如何使用Ghostbuster消除Elastic悬空IP

关于幽灵破坏者

Ghostbuster是一款功能强大的Elastic安全审计工具，该工具可以通过对目标AWS账号中的资源进行分析，从而消除Elastic悬空IP。

Ghostbuster可以帮助广大研究人员获取目标AWS账号(Route53)中所有的DNS记录，并能够选择通过CSV输入或Cloudflare来接收搜索到的记录。

收集到这些记录和数据之后，捉鬼敢死队将会遍历所有AWS Elastic IP和网络接口公共IP，并收集这些数据。

在拿到所有DNS记录(来自route53、文件输入或cloudflare)的完整信息，以及目标组织拥有的AWS IP的完整信息之后，该工具将能够检测出指向悬空Elastic IP(已失效)的子域名了。

功能介绍

• 动态枚举”.aws/config”中的每一个AWS账号；
• 从AWS Route53中提取记录；
• 从Cloudflare中提取记录(可选)；
• 从CSV输入中提取记录(可选)；
• 遍历所有区域、单个区域或以逗号分隔的区域列表；
• 获取与所有AWS帐户关联的所有Elastic IP；
• 获取与所有AWS帐户关联的所有公共IP；
• 交叉检查DNS记录，以及组织拥有的IP，以检测潜在的接管风险；
• Slack Webhook支持发送接管通知；

工具下载&安装

该工具基于Python开发，因此我们首先需要在本地设备上安装并配置好Python 3.x环境。

捉鬼敢死队的下载和安装都非常简单，广大研究人员可以使用下列命令将该项目源码克隆至本地：

gitclonehttps://github.com/assetnote/ghostbuster.git

或者直接使用下列命令进行安装：

pipinstallghostbuster

然后通过”捉鬼敢死队”命令来使用Ghostbuster即可。

工具使用

ghostbusterscanaws--help

Usage: ghostbusterscanaws [OPTIONS]



ScanfordanglingelasticIPsinsideyourAWSaccounts.



Options:

--profileTEXT指定Ghostbuster需要扫描的AWS账号信息



--skipasciiGhostbuster启动之后，不打印ASCII字符



--slackwebhookTEXT指定一个SlackWebhookURL以发送潜在接管的通知信息



--recordsPATH手动指定要检查的DNS记录。Ghostbuster将在检查检索到的DNS记录后检查这些IP



--cloudflaretokenTEXT从Cloudflare中提取DNS记录，需提供CFAPI令牌



--allregions扫描全范围

--excludeTEXT要排除的配置文件名称列表，用逗号分隔

--regionsTEXT要扫描的区域列表，用逗号分隔

--help显示帮助信息和退出

配置Cloudflare

配置AWS账号

.aws/credentials：

[default]

aws_access_key_id=AKIAIII...

aws_secret_access_key=faAaAaA...

.aws/config：

[default]

output=table

region=us-east-1



[profileaccount-one]

role_arn=arn:aws:iam::911111111113:role/Ec2Route53Access

source_profile=default

region=us-east-1



[profileaccount-two]

role_arn=arn:aws:iam::911111111112:role/Ec2Route53Access

source_profile=default

region=us-east-1



[profileaccount-three]

region=us-east-1

role_arn=arn:aws:iam::911111111111:role/Ec2Route53Access

source_profile=default

工具使用样例

运行Ghostbuster，提供Cloudflare DNS记录的访问令牌，向Slack Webhook发送通知，遍历的所有AWS区域中”.aws/config or .aws/credentials”内配置的每一个AWS账号：

ghostbusterscanaws--cloudflaretokenAPIKEY--slackwebhookhttps://hooks.slack.com/services/KEY --allregions

使用手动输入的子域名A记录列表(具体可参考records.csv格式)运行Ghostbuster：

ghostbusterscanaws--recordsrecords.csv

工具输出样例

ghostbusterscanaws--cloudflaretokenwhougonnacall

ObtainingallzonenamesfromCloudflare.

ObtainingDNSArecordsforallzonesfromCloudflare.

Obtained33DNSArecordssofar.

ObtainingRoute53hostedzonesforAWSprofile: default.

ObtainingRoute53hostedzonesforAWSprofile: account-five.

ObtainingRoute53hostedzonesforAWSprofile: account-four.

ObtainingRoute53hostedzonesforAWSprofile: account-four-deploy.

ObtainingRoute53hostedzonesforAWSprofile: account-two-deploy.

ObtainingRoute53hostedzonesforAWSprofile: account-one-deploy.

ObtainingRoute53hostedzonesforAWSprofile: account-three-deploy.

ObtainingRoute53hostedzonesforAWSprofile: account-six.

ObtainingRoute53hostedzonesforAWSprofile: account-seven.

ObtainingRoute53hostedzonesforAWSprofile: account-one.

Obtained124DNSArecordssofar.

ObtainingEIPsforregion: us-east-1, profile: default

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: default

ObtainingEIPsforregion: us-east-1, profile: account-five

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-five

ObtainingEIPsforregion: us-east-1, profile: account-four

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-four

ObtainingEIPsforregion: us-east-1, profile: account-four-deploy

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-four-deploy

ObtainingEIPsforregion: us-east-1, profile: account-two-deploy

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-two-deploy

ObtainingEIPsforregion: us-east-1, profile: account-one-deploy

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-one-deploy

ObtainingEIPsforregion: us-east-1, profile: account-three-deploy

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-three-deploy

ObtainingEIPsforregion: us-east-1, profile: account-six

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-six

ObtainingEIPsforregion: us-east-1, profile: account-seven

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-seven

ObtainingEIPsforregion: us-east-1, profile: account-one

ObtainingIPsfornetworkinterfacesforregion: us-east-1, profile: account-one

Obtained415uniqueelasticIPsfromAWS.





Takeoverpossible: {'name': 'takeover.assetnotecloud.com', 'records': ['52.54.24.193']}

许可证协议

本项目的开发与发布遵循​​AGPL-3.0​​开源许可证协议。

项目地址

捉鬼敢死队：【​​GitHub传送门​​】