OCInferno: An Offensive Security Toolkit for OCI

OCInferno: An Offensive Security Toolkit for OCI

Speakers: Scott Weston

Conference: fwd:cloudsec

YouTube: https://www.youtube.com/watch?v=FxvZrCuzra4

Overview

In this fwd:cloudsec presentation, Scott Weston introduces OCInferno, a comprehensive offensive security toolkit designed specifically for Oracle Cloud Infrastructure (OCI). The talk delves into the intricacies of OCI's unique Identity and Access Management (IAM) model, highlighting challenges posed by its policy syntax and the often-overlooked concept of identity domains. Weston, known for developing similar tools for AWS and GCP, emphasizes the growing relevance of OCI in the cloud market, making it a critical target for penetration testers and security professionals.

The core of OCInferno lies in its ability to enumerate OCI resources, parse complex policy statements into a machine-readable format, and visualize potential privilege escalation paths using a BloodHound-like graph. Weston's work addresses the significant gap in public offensive tooling for OCI, providing a much-needed framework for understanding and exploiting misconfigurations in this cloud environment. The talk culminates in a compelling demonstration of a novel lateral movement technique leveraging identity domain roles to pivot into traditional OCI IAM permissions, underscoring the importance of a deep, OCI-specific security understanding.

Background

▶ Watch: Introduction to OCInferno and Oracle Cloud's growing relevance (0:40)

While AWS, Azure, and GCP dominate the cloud market, Oracle Cloud Infrastructure holds a notable, albeit smaller, share. As organizations increasingly adopt multi-cloud strategies or migrate legacy Oracle workloads, OCI environments become targets for security assessments. However, offensive security tooling and public knowledge for OCI have traditionally lagged behind its competitors. Scott Weston's motivation for developing OCInferno stemmed from this very challenge, recognizing the need for specialized tools to avoid "reinventing the wheel" during OCI penetration tests.

Weston begins by establishing foundational OCI concepts crucial for understanding its security model. An OCID (Oracle Cloud Identifier) serves as a unique identifier for any OCI resource, akin to AWS ARNs or GCP resource URLs. Compartments are logical boundaries for organizing resources, similar to AWS accounts or GCP projects, forming a hierarchical structure where permissions typically flow from parent to child. The root compartment is known as the tenant, the highest level of administrative control.

A distinctive feature of OCI is Identity Domains, which are logical groupings of IAM users and groups. Unlike AWS or GCP, where IAM users and groups are typically managed within a single IAM service, OCI allows for multiple, separate identity domains. This enables organizations to maintain distinct user bases, even allowing users with the same name in different domains to be entirely separate entities.

Perhaps the most challenging aspect of OCI IAM, and a primary driver for Weston's tooling, is its policy syntax. OCI policies are not expressed in JSON or YAML, but rather as grammatical sentences (e.g., "Allow group X to manage instances in compartment Y"). This sentence-based structure is notoriously difficult to parse programmatically from an SDK perspective, making automated security analysis cumbersome. To address this, Weston developed OCI Policy Parser, a tool that ingests these policy sentences and outputs a structured JSON format, enabling subsequent automated analysis. Another prerequisite tool, OCI Signer, facilitates signing HTTP requests with various OCI credentials (API keys, session tokens, instance authentication), crucial for modifying requests in flight or sending API calls as different OCI principals.

Key Findings

▶ Watch: OCI 101: Understanding OCID, Compartments, and Identity Domains (2:15)

The central contribution of Scott Weston's talk is the introduction of OCInferno, an offensive security toolkit specifically tailored for OCI. This tool addresses the significant gap in publicly available offensive capabilities for OCI, providing a comprehensive framework for enumeration, analysis, and exploitation.

