Skip to content

Commit c7a5935

Browse files
manasmbellaniManas Bellanisebastian-mora
authored
Fix enum__secrets crash (RhinoSecurityLabs#194)
 * Fixed a bug in pre-req module detection__enum_services which was failing when enumerating AWS fips region by adding error handling to ensure that module continues to run and writes data to back-end database * Fixed bug to ensure that any secrets manager, parameter store errors do not stop the execution of the rest of the enum__secrets module * Added error handling for secrets manager * Added error handling for parameter store and attempt to get rest of the parameters Co-authored-by: Manas Bellani <[email protected]> Co-authored-by: Sebastian <[email protected]>
1 parent b345370 commit c7a5935

File tree

2 files changed

+81
-17
lines changed

2 files changed

+81
-17
lines changed

‎modules/detection__enum_services/main.py

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/usr/bin/env python3
22
import argparse
33
from copy import deepcopy
4-
from botocore.exceptions import ClientError
4+
from botocore.exceptions import ClientError,EndpointConnectionError
55

66

77
module_info = {
@@ -155,6 +155,12 @@ def main(args, pacu_main):
155155
guard_duty_permission = False
156156
else:
157157
print(' {}'.format(code))
158+
except EndpointConnectionError as error:
159+
print(' Error connecting to Guardduty Endpoint for region: {}'.format(region))
160+
print(' Error: {}, {}'.format(error.__class__, str(error)))
161+
except Exception as error:
162+
print(' Generic Error when enumerating Guardduty detectors for region: {}'.format(region))
163+
print(' Error: {}, {}'.format(error.__class__, str(error)))
158164

159165
summary_data['MasterDetectors'] = master_count
160166
guardduty_data = deepcopy(session.GuardDuty)

‎modules/enum__secrets/main.py

+74-16
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env python3
22
import argparse
3-
from botocore.exceptions import ClientError
3+
from botocore.exceptions import ClientError, EndpointConnectionError
44
import os
55

66
# When writing a module, feel free to remove any comments, placeholders, or
@@ -100,13 +100,25 @@ def main(args, pacu_main):
100100
else:
101101
print(' ' + code)
102102
print(' Could not list secrets... Exiting')
103-
return None
103+
response = None
104+
break
105+
except EndpointConnectionError as error:
106+
print(' Error connecting to SecretsManager Endpoint for listing secrets for region: {}'.format(region))
107+
print(' Error: {}, {}'.format(error.__class__, str(error)))
108+
response = None
109+
break
110+
except Exception as error:
111+
print(' Generic Error when Listing SecretsManager for region: {}'.format(region))
112+
print(' Error: {}, {}'.format(error.__class__, str(error)))
113+
response = None
114+
break
104115

105116
else:
106117
response = client.list_secrets()
107118

108-
for secret in response['SecretList']:
109-
secret_ids.append({"name":secret["Name"],"region":region})
119+
if response:
120+
for secret in response['SecretList']:
121+
secret_ids.append({"name":secret["Name"],"region":region})
110122

111123
all_secrets_ids_sm += secret_ids
112124

@@ -119,7 +131,7 @@ def main(args, pacu_main):
119131
while response is None:
120132
try:
121133
response = client.get_secret_value(
122-
SecretId=sec["name"]
134+
SecretId=sec["name"]
123135
)
124136
except ClientError as error:
125137
code = error.response['Error']['Code']
@@ -129,10 +141,22 @@ def main(args, pacu_main):
129141
else:
130142
print(' ' + code)
131143
print(' Could not get secrets value... Exiting')
132-
return None
133-
134-
with open('./sessions/{}/downloads/secrets/secrets_manager/secrets.txt'.format(session.name),'a') as f:
135-
f.write("{}:{}\n".format(sec["name"], response["SecretString"]))
144+
response = None
145+
break
146+
except EndpointConnectionError as error:
147+
print(' Error connecting to SecretsManager Endpoint for getting secret for region: {}'.format(sec["region"]))
148+
print(' Error: {}, {}'.format(error.__class__, str(error)))
149+
response = None
150+
break
151+
except Exception as error:
152+
print(' Generic Error when getting Secret from Secrets Manager for region: {}'.format(sec["region"]))
153+
print(' Error: {}, {}'.format(error.__class__, str(error)))
154+
response = None
155+
break
156+
157+
if response:
158+
with open('./sessions/{}/downloads/secrets/secrets_manager/secrets.txt'.format(session.name),'a') as f:
159+
f.write("{}:{}\n".format(sec["name"], response["SecretString"]))
136160

137161

138162

@@ -151,10 +175,22 @@ def main(args, pacu_main):
151175
else:
152176
print(' ' + code)
153177
print(' Could not list parameters... Exiting')
154-
return None
178+
response = None
179+
break
180+
except EndpointConnectionError as error:
181+
print(' Error connecting to SSM Endpoint for describing SSM Parameters for region: {}'.format(region))
182+
print(' Error: {}, {}'.format(error.__class__, str(error)))
183+
response = None
184+
break
185+
except Exception as error:
186+
print(' Generic Error when describing SSM Parameters for region: {}'.format(region))
187+
print(' Error: {}, {}'.format(error.__class__, str(error)))
188+
response = None
189+
break
155190

156-
for param in response["Parameters"]:
157-
secrets_ssm.append({"name":param["Name"],"type":param["Type"],"region":region})
191+
if response:
192+
for param in response["Parameters"]:
193+
secrets_ssm.append({"name":param["Name"],"type":param["Type"],"region":region})
158194

159195

160196
all_secrets_ids_ssm += secrets_ssm
@@ -178,7 +214,17 @@ def main(args, pacu_main):
178214
else:
179215
print(' ' + code)
180216
print(' Could not get parameter value... Exiting')
181-
return None
217+
response = None
218+
break
219+
except EndpointConnectionError as error:
220+
print(' Error connecting to SSM Endpoint for describing SSM Secure parameter for region: {}'.format(param["region"]))
221+
print(' Error: {}, {}'.format(error.__class__, str(error)))
222+
response = None
223+
except Exception as error:
224+
print(' Generic Error when describing SSM Secure Parameter for region: {}'.format(param['region']))
225+
print(' Error: {}, {}'.format(error.__class__, str(error)))
226+
response = None
227+
break
182228

183229
else:
184230
try:
@@ -194,10 +240,22 @@ def main(args, pacu_main):
194240
else:
195241
print(' ' + code)
196242
print(' Could not get parameter value... Exiting')
197-
return None
243+
response = None
244+
break
245+
except EndpointConnectionError as error:
246+
print(' Error connecting to SSM Endpoint for describing SSM parameter for region: {}'.format(param["region"]))
247+
print(' Error: {}, {}'.format(error.__class__, str(error)))
248+
response = None
249+
break
250+
except Exception as error:
251+
print(' Generic Error when describing SSM Parameter for region: {}'.format(param['region']))
252+
print(' Error: {}, {}'.format(error.__class__, str(error)))
253+
response = None
254+
break
198255

199-
with open('./sessions/{}/downloads/secrets/parameter_store/parameters.txt'.format(session.name),'a') as f:
200-
f.write("{}:{}\n".format(param["name"], response["Parameter"]["Value"]))
256+
if response:
257+
with open('./sessions/{}/downloads/secrets/parameter_store/parameters.txt'.format(session.name),'a') as f:
258+
f.write("{}:{}\n".format(param["name"], response["Parameter"]["Value"]))
201259

202260

203261
summary_data["SecretsManager"] = len(all_secrets_ids_sm)

0 commit comments

Comments
 (0)