Skip to content

Latest commit

 

History

History
142 lines (101 loc) · 6.74 KB

aws-datapipeline-codepipeline-codebuild-and-codecommit.md

File metadata and controls

142 lines (101 loc) · 6.74 KB
Raw

AWS - DataPipeline, CodePipeline, CodeBuild & CodeCommit

Support HackTricks and get benefits!

DataPipeline

With AWS Data Pipeline, you can regularly access your data where it’s stored, transform and process it at scale, and efficiently transfer the results to AWS services such as Amazon S3, Amazon RDS, Amazon DynamoDB, and Amazon EMR.

Enumeration

aws datapipeline list-pipelines
aws datapipeline describe-pipelines --pipeline-ids <ID>
aws datapipeline list-runs --pipeline-id <ID>
aws datapipeline get-pipeline-definition --pipeline-id <ID>

Privesc

In the following page you can check how to abuse datapipeline permissions to escalate privileges:

{% content-ref url="../aws-privilege-escalation/aws-datapipeline-privesc.md" %} aws-datapipeline-privesc.md {% endcontent-ref %}

CodePipeline

AWS CodePipeline is a fully managed continuous delivery service that helps you automate your release pipelines for fast and reliable application and infrastructure updates. CodePipeline automates the build, test, and deploy phases of your release process every time there is a code change, based on the release model you define.

Enumeration

aws codepipeline list-pipelines
aws codepipeline get-pipeline --name <pipeline_name>
aws codepipeline list-action-executions --pipeline-name <pl_name>
aws codepipeline list-pipeline-executions --pipeline-name <pl_name>
aws codepipeline list-webhooks
aws codepipeline get-pipeline-state --name <pipeline_name>

Privesc

In the following page you can check how to abuse codepipeline permissions to escalate privileges:

{% content-ref url="../aws-privilege-escalation/aws-codepipeline-privesc.md" %} aws-codepipeline-privesc.md {% endcontent-ref %}

CodeBuild

AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. With CodeBuild, you don’t need to provision, manage, and scale your own build servers.

Enumeration

# List external repo creds (such as github tokens)
## It dosn't rturn the token but just the ARN where it's located
aws codebuild list-source-credentials

# Projects
aws codebuild list-shared-projects
aws codebuild list-projects
aws codebuild batch-get-projects --names <project_name> #Check for creds in env vars

# Builds
aws codebuild list-builds
aws codebuild list-builds-for-project --project-name <p_name>

# Reports
aws codebuild list-reports
aws codebuild describe-test-cases --report-arn <ARN>

Privesc

In the following page you can check how to abuse codebuild permissions to escalate privileges:

{% content-ref url="../aws-privilege-escalation/aws-codebuild-privesc.md" %} aws-codebuild-privesc.md {% endcontent-ref %}

CodeCommit

It is a version control service, which is hosted and fully managed by Amazon, which can be used to privately store data (documents, binary files, source code) and manage them in the cloud.

It eliminates the requirement for the user to know Git and manage their own source control system or worry about scaling up or down their infrastructure. Codecommit supports all the standard functionalities that can be found in Git, which means it works effortlessly with user’s current Git-based tools.

Enumeration

# Repos
aws codecommit list-repositories
aws codecommit get-repository --repository-name <name>
aws codecommit get-repository-triggers --repository-name <name>
aws codecommit list-branches --repository-name <name>
aws codecommit list-pull-requests --repository-name <name>

# Approval rules
aws codecommit list-approval-rule-templates
aws codecommit get-approval-rule-template --approval-rule-template-name <name>
aws codecommit list-associated-approval-rule-templates-for-repository --repository-name <name>

# Get & Put files
## Get a file
aws codecommit get-file --repository-name backend-api --file-path app.py
## Put a file
aws codecommit get-branch --repository-name backend-api --branch-name master
aws codecommit put-file --repository-name backend-api --branch-name master --file-content fileb://./app.py --file-path app.py --parent-commit-id <commit-id>

# SSH Keys & Clone repo
## Get codecommit keys
aws iam list-ssh-public-keys #User keys for CodeCommit
aws iam get-ssh-public-key --user-name <username> --ssh-public-key-id <id> --encoding SSH #Get public key with metadata
# The previous command will give you the fingerprint of the ssh key
# With the next command you can check the fingerprint of an ssh key and compare them
ssh-keygen -f .ssh/id_rsa -l -E md5

# Clone repo
git clone ssh://<SSH-KEY-ID>@git-codecommit.<REGION>.amazonaws.com/v1/repos/<repo-name>
Support HackTricks and get benefits!