🛡️ Cyber with KT Vault

S3_Bucket_Misconfiguration

1 min read

☁️ S3 Bucket Misconfiguration

📝 Description

Amazon S3 (Simple Storage Service) buckets are often used to store static files, backups, and web application assets. A misconfiguration occurs when the bucket permissions (ACLs or Bucket Policies) allow unauthorized users to list, read, or write files.

🔍 Identification

  1. VHOST Enumeration: Often discovered as subdomains like s3.example.htb.
  2. Fingerprinting: Response headers often indicate the use of MinIO or AWS S3.
  3. Direct Access: Trying to access the bucket URL via browser or tool.

🛠️ Exploitation Tools

  • AWS CLI: The primary tool for interacting with S3-compatible interfaces.
  • S3Scanner: For automated scanning of open buckets.

🚀 Common Commands

# List buckets
aws --endpoint=http://s3.thetoppers.htb/ s3 ls
 
# List files in a specific bucket
aws --endpoint=http://s3.thetoppers.htb/ s3 ls s3://thetoppers.htb
 
# Uploading a webshell (if write access is enabled)
aws --endpoint=http://s3.thetoppers.htb/ s3 cp shell.php s3://thetoppers.htb

🛡️ Remediation

  1. Disable Public Access: Enable “Block all public access” settings in AWS.
  2. Principle of Least Privilege: Use IAM policies to restrict access to specific users/roles.
  3. Audit Permissions: Regularly review ACLs and Bucket Policies for unintended “AllUsers” or “AuthenticatedUsers” access.

IMPORTANT

If a bucket is used for web hosting, Ensure that only non-executable static files are writable.

Graph View