can-i-take-over-xyz Amazon S3 proofs

Amazon S3 proofs

Open PatrikHudak opened this issue 5 years ago • 74 comments

Service name

Amazon (AWS) S3

Proof

Amazon S3 service is indeed vulnerable. Amazon S3 follows pretty much the same concept of virtual hosting as other cloud providers. S3 buckets might be configured as website hosting to serve static content as web servers. If the canonical domain name has website in it, the S3 bucket is specified as Website hosting. I suspect that non-website and website configured buckets are handled by separate load balancers, and therefore they don't work with each other. The only difference will be in the bucket creation where correct website flag needs to be set if necessary. Step-by-step process:

Go to S3 panel
Click Create Bucket
Set Bucket name to source domain name (i.e., the domain you want to take over)
Click Next multiple times to finish
Open the created bucket
Click Upload
Select the file which will be used for PoC (HTML or TXT file). I recommend naming it differently than index.html; you can use poc (without extension)
In Permissions tab select Grant public read access to this object(s)
After upload, select the file and click More -> Change metadata
Click Add metadata, select Content-Type and value should reflect the type of document. If HTML, choose text/html, etc.
(Optional) If the bucket was configured as a website
1. Switch to Properties tab
2. Click Static website hosting
3. Select Use this bucket to host a website
4. As an index, choose the file that you uploaded
5. Click Save

To verify the domain, I run:

http -b GET http://{SOURCE DOMAIN NAME} | grep -E -q '<Code>NoSuchBucket</Code>|<li>Code: NoSuchBucket</li>' && echo "Subdomain takeover may be possible" || echo "Subdomain takeover is not possible"

Note that there are two possible error pages depending on the bucket settings (set as website hosting or not).

Some reports on H1, claiming S3 buckets:

https://hackerone.com/reports/121461
https://hackerone.com/reports/294201

Documentation

There are several formats of domains that Amazon uses for S3 (RegExp):

^[a-z0-9\.\-]{0,63}\.?s3.amazonaws\.com$
^[a-z0-9\.\-]{0,63}\.?s3-website[\.-](eu|ap|us|ca|sa|cn)-\w{2,14}-\d{1,2}\.amazonaws.com(\.cn)?$
^[a-z0-9\.\-]{0,63}\.?s3[\.-](eu|ap|us|ca|sa)-\w{2,14}-\d{1,2}\.amazonaws.com$
^[a-z0-9\.\-]{0,63}\.?s3.dualstack\.(eu|ap|us|ca|sa)-\w{2,14}-\d{1,2}\.amazonaws.com$

Note that there are cases where only raw domain (e.g. s3.amazon.com) is included in CNAME and takeover is still possible.

(Documentation taken from https://0xpatrik.com/takeover-proofs/)

Sep 12 '18 20:09 PatrikHudak

Official documentation link: https://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html

Sep 15 '18 19:09 PatrikHudak

I've come across a sub-domain which confirms the error message: <Error> <Code>NoSuchBucket</Code> <Message>The specified bucket does not exist</Message> <BucketName>randombucket-assets</BucketName>

When use the dig command, the CNAME points to a random.cloudfront.net URL.

On trying to follow the above steps, getting below message while creating the S3 bucket with same name: "Bucket name already exists"

I'm entering the full sub-domain name in the bucket name. Am I missing something to check?

Update: I've been able to find the S3 bucket URL: subdomain.s3.amazonaws.com

Mar 14 '19 16:03 sumgr0

id 64053 opcode QUERY rcode NOERROR flags QR RD RA ;QUESTION girishsarwal.me. IN CNAME ;ANSWER ;AUTHORITY something.me. 899 IN SOA ns-732.awsdns-27.net. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ;ADDITIONAL

in s3 bucket, i'm facing this problem. What's solution for this ? Screenshot_1

Jul 09 '19 08:07 soynek

@soynek You're going to need to dig into the documentation for this one, we've had to draw the line at this repository being treated like a support desk. This is here to outline the work people have contributed back, and to outline vulnerable areas, but if you have a specific subdomain takeover question then the documentation for that service is where you should be looking.

Jul 09 '19 11:07 codingo

@codingo I want to takeover a subdomain and i face that problem as in picture showing. Any solution for this?

