andresriancho/nimbostratus

Tools for fingerprinting and exploiting Amazon cloud infrastructures

Nimbostratus

Tools for fingerprinting and exploiting Amazon cloud infrastructures. These tools are a PoC which I developed for my "Pivoting in Amazon clouds" talk, developed using the great boto library for accessing Amazon's API.

For more information visit the project page

Feel free to report bugs, fork and send pull-requests. You can also drop me a line at @w3af.

nimbostratus's Issues

cant get it installed

Cloning into 'nimbostratus'...
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Incorrect boto version?

ubuntu@ip-10-130-77-91:~/nimbostratus$ ./nimbostratus
Traceback (most recent call last):
File "./nimbostratus", line 5, in
cmd_handler()
File "/home/ubuntu/nimbostratus/core/cmd_handler.py", line 35, in cmd_handler
args = parse_args()
File "/home/ubuntu/nimbostratus/core/cmd_handler.py", line 24, in parse_args
_temp = import(module_name, globals(), locals(), ['cmd_arguments'], -1)
File "/home/ubuntu/nimbostratus/core/dump_credentials/command.py", line 3, in
from boto.core.credentials import AllCredentialFunctions
ImportError: No module named core.credentials

Installation in MacOS fails without --user

Got this over email:

Just as an FYI, Mac owners will have to run pip install -r requirements.txt --user. The --user flag is necessary to get around the MacOS

System Integrity Protection, and without that flag you’ll get an obscure “Operation Not Permitted” error when attempting to install Nose.

Should document this issue in the main site to guide new users in their installation process.

Hardcoded info: AWS region

Hardcoded info like AWS region in servers/celery_backend/broker.config, are nice to document it or take argument from deploy script.

Bypass SSL Certificate Checking

Hello,

Can there be a way to bypass the SSL Certificate Checking? (The analog would be --no-verify-ssl in the AWS CLI).

Thanks,

Automatic region iteration, more services, etc.

Looks like you thought of this 4 years before I did - awesome! I'd love to submit some PRs once I get the time, so hopefully you're still around!

Some thoughts:

• some functions to iterate bruteforces over regions (can auto get latest regions in event of a new one coming online.
• Check for cloudtrail tampering permissions
  -"safety" check levels (safe = read, not so safe = write) for bruteforce
  -boto3 support (not sure if that gets us anything, but new features added and clean Python2/3 path).
  -Policy simulation? (http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html#policies-simulator-using-api)

Thanks for writing this, it's a great idea!

Better error handling / message when user doesn't specify a mangle function

It's nice to have nimbostratus/core/utils/mangle.py taking domain name or IP. Currently the vuln app URL is hardcoded.

bruteforce_permissions requires more detail

bruteforce_permissions requires more detail, since we're only bruteforcing a small part of the API calls.

All commands should metadata_hook?

All commands should metadata_hook in order to be able to use the instance profile of the remote EC2 server?

dump_permissions ignores token

dump_permissions ignores token provided by user:

def check_via_iam(access_key, secret_key, token):
    '''
    Connect to IAM and try to retrieve my policy.
    '''
    try:
        conn = IAMConnection(aws_access_key_id=access_key,
                             aws_secret_access_key=secret_key)