AWS: Persist by creating an identity provider

[christophetd]

from #541

[xvirgov]

Hello, thanks for the reply!

I would be interested in adding this as well. Would that be okay? If yes, what do you think about this scenario?:

aws.persistence.iam-identity-provider-saml-backdoor

Establishes persistence by changing SAML metadata for an IAM IDP, resulting in a backdoor access to a IAM role.

Warm-up

• create an IAM IDP configuration (use aws sample SAML config for the initial configuration)
• create an IAM role with the IDP in the trust relationship

Detonation

• replace the SAML metadata with the attacker's

References

• https://aws.amazon.com/blogs/security/unauthorized-tactic-spotlight-initial-access-through-a-third-party-identity-provider/
• https://medium.com/@adan.alvarez/gaining-aws-persistence-by-updating-a-saml-identity-provider-ef57ebdc8db5
• https://github.com/terraform-aws-modules/terraform-aws-iam/blob/master/examples/iam-assumable-roles-with-saml/saml-metadata.xml
• https://github.com/mattbaird/gosaml

Questions

• do you prefer to test with SAML (as suggested above) or OIDC identity provider?
• do you also want to generate the temporary credentials for the role - that attacker gains access to? Can also do :)