Skip to content

Commit 16fcbc2

Browse files
sethsec-bfsethsec-bf
authored
Merge pull request #7 from rpunnett-bf/bug-fix-09220222
Small bug fixes and cleanup
2 parents 8cdb854 + 7cafe1f commit 16fcbc2

18 files changed

Lines changed: 203 additions & 161 deletions

‎aws/access-keys.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,9 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
4646
"module": m.output.CallingModule,
4747
},
4848
)
49+
4950
if m.AWSProfile == "" {
50-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
51+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
5152
}
5253

5354
fmt.Printf("[%s] Mapping user access keys for account: %s.\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))
@@ -82,7 +83,7 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
8283
//m.output.OutputSelector(outputFormat)
8384
utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
8485

85-
m.writeLoot(outputDirectory, verbosity)
86+
m.writeLoot(m.output.FilePath, verbosity)
8687
fmt.Printf("[%s] %s access keys found.\n", cyan(m.output.CallingModule), strconv.Itoa(len(m.output.Body)))
8788
} else {
8889
fmt.Printf("[%s] No access keys found, skipping the creation of an output file.\n", cyan(m.output.CallingModule))
@@ -91,7 +92,7 @@ func (m *AccessKeysModule) PrintAccessKeys(filter string, outputFormat string, o
9192
}
9293

9394
func (m *AccessKeysModule) writeLoot(outputDirectory string, verbosity int) {
94-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
95+
path := filepath.Join(outputDirectory, "loot")
9596
err := os.MkdirAll(path, os.ModePerm)
9697
if err != nil {
9798
m.modLog.Error(err.Error())

‎aws/buckets.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,9 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
5050
m.modLog = utils.TxtLogger.WithFields(logrus.Fields{
5151
"module": m.output.CallingModule,
5252
})
53+
5354
if m.AWSProfile == "" {
54-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
55+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
5556
}
5657

5758
fmt.Printf("[%s] Enumerating buckets for account %s.\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))
@@ -102,7 +103,7 @@ func (m *BucketsModule) PrintBuckets(outputFormat string, outputDirectory string
102103
m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
103104
////m.output.OutputSelector(outputFormat)
104105
utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
105-
m.writeLoot(outputDirectory, verbosity, m.AWSProfile)
106+
m.writeLoot(m.output.FilePath, verbosity, m.AWSProfile)
106107
fmt.Printf("[%s] %s buckets found.\n", cyan(m.output.CallingModule), strconv.Itoa(len(m.output.Body)))
107108

108109
} else {
@@ -135,7 +136,7 @@ func (m *BucketsModule) executeChecks(wg *sync.WaitGroup, semaphore chan struct{
135136
}
136137

137138
func (m *BucketsModule) writeLoot(outputDirectory string, verbosity int, profile string) {
138-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
139+
path := filepath.Join(outputDirectory, "loot")
139140
err := os.MkdirAll(path, os.ModePerm)
140141
if err != nil {
141142
m.modLog.Error(err.Error())

‎aws/ecr.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
5656
"module": m.output.CallingModule,
5757
})
5858
if m.AWSProfile == "" {
59-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
59+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
6060
}
6161

6262
fmt.Printf("[%s] Enumerating container repositories for account %s.\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))
@@ -122,7 +122,7 @@ func (m *ECRModule) PrintECR(outputFormat string, outputDirectory string, verbos
122122
m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
123123
//m.output.OutputSelector(outputFormat)
124124
utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
125-
m.writeLoot(outputDirectory, verbosity)
125+
m.writeLoot(m.output.FilePath, verbosity)
126126
fmt.Printf("[%s] %s repositories found.\n", cyan(m.output.CallingModule), strconv.Itoa(len(m.output.Body)))
127127
} else {
128128
fmt.Printf("[%s] No repositories found, skipping the creation of an output file.\n", cyan(m.output.CallingModule))
@@ -152,7 +152,7 @@ func (m *ECRModule) Receiver(receiver chan Repository, receiverDone chan bool) {
152152
}
153153

154154
func (m *ECRModule) writeLoot(outputDirectory string, verbosity int) {
155-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
155+
path := filepath.Join(outputDirectory, "loot")
156156
err := os.MkdirAll(path, os.ModePerm)
157157
if err != nil {
158158
m.modLog.Error(err.Error())

‎aws/endpoints.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory st
8888
"module": m.output.CallingModule,
8989
})
9090
if m.AWSProfile == "" {
91-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
91+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
9292
}
9393

