Identify IAM Breaches with CloudTrail and Athena

Iniciamos sesion con las credenciales.

aws configure

aws sts get-caller-identity

aws athena start-query-execution --query-string "SELECT useridentity, sourceipaddress FROM cloudtrail_logs_aws_cloudtrail_logs_104506445608_4e45885e WHERE eventname = 'ConsoleLogin' AND eventTime LIKE '%2023-08-30%' AND responseelements LIKE '%Success%'" --result-configuration OutputLocation="s3://aws-athena-query-results-104506445608-us-east-1/Unsaved/"

Con este comando vemos cual usuario inicio sesion exitosamente.

aws athena get-query-results --query-execution-id a537d23d-26ca-4282-9854-fc531f688ca9 --query 'ResultSet.Rows[].Data[].VarCharValue' --output text > resultado.txt

Con el siguiente comando en awk podemos adquirir el usuario y la ip.

awk '
BEGIN {                                                                          
  print " IP Address\t User Agent"
} 
{
  user_agent = "";
  for (i=3; i<=NF; i++) {
    # Check if the field is an IP address using regex.
    if ($i ~ /^[0-9]{1,3}(\.[0-9]{1,3}){3}$/) {
      if (user_agent != "") {
        uniqueKey = ip " " user_agent;
        if (!(uniqueKey in seen)) {
          print " "ip "\t " user_agent;
          seen[uniqueKey] = 1;
        }
        user_agent = "";
      }
      ip = $i;
    } else {
      if (user_agent != "") {
        user_agent = user_agent " " $i;
      } else {
        user_agent = $i;
      }
    }
  }
  if (ip && user_agent) {
    uniqueKey = ip " " user_agent;
    if (!(uniqueKey in seen)) {
      print " "ip "\t " user_agent;
      seen[uniqueKey] = 1;
    }
  }
}' results.txt

A mi nunca me salio el usuario.

aws athena start-query-execution --query-string "SELECT sourceipaddress, useragent FROM cloudtrail_logs_aws_cloudtrail_logs_104506445608_4e45885e WHERE eventname = 'ConsoleLogin' AND eventTime LIKE '%2023-09-%'" --result-configuration OutputLocation="s3://aws-athena-query-results-104506445608-us-east-1/Unsaved/"

Ahora hacemos una consulta con la informacion de la ip.

aws athena get-query-results --query-execution-id 20ea9f7c-8863-4100-9e13-d5c264991fce --query 'ResultSet.Rows[].Data[].VarCharValue' --output text > resultados.txt

Exportamos el resultado a un archivo.

aws athena start-query-execution --query-string "SELECT sourceipaddress, useragent FROM cloudtrail_logs_aws_cloudtrail_logs_104506445608_4e45885e WHERE eventname = 'ConsoleLogin' AND eventTime LIKE '%2023-09-%'" --result-configuration OutputLocation="s3://aws-athena-query-results-104506445608-us-east-1/Unsaved/"

Adquirimos otro id para poder agarrar el flag.

└─$ aws athena get-query-results --query-execution-id 20ea9f7c-8863-4100-9e13-d5c264991fce --query 'ResultSet.Rows[].Data[].VarCharValue' --output text > resultado_final.txt

Lo exportamos a un archivo texto.

Desplegamos los resultados.