LasCon 2014 DevOoops

Transcript

• 1. DevOoops LasCon October 2014
• 2. Who Ken Ken Johnson (@cktricky) ● CTO (@nVisium) ● Railsgoat Co-Author ● (One) of the voices of SecCasts
• 3. Who Chris Chris Gates (CG) @carnal0wnage ● Security Engineer (Facebook) ● NoVA Hackers Co-Founder ● http://carnal0wnage.attackresearch.com
• 4. Why This Talk Increase awareness around DevOps infra security Provide solutions Demonstrate impact, regardless of where the infrastructure is deployed (internal, external, cloud)
• 5. Agenda ● GitHub ● Revision Control Tools ● Continuous Integration Tools ● AWS Config Files ● Client Provisioning Tools ● Elasticsearch ● In-Memory Databases
• 6. GitHub
• 7. GitHub Search GitHub Advanced Search ● GitHub supports advanced search operators ● Google hacking for GitHub ○ http://seclists.org/fulldisclosure/2013/Jun/15 ○ http://blog.conviso.com.br/2013/06/github-hacking-for-fun-and-sensitive.html GitHub OSINT ● Check $company employee repos for uh ohs ○ internal project commits, passwords, etc
• 8. Git Fun Can we impersonate other GitHub users? Sort of.
• 9. Git Fun Let’s be Linus...
• 10. Git Fun
• 11. Git Fun Result: It appears Linus committed to our repo
• 12. Git Fun (Review) ● Audit who has access to your repos ○ Have a process to remove ex-employees ○ Consider auditing their personal repos for leaks ● Be suspicious of Pull Requests ○ From “trusted” authors (they can be spoofed) ○ With massive code changes within the PR (can potentially introduce vulns)
• 13. GitHub Org “To Do’s” Forks need be deleted if a member leaves your org ● https://help.github.com/articles/deleting-a-private-fork-of-a-private- organization-repository/ Audit organization members for 2 factor authentication ● https://developer.github.com/changes/2014-01-29-audit-org-members- for-2fa/
• 14. Revision Control
• 15. .Git Exposed Do you have your .git folder exposed on a webserver outside? ● Or inside? ● Access to .git content can allow for full source download. ● Use wget, DVCS-Pillage, or dvcs-ripper to archive and recreate the repo locally. https://github.com/evilpacket/DVCS-Pillage https://github.com/kost/dvcs-ripper
• 16. .Git Exposed If directory listings are enabled, it’s simple to get source $ mkdir git-test $ cd git-test $ wget --mirror --include-directories=/.git http://www. example.com/.git Then $ cd www.example.com $ git reset --hard HEAD is now at [...] You now have the source of the site
• 17. .Git Exposed
• 18. .Git Exposed If directory listings are NOT enabled ● Test by checking for .git/config ● Use DVCS-Pillage or dvcs-ripper to download the source. DVCS-Pillage also supports Mercurial (HG) and Bazaar (BZR).
• 19. .Git Exposed What can you get? ● Creds, config files, source code, dev names, public keys, email addresses, etc ● repo history: vulns fixed, passwords/keys checked in but removed later :-) ● wordpress config files common ● site/database backups in .git ● session generation keys
• 20. .Git Exposed Internal GitHub Enterprise ties into organization’s LDAP or Active Directory. ● Find devops/devpassword equivalent ● Download source code ● Log in and search for interesting things
• 21. Subversion Subversion 1.6 (and earlier) ● Check for .entries files ● Walk svn chain to retrieve source ● Example: ○ http://somedomain.com/.svn/text-base/index.php.svn-base ● Metasploit Auxiliary Module: ○ auxiliary/scanner/http/svn_scanner Reference: http://pen-testing.sans.org/blog/pen-testing/2012/12/06/all-your-svn-are-belong-to-us
• 22. Subversion Subversion 1.7 and later ● Working copy and changes stored in a sqlite database ● Example: ○ http://www.somedomain.com/.svn/wc.db ● Metasploit Auxiliary Module: ○ auxiliary/scanner/http/svn_wcdb_scanner Reference: http://pen-testing.sans.org/blog/pen-testing/2012/12/06/all-your-svn-are-belong-to-us
• 23. GitList
• 24. GitList
• 25. GitList RCE: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/ Affects: version 0.4.0 and below
• 26. Continuous Integration
• 27. Hudson/Jenkins “Hudson is a continuous integration (CI) tool written in Java, which runs in a servlet container, such as Apache Tomcat or the GlassFish application server” Very popular If you can’t pwn Jenkins then try GlassFish or Tomcat :-)
• 28. Hudson/Jenkins Shodan search for X-Hudson
• 29. Hudson/Jenkins Shodan search for X-Hudson with HTTP 200
• 30. Hudson/Jenkins Metasploit Aux Module
• 31. Hudson/Jenkins If no authentication required ● Trivial to gain remote code execution via script console ● Metasploit Module ○ exploit/multi/http/jenkins_script_console https://www.pentestgeek.com/2014/06/13/hacking-jenkins-servers-with-no-password/ http://www.labofapenetrationtester.com/2014/06/hacking-jenkins-servers.html http://zeroknock.blogspot.com/search/label/Hacking%20Jenkins
• 32. Hudson/Jenkins Script Console
• 33. Hudson/Jenkins
• 34. Hudson/Jenkins Metasploit exploit module for script console
• 35. Hudson/Jenkins You can lock down script console access by turning on authentication ● However, if it’s set to local auth, you can register as a regular user :-) ● ...then get access to the /script
• 36. Hudson/Jenkins If you have access to /view/All/newJob, create a new build and run commands
• 37. Hudson/Jenkins
• 38. Hudson/Jenkins Can you browse a workspace?
