Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'aws-sdk-iam'
7

8
class MetasploitModule < Msf::Auxiliary
9
  def initialize(info = {})
10
    super(
11
      update_info(
12
        info,
13
        'Name'        => 'Amazon Web Services IAM credential enumeration',
14
        'Description' => %q(
15
                          Provided AWS credentials, this module will call the authenticated
16
                          API of Amazon Web Services to list all IAM credentials associated
17
                          with the account
18
                         ),
19
        'Author'      => ['Aaron Soto <[email protected]>'],
20
        'License'     => MSF_LICENSE
21
      )
22
    )
23

24
    register_options(
25
      [
26
        OptString.new('ACCESS_KEY_ID', [true, 'AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")', '']),
27
        OptString.new('SECRET_ACCESS_KEY', [true, 'AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")', ''])
28
      ]
29
    )
30
  end
31

32
  def handle_aws_errors(e)
33
    if e.class.module_parents.include?(Aws)
34
      fail_with(Failure::UnexpectedReply, e.message)
35
    else
36
      raise e
37
    end
38
  end
39

40
  def describe_iam_users(i)
41
    user = i.user_name
42

43
    print_good "  User Name:       #{user}"
44
    print_good "  User ID:         #{i.user_id}"
45
    print_good "  Creation Date:   #{i.create_date}"
46
    print_good "  Tags:            #{i.tags}"
47
    print_good "  Groups:          #{i.group_list}"
48
    print_good "  SSH Pub Keys:    #{@iam.list_ssh_public_keys(user_name: user).ssh_public_keys}"
49

50
    policies = i.attached_managed_policies
51
    if policies.empty?
52
      print_good "  Policies:        []"
53
    else
54
      print_good "  Policies:        #{policies[0].policy_name}"
55
      policies[1..policies.length].each do |p|
56
        print_good "                   #{p.policy_name}"
57
      end
58
    end
59

60
    certs = @iam.list_signing_certificates(user_name: user).certificates
61
    if certs.empty?
62
      print_good "  Signing certs:   []"
63
    else
64
      print_good "  Signing certs:   #{certs[0].certificate_id} (#{certs[0].status})"
65
      certs[1..certs.length].each do |c|
66
        print_good "                   #{c.certificate_id} (#{c.status})"
67
      end
68
    end
69

70
    @users.each do |u|
71
      if u.user_name == user
72
        print_good "  Password Used:   #{u.password_last_used || '(Never)'}"
73
      end
74
    end
75

76
    keys = @iam.list_access_keys(user_name: user).access_key_metadata
77
    if keys.empty?
78
      print_good "  AWS Access Keys: []"
79
    else
80
      print_good "  AWS Access Keys: #{keys[0].access_key_id} (#{keys[0].status})"
81
      keys[1..keys.length].each do |k|
82
        print_good "                   #{k.access_key_id} (#{k.status})"
83
      end
84
    end
85

86
    begin
87
      console_login = @iam.get_login_profile(user_name: user).empty? ? 'Disabled' : 'Enabled'
88
      print_good "  Console login:   #{console_login}"
89
    rescue Aws::IAM::Errors::NoSuchEntity
90
      print_good "  Console login:   Disabled"
91
    end
92

93
    mfa = @iam.list_mfa_devices(user_name: i.user_name).mfa_devices
94
    mfa_enabled = mfa.empty? ? 'Disabled' : "Enabled on #{mfa[0].enable_date}"
95
    print_good "  Two-factor auth: #{mfa_enabled}"
96

97
    print_status ''
98
  end
99

100
  def run
101
    @iam = Aws::IAM::Client.new(
102
      region: 'us-west-1',      # This is meaningless, but required.  Thanks AWS.
103
      access_key_id: datastore['ACCESS_KEY_ID'],
104
      secret_access_key: datastore['SECRET_ACCESS_KEY']
105
    )
106

107
    @users = @iam.list_users.users
108
    creds = @iam.get_account_authorization_details
109

110
    users = creds.user_detail_list
111
    if users.empty?
112
      print_status 'No users found.'
113
      return
114
    end
115

116
    print_good "Found #{users.count} users."
117
    users.each do |i|
118
      describe_iam_users(i)
119
    end
120
  rescue ::Exception => e
121
    handle_aws_errors(e)
122
  end
123
end
124

125