BlackHat资料us-14-Riancho-Pivoting-In-Amazon-Clouds.pdfVIP

HTTP request proxying vulnerability andres@laptop:~/$ curl /?url=/user- andres@laptop:~/$ agent { user-agent: python-requests/1.2.3 CPython/2.7.3 Linux/3.2.0-48- virtual } andres@laptop:~/$ curl /user-agent andres@laptop:~/$ { user-agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/ libidn/1.23 librtmp/2.3 } 2 * We use as an example. No twitter server(s) were compromised. Maybe if this is hosted at Amazon... andres@laptop:~/$ curl /? andres@laptop:~/$ url=54/latest/meta-data/ami-id ami-a02f66f2 3 Instance meta-data ● Each time an EC2 instance starts, AWS attaches a “meta-data server” to it, which can be accessed from the instance itself using 54/ ● The instance meta-data stores information such as: – AMI id: operating system which was used to boot the instance – Private IP address – Instance type: number of cores, memory, etc. – Amazon region 4 The meta-data HTTP server Now we know about the meta-data server and our map of the target architecture looks like: 5 * We use as an example. No twitter server(s) were compromised. Programmatically accessing the meta-data ● Developers use libraries such as boto (Python) and fog (Ruby) to access the instance meta-data in a programmatic way ● The meta-data is always accessed locally , from within the EC2 instance. ● The meta-data is organized in paths , which are well documented. Some paths are static and others change based on the names of objects retrieved from other objects/paths. ● Wrote a wrapper which monke