-
Notifications
You must be signed in to change notification settings - Fork 219
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Attack technique: Retrieve a High Number of Secrets Manager secrets
- Loading branch information
1 parent
3150b1c
commit a54527a
Showing
8 changed files
with
141 additions
and
0 deletions.
There are no files selected for viewing
24 changes: 24 additions & 0 deletions
24
.../attack-techniques/AWS/aws.credential-access.secretsmanager-retrieve-secrets.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| # Retrieve a High Number of Secrets Manager secrets | ||
|
|
||
| Platform: AWS | ||
|
|
||
| ## MITRE ATT&CK Tactics | ||
|
|
||
|
|
||
| - Credential Access | ||
|
|
||
| ## Description | ||
|
|
||
|
|
||
| Retrieves a high number of Secrets Manager secrets, through secretsmanager:GetSecretValue. | ||
|
|
||
| Warm-up: Create multiple secrets in Secrets Manager. | ||
|
|
||
| Detonation: Enumerate the secrets through secretsmanager:ListSecrets, then retrieve their value through secretsmanager:GetSecretValue. | ||
|
|
||
|
|
||
| ## Instructions | ||
|
|
||
| ```bash title="Detonate with Stratus Red Team" | ||
| stratus detonate aws.credential-access.secretsmanager-retrieve-secrets | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
66 changes: 66 additions & 0 deletions
66
internal/attacktechniques/aws/credential-access/secretsmanager-retrieve-secrets/main.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "context" | ||
| _ "embed" | ||
| "errors" | ||
| "github.com/aws/aws-sdk-go-v2/config" | ||
| "github.com/aws/aws-sdk-go-v2/service/secretsmanager" | ||
| "github.com/aws/aws-sdk-go-v2/service/secretsmanager/types" | ||
| "github.com/datadog/stratus-red-team/pkg/stratus" | ||
| "github.com/datadog/stratus-red-team/pkg/stratus/mitreattack" | ||
| "log" | ||
| ) | ||
|
|
||
| //go:embed main.tf | ||
| var tf []byte | ||
|
|
||
| func init() { | ||
| stratus.GetRegistry().RegisterAttackTechnique(&stratus.AttackTechnique{ | ||
| ID: "aws.credential-access.secretsmanager-retrieve-secrets", | ||
| FriendlyName: "Retrieve a High Number of Secrets Manager secrets", | ||
| Description: ` | ||
| Retrieves a high number of Secrets Manager secrets, through secretsmanager:GetSecretValue. | ||
| Warm-up: Create multiple secrets in Secrets Manager. | ||
| Detonation: Enumerate the secrets through secretsmanager:ListSecrets, then retrieve their value through secretsmanager:GetSecretValue. | ||
| `, | ||
| Platform: stratus.AWS, | ||
| MitreAttackTactics: []mitreattack.Tactic{mitreattack.CredentialAccess}, | ||
| PrerequisitesTerraformCode: tf, | ||
| Detonate: detonate, | ||
| }) | ||
| } | ||
|
|
||
| const numCalls = 30 | ||
|
|
||
| func detonate(params map[string]string) error { | ||
| cfg, _ := config.LoadDefaultConfig(context.Background()) | ||
| secretsManagerClient := secretsmanager.NewFromConfig(cfg) | ||
|
|
||
| secretsResponse, err := secretsManagerClient.ListSecrets(context.Background(), &secretsmanager.ListSecretsInput{ | ||
| Filters: []types.Filter{ | ||
| {Key: types.FilterNameStringTypeTagKey, Values: []string{"StratusRedTeam"}}, | ||
| }, | ||
| MaxResults: 100, | ||
| }) | ||
|
|
||
| if err != nil { | ||
| return errors.New("unable to list SecretsManager secrets: " + err.Error()) | ||
| } | ||
|
|
||
| for i := range secretsResponse.SecretList { | ||
| secret := secretsResponse.SecretList[i] | ||
| log.Println("Retrieving value of secret " + *secret.ARN) | ||
| _, err := secretsManagerClient.GetSecretValue(context.Background(), &secretsmanager.GetSecretValueInput{ | ||
| SecretId: secret.ARN, | ||
| }) | ||
|
|
||
| if err != nil { | ||
| return errors.New("unable to retrieve secret value: " + err.Error()) | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } |
44 changes: 44 additions & 0 deletions
44
internal/attacktechniques/aws/credential-access/secretsmanager-retrieve-secrets/main.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| terraform { | ||
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = "~> 3.71.0" | ||
| } | ||
| } | ||
| } | ||
| provider "aws" { | ||
| skip_region_validation = true | ||
| skip_credentials_validation = true | ||
| skip_get_ec2_platforms = true | ||
| skip_metadata_api_check = true | ||
| default_tags { | ||
| tags = { | ||
| StratusRedTeam = true | ||
| } | ||
| } | ||
| } | ||
|
|
||
| locals { | ||
| num_secrets = 20 | ||
| } | ||
|
|
||
| resource "random_string" "secrets" { | ||
| count = local.num_secrets | ||
| length = 16 | ||
| min_lower = 16 | ||
| } | ||
|
|
||
| resource "aws_secretsmanager_secret" "secrets" { | ||
| count = local.num_secrets | ||
| name = "stratus-red-team-secret-${count.index}" | ||
| } | ||
|
|
||
| resource "aws_secretsmanager_secret_version" "secret-values" { | ||
| count = local.num_secrets | ||
| secret_id = aws_secretsmanager_secret.secrets[count.index].id | ||
| secret_string = random_string.secrets[count.index].result | ||
| } | ||
|
|
||
| output "display" { | ||
| value = format("%s Secrets Manager secrets ready", local.num_secrets) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters