diff --git a/libs/ec2.py b/libs/ec2.py index 494614c..5f9a070 100644 --- a/libs/ec2.py +++ b/libs/ec2.py @@ -28,7 +28,7 @@ def review_encrypted_volumes(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): 'Name' : 'status', 'Values' : ['in-use'] }])['Volumes'] - + for volume in response: if volume['Encrypted']: encrypted.append(volume['VolumeId']) @@ -49,7 +49,7 @@ def review_encrypted_volumes(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): if e.response['Error']['Code'] == 'UnauthorizedOperation': print('{} : (UnauthorizedOperation) when calling the DescribeVolumes -- sure you have ec2 permissions?' .format(AWS_ACCESS_KEY_ID)) else: - print e + print(e) except KeyboardInterrupt: print("CTRL-C received, exiting...") @@ -70,7 +70,7 @@ def get_instance_details(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): pp.pprint(i) except botocore.exceptions.ClientError as e: - print e + print(e) except KeyboardInterrupt: print("CTRL-C received, exiting...") @@ -91,9 +91,9 @@ def get_instance_volume_details(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): volumes = client.describe_instance_attribute(InstanceId=i['InstanceId'], Attribute='blockDeviceMapping') print ("Instance ID: {} \n" .format(i['InstanceId'])) pp.pprint(volumes) - + except botocore.exceptions.ClientError as e: - print e + print(e) except KeyboardInterrupt: print("CTRL-C received, exiting...") @@ -115,9 +115,8 @@ def get_instance_volume_details2(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): print("InstandID:{} \n" .format(volume['Attachments'][0]['InstanceId'])) pp.pprint(volume) print("\n") - + except botocore.exceptions.ClientError as e: - print e + print(e) except KeyboardInterrupt: print("CTRL-C received, exiting...") - diff --git a/libs/iam.py b/libs/iam.py index 6044679..80f1cc5 100644 --- a/libs/iam.py +++ b/libs/iam.py @@ -17,7 +17,7 @@ region = 'us-east-1' def check_root_account(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): client = boto3.client('iam', aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY,region_name=region) - + try: acct_summary = client.get_account_summary() if acct_summary: @@ -28,18 +28,18 @@ def check_root_account(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): if client_list: print("Printing Users") pp.pprint(client_list['Users']) - + print("Checking for console access") for user in client_list['Users']: - + try: profile = client.get_login_profile(UserName=user['UserName']) if profile: print('User {} likely has console access and the password can be reset :-)' .format(user['UserName'])) print("Checking for MFA on account") mfa = client.list_mfa_devices(UserName=user['UserName']) - print mfa['MFADevices'] - + print(mfa['MFADevices']) + except botocore.exceptions.ClientError as e: if e.response['Error']['Code'] == 'NoSuchEntity': print("[-]: user '{}' likely doesnt have console access" .format(user['UserName'])) @@ -55,10 +55,10 @@ def check_root_account(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): print("Unexpected error: {}" .format(e)) except KeyboardInterrupt: print("CTRL-C received, exiting...") - + def change_user_console_password(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username, password): client = boto3.client('iam', aws_access_key_id = AWS_ACCESS_KEY_ID, aws_secret_access_key = AWS_SECRET_ACCESS_KEY, region_name=region) - + try: response = client.update_login_profile(UserName=username,Password=password, PasswordResetRequired=False) print('Changing password for user: {} to password: {}' .format(username, password)) @@ -76,7 +76,7 @@ def change_user_console_password(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, usern def create_user_console_password(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username, password): client = boto3.client('iam', aws_access_key_id = AWS_ACCESS_KEY_ID, aws_secret_access_key = AWS_SECRET_ACCESS_KEY, region_name=region) - + try: response = client.create_login_profile(UserName=username,Password=password, PasswordResetRequired=False) print('Changing password for user: %s to password: {}' .format(username, password)) @@ -94,7 +94,7 @@ def create_user_console_password(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, usern def get_password_policy(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): client = boto3.client('iam', aws_access_key_id = AWS_ACCESS_KEY_ID, aws_secret_access_key = AWS_SECRET_ACCESS_KEY, region_name=region) - + try: pass_policy = client.get_account_password_policy() print("Account Password Policy:") @@ -106,7 +106,7 @@ def get_password_policy(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): def create_user(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username): client = boto3.client('iam', aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY, region_name=region) - + try: print("Creating a new IAM user named: {}" .format(username)) create_user = client.create_user(Path='/',UserName=username) @@ -123,7 +123,7 @@ def create_user(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username): def create_access_key(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username): client = boto3.client('iam', aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY, region_name=region) - + try: create_access_key = client.create_access_key(UserName=username) print("Creating a new access key for: {}" .format(username)) @@ -135,7 +135,7 @@ def create_access_key(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username): def delete_access_key(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username, accesskey): client = boto3.client('iam', aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY, region_name=region) - + try: delete_access_key = client.delete_access_key(UserName=username, AccessKeyId=accesskey) print("Deleting a access key: {} for: {}" .format(accesskey, username)) @@ -166,7 +166,7 @@ def delete_mfa_device(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username, mfaser def make_admin(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username): client = boto3.client('iam', aws_access_key_id=AWS_ACCESS_KEY_ID, aws_secret_access_key=AWS_SECRET_ACCESS_KEY, region_name=region) - + try: make_admin = client.attach_user_policy(UserName=username, PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess') print("Adding admin policy to: {}" .format(username)) @@ -189,7 +189,7 @@ def make_backdoor_account(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username, pa make_admin(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,username) create_user_console_password(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, username, password) create_access_key(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,username) - + except botocore.exceptions.ClientError as e: print("Unexpected error: {}" .format(e)) except KeyboardInterrupt: diff --git a/libs/opsworks.py b/libs/opsworks.py index f2203ef..3e5aeaa 100644 --- a/libs/opsworks.py +++ b/libs/opsworks.py @@ -22,13 +22,13 @@ def describe_stacks(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): ) response = client.describe_stacks() #debug - print response + print(response) if response.get('Stacks') is None: print("{} likely does not have Lambda permissions\n" .format(AWS_ACCESS_KEY_ID)) elif len(response['Stacks']) <= 0: print("[-] DescribeStacks allowed for {} but no results (everyone seems to have this permission) [-]\n" .format(region)) else: #THIS PART IS UNTESTED - for r in response['Stacks']: + for r in response['Stacks']: pp.pprint(r) except botocore.exceptions.EndpointConnectionError as e: print("Unexpected error: {}" .format(e)) diff --git a/libs/rds.py b/libs/rds.py index 4151765..2bcbfa3 100644 --- a/libs/rds.py +++ b/libs/rds.py @@ -25,6 +25,6 @@ def describe_db_instances(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY): pp.pprint(i) except botocore.exceptions.ClientError as e: - print e + print(e) except KeyboardInterrupt: - print("CTRL-C received, exiting...") \ No newline at end of file + print("CTRL-C received, exiting...") diff --git a/logging_list_monitoring_configuration.py b/logging_list_monitoring_configuration.py index 6ef909d..cf1ea68 100644 --- a/logging_list_monitoring_configuration.py +++ b/logging_list_monitoring_configuration.py @@ -42,7 +42,7 @@ for region in regions: print(config_service_text) print("Region:" + region) print_config_text(config_service_text) - + if response.get('ConfigurationRecorders') is None: print("{} likely does not have Config permissions\n" .format(AWS_ACCESS_KEY_ID)) elif len(response['ConfigurationRecorders']) <= 0: @@ -55,6 +55,6 @@ for region in regions: # pp.pprint(resourcetype['resourceTypes'][0]) ruleresponse = describe_configuration_recorders(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, region) - print ruleresponse - + print(ruleresponse) + print_section_header_and_footer("END OF CONFIG SERVICE REVIEW", True)