Jul 09 '19 18:07 soynek

Hi I found a domain with CNAME *.cloudfront.net When I access it from browser it returned empty. I tried to add it to bucket by steps above and was successfully added. But when I access it, it's still empty, I tried other subdomains from same domain but they say 'Bucket name already exist'. Please explain me this

Feb 23 '20 10:02 yoursquad13

@yoursquad13 Because *.cloudfront.net is not a subdomain for S3

Feb 23 '20 12:02 PatrikHudak

Hi, during a bug bounty activity I have found a subdomain vulnerable to takeover, the dig command returns this information: sub.example.com CNAME [bucket_name].s3.amazonaws.com and then: [bucket_name].s3.amazonaws.com CNAME s3-1-w.amazonaws.com I haven't the region information from dig command.

Also if I visit the page, I get an XML error. Below is the screenshot: Screenshot_2020-02-26_15-59-34

The subdomain would seem vulnerable to takeover, but when I go to create the bucket from my AWS console, I get the following error: Bucket name already exists

Anyone can help me? Thank You!

Feb 26 '20 15:02 nynuz

@webliqui Any news on this issue? I am running into the same thing

May 04 '20 16:05 OGoodness

Have you guys ran the AWS CLI like aws s3 ls <bucket_name>? I think this command search in all regions for a bucket name.

May 04 '20 18:05 soareswallace

@webliqui You found something? I'm facing the same issue. @codingo Do you have some solution for this?

May 05 '20 11:05 theinfosecguy

same issue as @webliqui. @codingo?

Jun 19 '20 06:06 Zachswan1

I believe, as I mentioned above, this issue is related to the region. This bucket may not be created on the region that you are testing on. But if you use the AWS CLI (aws s3 ls <bucket_name>) I believe you would find the bucket. I suggest you to test using the AWS CLI.

Jun 23 '20 22:06 soareswallace

Hi @soareswallace :), I got the same error and when I execute the command you suggested in the latest reply, I get this error: An error occurred (AllAccessDisabled) when calling the ListObjectsV2 operation: All access to this object has been disabled ... any tip to make possible the take over ?

Regards, Mik

Jul 05 '20 10:07 Mik317

I believe when we get this message @Mik317 , the take over is not possible. This message show that the bucket does exist and has an owner.

Stay safe,

Wallace

Jul 09 '20 18:07 soareswallace

Hi @soareswallace :). Thanks for the reply. I'll be lucky the next time ;)

Until that, stay safe and hack the world ;)

Regards, Mik

Jul 09 '20 18:07 Mik317

Hi @soareswallace I discovered a subdomain whose CNAME is point to *.elb.amazonaws.com. How can I takeover this subdomain? Is the process same as creating a s3 bucket?

Jul 15 '20 15:07 FaizanNehal

Hi @FaizanNehal,

I tried once, but never found out how to do it. I also would like to know how we can takeover. Let us know if you discover anything.

Wallace

Jul 15 '20 16:07 soareswallace

Anyone knows about amazon route 53???? Is it vulnerable?

Jul 21 '20 06:07 vemoa

I found a subdomain.domain.com that is vulnerable, and confirmed with dig that CNAME was for s3 bucket in Verginia When I tried creating the bucket with the same name it worked but the endpoint for the bucket was like so: ^[a-z0-9\.\-]{0,63}\.?s3-website[\.-](eu|ap|us|ca|sa|cn)-\w{2,14}-\d{1,2}\.amazonaws.com(\.cn)?$ Which is mentioned in the documentation. OR ^[a-z0-9\.\-]{0,63}\.?s3.amazonaws\.com$/subdomain.domain.com/ Which is not.

my question is since it is not mentioned in the steps above how to make those regexes point to subdomain.domain.com?

Aug 04 '20 16:08 PxHunt3r

is this service still vulnerable?

Sep 04 '20 16:09 GDATTACKER-RESEARCHER

Not really, usually before the elb there's a random number.

Sep 23 '20 19:09 pdelteil

Hi, I have found "The specified bucket does not exist" for few subdomains. But when I do a dig, the subdomains fail to give a CNAME record. So does it mean that they are not vulnerable. Or am I missing something here?

