Skip to content

Commit c34afc0

Browse files
christophetdchristophetd
authored
Implement initial EKS support and first attack techniques (#542)
* Implement initial EKS support and first attack technique (closes #374, #540) * Add new EKS attack technique: backdoor EKS aws-auth configmap (closes #375) * Bump AWS Go SDK * Bump Go version from 1.18 to 1.19 * Update docs * Replace io/ioutil with io due to the bump to Go 1.19
1 parent cea6917 commit c34afc0

File tree

22 files changed

+751
-25
lines changed

22 files changed

+751
-25
lines changed

‎.github/workflows/release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
- name: Set up Go
4242
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
4343
with:
44-
go-version: 1.18
44+
go-version: 1.19
4545
- name: Run GoReleaser
4646
timeout-minutes: 60
4747
uses: goreleaser/goreleaser-action@c21f56a7bc891b5f73bec61233c4102ef8273150 # v5.0.0

‎.github/workflows/static-analysis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
- name: Set up Go
3737
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
3838
with:
39-
go-version: 1.18
39+
go-version: 1.19
4040
- uses: dominikh/staticcheck-action@ba605356b4b29a60e87ab9404b712f3461e566dc
4141
with:
4242
version: "2022.1"

‎.github/workflows/test.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
- name: Set up Go
3535
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
3636
with:
37-
go-version: 1.18
37+
go-version: 1.19
3838

3939
- name: Run unit tests
4040
run: make test

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ See the documentation at **[stratus-red-team.cloud](https://stratus-red-team.clo
3333

