Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

github.com

Post reply on HN
Print view View original

11–20 of 101 posts

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#11

Post by denismurphy »

kmcquade wrote: post #4
sodality2 wrote: post #2

My first thought was "why is salesforce publishing essentially a hacking tool? why can't they bring it up privately, surely a large enough company will have some weight to their request?" but then I remembered AWS... >At the time of this writing, AWS Access Analyzer does NOT support auditing 11 out of the 18 services that Endgame attacks. Given that Access Analyzer is intended to detect this exact kind of violation,…

Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…

you're an evil genius

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#12

Post by [deleted] »

gchamonlive wrote: post #6
bwaine wrote: post #3

It would be nice if this was the other way round :'''''( # this will ruin your day endgame smash --service all --evil-principal " " # This will show you how your day could have been ruined endgame smash --service all --evil-principal " " --dry-run Looks like it can be reversed with --undo, but brown trousers time if you groggily run it at 08:30am coffee in hand.

dry run should be the default, and for you to actually do damage, you should explicitly run with a flag like `--commit` or `--deploy-evil-payload "yes I am certain of this"`

[deleted]

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#13

Post by nic-waller »

Impressive tool, but the supporting documentation is what I appreciate most.

I think the prevention guide could be improved by providing an example service control policy that blocks known dangerous IAM actions like ecr:SetRepositoryPolicy for all but a specific security principal.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#16

Post by Operyl »

kmcquade wrote: post #4
sodality2 wrote: post #2

My first thought was "why is salesforce publishing essentially a hacking tool? why can't they bring it up privately, surely a large enough company will have some weight to their request?" but then I remembered AWS... >At the time of this writing, AWS Access Analyzer does NOT support auditing 11 out of the 18 services that Endgame attacks. Given that Access Analyzer is intended to detect this exact kind of violation,…

Author here :) Endgame exploits/abuses features. If it was a bug, I'd work with AWS to solve the problem, but with abusing features - that would result in years of unsatisfied feature requests. This should push the issue along. >...and it's not even a hacking tool! It can be used to backdoor resources to rogue accounts, so I'd say it's a hacking tool and can/should be used on penetration tests. I'd certainly use it o…

I'm impressed you were able to get your employer (Salesforce) to actually let you publish this under their organization. Kudos to that.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#17

Post by kmcquade »

procrastinatus wrote: post #14

Do analogous tools exist for GCP and Azure?

Not sure. I did uncover a ridiculously destructive approach to abusing Azure Service Principals in CI/CD pipelines that deploy infrastructure in Azure (Confused Deputy problem): https://kmcquade.com/2020/11/nuking-all-azure-resource-group...

for sub in `az account list | jq -r '.[].id'`; do \ for rg in `az group list --subscription $sub | jq -r '.[].name'`; do \ az group delete --name ${rg} --subscription $sub --no-wait --yes; \ done; done;

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#18

Post by kapilvt »

fwiw the opensource (and cncf incubator project) https://cloudcustodian.io can detect and remediate these modifications to embedded iam policies (across many resource types) in realtime that share beyond an organizations/accounts boundaries. its like access analyzer except its flexible enough to understand internal org distinctions (dev/prod separation) and allowed access to third parties.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#19

Post by kmcquade »

nic-waller wrote: post #13

Impressive tool, but the supporting documentation is what I appreciate most. I think the prevention guide could be improved by providing an example service control policy that blocks known dangerous IAM actions like ecr:SetRepositoryPolicy for all but a specific security principal.

Great feedback! I will update the docs accordingly.

Re: Show HN: Endgame – An AWS Pentesting tool to backdoor or expose AWS resources

#20

Post by sandGorgon »

@kmcquade ur awesome ! we are users of https://github.com/salesforce/policy_sentry and definitely definitely https://github.com/salesforce/cloudsplaining .

If I could give you guys money, I would. You should totally build a startup around it.

Post reply on HN