Comments (7)
Eyilink
commented on August 27, 2024
1
https://aws.amazon.com/blogs/aws/amazon-ec2-instance-metadata-service-imdsv2-by-default/
I believe this may be the root cause, will require an update to the Terraform.
I have the same issue to see webcontent of ecs takeover scenario I cant access website I have timeout
from cloudgoat.
andrew-aiken
commented on August 27, 2024
Getting the same issue deploying from the latest code.
I'll look into fixing it, probably an issue with the User data that populates the instance
from cloudgoat.
andrew-aiken
commented on August 27, 2024
https://aws.amazon.com/blogs/aws/amazon-ec2-instance-metadata-service-imdsv2-by-default/
I believe this may be the root cause, will require an update to the Terraform.
from cloudgoat.
andrew-aiken
commented on August 27, 2024
ECS takeover still seems to work for me
From the AWS console what is your IMDSv2 configured as? (optional/required)
from cloudgoat.
Eyilink
commented on August 27, 2024
I have it configured as optional
[cid:372c9698-b21d-4d17-9446-982f104b2c91]
…________________________________
De : Andrew ***@***.***>
Envoyé : lundi 5 août 2024 12:45
À : RhinoSecurityLabs/cloudgoat ***@***.***>
Cc : Eyilink ***@***.***>; Author ***@***.***>
Objet : Re: [RhinoSecurityLabs/cloudgoat] EC2 SSRF - EC2 INSTANCE PORT 80 CLOSED (Issue #267)
ECS takeover still seems to work for me
image.png (view on web)<https://github.com/user-attachments/assets/ea69f7d0-cb56-407f-9c41-e38f53ae45a9>
From the AWS console what is your IMDSv2 configured as? (optional/required)
image.png (view on web)<https://github.com/user-attachments/assets/d5839b1b-6328-4591-80ea-1cb6fa947393>
—
Reply to this email directly, view it on GitHub<#267 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJEYQVZNPSGWCKGZ2F3JZY3ZP5XVRAVCNFSM6AAAAABL63OLVKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENRYHE4DSMBQGU>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
from cloudgoat.
andrew-aiken
commented on August 27, 2024
If the security group configured correctly to your public IP (ifconfig.me)?
from cloudgoat.
Eyilink
commented on August 27, 2024
I solved the issue by using aws-nuke and resetting all to a clean setup.
Thank you for your help.
…________________________________
De : Andrew ***@***.***>
Envoyé : lundi 5 août 2024 14:35
À : RhinoSecurityLabs/cloudgoat ***@***.***>
Cc : Eyilink ***@***.***>; Author ***@***.***>
Objet : Re: [RhinoSecurityLabs/cloudgoat] EC2 SSRF - EC2 INSTANCE PORT 80 CLOSED (Issue #267)
If the security group configured correctly to your public IP (ifconfig.me<https://ifconfig.me/>)?
—
Reply to this email directly, view it on GitHub<#267 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJEYQV4HW3K75WZ4XEI2XA3ZP6ER5AVCNFSM6AAAAABL63OLVKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENRZGIZTAMZWGQ>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
from cloudgoat.
Related Issues (20)
- cicd : ssm connection and scenario deletion HOT 4
- detection_evasion : ssm connection and git clone issue HOT 4
- Problem creating ec2 instance on ecs_takeover HOT 1
- CICD: FIX HOT 1
- Installing requirements error. HOT 4
- ecs_takeover creation fail >>> FIX HOT 6
- cicd
- Docker Build Issue: Pip Install Error
- Duplicate resource in IAM policy
- Problem creating ec2 instance on cloud_breach_s3 HOT 10
- Trying getting it to work under Windows with Zero Luck
- Cloudgoat Missing Versioning
- ecs_takeover setup error HOT 2
- glue_privesc setup error HOT 1
- Using AWS cloudGoat with aws-vault HOT 3
- Terraform not found when running CloudGoat on Kali Linux HOT 5
- Error deploying ec2_takeover senario HOT 3
- rds_snapshot depricated instance family
- Feature Request: Scenario Template & Contribution Guide
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cloudgoat.