ec2-send-serial-console-ssh-public-key technique * add ec2-send-serial-console-ssh-public-key docs * fix cloudtrail example * keep ec2 serial console access as it was * Sort imports * Fix potential nil pointer dereference and improve logging * Move enabling/disabling SendSerielConsoleSSHKey to Terraform * Cosmetic improvements and update docs * Change logic for handling initial serial console enablement * Remove unused variable --------- Co-authored-by: Christophe Tafani-Dereeper <[email protected]>
1 parent 1dfcf0c commit a912e7f

File tree

9 files changed

+762
-1
lines changed

9 files changed

+762
-1
lines changed

‎docs/attack-techniques/AWS/aws.lateral-movement.ec2-serial-console-send-ssh-public-key.md

+277
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,277 @@
1+
---
2+
title: Usage of EC2 Serial Console to push SSH public key
3+
---
4+
5+
# Usage of EC2 Serial Console to push SSH public key
6+
7+
<span class="smallcaps w3-badge w3-orange w3-round w3-text-sand" title="This attack technique might be slow to warm up or detonate">slow</span>
8+
<span class="smallcaps w3-badge w3-blue w3-round w3-text-white" title="This attack technique can be detonated multiple times">idempotent</span>
9+
10+
Platform: AWS
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Lateral Movement
16+
17+
## Description
18+
19+
20+
Simulates an attacker using EC2 Instance Connect to push an SSH public key to multiple EC2 instances, using <code>SendSerialConsoleSSHPublicKey</code>. This allows anyone
21+
with the corresponding private key to connect directly to the systems via SSH, assuming they have appropriate network connectivity.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>:
24+
25+
- Create multiple EC2 instances and a VPC (takes a few minutes).
26+
27+
<span style="font-variant: small-caps;">Detonation</span>:
28+
29+
- Adds a public SSH key to the EC2 instances using <code>SendSerialConsoleSSHPublicKey</code>.
30+
31+
References:
32+
33+
- https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSerialConsoleSSHPublicKey.html
34+
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
35+
- https://fwdcloudsec.org/assets/presentations/2024/europe/sebastian-walla-cloud-conscious-tactics-techniques-and-procedures-an-overview.pdf
36+
- https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques/
37+
- https://unit42.paloaltonetworks.com/cloud-virtual-machine-attack-vectors/
38+
39+
40+
## Instructions
41+
42+
```bash title="Detonate with Stratus Red Team"
43+
stratus detonate aws.lateral-movement.ec2-serial-console-send-ssh-public-key
44+
```
45+
## Detection
46+
47+
48+
Identify, through CloudTrail's <code>SendSerialConsoleSSHPublicKey</code> event, when a user is adding an SSH key to EC2 instances.
49+
50+
51+
52+
## Detonation logs <span class="smallcaps w3-badge w3-light-green w3-round w3-text-sand">new!</span>
53+
54+
The following CloudTrail events are generated when this technique is detonated[^1]:
55+
56+
57+
- `ec2-instance-connect:SendSerialConsoleSSHPublicKey`
58+
59+
- `ec2:EnableSerialConsoleAccess`
60+
61+
62+
??? "View raw detonation logs"
63+
64+
```json hl_lines="6 57 109 161"
65+
66+
[
67+
{
68+
"awsRegion": "cniso-east-3r",
69+
"eventCategory": "Management",
70+
"eventID": "37ba412b-f943-44f2-ae48-4527f6e789d9",
71+
"eventName": "EnableSerialConsoleAccess",
72+
"eventSource": "ec2.amazonaws.com",
73+
"eventTime": "2024-11-26T15:35:22Z",
74+
"eventType": "AwsApiCall",
75+
"eventVersion": "1.10",
76+
"managementEvent": true,
77+
"readOnly": false,
78+
"recipientAccountId": "844015365555",
79+
"requestID": "e110338f-cc06-4284-bf16-6528a7df1561",
80+
"requestParameters": {
81+