A key finding highlighted by Weston is the discovery and exploitation of a unique lateral movement path within OCI that leverages Identity Domain level roles. He observed that upon initial creation of an OCI environment or identity domain, certain administrative roles (such as "Identity Domain Admin," "Security Admin," and "Application Admin") are pre-populated in the "Administrators" tab of an identity domain. Crucially, these roles are tied to an implicit, system-managed application called the IDCS application.

Weston's research suggests that OCI's IAM model effectively operates with two distinct authorization layers:

1. Traditional OCI IAM: Policies written in sentence format that govern access to OCI resources (e.g., compute instances, storage buckets).
2. Identity Domain Level Roles: Roles within an identity domain that grant permissions over principals (users, groups) within that domain, often including the ability to manage user attributes like passwords and multi-factor authentication.

The critical insight is that an attacker with control over an identity domain role, such as "User Administrator," can manipulate users defined within that identity domain, even if those users subsequently have traditional OCI IAM policies granting extensive access to OCI resources. This creates a powerful pivot point, allowing an attacker to bypass traditional OCI IAM policy restrictions by compromising a user's identity domain credentials and then leveraging that user's OCI IAM permissions. This unique interaction between identity domains and OCI IAM policies represents a significant, and often overlooked, attack surface in OCI environments.

Technical Deep Dive

▶ Watch: The unique challenge of OCI's sentence-based policy statements (4:05)

OCInferno is presented as a Python framework akin to GC Pwn (Weston's tool for GCP) or Pacu (for AWS). Its core functionalities include:

1. Enumeration: OCInferno can enumerate all possible data across an OCI tenancy. It supports a --comp flag to recursively list all compartments and enumerate resources within each. The --download flag attempts to download relevant data to disk, and --save stores enumerated data in an SQLite database for persistence and analysis.
2. Data Export: Enumerated data can be exported to various formats, including CSV, JSON, and Excel, facilitating offline analysis and integration with other tools.
3. Tool-wide Proxying: OCInferno supports proxying, which is essential for network monitoring, debugging, and bypassing network restrictions during security assessments.

The standout technical feature of OCInferno is its BloodHound graphing capability. Leveraging the Open Graph specifications released by SpecterOps, OCInferno constructs a visual representation of OCI IAM relationships. This graph maps:

• User-group membership.
• Resource dynamic group membership.
• Identity Domain IDCS application level roles (a crucial new addition).
• Allow IAM policies.
• Resource expansion.

By default, OCInferno's graph focuses on privilege escalation edges and tangentially related paths, aiming to reduce visual clutter in complex cloud environments. However, it offers several flags to customize the graph:

• --inheritance: This flag visualizes how permissions propagate through the compartment hierarchy, showing how policies attached to parent compartments affect resources in child compartments. As Weston demonstrated, enabling inheritance can significantly "balloon out" the graph, revealing a much broader scope of access.
• Conditional Evaluation: OCI IAM policies can include conditionals, similar to AWS IAM. OCInferno evaluates a subset of these conditionals, allowing the graph to represent more precise access paths. For instance, a policy allowing "any user to manage users" only for a specific user ID will be accurately depicted when conditionals are enabled.
• --include-all: For comprehensive analysis, this flag graphs every possible edge and relationship, regardless of whether it directly leads to privilege escalation. This is valuable for understanding the full connectivity and trust relationships within an OCI environment.

The technical deep dive into the IDCS application is particularly insightful. Weston explains that app roles within Identity Domains are designed to translate OAuth scopes into permissions. He discovered that the pre-existing administrative roles (e.g., "User Administrator") found in newly created identity domains are implicitly tied to an application named the IDCS application. This application is a remnant of Oracle's older Identity Cloud Service (IDCS) product, which was eventually merged into OCI's IAM model.

This historical integration has resulted in a dual authorization model. While traditional OCI IAM policies govern resource access, identity domain level roles, managed through the IDCS application, confer powerful control over identity domain principals. For instance, the "User Administrator" role grants permissions to manage users within that specific identity domain, including the ability to:

• Change a user's email address.
• Reset a user's password.
• Reset a user's two-factor authentication (2FA) settings.

