restructuring libs to be a bit more sane in terms of schema and so that we can split between aws and gcp
This commit is contained in:
cktricky
175
libs/aws/cloudtrail.py
Normal file
175
libs/aws/cloudtrail.py
Normal file
@@ -0,0 +1,175 @@
|
||||
'''
|
||||
Cloudtrail functions for WeirdAAL
|
||||
'''
|
||||
|
||||
import boto3
|
||||
import botocore
|
||||
import os
|
||||
import pprint
|
||||
import sys
|
||||
|
||||
pp = pprint.PrettyPrinter(indent=5, width=80)
|
||||
|
||||
# from http://docs.aws.amazon.com/general/latest/gr/rande.html
|
||||
regions = ['us-east-1', 'us-east-2', 'us-west-1', 'us-west-2', 'ap-northeast-1', 'ap-northeast-2', 'ap-northeast-3', 'ap-south-1', 'ap-southeast-1', 'ap-southeast-2', 'ca-central-1', 'eu-central-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'sa-east-1']
|
||||
# 'cn-north-1', 'cn-northwest-1', 'us-gov-west-1' throwing An error occurred (UnrecognizedClientException) when calling the DescribeTrails operation: The security token included in the request is invalid.
|
||||
|
||||
'''
|
||||
Code to get the AWS_ACCESS_KEY_ID from boto3
|
||||
'''
|
||||
session = boto3.Session()
|
||||
credentials = session.get_credentials()
|
||||
AWS_ACCESS_KEY_ID = credentials.access_key
|
||||
|
||||
|
||||
def describe_trails():
|
||||
'''
|
||||
Describe CloudTrail Trails for each region
|
||||
'''
|
||||
print("### Printing CloudTrail DescribeTrails ###")
|
||||
try:
|
||||
for region in regions:
|
||||
client = boto3.client('cloudtrail', region_name=region)
|
||||
response = client.describe_trails()
|
||||
|
||||
if response['trailList'] is None:
|
||||
print("{} likely does not have CloudTrail permissions\n" .format(AWS_ACCESS_KEY_ID))
|
||||
elif len(response['trailList']) <= 0:
|
||||
print("[-] ListTrails allowed for {} but no results [-]" .format(region))
|
||||
else:
|
||||
print("### {} CloudTrail Trails ###" .format(region))
|
||||
for trail in response['trailList']:
|
||||
pp.pprint(trail)
|
||||
print("\n")
|
||||
except botocore.exceptions.ClientError as e:
|
||||
if e.response['Error']['Code'] == 'InvalidClientTokenId':
|
||||
sys.exit("{} : The AWS KEY IS INVALID. Exiting" .format(AWS_ACCESS_KEY_ID))
|
||||
elif e.response['Error']['Code'] == 'AccessDenied':
|
||||
print('{} : Does not have the required permissions' .format(AWS_ACCESS_KEY_ID))
|
||||
# elif e.response['Error']['Code'] == 'UnrecognizedClientException':
|
||||
# print('{} : UnrecognizedClientException error' .format(AWS_ACCESS_KEY_ID))
|
||||
# pass
|
||||
elif e.response['Error']['Code'] == 'SubscriptionRequiredException':
|
||||
print('{} : Has permissions but isnt signed up for service - usually means you have a root account' .format(AWS_ACCESS_KEY_ID))
|
||||
else:
|
||||
print("Unexpected error: {}" .format(e))
|
||||
pass
|
||||
except KeyboardInterrupt:
|
||||
print("CTRL-C received, exiting...")
|
||||
|
||||
|
||||
def list_public_keys():
|
||||
'''
|
||||
List public keys
|
||||
'''
|
||||
print("### Printing CloudTrail DescribeTrails ###")
|
||||
try:
|
||||
for region in regions:
|
||||
client = boto3.client('cloudtrail', region_name=region)
|
||||
response = client.list_public_keys()
|
||||
|
||||
if response['PublicKeyList'] is None:
|
||||
print("{} likely does not have CloudTrail permissions\n" .format(AWS_ACCESS_KEY_ID))
|
||||
elif len(response['PublicKeyList']) <= 0:
|
||||
print("[-] PublicKeyList allowed for {} but no results [-]" .format(region))
|
||||
else:
|
||||
print("### {} CloudTrail Public Keys ###" .format(region))
|
||||
for keys in response['PublicKeyList']:
|
||||
pp.pprint(keys)
|
||||
print("\n")
|
||||
except botocore.exceptions.ClientError as e:
|
||||
if e.response['Error']['Code'] == 'InvalidClientTokenId':
|
||||
sys.exit("{} : The AWS KEY IS INVALID. Exiting" .format(AWS_ACCESS_KEY_ID))
|
||||
elif e.response['Error']['Code'] == 'AccessDenied':
|
||||
print('{} : Does not have the required permissions' .format(AWS_ACCESS_KEY_ID))
|
||||
elif e.response['Error']['Code'] == 'SubscriptionRequiredException':
|
||||
print('{} : Has permissions but isnt signed up for service - usually means you have a root account' .format(AWS_ACCESS_KEY_ID))
|
||||
else:
|
||||
print("Unexpected error: {}" .format(e))
|
||||
pass
|
||||
except KeyboardInterrupt:
|
||||
print("CTRL-C received, exiting...")