"EnableSerialConsoleAccessRequest": ""
82+
},
83+
"responseElements": {
84+
"EnableSerialConsoleAccessResponse": {
85+
"requestId": "e110338f-cc06-4284-bf16-6528a7df1561",
86+
"serialConsoleAccessEnabled": true,
87+
"xmlns": "http://ec2.amazonaws.com/doc/2016-11-15/"
88+
}
89+
},
90+
"sourceIPAddress": "201.252.42.03",
91+
"tlsDetails": {
92+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
93+
"clientProvidedHostHeader": "ec2.cniso-east-3r.amazonaws.com",
94+
"tlsVersion": "TLSv1.3"
95+
},
96+
"userAgent": "stratus-red-team_b0fedc91-bd4a-4ba1-a776-80e707fef2a0",
97+
"userIdentity": {
98+
"accessKeyId": "ASIA2HJRQF0DHNYEE9N1",
99+
"accountId": "844015365555",
100+
"arn": "arn:aws:sts::844015365555:assumed-role/[email protected]",
101+
"principalId": "AROAEMHZD694LU95MUYOP:[email protected]",
102+
"sessionContext": {
103+
"attributes": {
104+
"creationDate": "2024-11-26T15:14:58Z",
105+
"mfaAuthenticated": "false"
106+
},
107+
"sessionIssuer": {
108+
"accountId": "844015365555",
109+
"arn": "arn:aws:iam::844015365555:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_account-admin_599c9e90e350d2ff",
110+
"principalId": "AROAEMHZD694LU95MUYOP",
111+
"type": "Role",
112+
"userName": "AWSReservedSSO_account-admin_599c9e90e350d2ff"
113+
}
114+
},
115+
"type": "AssumedRole"
116+
}
117+
},
118+
{
119+
"awsRegion": "cniso-east-3r",
120+
"eventCategory": "Management",
121+
"eventID": "787b2464-f27b-4d4c-91bc-6396f2297d0e",
122+
"eventName": "SendSerialConsoleSSHPublicKey",
123+
"eventSource": "ec2-instance-connect.amazonaws.com",
124+
"eventTime": "2024-11-26T15:35:23Z",
125+
"eventType": "AwsApiCall",
126+
"eventVersion": "1.08",
127+
"managementEvent": true,
128+
"readOnly": false,
129+
"recipientAccountId": "844015365555",
130+
"requestID": "c74b1e77-bc91-4174-b297-d06a71c89abf",
131+
"requestParameters": {
132+
"instanceId": "i-EFCb4e480CAbc4CF9",
133+
"monitorMode": false,
134+
"sSHPublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtAlK45MAEWZ7MUY2QEmi3M6W+peGL3VCrc0qH54xRu",
135+
"serialPort": 0
136+
},
137+
"responseElements": {
138+
"requestId": "c74b1e77-bc91-4174-b297-d06a71c89abf",
139+
"success": true
140+
},
141+
"sourceIPAddress": "201.252.42.03",
142+
"tlsDetails": {
143+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
144+
"clientProvidedHostHeader": "ec2-instance-connect.cniso-east-3r.amazonaws.com",
145+
"tlsVersion": "TLSv1.3"
146+
},
147+
"userAgent": "stratus-red-team_b0fedc91-bd4a-4ba1-a776-80e707fef2a0",
148+
"userIdentity": {
149+
"accessKeyId": "ASIA2HJRQF0DHNYEE9N1",
150+
"accountId": "844015365555",
151+
"arn": "arn:aws:sts::844015365555:assumed-role/[email protected]",
152+
"principalId": "AROAEMHZD694LU95MUYOP:[email protected]",
153+
"sessionContext": {
154+
"attributes": {
155+
"creationDate": "2024-11-26T15:14:58Z",
156+
"mfaAuthenticated": "false"
157+
},
158+
"sessionIssuer": {
159+
"accountId": "844015365555",
160+
"arn": "arn:aws:iam::844015365555:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_account-admin_599c9e90e350d2ff",
161+
"principalId": "AROAEMHZD694LU95MUYOP",
162+
"type": "Role",
163+
"userName": "AWSReservedSSO_account-admin_599c9e90e350d2ff"
164+
},
165+
"webIdFederationData": {}
166+
},
167+
"type": "AssumedRole"
168+
}
169+
},
170+
{
171+
"awsRegion": "cniso-east-3r",
172+
"eventCategory": "Management",
173+
"eventID": "e49972cb-b394-43e2-aab5-602f1fb56f85",
174+
"eventName": "SendSerialConsoleSSHPublicKey",
175+
"eventSource": "ec2-instance-connect.amazonaws.com",
176+
"eventTime": "2024-11-26T15:35:23Z",
177+
"eventType": "AwsApiCall",
178+
"eventVersion": "1.08",
179+
"managementEvent": true,
180+
"readOnly": false,
181+
"recipientAccountId": "844015365555",
182+