9494
fmt.Printf("[%s] Enumerating endpoints for account %s.\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))
@@ -169,7 +169,7 @@ func (m *EndpointsModule) PrintEndpoints(outputFormat string, outputDirectory st
169169
m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
170170
//m.output.OutputSelector(outputFormat)
171171
utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
172-
m.writeLoot(outputDirectory, verbosity)
172+
m.writeLoot(m.output.FilePath, verbosity)
173173
fmt.Printf("[%s] %s endpoints found.\n", cyan(m.output.CallingModule), strconv.Itoa(len(m.output.Body)))
174174
} else {
175175
fmt.Printf("[%s] No endpoints found, skipping the creation of an output file.\n", cyan(m.output.CallingModule))
@@ -260,7 +260,7 @@ func (m *EndpointsModule) executeChecks(r string, wg *sync.WaitGroup, semaphore
260260
}
261261

262262
func (m *EndpointsModule) writeLoot(outputDirectory string, verbosity int) {
263-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
263+
path := filepath.Join(outputDirectory, "loot")
264264
err := os.MkdirAll(path, os.ModePerm)
265265
if err != nil {
266266
m.modLog.Error(err.Error())

‎aws/env-vars.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ func (m *EnvsModule) PrintEnvs(outputFormat string, outputDirectory string, verb
7272
"module": m.output.CallingModule,
7373
})
7474
if m.AWSProfile == "" {
75-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
75+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
7676
}
7777

7878
fmt.Printf("[%s] Enumerating environment variables in all regions for account %s.\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))

‎aws/filesystems.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
6363
"module": m.output.CallingModule,
6464
})
6565
if m.AWSProfile == "" {
66-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
66+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
6767
}
6868
//populate region in the filesystems module struct
6969
for i, region := range m.AWSRegions {
@@ -137,7 +137,7 @@ func (m *FilesystemsModule) PrintFilesystems(outputFormat string, outputDirector
137137
m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
138138
//m.output.OutputSelector(outputFormat)
139139
utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
140-
m.writeLoot(outputDirectory, verbosity)
140+
m.writeLoot(m.output.FilePath, verbosity)
141141
fmt.Printf("[%s] %s filesystems found.\n", cyan(m.output.CallingModule), strconv.Itoa(len(m.output.Body)))
142142

143143
} else {
@@ -168,7 +168,7 @@ func (m *FilesystemsModule) executeChecks(r string, wg *sync.WaitGroup, semaphor
168168
}
169169

170170
func (m *FilesystemsModule) writeLoot(outputDirectory string, verbosity int) {
171-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
171+
path := filepath.Join(outputDirectory, "loot")
172172
err := os.MkdirAll(path, os.ModePerm)
173173
if err != nil {
174174
m.modLog.Error(err.Error())

‎aws/iam-simulator.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -85,9 +85,8 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
8585
var pmapperOutFileName string
8686

8787
if m.AWSProfile == "" {
88-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
88+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
8989
}
90-
9190
wg := new(sync.WaitGroup)
9291
// Create a channel to signal the spinner aka task status goroutine to finish
9392
spinnerDone := make(chan bool)
@@ -126,15 +125,15 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
126125
m.getIAMUsers(wg, actionList, resource, dataReceiver)
127126
wg.Add(1)
128127
m.getIAMRoles(wg, actionList, resource, dataReceiver)
129-
pmapperOutFileName = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
128+
pmapperOutFileName = filepath.Join(m.output.FullFilename, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
130129
pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper --profile %s query \"who can do %s with %s\" | tee %s\n", m.AWSProfile, action, resource, pmapperOutFileName))
131130
} else {
132131
// Both --principal and --action are empty. Run in default mode!
133132
fmt.Printf("[%s] Running multiple iam-simulator queries for account %s. (This command can be pretty slow, FYI)\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))
134133
m.output.FullFilename = m.output.CallingModule
135134
m.executeChecks(wg, resource, dataReceiver)
136135
for _, action := range defaultActionNames {
137-
pmapperOutFileName = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
136+
pmapperOutFileName = filepath.Join(m.output.FullFilename, "loot", fmt.Sprintf("pmapper-output-%s.txt", action))
138137
pmapperCommands = append(pmapperCommands, fmt.Sprintf("pmapper --profile %s query \"who can do %s with %s\" | tee %s\n", m.AWSProfile, action, resource, pmapperOutFileName))
139138
}
140139

@@ -176,14 +175,14 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
176175

177176
}
178177
if len(m.output.Body) > 0 {
179-
//m.output.OutputSelector(outputFormat)
178+
m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile)
180179
utils.OutputSelector(verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.FullFilename, m.output.CallingModule)
181180
fmt.Printf("[%s] We suggest running the pmapper commands in the loot file to get the same information but taking privesc paths into account.\n", cyan(m.output.CallingModule))
182181
// fmt.Printf("[%s]\t\tpmapper --profile %s graph create\n", cyan(m.output.CallingModule), m.AWSProfile)
183182
// for _, line := range pmapperCommands {
184183
// fmt.Printf("[%s]\t\t%s", cyan(m.output.CallingModule), line)
185184
// }
186-
m.writeLoot(outputDirectory, verbosity, pmapperCommands)
185+
m.writeLoot(m.output.FilePath, verbosity, pmapperCommands)
187186