3434
### Direct install
3535

36-
Requires Go 1.18+
36+
Requires Go 1.19+
3737

3838
```
3939
go install -v github.com/datadog/stratus-red-team/v2/cmd/stratus@latest

‎docs/attack-techniques/EKS/eks.lateral-movement.create-access-entry.md

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
title: Create Admin EKS Access Entry
3+
---
4+
5+
# Create Admin EKS Access Entry
6+
7+
8+
9+
10+
Platform: EKS
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Lateral Movement
16+
17+
## Description
18+
19+
20+
Uses the EKS Cluster Access Management to assign cluster administrator privileges to an IAM role. This allows the role to perform any action inside the Kubernetes cluster.
21+
22+
<span style="font-variant: small-caps;">Warm-up</span>:
23+
24+
- Create an IAM role
25+
26+
<span style="font-variant: small-caps;">Detonation</span>:
27+
28+
- Create an access entry for the IAM role
29+
- Associate the access entry with the AmazonEKSClusterAdminPolicy access policy
30+
31+
References:
32+
33+
- https://securitylabs.datadoghq.com/articles/eks-cluster-access-management-deep-dive/
34+
- https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html
35+
36+
37+
## Instructions
38+
39+
```bash title="Detonate with Stratus Red Team"
40+
stratus detonate eks.lateral-movement.create-access-entry
41+
```
42+
## Detection
43+
44+
45+
You can use the following CloudTrail events to identify when someone grants access to your EKS cluster:
46+
47+
- **CreateAccessEntry**, when someone creates an access entry for a principal (meaning it's the first this principal is granted privileges in the cluster)':
48+
49+
```json
50+
{
51+
"eventSource": "eks.amazonaws.com",
52+
"eventName": "CreateAccessEntry",
53+
"requestParameters": {
54+
"name": "eks-cluster",
55+
"principalArn": "arn:aws:iam::012345678901:role/stratus-red-team-eks-create-access-entry-role"
56+
},
57+
"responseElements": {
58+
"accessEntry": {
59+
"clusterName": "eks-cluster",
60+
"type": "STANDARD",
61+
"principalArn": "arn:aws:iam::012345678901:role/stratus-red-team-eks-create-access-entry-role",
62+
}
63+
}
64+
}
65+
```
66+
67+
68+
- **AssociateAccessPolicy**: when someone assigns an access policy to a principal
69+
70+
```json
71+
{
72+
"eventSource": "eks.amazonaws.com",
73+
"eventName": "AssociateAccessPolicy",
74+
"requestParameters": {
75+
"policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy",
76+
"accessScope": {
77+
"type": "cluster"
78+
},
79+
"name": "eks-cluster",
80+
"principalArn": "arn%3Aaws%3Aiam%3A%3A012345678901%3Arole%2Fstratus-red-team-eks-create-access-entry-role"
81+
}
82+
}
83+
```
84+
85+

‎docs/attack-techniques/EKS/eks.persistence.backdoor-aws-auth-configmap.md

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
title: Backdoor aws-auth EKS ConfigMap
3+
---
4+
5+
# Backdoor aws-auth EKS ConfigMap
6+
7+
8+
9+
10+
Platform: EKS
11+
12+
## MITRE ATT&CK Tactics
13+
14+
15+
- Persistence
16+
- Privilege Escalation
17+
18+
## Description
19+
20+
21+
Backdoors the aws-auth ConfigMap in an EKS cluster to grant access to the cluster to a specific role.
22+
23+
<span style="font-variant: small-caps;">Warm-up</span>:
24+
25+
- Create an IAM role
26+
27+
<span style="font-variant: small-caps;">Detonation</span>:
28+
29+
- Add an entry to the aws-auth ConfigMap to grant administrator access to the cluster to the role
30+
31+
References:
32+
33+
- https://securitylabs.datadoghq.com/articles/amazon-eks-attacking-securing-cloud-identities/#authorization-the-aws-auth-configmap-deprecated
34+
- https://docs.aws.amazon.com/eks/latest/userguide/auth-configmap.html
35+
36+
37+
## Instructions
38+
39+
```bash title="Detonate with Stratus Red Team"
40+
stratus detonate eks.persistence.backdoor-aws-auth-configmap
41+
```
42+
## Detection
43+
44+
45+
Through EKS API Server audit logs, by looking for changes to the aws-auth ConfigMap in the kube-system namespace. Here's what a relevant audit event looks like:
46+
47+
```json
48+
{
49+
"objectRef": {
50+
"apiVersion": "v1",
51+
"resource": "configmaps",
52+
"name": "aws-auth"
53+
},
54+
"requestURI": "/api/v1/namespaces/kube-system/configmaps/aws-auth",
55+
"requestObject": {
56+
"metadata": {
57+
"resourceVersion": "184358280",
58+
"name": "aws-auth",
59+
"namespace": "kube-system",
60+
"creationTimestamp": "2022-07-20T13:13:30Z"
61+
},
62+
"apiVersion": "v1",
63+
"data": {
64+
"mapRoles": "- groups:\n - system:masters\n rolearn: arn:aws:iam::012345678901:role/account-admin\n username: cluster-admin-{{SessionName}}\n- groups:\n - system:bootstrappers\n - system:nodes\n rolearn: arn:aws:iam::012345678901:role/eksctl-cluser-NodeInstanceRole\n username: system:node:{{EC2PrivateDNSName}}\n- groups:\n - system:masters\n rolearn: arn:aws:iam::012345678901:role/stratus-red-team-eks-backdoor-aws-auth-role\n username: backdoor\n"
65+
},
66+
"kind": "ConfigMap"
67+
}
68+
}
69+
```
70+
71+

‎docs/attack-techniques/EKS/index.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# EKS
2+
3+
This page contains the Stratus attack techniques for EKS, grouped by MITRE ATT&CK Tactic.
4+
Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic.
5+
6+
7+
## Lateral Movement
8+
9+
- [Create Admin EKS Access Entry](./eks.lateral-movement.create-access-entry.md)
10+
11+
12+
## Persistence
13+
14+
- [Backdoor aws-auth EKS ConfigMap](./eks.persistence.backdoor-aws-auth-configmap.md)
15+
16+
17+
## Privilege Escalation
18+
19+
- [Backdoor aws-auth EKS ConfigMap](./eks.persistence.backdoor-aws-auth-configmap.md)
20+

‎docs/attack-techniques/list.md

+2
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ This page contains the list of all Stratus Attack Techniques.
5050
| [Execute Command on Virtual Machine using Custom Script Extension](./azure/azure.execution.vm-custom-script-extension.md) | [Azure](./azure/index.md) | Execution |
5151
| [Execute Commands on Virtual Machine using Run Command](./azure/azure.execution.vm-run-command.md) | [Azure](./azure/index.md) | Execution |
5252
| [Export Disk Through SAS URL](./azure/azure.exfiltration.disk-export.md) | [Azure](./azure/index.md) | Exfiltration |
53+
| [Create Admin EKS Access Entry](./EKS/eks.lateral-movement.create-access-entry.md) | [EKS](./EKS/index.md) | Lateral Movement |
54+
| [Backdoor aws-auth EKS ConfigMap](./EKS/eks.persistence.backdoor-aws-auth-configmap.md) | [EKS](./EKS/index.md) | Persistence, Privilege Escalation |
5355
| [Exfiltrate Compute Disk by sharing it](./GCP/gcp.exfiltration.share-compute-disk.md) | [GCP](./GCP/index.md) | Exfiltration |
5456
| [Exfiltrate Compute Image by sharing it](./GCP/gcp.exfiltration.share-compute-image.md) | [GCP](./GCP/index.md) | Exfiltration |
5557
| [Exfiltrate Compute Disk by sharing a snapshot](./GCP/gcp.exfiltration.share-compute-snapshot.md) | [GCP](./GCP/index.md) | Exfiltration |

‎docs/attack-techniques/supported-platforms.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
# Supported Platforms
22

3-
Stratus Red Team currently supports AWS, Azure, GCP and Kubernetes.
3+
Stratus Red Team currently supports AWS, Azure, GCP, Kubernetes, and Amazon EKS.
44
See [Connecting to your cloud account](https://stratus-red-team.cloud/user-guide/getting-started/#connecting-to-your-cloud-account) for setup instructions.

‎docs/index.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,33 @@ AWS:
329329
- Privilege Escalation
330330
platform: AWS
331331
isIdempotent: false
332+
EKS:
333+
Lateral Movement:
334+
- id: eks.lateral-movement.create-access-entry
335+
name: Create Admin EKS Access Entry
336+
isSlow: false
337+
mitreAttackTactics:
338+
- Lateral Movement
339+
platform: EKS
340+
isIdempotent: false
341+
Persistence:
342+
- id: eks.persistence.backdoor-aws-auth-configmap
343+
name: Backdoor aws-auth EKS ConfigMap
344+
isSlow: false
345+
mitreAttackTactics:
346+
- Persistence
347+
- Privilege Escalation
348+
platform: EKS
349+
isIdempotent: false
350+
Privilege Escalation:
351+
- id: eks.persistence.backdoor-aws-auth-configmap
352+
name: Backdoor aws-auth EKS ConfigMap
353+
isSlow: false
354+
mitreAttackTactics:
355+
- Persistence
356+
- Privilege Escalation
357+
platform: EKS
358+
isIdempotent: false
332359
GCP:
333360
Exfiltration:
334361
- id: gcp.exfiltration.share-compute-disk

‎docs/user-guide/getting-started.md

+11-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
## Installation
44

5-
Direct install (required Go 1.18+):
5+
Direct install (required Go 1.19+):
66

77
```
88
go install -v github.com/datadog/stratus-red-team/v2/cmd/stratus@latest
@@ -94,7 +94,7 @@ For more information, see [Usage](./usage.md), [Examples](./examples.md) and the
9494

