dash/weirdAAL
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

db updates and an iam function

Browse Source
This commit is contained in:
carnal0wnage
2018-05-01 19:21:21 -04:00
parent 32ec7ae4fb
commit fa6400ee41
6 changed files with 39 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libs/brute.py
View File

@@ -126,7 +126,7 @@ def generic_permission_bruteforcer(service, tests):
db_logger = [] db_logger = []
for action in actions: for action in actions:
db_logger.append([service, action, AWS_ACCESS_KEY_ID, datetime.datetime.now()]) db_logger.append([service, action, AWS_ACCESS_KEY_ID, target, datetime.datetime.now()])
# print (db_logger) # print (db_logger)
# scrapped the json logging idea but keeping it here just in case # scrapped the json logging idea but keeping it here just in case
@@ -164,7 +164,7 @@ def generic_permission_bruteforcer_region(service, tests, region_passed):
db_logger = [] db_logger = []
for action in actions: for action in actions:
db_logger.append([service, action, AWS_ACCESS_KEY_ID, datetime.datetime.now()]) db_logger.append([service, action, AWS_ACCESS_KEY_ID, target, datetime.datetime.now()])
# print (db_logger) # print (db_logger)
# scrapped the json logging idea but keeping it here just in case # scrapped the json logging idea but keeping it here just in case

4
libs/ec2.py
View File

@@ -90,7 +90,7 @@ def describe_instances():
print("[+] Listing instances for region: {} [+]" .format(region)) print("[+] Listing instances for region: {} [+]" .format(region))
db_logger = [] db_logger = []
for r in response['Reservations']: for r in response['Reservations']:
db_logger.append(['ec2', 'DescribeInstances', str(r), AWS_ACCESS_KEY_ID, datetime.datetime.now()]) db_logger.append(['ec2', 'DescribeInstances', str(r), AWS_ACCESS_KEY_ID, target, datetime.datetime.now()])
for i in r['Instances']: for i in r['Instances']:
pp.pprint(i) pp.pprint(i)
# logging to db here # logging to db here
@@ -132,7 +132,7 @@ def describe_instances_basic():
db_logger = [] db_logger = []
for r in response['Reservations']: for r in response['Reservations']:
# logging the full blob # logging the full blob
db_logger.append(['ec2', 'DescribeInstances', str(r), AWS_ACCESS_KEY_ID, datetime.datetime.now()]) db_logger.append(['ec2', 'DescribeInstances', str(r), AWS_ACCESS_KEY_ID, target, datetime.datetime.now()])
for i in r['Instances']: for i in r['Instances']:
launchtime = i['LaunchTime'] launchtime = i['LaunchTime']
instanceid = i['InstanceId'] instanceid = i['InstanceId']

15
libs/iam.py
View File

@@ -129,6 +129,21 @@ def get_password_policy():
except KeyboardInterrupt: except KeyboardInterrupt:
print("CTRL-C received, exiting...") print("CTRL-C received, exiting...")
def get_account_authorization_details():
'''
Get the account authoirzation details
'''
client = boto3.client('iam', region_name=region)
try:
deets = client.get_account_authorization_details()
print("Account Authorization Details:")
pp.pprint(deets['UserDetailList'])
except botocore.exceptions.ClientError as e:
print("Unexpected error: {}" .format(e))
except KeyboardInterrupt:
print("CTRL-C received, exiting...")
def iam_create_user(username): def iam_create_user(username):
''' '''

