|
| 1 | +from __future__ import print_function |
| 2 | +import sys |
| 3 | +import json |
| 4 | +import pyjq |
| 5 | +from shared.common import parse_arguments |
| 6 | +from commands.prepare import build_data_structure |
| 7 | + |
| 8 | +__description__ = "Find publicly exposed services and their ports" |
| 9 | + |
| 10 | +# TODO Look for IPv6 also |
| 11 | +# TODO Look at more services from https://github.com/arkadiyt/aws_public_ips |
| 12 | +# TODO Integrate into something to more easily port scan and screenshot web services |
| 13 | + |
| 14 | +def regroup_ranges(rgs): |
| 15 | + """ |
| 16 | + Functions to reduce sets of ranges. |
| 17 | +
|
| 18 | + Examples: |
| 19 | + [[80,80],[80,80]] -> [80,80] |
| 20 | + [[80,80],[0,65000]] -> [0,65000] |
| 21 | +
|
| 22 | + Taken from https://stackoverflow.com/questions/47656430/given-a-list-of-tuples-representing-ranges-condense-the-ranges-write-a-functio |
| 23 | + """ |
| 24 | + |
| 25 | + def overlap(r1, r2): |
| 26 | + """ |
| 27 | + Check for overlap in ranges. |
| 28 | + Returns -1 to ensure ranges like (2, 3) and (4, 5) merge into (2, 5) |
| 29 | + """ |
| 30 | + return r1[1] >= r2[0] - 1 |
| 31 | + |
| 32 | + def merge_range(r1, r2): |
| 33 | + s1, e1 = r1 |
| 34 | + s2, e2 = r2 |
| 35 | + return (min(s1, s2), max(e1, e2)) |
| 36 | + |
| 37 | + assert all([s <= e for s, e in rgs]) |
| 38 | + if len(rgs) == 0: |
| 39 | + return rgs |
| 40 | + |
| 41 | + rgs.sort() |
| 42 | + |
| 43 | + regrouped = [rgs[0]] |
| 44 | + |
| 45 | + for r2 in rgs[1:]: |
| 46 | + r1 = regrouped.pop() |
| 47 | + if overlap(r1, r2): |
| 48 | + regrouped.append(merge_range(r1, r2)) |
| 49 | + else: |
| 50 | + regrouped.append(r1) |
| 51 | + regrouped.append(r2) |
| 52 | + |
| 53 | + return regrouped |
| 54 | + |
| 55 | + |
| 56 | +def port_ranges_string(port_ranges): |
| 57 | + """ |
| 58 | + Given an array of tuple port ranges return a string that makes this more readable. |
| 59 | + Ex. [[80,80],[443,445]] -> "80,443-445" |
| 60 | + """ |
| 61 | + |
| 62 | + def port_range_string(port_range): |
| 63 | + if port_range[0] == port_range[1]: |
| 64 | + return '{}'.format(port_range[0]) |
| 65 | + return '{}-{}'.format(port_range[0], port_range[1]) |
| 66 | + return ','.join(map(port_range_string, port_ranges)) |
| 67 | + |
| 68 | + |
| 69 | +def log_warning(msg): |
| 70 | + print('WARNING: {}'.format(msg), file=sys.stderr) |
| 71 | + |
| 72 | + |
| 73 | +def public(accounts, config): |
| 74 | + for account in accounts: |
| 75 | + # Get the data from the `prepare` command |
| 76 | + outputfilter = {'internal_edges': False, 'read_replicas': False, 'inter_rds_edges': False, 'azs': False, 'collapse_by_tag': None, 'mute': True} |
| 77 | + network = build_data_structure(account, config, outputfilter) |
| 78 | + |
| 79 | + # Look at all the edges for ones connected to the public Internet (0.0.0.0/0) |
| 80 | + for edge in pyjq.all('.[].data|select(.type=="edge")|select(.source=="0.0.0.0/0")', network): |
| 81 | + |
| 82 | + # Find the node at the other end of this edge |
| 83 | + target = {'arn': edge['target'], 'account': account['name']} |
| 84 | + target_node = pyjq.first('.[].data|select(.id=="{}")'.format(target['arn']), network, {}) |
| 85 | + |
| 86 | + # Depending on the type of node, identify what the IP or hostname is |
| 87 | + if target_node['type'] == 'elb': |
| 88 | + target['type'] = 'elb' |
| 89 | + target['hostname'] = target_node['node_data']['DNSName'] |
| 90 | + elif target_node['type'] == 'autoscaling': |
| 91 | + target['type'] = 'autoscaling' |
| 92 | + target['hostname'] = target_node['node_data'].get('PublicIpAddress', '') |
| 93 | + if target['hostname'] == '': |
| 94 | + target['hostname'] = target_node['node_data']['PublicDnsName'] |
| 95 | + elif target_node['type'] == 'rds': |
| 96 | + target['type'] = 'rds' |
| 97 | + target['hostname'] = target_node['node_data']['Endpoint']['Address'] |
| 98 | + elif target_node['type'] == 'ec2': |
| 99 | + target['type'] = 'ec2' |
| 100 | + dns_name = target_node['node_data'].get('PublicDnsName', '') |
| 101 | + target['hostname'] = target_node['node_data'].get('PublicIpAddress', dns_name) |
| 102 | + else: |
| 103 | + print(pyjq.first('.[].data|select(.id=="{}")|[.type, (.node_data|keys)]'.format(target['arn']), network, {})) |
| 104 | + |
| 105 | + # Check if any protocol is allowed (indicated by IpProtocol == -1) |
| 106 | + ingress = pyjq.all('.[].IpPermissions[]', edge.get('node_data', {})) |
| 107 | + if pyjq.first('.[]|select(.IpProtocol=="-1")|.IpProtocol', ingress, '1') == '-1': |
| 108 | + log_warning('All protocols allowed access to {}'.format(target)) |
| 109 | + range_string = '0-65535' |
| 110 | + else: |
| 111 | + # from_port and to_port mean the beginning and end of a port range |
| 112 | + # We only care about TCP (6) and UDP (17) |
| 113 | + # For more info see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html |
| 114 | + selection = 'select((.IpProtocol=="tcp") or (.IpProtocol=="udp")) | select(.IpRanges[].CidrIp=="0.0.0.0/0")' |
| 115 | + port_ranges = pyjq.all('.[]|{}| [.FromPort,.ToPort]'.format(selection), ingress) |
| 116 | + range_string = port_ranges_string(regroup_ranges(port_ranges)) |
| 117 | + |
| 118 | + target['ports'] = range_string |
| 119 | + if target['ports'] == "": |
| 120 | + issue_msg = 'No ports open for tcp or udp (probably can only be pinged). Rules that are not tcp or udp: {} -- {}' |
| 121 | + log_warning(issue_msg.format(json.dumps(pyjq.all('.[]|select((.IpProtocol!="tcp") and (.IpProtocol!="udp"))'.format(selection), ingress)), account)) |
| 122 | + print(json.dumps(target, indent=4, sort_keys=True)) |
| 123 | + |
| 124 | + |
| 125 | +def run(arguments): |
| 126 | + _, accounts, config = parse_arguments(arguments) |
| 127 | + public(accounts, config) |
0 commit comments