9595
## Connecting to your cloud account
9696

97-
Stratus Red Team currently supports AWS and Kubernetes.
97+
Stratus Red Team currently supports AWS, Azure, Kubernetes, and Amazon EKS.
9898

9999
!!! warning
100100

@@ -108,6 +108,15 @@ In order to use Stratus attack techniques against AWS, you need to be authentica
108108

109109
- Using static credentials in `~/.aws/config`, and setting your desired AWS profile using `export AWS_PROFILE=my-profile`
110110

111+
### EKS
112+
113+
Stratus Red Team does **not** create an EKS cluster for you. It assumes you're already authenticated to an EKS cluster.
114+
115+
To use Stratus attack techniques against Amazon EKS, you need to be authenticated against AWS, as described above. Stratus Red Team will use the current AWS credentials and Kubernetes context to interact with the EKS cluster. It will check that the Kubernetes cluster you're connected to is an EKS cluster, and refuse to run otherwise.
116+
117+
- Authenticate to AWS (for instance, using [`aws-vault`](https://github.com/99designs/aws-vault))
118+
- Run `aws eks update-kubeconfig --name your-cluster-name --region your-region` to update your `~/.kube/config` file with the EKS cluster configuration
119+
111120
### Azure
112121

113122
- Use the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli) to authenticate against your Azure tenant:

‎v2/go.mod

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
module github.com/datadog/stratus-red-team/v2
22

3-
go 1.18
3+
go 1.19
44

55
require (
66
cloud.google.com/go/compute v1.10.0
77
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.4
88
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0
99
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute v1.0.0
1010
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0
11-
github.com/aws/aws-sdk-go-v2 v1.26.1
11+
github.com/aws/aws-sdk-go-v2 v1.30.3
1212
github.com/aws/aws-sdk-go-v2/config v1.25.11
1313
github.com/aws/aws-sdk-go-v2/credentials v1.16.9
1414
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.4
1515
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.35.2
1616
github.com/aws/aws-sdk-go-v2/service/ec2 v1.138.2
1717
github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect v1.20.6
18+
github.com/aws/aws-sdk-go-v2/service/eks v1.46.0
1819
github.com/aws/aws-sdk-go-v2/service/iam v1.28.2
1920
github.com/aws/aws-sdk-go-v2/service/lambda v1.49.2
2021
github.com/aws/aws-sdk-go-v2/service/organizations v1.23.2
@@ -24,10 +25,9 @@ require (
2425
github.com/aws/aws-sdk-go-v2/service/s3 v1.47.2
2526
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.25.2
2627
github.com/aws/aws-sdk-go-v2/service/ses v1.22.4
27-
github.com/aws/aws-sdk-go-v2/service/sesv2 v1.27.3
2828
github.com/aws/aws-sdk-go-v2/service/ssm v1.44.2
2929
github.com/aws/aws-sdk-go-v2/service/sts v1.26.2
30-
github.com/aws/smithy-go v1.20.2
30+
github.com/aws/smithy-go v1.20.3
3131
github.com/cenkalti/backoff/v4 v4.2.1
3232
github.com/fatih/color v1.13.0
3333
github.com/golang-jwt/jwt v3.2.2+incompatible
@@ -51,8 +51,8 @@ require (
5151
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
5252
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.3 // indirect
5353
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.9 // indirect
54-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
55-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
54+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.13 // indirect
55+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.13 // indirect
5656
github.com/aws/aws-sdk-go-v2/internal/ini v1.7.1 // indirect
5757
github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.8 // indirect
5858
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.3 // indirect

0 commit comments

Comments
 (0)