15
libs/sql.py
View File

@@ -40,6 +40,7 @@ def create_recon_table(db_name, table_name):
service text, service text,
sub_service text, sub_service text,
AWSKeyID text, AWSKeyID text,
target text,
checked_at timestamp, checked_at timestamp,
PRIMARY KEY (ID))""" PRIMARY KEY (ID))"""
#FOREIGN KEY (AWSKeyID) references AWSKey(ID))""" #FOREIGN KEY (AWSKeyID) references AWSKey(ID))"""
@@ -53,8 +54,9 @@ def create_awskey_table(db_name, table_name):
''' '''
sql = """CREATE TABLE AWSKey sql = """CREATE TABLE AWSKey
(ID integer, (ID integer,
AWSKeyID Text, AWSKeyID text,
Description text, description text,
target text,
PRIMARY KEY(ID))""" PRIMARY KEY(ID))"""
create_table(db_name,table_name,sql) create_table(db_name,table_name,sql)
print ("created table: {}".format(table_name)) print ("created table: {}".format(table_name))
@@ -71,6 +73,7 @@ def create_services_table(db_name, table_name):
sub_service text, sub_service text,
sub_service_data text, sub_service_data text,
checked_at timestamp, checked_at timestamp,
target text,
PRIMARY KEY(ID))""" PRIMARY KEY(ID))"""
create_table(db_name,table_name,sql) create_table(db_name,table_name,sql)
print ("created table: {}".format(table_name)) print ("created table: {}".format(table_name))
@@ -80,7 +83,7 @@ def insert_awskey_data(db_name, records):
''' '''
Insert AWS Key and a description to the AWSKey table (unused) Insert AWS Key and a description to the AWSKey table (unused)
''' '''
sql = """INSERT INTO AWSKey(AWSKeyID, Description) VALUES (?,?)""" sql = """INSERT INTO AWSKey(AWSKeyID, description, target) VALUES (?,?,?)"""
for record in records: for record in records:
query(db_name, sql,record) query(db_name, sql,record)
@@ -89,7 +92,7 @@ def insert_reconservice_data(db_name, records):
''' '''
Insert data into the recon table Insert data into the recon table
''' '''
sql = """INSERT INTO recon(service, sub_service, AWSKeyID, checked_at) VALUES (?,?,?,?)""" sql = """INSERT INTO recon(service, sub_service, AWSKeyID, target, checked_at) VALUES (?,?,?,?,?)"""
for record in records: for record in records:
query(db_name,sql,record) query(db_name,sql,record)
@@ -98,7 +101,7 @@ def insert_sub_service_data(db_name, records):
''' '''
Insert service, sub_service & sub_service data into the DB Insert service, sub_service & sub_service data into the DB
''' '''
sql = """INSERT INTO services(service, sub_service, sub_service_data, AWSKeyID, checked_at) VALUES (?,?,?,?,?)""" sql = """INSERT INTO services(service, sub_service, sub_service_data, AWSKeyID, target, checked_at) VALUES (?,?,?,?,?,?)"""
for record in records: for record in records:
query(db_name,sql,record) query(db_name,sql,record)
@@ -109,7 +112,7 @@ def search_recon_by_key(db_name,AWSKeyID):
''' '''
with sqlite3.connect(db_name) as db: with sqlite3.connect(db_name) as db:
cursor = db.cursor() cursor = db.cursor()
cursor.execute("""SELECT DISTINCT service,sub_service,checked_at FROM recon WHERE AWSKeyID=? ORDER BY datetime(checked_at)""",(AWSKeyID,)) cursor.execute("""SELECT DISTINCT service, sub_service, checked_at FROM recon WHERE AWSKeyID=? ORDER BY datetime(checked_at)""",(AWSKeyID,))
results = cursor.fetchall() results = cursor.fetchall()
return results return results

7
modules/iam.py
View File

@@ -90,3 +90,10 @@ def module_iam_list_entities_for_policy(*text):
python3 weirdAAL.py -m iam_list_entities_for_policy -a 'arn:aws:iam::...' -t yolo python3 weirdAAL.py -m iam_list_entities_for_policy -a 'arn:aws:iam::...' -t yolo
''' '''
iam_list_entities_for_policy(text[0][0]) iam_list_entities_for_policy(text[0][0])
def module_iam_get_account_authorization_details():
'''
Retrieves information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another. Use this API to obtain a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) in your account.
'''
get_account_authorization_details()

