-
Notifications
You must be signed in to change notification settings - Fork 226
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement initial EKS support and first attack techniques (#542)
* Implement initial EKS support and first attack technique (closes #374, #540) * Add new EKS attack technique: backdoor EKS aws-auth configmap (closes #375) * Bump AWS Go SDK * Bump Go version from 1.18 to 1.19 * Update docs * Replace io/ioutil with io due to the bump to Go 1.19
- Loading branch information
1 parent
cea6917
commit c34afc0
Showing
22 changed files
with
751 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
85 changes: 85 additions & 0 deletions
85
docs/attack-techniques/EKS/eks.lateral-movement.create-access-entry.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| --- | ||
| title: Create Admin EKS Access Entry | ||
| --- | ||
|
|
||
| # Create Admin EKS Access Entry | ||
|
|
||
|
|
||
|
|
||
|
|
||
| Platform: EKS | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Lateral Movement | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Uses the EKS Cluster Access Management to assign cluster administrator privileges to an IAM role. This allows the role to perform any action inside the Kubernetes cluster. | ||
|
|
||
| <span style="font-variant: small-caps;">Warm-up</span>: | ||
|
|
||
| - Create an IAM role | ||
|
|
||
| <span style="font-variant: small-caps;">Detonation</span>: | ||
|
|
||
| - Create an access entry for the IAM role | ||
| - Associate the access entry with the AmazonEKSClusterAdminPolicy access policy | ||
|
|
||
| References: | ||
|
|
||
| - https://securitylabs.datadoghq.com/articles/eks-cluster-access-management-deep-dive/ | ||
| - https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate eks.lateral-movement.create-access-entry | ||
| ``` | ||
| ## Detection | ||
|
|
||
|
|
||
| You can use the following CloudTrail events to identify when someone grants access to your EKS cluster: | ||
|
|
||
| - **CreateAccessEntry**, when someone creates an access entry for a principal (meaning it's the first this principal is granted privileges in the cluster)': | ||
|
|
||
| ```json | ||
| { | ||
| "eventSource": "eks.amazonaws.com", | ||
| "eventName": "CreateAccessEntry", | ||
| "requestParameters": { | ||
| "name": "eks-cluster", | ||
| "principalArn": "arn:aws:iam::012345678901:role/stratus-red-team-eks-create-access-entry-role" | ||
| }, | ||
| "responseElements": { | ||
| "accessEntry": { | ||
| "clusterName": "eks-cluster", | ||
| "type": "STANDARD", | ||
| "principalArn": "arn:aws:iam::012345678901:role/stratus-red-team-eks-create-access-entry-role", | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| - **AssociateAccessPolicy**: when someone assigns an access policy to a principal | ||
|
|
||
| ```json | ||
| { | ||
| "eventSource": "eks.amazonaws.com", | ||
| "eventName": "AssociateAccessPolicy", | ||
| "requestParameters": { | ||
| "policyArn": "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy", | ||
| "accessScope": { | ||
| "type": "cluster" | ||
| }, | ||
| "name": "eks-cluster", | ||
| "principalArn": "arn%3Aaws%3Aiam%3A%3A012345678901%3Arole%2Fstratus-red-team-eks-create-access-entry-role" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
71 changes: 71 additions & 0 deletions
71
docs/attack-techniques/EKS/eks.persistence.backdoor-aws-auth-configmap.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| --- | ||
| title: Backdoor aws-auth EKS ConfigMap | ||
| --- | ||
|
|
||
| # Backdoor aws-auth EKS ConfigMap | ||
|
|
||
|
|
||
|
|
||
|
|
||
| Platform: EKS | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Persistence | ||
| - Privilege Escalation | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Backdoors the aws-auth ConfigMap in an EKS cluster to grant access to the cluster to a specific role. | ||
|
|
||
| <span style="font-variant: small-caps;">Warm-up</span>: | ||
|
|
||
| - Create an IAM role | ||
|
|
||
| <span style="font-variant: small-caps;">Detonation</span>: | ||
|
|
||
| - Add an entry to the aws-auth ConfigMap to grant administrator access to the cluster to the role | ||
|
|
||
| References: | ||
|
|
||
| - https://securitylabs.datadoghq.com/articles/amazon-eks-attacking-securing-cloud-identities/#authorization-the-aws-auth-configmap-deprecated | ||
| - https://docs.aws.amazon.com/eks/latest/userguide/auth-configmap.html | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate eks.persistence.backdoor-aws-auth-configmap | ||
| ``` | ||
| ## Detection | ||
|
|
||
|
|
||
| Through EKS API Server audit logs, by looking for changes to the aws-auth ConfigMap in the kube-system namespace. Here's what a relevant audit event looks like: | ||
|
|
||
| ```json | ||
| { | ||
| "objectRef": { | ||
| "apiVersion": "v1", | ||
| "resource": "configmaps", | ||
| "name": "aws-auth" | ||
| }, | ||
| "requestURI": "/api/v1/namespaces/kube-system/configmaps/aws-auth", | ||
| "requestObject": { | ||
| "metadata": { | ||
| "resourceVersion": "184358280", | ||
| "name": "aws-auth", | ||
| "namespace": "kube-system", | ||
| "creationTimestamp": "2022-07-20T13:13:30Z" | ||
| }, | ||
| "apiVersion": "v1", | ||
| "data": { | ||
| "mapRoles": "- groups:\n - system:masters\n rolearn: arn:aws:iam::012345678901:role/account-admin\n username: cluster-admin-{{SessionName}}\n- groups:\n - system:bootstrappers\n - system:nodes\n rolearn: arn:aws:iam::012345678901:role/eksctl-cluser-NodeInstanceRole\n username: system:node:{{EC2PrivateDNSName}}\n- groups:\n - system:masters\n rolearn: arn:aws:iam::012345678901:role/stratus-red-team-eks-backdoor-aws-auth-role\n username: backdoor\n" | ||
| }, | ||
| "kind": "ConfigMap" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # EKS | ||
|
|
||
| This page contains the Stratus attack techniques for EKS, grouped by MITRE ATT&CK Tactic. | ||
| Note that some Stratus attack techniques may correspond to more than a single ATT&CK Tactic. | ||
|
|
||
|
|
||
| ## Lateral Movement | ||
|
|
||
| - [Create Admin EKS Access Entry](./eks.lateral-movement.create-access-entry.md) | ||
|
|
||
|
|
||
| ## Persistence | ||
|
|
||
| - [Backdoor aws-auth EKS ConfigMap](./eks.persistence.backdoor-aws-auth-configmap.md) | ||
|
|
||
|
|
||
| ## Privilege Escalation | ||
|
|
||
| - [Backdoor aws-auth EKS ConfigMap](./eks.persistence.backdoor-aws-auth-configmap.md) | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| # Supported Platforms | ||
|
|
||
| Stratus Red Team currently supports AWS, Azure, GCP and Kubernetes. | ||
| Stratus Red Team currently supports AWS, Azure, GCP, Kubernetes, and Amazon EKS. | ||
| See [Connecting to your cloud account](https://stratus-red-team.cloud/user-guide/getting-started/#connecting-to-your-cloud-account) for setup instructions. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.