{"id":13826322,"url":"https://github.com/andresriancho/vpc-vpn-pivot","last_synced_at":"2025-04-10T01:53:27.930Z","repository":{"id":146200698,"uuid":"194434115","full_name":"andresriancho/vpc-vpn-pivot","owner":"andresriancho","description":"Pivot into private VPC networks using a VPN connection","archived":false,"fork":false,"pushed_at":"2019-10-08T00:03:29.000Z","size":70,"stargazers_count":41,"open_issues_count":4,"forks_count":9,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-24T03:34:58.818Z","etag":null,"topics":["aws","hacking","pentesting","pivoting","vpc","vpn"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/andresriancho.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2019-06-29T17:54:19.000Z","updated_at":"2024-11-08T01:41:47.000Z","dependencies_parsed_at":"2023-05-03T20:31:31.088Z","dependency_job_id":null,"html_url":"https://github.com/andresriancho/vpc-vpn-pivot","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fvpc-vpn-pivot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fvpc-vpn-pivot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fvpc-vpn-pivot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/andresriancho%2Fvpc-vpn-pivot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/andresriancho","download_url":"https://codeload.github.com/andresriancho/vpc-vpn-pivot/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248142939,"owners_count":21054671,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","hacking","pentesting","pivoting","vpc","vpn"],"created_at":"2024-08-04T09:01:35.658Z","updated_at":"2025-04-10T01:53:27.903Z","avatar_url":"https://github.com/andresriancho.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"d62a971d37c69db9f3b9187318c3921a\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"8ea8f890cf767c3801b5e7951fca3570\"\u003e\u003c/a\u003e公网访问局域网"],"readme":"## Pivoting into VPC networks\n\nThis tool automates the creation of a VPN between the attacker's workstation and an\nAWS resource in the target VPC with the objective of connecting to other AWS services,\nsuch as EC2 instances, which are not accessible from the Internet.\n\n![vpn-vpc-pivot-demo](https://user-images.githubusercontent.com/865200/66357402-0fe21200-e945-11e9-8191-0baf02dba573.gif)\n\nOr watch this demo on [asciinema](https://asciinema.org/a/272966).\n\n## Use case\n\nYou are performing a cloud penetration test and gained access to a set of \nAWS credentials. The target infrastructure uses VPCs and most of the interesting\nservices are private (can only be accessed by other hosts connected to the same\nVPC or subnet).\n\nThis tool completely automates the process of creating a VPN between your workstation\nand the target VPC so you can connect to those private services.\n\nDepending on the permissions associated with the compromised credentials the tool\nwill use different techniques to create and maintain the VPN service running. For\nexample, if the credentials have permissions for EC2 and ACM then an [AWS Client VPN](https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-getting-started.html)\nis created and the `openvpn` client is used to connect to it.\n\n## Supported services\n\nThis tool will try to create the VPN connection using different techniques, based\non the permissions associated with the compromised credentials. The supported services\nfor creating the VPN are:\n\n * [AWS Client VPN](https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/cvpn-getting-started.html)\n\nThe following will be implemented in the future:\n * EC2\n * Lambda\n * LightSail\n * Fargate\n \n## Noise\n\nThe tool will generate a lot of CloudTrail logs and if anyone is paying attention\nyou will get detected and blocked.\n\n## Installation\n\nThe `vpc-vpn-pivot` tool uses Python 3.6. The full installation steps are:\n\n```\ngit clone https://github.com/andresriancho/vpc-vpn-pivot.git\ncd vpc-vpn-pivot\n\npip3 install requirements.txt\nsudo apt-get install openvpn\n```\n\n## Usage\n\nThis command will setup the SSL certificates, routes and other resources\nrequired for the AWS Client VPN to work:\n\n```\n./vpc-vpn-pivot create --profile={profile-name} --subnet-id={subnet-id}\n```\n\nThe `profile` needs to contain compromised credentials for the target AWS account and\nbe stored in `~/.aws/credentials/`, the VPC ID can be obtained using `aws ec2 describe-vpcs`.\n\n\nEverything is ready! Just connect your workstation to the VPC using `openvpn`:\n\n```\nsudo ./vpc-vpn-pivot connect\n\n./vpc-vpn-pivot status\nroute -n\nnmap -sS ...\n```\n\nThe script needs to be run using `sudo` because `openvpn` requires root privileges\nto create the `tun` interface.\n\nOnce connected to the VPC you should be able to inspect the IP address range with\n`ifconfig` and run any tool, such as `nmap` to find open services on the VPC.\n\nUse the following commands to disconnect from the VPN and remove all remote\nresources created for the VPN to work:\n\n```\n./vpc-vpn-pivot disconnect\n./vpc-vpn-pivot purge\n```\n\n## Troubleshooting\n\n`vpc-vpn-pivot` keeps current state and the names of all the created resources in the\nstate file (`~/.vpc-vpn-pivot/state`). This file is useful if you need to manually kill\nthe `openvpn` process or remove the AWS resources.\n\n##  Warning\n\nIn order to create an AWS Client VPN we import two certificates into the target's\nAWS account. There is a hard-limit of 20 imported certificates per year, by using\nthis tool you are reducing the number of available ACM certificates.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandresriancho%2Fvpc-vpn-pivot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fandresriancho%2Fvpc-vpn-pivot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fandresriancho%2Fvpc-vpn-pivot/lists"}