"requestID": "d392c0ca-351f-472f-9ca3-b411beb9df9c",
183+
"requestParameters": {
184+
"instanceId": "i-B2ABDCa5b78E0f1dd",
185+
"monitorMode": false,
186+
"sSHPublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtAlK45MAEWZ7MUY2QEmi3M6W+peGL3VCrc0qH54xRu",
187+
"serialPort": 0
188+
},
189+
"responseElements": {
190+
"requestId": "d392c0ca-351f-472f-9ca3-b411beb9df9c",
191+
"success": true
192+
},
193+
"sourceIPAddress": "201.252.42.03",
194+
"tlsDetails": {
195+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
196+
"clientProvidedHostHeader": "ec2-instance-connect.cniso-east-3r.amazonaws.com",
197+
"tlsVersion": "TLSv1.3"
198+
},
199+
"userAgent": "stratus-red-team_b0fedc91-bd4a-4ba1-a776-80e707fef2a0",
200+
"userIdentity": {
201+
"accessKeyId": "ASIA2HJRQF0DHNYEE9N1",
202+
"accountId": "844015365555",
203+
"arn": "arn:aws:sts::844015365555:assumed-role/[email protected]",
204+
"principalId": "AROAEMHZD694LU95MUYOP:[email protected]",
205+
"sessionContext": {
206+
"attributes": {
207+
"creationDate": "2024-11-26T15:14:58Z",
208+
"mfaAuthenticated": "false"
209+
},
210+
"sessionIssuer": {
211+
"accountId": "844015365555",
212+
"arn": "arn:aws:iam::844015365555:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_account-admin_599c9e90e350d2ff",
213+
"principalId": "AROAEMHZD694LU95MUYOP",
214+
"type": "Role",
215+
"userName": "AWSReservedSSO_account-admin_599c9e90e350d2ff"
216+
},
217+
"webIdFederationData": {}
218+
},
219+
"type": "AssumedRole"
220+
}
221+
},
222+
{
223+
"awsRegion": "cniso-east-3r",
224+
"eventCategory": "Management",
225+
"eventID": "f4dc86c9-6b22-4643-a0e8-fcb97fcfae68",
226+
"eventName": "SendSerialConsoleSSHPublicKey",
227+
"eventSource": "ec2-instance-connect.amazonaws.com",
228+
"eventTime": "2024-11-26T15:35:22Z",
229+
"eventType": "AwsApiCall",
230+
"eventVersion": "1.08",
231+
"managementEvent": true,
232+
"readOnly": false,
233+
"recipientAccountId": "844015365555",
234+
"requestID": "88c8e41e-7754-4377-983f-140f8ca5617e",
235+
"requestParameters": {
236+
"instanceId": "i-D46eD8FCdefED5aAE",
237+
"monitorMode": false,
238+
"sSHPublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtAlK45MAEWZ7MUY2QEmi3M6W+peGL3VCrc0qH54xRu",
239+
"serialPort": 0
240+
},
241+
"responseElements": {
242+
"requestId": "88c8e41e-7754-4377-983f-140f8ca5617e",
243+
"success": true
244+
},
245+
"sourceIPAddress": "201.252.42.03",
246+
"tlsDetails": {
247+
"cipherSuite": "TLS_AES_128_GCM_SHA256",
248+
"clientProvidedHostHeader": "ec2-instance-connect.cniso-east-3r.amazonaws.com",
249+
"tlsVersion": "TLSv1.3"
250+
},
251+
"userAgent": "stratus-red-team_b0fedc91-bd4a-4ba1-a776-80e707fef2a0",
252+
"userIdentity": {
253+
"accessKeyId": "ASIA2HJRQF0DHNYEE9N1",
254+
"accountId": "844015365555",
255+
"arn": "arn:aws:sts::844015365555:assumed-role/[email protected]",
256+
"principalId": "AROAEMHZD694LU95MUYOP:[email protected]",
257+
"sessionContext": {
258+
"attributes": {
259+
"creationDate": "2024-11-26T15:14:58Z",
260+
"mfaAuthenticated": "false"
261+
},
262+
"sessionIssuer": {
263+
"accountId": "844015365555",
264+
"arn": "arn:aws:iam::844015365555:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_account-admin_599c9e90e350d2ff",
265+
"principalId": "AROAEMHZD694LU95MUYOP",
266+
"type": "Role",
267+
"userName": "AWSReservedSSO_account-admin_599c9e90e350d2ff"
268+
},
269+
"webIdFederationData": {}
270+
},
271+
"type": "AssumedRole"
272+
}
273+
}
274+
]
275+
```
276+
277+
[^1]: These logs have been gathered from a real detonation of this technique in a test environment using [Grimoire](https://github.com/DataDog/grimoire), and anonymized using [LogLicker](https://github.com/Permiso-io-tools/LogLicker).