7
test_insert.py
View File

@@ -7,17 +7,18 @@ from libs.sql import *
# Provides us with a global var "db_name" we can access anywhere # Provides us with a global var "db_name" we can access anywhere
builtins.db_name = "weirdAAL.db" builtins.db_name = "weirdAAL.db"
target = "sometarget"
#create some tables to stick data in #create some tables to stick data in
if __name__ == "__main__": if __name__ == "__main__":
timenow = datetime.datetime.now() timenow = datetime.datetime.now()
test_aws_key = [("AKIAIOSFODNN7EXAMPLE", "some test shit")] test_aws_key = [("AKIAIOSFODNN7EXAMPLE", "some test shit", target)]
insert_awskey_data(db_name,test_aws_key) insert_awskey_data(db_name,test_aws_key)
test_service_data = [("ec2","DescribeInstances","AKIAIOSFODNN7EXAMPLE", timenow),("ecr","DescribeRepositories","AKIAIOSFODNN7EXAMPLE",timenow)] test_service_data = [("ec2","DescribeInstances","AKIAIOSFODNN7EXAMPLE", target, timenow),("ecr","DescribeRepositories","AKIAIOSFODNN7EXAMPLE", target, timenow)]
insert_reconservice_data(db_name, test_service_data) insert_reconservice_data(db_name, test_service_data)
test_sub_service_data = [("ec2","DescribeInstances","{'Groups': [], 'Instances': [{'AmiLaunchIndex': 0, 'ImageId': 'ami-90123455', 'InstanceId': 'i-04340cXXXXXXX', 'InstanceType': 't2.micro', 'KeyName': 'TEST THAT SHIT', 'LaunchTime': datetime.datetime(2018, 3, 28, 15, 42, 9, tzinfo=tzutc()), 'Monitoring': {'State': 'disabled'}, 'Placement': {'AvailabilityZone': 'us-east-1e', 'GroupName': '', 'Tenancy': 'default'}, 'Platform': 'windows', 'PrivateDnsName': 'ip-192-168-1-15.ec2.internal', 'PrivateIpAddress': '192.168.1.15', 'ProductCodes': [], 'PublicDnsName': '', 'State': {'Code': 16, 'Name': 'running'}, 'StateTransitionReason': '', 'SubnetId': 'subnet-12345a', 'VpcId': 'vpc-12345a', 'Architecture': 'x86_64', 'BlockDeviceMappings': [{'DeviceName': '/dev/sda1', 'Ebs': {'AttachTime': datetime.datetime(2018, 3, 28, 15, 42, 9, tzinfo=tzutc()), 'DeleteOnTermination': True, 'Status': 'attached', 'VolumeId': 'vol-123456'}}], 'ClientToken': '', 'EbsOptimized': False, 'EnaSupport': True, 'Hypervisor': 'xen', 'NetworkInterfaces': [{'Attachment': {'AttachTime': datetime.datetime(2018, 3, 28, 15, 42, 9, tzinfo=tzutc()), 'AttachmentId': 'eni-attach-12345', 'DeleteOnTermination': True, 'DeviceIndex': 0, 'Status': 'attached'}, 'Description': 'Primary network interface', 'Groups': [{'GroupName': 'INTERNAL', 'GroupId': 'sg-x12345c'}], 'Ipv6Addresses': [], 'MacAddress': 'ff:aa:ad:b1:c0:34', 'NetworkInterfaceId': 'eni-654321', 'OwnerId': 'xxxxxxxxxx', 'PrivateIpAddress': '192.168.1.15', 'PrivateIpAddresses': [{'Primary': True, 'PrivateIpAddress': '192.168.1.15'}], 'SourceDestCheck': True, 'Status': 'in-use', 