• 39. Hudson/Jenkins
• 40. Hudson/Jenkins
• 41. AWS Config Files
• 42. AWS - CLI Dev Tools AWS stores creds in plaintext in **hidden files** Typically privileged access
• 43. AWS - CLI Dev Tools
• 44. AWS - CLI Dev Tools + EB
• 45. AWS - Pivoting Once credentials are obtained, leverage nimbostratus to pivot http://andresriancho.github.io/nimbostratus/ or… just leverage any of the open source libraries available to interact with AWS
• 46. Client Provisioning
• 47. Chef Chef allows you to define the state your servers (local or cloud) should be in and enforces it.
• 48. Chef (Web Interface) Default/Weak Creds
• 49. Chef (Web Interface) Environment Leakage
• 50. Chef (Web Interface) Databags
• 51. Chef/knife knife is a Chef command line utility ● Credentials stored in data bags ● Can be encrypted ● Example: $ knife data bag list
• 52. Chef/knife
• 53. Chef/knife (encrypted data bag)
• 54. Chef/knife
• 55. Vagrant Did you change your SSH keys?
• 56. Vagrant ● Default Credentials ○ root/vagrant vagrant/vagrant ○ No pass to sudo :-)
• 57. Vagrant Scan using the default private key
• 58. Vagrant Scan using the default private key
• 59. Vagrant Identify real from fake by ssh version scan
• 60. Vagrant Breaking into host from guest http://finite.state.io/blog/2012/10/30/breaking-in-and-out-of-vagrant/ “Put evil things in /vagrant/.git/hooks/post-commit and wait for the user to commit some code. Since the /vagrant/ directory is mounted from the host, my hook will persist even if the user destroys the VM.”
• 61. Kickstart Files 3 ways to set root password 1. Enter during installation 2. Crypted hash in the kickstart file “rootpw --iscrypted” 3. Clear text in the kickstart file “rootpw --plaintext”
• 62. Kickstart Files Examples
• 63. Kickstart Files Examples
• 64. ElasticSearch
• 65. elasticsearch Provides a distributed, multitenant-capable full-text search engine with a RESTful web interface and schema-free JSON documents. ● GET request to port 9200 will show version "version" : { "number" : "1.2.4",
• 66. elasticsearch ● No Authentication ● Can search stored data via HTTP API ● Update data with PUT request ● Join an open cluster and receive all data ● RCE prior to 1.2.0
• 67. elasticsearch exploit/multi/elasticsearch/script_mvel_rce
• 68. elasticsearch Searching via curl/browser is cumbersome ● Kibana FTW ○ http://www.elasticsearch.org/overview/kibana/ ● Edit config.js to point to open Elasticsearch ● Open index.html in local browser or host on a server
• 69. elasticsearch (Kibana)
• 70. elasticsearch (Kibana)
• 71. elasticsearch (Kibana) Viewing the content of the document
• 72. In-Memory Databases
• 73. Redis Defaults: ● No encrypted communication ● No credentials ● Port 6379 (TCP) ● Binds to all interfaces ○ Moral of the story? Keep off the interwebs!
• 74. Redis How prevalent is this?
• 75. Redis You can navigate the DB with the redis-cli
• 76. Redis Or use the Redis Desktop Manager
• 77. Redis Feel lucky?
• 78. Redis - Fun Commands FLUSHALL SCRIPT LOAD EVAL / EVALSHA ○ Also - Thanks Adam Baldwin: ○ https://github.com/evilpacket/redis-sha-crack
• 79. memcache Free & open source, high-performance, distributed memory object caching system No code exec, but fun things get put into memcache Examples
• 80. memcache
• 81. memcache
• 82. memcache
• 83. What can we do about this?
• 84. Actions you can take tomorrow ● If you have Jenkins, make sure it requires authentication ● Ensure access to tools/systems are only available to hosts that need it ● Change default vagrant private key ● Update to latest versions of your devops tools
• 85. Thanks! Ken Johnson ken.johnson [at] nvisium.com Chris Gates chris [at] carnal0wnage.com