|
||||
|
||||
|
||||
def stop_trail(TrailARN):
|
||||
'''
|
||||
Stop a specified trailARN
|
||||
Port of https://github.com/dagrz/aws_pwn/blob/master/stealth/disrupt_cloudtrail.py
|
||||
'''
|
||||
print("### Attempting to stop trail {} ###\n".format(TrailARN[0]))
|
||||
try:
|
||||
for region in regions:
|
||||
client = boto3.client('cloudtrail', region_name=region)
|
||||
response = client.describe_trails()
|
||||
|
||||
if response['trailList'] is None:
|
||||
print("{} likely does not have CloudTrail permissions\n" .format(AWS_ACCESS_KEY_ID))
|
||||
elif len(response['trailList']) <= 0:
|
||||
print("[-] ListTrails allowed for {} but no results [-]" .format(region))
|
||||
else:
|
||||
for trail in response['trailList']:
|
||||
HomeRegion = trail['HomeRegion']
|
||||
myTrailARN = TrailARN[0]
|
||||
# print(HomeRegion)
|
||||
# print(myTrailARN)
|
||||
client2 = boto3.client('cloudtrail', region_name=HomeRegion)
|
||||
response = client2.stop_logging(Name=myTrailARN)
|
||||
print(response)
|
||||
print("\n")
|
||||
except botocore.exceptions.ClientError as e:
|
||||
if e.response['Error']['Code'] == 'InvalidClientTokenId':
|
||||
sys.exit("{} : The AWS KEY IS INVALID. Exiting" .format(AWS_ACCESS_KEY_ID))
|
||||
elif e.response['Error']['Code'] == 'AccessDenied':
|
||||
print('{} : Does not have the required permissions' .format(AWS_ACCESS_KEY_ID))
|
||||
# elif e.response['Error']['Code'] == 'UnrecognizedClientException':
|
||||
# print('{} : UnrecognizedClientException error' .format(AWS_ACCESS_KEY_ID))
|
||||
# pass
|
||||
elif e.response['Error']['Code'] == 'SubscriptionRequiredException':
|
||||
print('{} : Has permissions but isnt signed up for service - usually means you have a root account' .format(AWS_ACCESS_KEY_ID))
|
||||
else:
|
||||
print("Unexpected error: {}" .format(e))
|
||||
pass
|
||||
except KeyboardInterrupt:
|
||||
print("CTRL-C received, exiting...")
|
||||
|
||||
|
||||
def delete_trail(TrailARN):
|
||||
'''
|
||||
Delete a specified trailARN
|
||||
Port of https://github.com/dagrz/aws_pwn/blob/master/stealth/disrupt_cloudtrail.py
|
||||
'''
|
||||
print("### Attempting to delete trail {} ###\n".format(TrailARN[0]))
|
||||
try:
|
||||
for region in regions:
|
||||
client = boto3.client('cloudtrail', region_name=region)
|
||||
response = client.describe_trails()
|
||||
|
||||
if response['trailList'] is None:
|
||||
print("{} likely does not have CloudTrail permissions\n" .format(AWS_ACCESS_KEY_ID))
|
||||
elif len(response['trailList']) <= 0:
|
||||
print("[-] ListTrails allowed for {} but no results [-]" .format(region))
|
||||
else:
|
||||
for trail in response['trailList']:
|
||||
HomeRegion = trail['HomeRegion']
|
||||
myTrailARN = TrailARN[0]
|
||||
# print(HomeRegion)
|
||||
# print(myTrailARN)
|
||||
client2 = boto3.client('cloudtrail', region_name=HomeRegion)
|
||||
response = client2.delete_trail(Name=myTrailARN)
|
||||
print(response)
|
||||
print("\n")
|
||||
except botocore.exceptions.ClientError as e:
|
||||
if e.response['Error']['Code'] == 'InvalidClientTokenId':
|
||||
sys.exit("{} : The AWS KEY IS INVALID. Exiting" .format(AWS_ACCESS_KEY_ID))
|
||||
elif e.response['Error']['Code'] == 'AccessDenied':
|
||||
print('{} : Does not have the required permissions' .format(AWS_ACCESS_KEY_ID))
|
||||
# elif e.response['Error']['Code'] == 'UnrecognizedClientException':
|
||||
# print('{} : UnrecognizedClientException error' .format(AWS_ACCESS_KEY_ID))
|
||||
# pass
|
||||
elif e.response['Error']['Code'] == 'SubscriptionRequiredException':
|
||||
print('{} : Has permissions but isnt signed up for service - usually means you have a root account' .format(AWS_ACCESS_KEY_ID))
|
||||
else:
|
||||
print("Unexpected error: {}" .format(e))
|
||||
pass
|
||||
except KeyboardInterrupt:
|
||||
print("CTRL-C received, exiting...")
|
||||
Reference in New Issue
Block a user