CTF Walkthrough: pentesting.cloud "Aurora Borealis"
Tags: aws, pentesting, cloud, mysql
Published: 2023-01-22 01:16:14

The [`pentesting.cloud`](pentesting.cloud) challenge [Aurora Borealis](https://pentesting.cloud/challenge/aurora-borealis/) asks us to understand the permissions and processes to connect to Aurora databases with AWS IAM authentication. It creates an Amazon Aurora DB based on a snapshot with unknown contents and configuration, an EC2 instance, and limited user permissions.

## Finding a starting point

We examine the IAM roles and policies in the environment, and see that there's an EC2 instance role that can `rds-db:*` on `arn:aws:rds-db:us-west-2:*:dbuser:*/us-west-2`. The `rds-db:*` includes all RDS IAM actions, including connecting to the database. It's important to read that ARN carefully because it reveals the database username we'll need. The [ARN format of a db-user](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsiamauthentication.html) is `arn:${Partition}:rds-db:${Region}:${Account}:dbuser:${DbiResourceId}/${DbUserName}`. That's right, the _username_ is `us-west-2`, it's not referring to the region.

Since the permissions belong to the EC2 instance, we need to connect from there. Conveniently, `pentesting-user` can `ssm:StartSession` on that instance.

## Connecting to the DB

We start an SSM session on the EC2 instance so we can use its permissions to connect to the [RDS database using IAM authentication](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.AWSCLI.html). We'll first need to install the mysql client, download the SSL certificate, and generate an authentication token for the user.

```
sh-4.2$ sudo yum install mysql
sh-4.2$ wget https://truststore.pki.rds.amazonaws.com/us-west-2/us-west-2-bundle.pem
sh-4.2$ RDSHOST="aurora-dbcluster-yjt22bb5xqez.cluster-cmugjtcpbuo6.us-west-2.rds.amazonaws.com"
sh-4.2$ TOKEN="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 1337 --region us-west-2 --username us-west-2)"
sh-4.2$ mysql --host=$RDSHOST --port=1337 --ssl-ca=us-west-2-bundle.pem --user=us-west-2 --password=$TOKEN

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 24
Server version: 5.7.12 MySQL Community Server (GPL)
MySQL [(none)]>
```

With the MySQL connection, let's explore the database to find the flag.

```
MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| flags              |
+--------------------+

MySQL [(none)]> use flags;
Database changed

MySQL [flags]> show tables;
+-----------------+
| Tables_in_flags |
+-----------------+
| flag            |
+-----------------+

MySQL [flags]> describe flag;
+-------+--------------+------+-----+---------+-------+
| Field | Type         | Null | Key | Default | Extra |
+-------+--------------+------+-----+---------+-------+
| flag  | varchar(100) | YES  |     | NULL    |       |
+-------+--------------+------+-----+---------+-------+

MySQL [flags]> select * from flag;
+----------------------------------+
| flag                             |
+----------------------------------+
| xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx |
+----------------------------------+
```

## Improving AWS data protection

This challenge didn't involve many steps, but required understanding AWS IAM authentication to RDS. To improve data protection with RDS:
- Be cognizant of the enabled authentication mechanisms
- Grant users the minimum permissions to perform their duties
- As much as possible, keep people away from data, limiting potential access vectors