‎docs/attack-techniques/AWS/index.md

+2
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,8 @@ Note that some Stratus attack techniques may correspond to more than a single AT
8585

8686
## Lateral Movement
8787

88+
- [Usage of EC2 Serial Console to push SSH public key](./aws.lateral-movement.ec2-serial-console-send-ssh-public-key.md)
89+
8890
- [Usage of EC2 Instance Connect on multiple instances](./aws.lateral-movement.ec2-instance-connect.md)
8991

9092

‎docs/attack-techniques/list.md

+1
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ This page contains the list of all Stratus Attack Techniques.
3838
| [S3 Ransomware through client-side encryption](./AWS/aws.impact.s3-ransomware-client-side-encryption.md) | [AWS](./AWS/index.md) | Impact |
3939
| [S3 Ransomware through individual file deletion](./AWS/aws.impact.s3-ransomware-individual-deletion.md) | [AWS](./AWS/index.md) | Impact |
4040
| [Console Login without MFA](./AWS/aws.initial-access.console-login-without-mfa.md) | [AWS](./AWS/index.md) | Initial Access |
41+
| [Usage of EC2 Serial Console to push SSH public key](./AWS/aws.lateral-movement.ec2-serial-console-send-ssh-public-key.md) | [AWS](./AWS/index.md) | Lateral Movement |
4142
| [Usage of EC2 Instance Connect on multiple instances](./AWS/aws.lateral-movement.ec2-instance-connect.md) | [AWS](./AWS/index.md) | Lateral Movement |
4243
| [Backdoor an IAM Role](./AWS/aws.persistence.iam-backdoor-role.md) | [AWS](./AWS/index.md) | Persistence |
4344
| [Create an Access Key on an IAM User](./AWS/aws.persistence.iam-backdoor-user.md) | [AWS](./AWS/index.md) | Persistence, Privilege Escalation |

0 commit comments

Comments
 (0)