Главная
Study mode:
on
1
Introduction
2
HTTP request vulnerability
3
Change URL parameter
4
Instance metadata
5
AMI
6
Python
7
Nimbostratus
8
User Data
9
Source Code Review
10
Amazon Cloud Architecture
11
Instance Profiles
12
Credentials
13
Dump Permissions
14
SQS
15
Salary
16
Serializer
17
Salary Pickle
18
Executing arbitrary commands
19
Worker credentials
20
IAM
21
IAM API
22
Create IAM User
23
Create Snapshot
24
Source Code
25
Thank You
26
Questions
Description:
Explore advanced techniques for pivoting and escalating privileges in Amazon Web Services (AWS) environments in this Black Hat conference talk. Learn about various AWS components including EC2, SQS, IAM, RDS, meta-data, and user-data, as well as how to exploit misconfigurations to gain unauthorized access to operating systems, databases, application source code, and Amazon's services through its API. Follow a step-by-step demonstration of how an attacker can progress from exploiting an initial web application vulnerability to ultimately compromising the root account of an Amazon user. Discover cloud-specific vulnerabilities and weaknesses, and gain insights into tools that can enumerate AWS service access, create new AWS users, extract credentials, clone databases, and inject malicious tasks. Understand the intricacies of AWS security and learn how to better protect your cloud infrastructure against potential threats.

Pivoting in Amazon Clouds

Black Hat
Add to list
0:00 / 0:00