Sep 25 '20 05:09 anantupadhya

did u find any info about it?

Mar 18 '21 16:03 empty00

So far, from what I could search about it, is not possibly to take over amazon's load balance.

Mar 18 '21 16:03 soareswallace

And as @pdelteil replied above:

Mar 18 '21 16:03 soareswallace

okey , thanks

Mar 18 '21 16:03 empty00

in this case i try to create bucket by deleteing at recreating it ofcourse it take time but work it.

May 23 '21 13:05 GDATTACKER-RESEARCHER

@technicaljunkie which kind?

Aug 25 '21 10:08 knowthetech

Hi,

I've got the fingerprint The specified bucket does not exist However, when I dig for dns records using dig +nocmd +noall +answer CNAME sub.domain.com I get nothing on CNAME record ?

Does it mean some measures have already been taken ? can I take it over ?

Thank you in advance

Nov 04 '21 17:11 Sim4n6

Try ping to know region and in case of subdomain not necessary you usually see them clear when firewall being used

Nov 04 '21 17:11 GDATTACKER-RESEARCHER

Do you mean traceroute?

Nov 04 '21 20:11 Sim4n6

@Sim4n6 no i mean ping sub.site.com

Nov 04 '21 20:11 GDATTACKER-RESEARCHER

Well, either dig or ping got me the IP address. And it is located in Zurich. Now the question is the bucket name is unknown.

Nov 05 '21 06:11 Sim4n6

CNAME of sub.domain.com does not show a domain of format ^[a-z0-9.-]{0,63}.?s3.amazonaws.com$

But curl -v does return the fingerprint.

Nov 05 '21 06:11 Sim4n6

I've got the bucket name, so unfortunate the name is already taken 😕😕

Nov 08 '21 14:11 Sim4n6

Got this errror solved in some of my takeovers

Jan 13 '22 15:01 GDATTACKER-RESEARCHER

I was checking for subdomain takeover and got a s3 bucket which doesn't exists and confirmed the takeover vulnerability with subzy, but the problem is im not able to create bucket with the vulnerable domain name, its says, Bucket with the same name already exists, so how to takeover this bucket??

eiTL45H29314

Apr 08 '22 15:04 AkshayraviC09YC47

It can possibly be a honeypot i saw same during one target else confirm you are entering bucket name because sometimes it's not same as host url

Apr 08 '22 15:04 knowthetech

@soynek did you ever find a solution to this? If so, how did you fix it?

May 28 '22 17:05 Finlay1010

Bucket region mismatch change region

May 28 '22 17:05 GDATTACKER-RESEARCHER

In your case us-west-2 is region

May 28 '22 18:05 GDATTACKER-RESEARCHER

@GDATTACKER-RESEARCHER how can you find out which one you need to change to out of the 22 options?

May 28 '22 19:05 Finlay1010

Different ways depend on case by case bases by ping, other buckets in use by site, cname etc

May 28 '22 19:05 GDATTACKER-RESEARCHER

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Jul 16 '22 08:07 SAGEof6iixPATHS

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Yes

Jul 16 '22 08:07 GDATTACKER-RESEARCHER

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Yes

Have you tried?

Jul 16 '22 08:07 SAGEof6iixPATHS

Is this vulnerable? asdasd.target.com shows this

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist.</Message>
<Resource>/asd</Resource>
<RequestId>uzEH...</RequestId>
</Error>

And DIG shows this:

target.com.       *   IN      NS      ns-*.awsdns-53.net.
target.com.       *   IN      NS      ns-*.awsdns-58.org.
target.com.       *   IN      NS      ns-*.awsdns-23.co.uk.
target.com.       *   IN      NS      ns-*.awsdns-44.com.

* - Stars are in the place of some numbers

Yes

Have you tried?

🤣😂 nice question i still hai 15 buckets claimed i guess

Jul 16 '22 09:07 GDATTACKER-RESEARCHER

Good for you, thanks for the help!!

Jul 16 '22 09:07 SAGEof6iixPATHS

can-i-take-over-xyz can-i-take-over-xyz copied to clipboard

Amazon S3 proofs

Service name

Proof

Documentation

can-i-take-over-xyz
can-i-take-over-xyz copied to clipboard