188187
} else if principal != "" || action != "" {
189188
fmt.Printf("[%s] No allowed permissions identified, skipping the creation of an output file.\n", cyan(m.output.CallingModule))
@@ -192,7 +191,7 @@ func (m *IamSimulatorModule) PrintIamSimulator(principal string, action string,
192191
}
193192

194193
func (m *IamSimulatorModule) writeLoot(outputDirectory string, verbosity int, pmapperCommands []string) {
195-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
194+
path := filepath.Join(outputDirectory, "loot")
196195
err := os.MkdirAll(path, os.ModePerm)
197196
if err != nil {
198197
m.modLog.Error(err.Error())

‎aws/instances.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,8 @@ func (m *InstancesModule) Instances(filter string, outputFormat string, outputDi
5959
"module": m.output.CallingModule,
6060
})
6161
if m.AWSProfile == "" {
62-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
62+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
6363
}
64-
6564
// regions, errtemp := m.EC2Client.DescribeRegions(
6665
// context.TODO(),
6766
// &ec2.DescribeRegionsInput{})
@@ -143,7 +142,6 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
143142

144143
m.output.CallingModule = "instance-userdata"
145144
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
146-
147145
err := os.MkdirAll(path, os.ModePerm)
148146
if err != nil {
149147
m.modLog.Error(err.Error())
@@ -171,7 +169,8 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
171169
}
172170
}
173171
}
174-
if len(m.MappedInstances) > 0 {
172+
// only create a file if if there is at least one instance AND at least one instance had user-data.
173+
if (len(m.MappedInstances) > 0) && (userDataOut != "=============================================\n") {
175174
if m.output.Verbosity > 1 {
176175
fmt.Printf("%s", userDataOut)
177176
}
@@ -181,6 +180,8 @@ func (m *InstancesModule) printInstancesUserDataAttributesOnly(outputFormat stri
181180
m.CommandCounter.Error++
182181
}
183182
fmt.Printf("[%s] Loot written to [%s]\n", cyan(m.output.CallingModule), userDataFileName)
183+
} else {
184+
fmt.Printf("[%s] No user data found, skipping the creation of an output file\n", cyan(m.output.CallingModule))
184185
}
185186
}
186187

@@ -219,7 +220,7 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
219220
////m.output.OutputSelector(outputFormat)
220221
utils.OutputSelector(m.output.Verbosity, outputFormat, m.output.Headers, m.output.Body, m.output.FilePath, m.output.CallingModule, m.output.CallingModule)
221222

222-
m.writeLoot(outputDirectory)
223+
m.writeLoot(m.output.FilePath)
223224
fmt.Printf("[%s] %s instances found.\n", cyan(m.output.CallingModule), strconv.Itoa(len(m.output.Body)))
224225

225226
} else {
@@ -228,7 +229,7 @@ func (m *InstancesModule) printGeneralInstanceData(outputFormat string, outputDi
228229
}
229230

230231
func (m *InstancesModule) writeLoot(outputDirectory string) {
231-
path := filepath.Join(outputDirectory, "cloudfox-output", "aws", m.AWSProfile, "loot")
232+
path := filepath.Join(outputDirectory, "loot")
232233
err := os.MkdirAll(path, os.ModePerm)
233234
if err != nil {
234235
m.modLog.Error(err.Error())

‎aws/inventory.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func (m *Inventory2Module) PrintInventoryPerRegion(outputFormat string, outputDi
111111
m.totalRegionCounts = map[string]int{}
112112

113113
if m.AWSProfile == "" {
114-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
114+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
115115
}
116116

117117
//initialize servicemap and total

‎aws/outbound-assumed-roles.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,8 @@ func (m *OutboundAssumedRolesModule) PrintOutboundRoleTrusts(days int, outputFor
122122
"module": m.output.CallingModule,
123123
})
124124
if m.AWSProfile == "" {
125-
m.AWSProfile = fmt.Sprintf("%s-%s", aws.ToString(m.Caller.Account), aws.ToString(m.Caller.UserId))
125+
m.AWSProfile = utils.BuildAWSPath(m.Caller)
126126
}
127-
128127
m.Days = days
129128

130129
fmt.Printf("[%s] Enumerating outbound assumed role entries in cloudtrail for account %s.\n", cyan(m.output.CallingModule), aws.ToString(m.Caller.Account))

0 commit comments

Comments
 (0)