'SubnetId': 'subnet-85d385ba', 'VpcId': 'vpc-deadbabe'}], 'RootDeviceName': '/dev/sda1', 'RootDeviceType': 'ebs', 'SecurityGroups': [{'GroupName': 'INTERNAL', 'GroupId': 'sg-12345'}], 'SourceDestCheck': True, 'Tags': [{'Key': 'Name', 'Value': 'INTERNAL'}], 'VirtualizationType': 'hvm'}], 'OwnerId': 'xxxxxxxxxx', 'ReservationId': 'r-00000000555555'}","AKIAIOSFODNN7EXAMPLE", datetime.datetime.now()),("ecr","DescribeRepositories","poop", "AKIAIOSFODNN7EXAMPLE",datetime.datetime.now())] test_sub_service_data = [("ec2","DescribeInstances","{'Groups': [], 'Instances': [{'AmiLaunchIndex': 0, 'ImageId': 'ami-90123455', 'InstanceId': 'i-04340cXXXXXXX', 'InstanceType': 't2.micro', 'KeyName': 'TEST THAT SHIT', 'LaunchTime': datetime.datetime(2018, 3, 28, 15, 42, 9, tzinfo=tzutc()), 'Monitoring': {'State': 'disabled'}, 'Placement': {'AvailabilityZone': 'us-east-1e', 'GroupName': '', 'Tenancy': 'default'}, 'Platform': 'windows', 'PrivateDnsName': 'ip-192-168-1-15.ec2.internal', 'PrivateIpAddress': '192.168.1.15', 'ProductCodes': [], 'PublicDnsName': '', 'State': {'Code': 16, 'Name': 'running'}, 'StateTransitionReason': '', 'SubnetId': 'subnet-12345a', 'VpcId': 'vpc-12345a', 'Architecture': 'x86_64', 'BlockDeviceMappings': [{'DeviceName': '/dev/sda1', 'Ebs': {'AttachTime': datetime.datetime(2018, 3, 28, 15, 42, 9, tzinfo=tzutc()), 'DeleteOnTermination': True, 'Status': 'attached', 'VolumeId': 'vol-123456'}}], 'ClientToken': '', 'EbsOptimized': False, 'EnaSupport': True, 'Hypervisor': 'xen', 'NetworkInterfaces': [{'Attachment': {'AttachTime': datetime.datetime(2018, 3, 28, 15, 42, 9, tzinfo=tzutc()), 'AttachmentId': 'eni-attach-12345', 'DeleteOnTermination': True, 'DeviceIndex': 0, 'Status': 'attached'}, 'Description': 'Primary network interface', 'Groups': [{'GroupName': 'INTERNAL', 'GroupId': 'sg-x12345c'}], 'Ipv6Addresses': [], 'MacAddress': 'ff:aa:ad:b1:c0:34', 'NetworkInterfaceId': 'eni-654321', 'OwnerId': 'xxxxxxxxxx', 'PrivateIpAddress': '192.168.1.15', 'PrivateIpAddresses': [{'Primary': True, 'PrivateIpAddress': '192.168.1.15'}], 'SourceDestCheck': True, 'Status': 'in-use', 'SubnetId': 'subnet-85d385ba', 'VpcId': 'vpc-deadbabe'}], 'RootDeviceName': '/dev/sda1', 'RootDeviceType': 'ebs', 'SecurityGroups': [{'GroupName': 'INTERNAL', 'GroupId': 'sg-12345'}], 'SourceDestCheck': True, 'Tags': [{'Key': 'Name', 'Value': 'INTERNAL'}], 'VirtualizationType': 'hvm'}], 'OwnerId': 'xxxxxxxxxx', 'ReservationId': 'r-00000000555555'}","AKIAIOSFODNN7EXAMPLE", target, datetime.datetime.now()),("ecr","DescribeRepositories","poop", "AKIAIOSFODNN7EXAMPLE", target, datetime.datetime.now())]
insert_sub_service_data(db_name, test_sub_service_data) insert_sub_service_data(db_name, test_sub_service_data)