{% hint style="success" %}
Learn & practice AWS Hacking:.png)
HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: .png)
HackTricks Training GCP Red Team Expert (GRTE).png)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
For more information, check:
{% content-ref url="../../aws-services/aws-codebuild-enum.md" %} aws-codebuild-enum.md {% endcontent-ref %}
In order to configure CodeBuild, it will need access to the code repo that it's going to be using. Several platforms could be hosting this code:
.png)
The CodeBuild project must have access to the configured source provider, either via IAM role of with a github/bitbucket token or OAuth access.
An attacker with elevated permissions in over a CodeBuild could abuse this configured access to leak the code of the configured repo and others where the set creds have access.
In order to do this, an attacker would just need to change the repository URL to each repo the config credentials have access (note that the aws web will list all of them for you):
.png)
And change the Buildspec commands to exfiltrate each repo.
{% hint style="warning" %}
However, this task is repetitive and tedious and if a github token was configured with write permissions, an attacker won't be able to (ab)use those permissions as he doesn't have access to the token.
Or does he? Check the next section
{% endhint %}
You can leak access given in CodeBuild to platforms like Github. Check if any access to external platforms was given with:
aws codebuild list-source-credentials{% content-ref url="aws-codebuild-token-leakage.md" %} aws-codebuild-token-leakage.md {% endcontent-ref %}
An attacker could delete an entire CodeBuild project, causing loss of project configuration and impacting applications relying on the project.
aws codebuild delete-project --name <value>Potential Impact: Loss of project configuration and service disruption for applications using the deleted project.
An attacker could add, modify, or remove tags from CodeBuild resources, disrupting your organization's cost allocation, resource tracking, and access control policies based on tags.
aws codebuild tag-resource --resource-arn <value> --tags <value>
aws codebuild untag-resource --resource-arn <value> --tag-keys <value>Potential Impact: Disruption of cost allocation, resource tracking, and tag-based access control policies.
An attacker could delete source credentials for a Git repository, impacting the normal functioning of applications relying on the repository.
aws codebuild delete-source-credentials --arn <value>Potential Impact: Disruption of normal functioning for applications relying on the affected repository due to the removal of source credentials.
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.