The critical vulnerability arises when a user with these identity domain-level administrative privileges (e.g., "User Administrator") targets another user who, while having limited identity domain permissions, possesses extensive traditional OCI IAM policies. By compromising the latter user's credentials through password and 2FA resets, the attacker can effectively "pivot" from the identity domain's administrative scope into the broader OCI IAM resource access. This mechanism represents a fundamental design aspect of OCI's integrated identity management that creates a unique and potent lateral movement vector.

Demo / Proof of Concept

▶ Watch: OCInferno tool: Parsing OCI policy sentences into JSON (5:25)

Scott Weston's presentation included a compelling proof-of-concept demonstrating the lateral movement technique leveraging Identity Domain roles. The scenario was structured as follows:

Scenario Setup:

• Company: Lion Tamers Inc.
• Identity Domain: Lion Tamer Consulting.
• User 1: Jay Cleese
• Assigned the "User Administrator" role within the Lion Tamer Consulting identity domain.
• Crucially, no traditional OCI IAM policies are directly assigned to Jay Cleese. His permissions are entirely constrained to managing users within the identity domain.
• User 2: Han Chovi
• Has no identity domain permissions.
• Is a member of a group (e.g., Chartered Accountancy group) that is granted extensive traditional OCI IAM permissions over "all resources" in the OCI tenancy via an OCI IAM policy (Chart Accountancy Policy).

Attack Flow (Demonstrated using OCInferno and the OCI Console):

1. Initial Access: The attacker gains access as Jay Cleese. This could be through various means, such as phishing, compromised credentials, or exploiting a vulnerability that grants identity domain user administration.
2. Enumeration with OCInferno:

• Weston initializes OCInferno, specifying his OCI CLI profile for authentication.
• He runs the enum all command with the --comp (enumerate all compartments), --download (download data to disk), and --save (save to SQLite) flags. This enumerates all OCI resources and IAM configurations.
• The enumerated data is then used to generate a BloodHound graph using the Enum Oracle Cloud Hound Data module, with a --reset flag for a fresh run.
• An authorization bearer token is passed to BloodHound for proper visualization (icons and colors).

1. BloodHound Visualization:

• The generated JSON file is uploaded to BloodHound.
• A Cypher query is run to visualize the privilege escalation path. The graph clearly shows:
• The John Cleese user node.
• An edge from John Cleese to the User Administrator role node within the identity domain.
• An edge from the User Administrator role node to the Han Chovi user node, representing the ability to take over this user. The details on this edge in BloodHound would explicitly state the actions possible (reset password, change email, reset 2FA).
• An edge from the Han Chovi user node to the Chartered Accountancy group node (membership).
• An edge from the Chartered Accountancy group node to the Chart Accountancy Policy node (policy subject).
• An edge from the Chart Accountancy Policy node to the All Resources node, indicating full access.
• This visual path clearly illustrates how starting with limited identity domain permissions as Jay Cleese leads to full control over OCI resources via Han Chovi.

1. Execution via OCI Console:

• Jay Cleese signs into the OCI console.
• Navigates to the Lion Tamer Consulting identity domain.
• Locates the Han Chovi user.
• Uses the "User Administrator" privileges to change Han Chovi's email address to an attacker-controlled email.
• Triggers a password reset for Han Chovi.
• Triggers a two-factor authentication (2FA) reset for Han Chovi.
• With the new email and password, the attacker (as Jay Cleese) signs in as Han Chovi.
• Once authenticated as Han Chovi, the attacker gains access to all OCI resources that Han Chovi's group (Chartered Accountancy group) is permitted to manage, such as storage buckets, compute instances, and more.

This demonstration effectively highlights the critical intersection between identity domain administration and traditional OCI IAM permissions, showcasing a practical and potent lateral movement technique in OCI environments.

Defensive Implications

▶ Watch: OCInferno tool: OCI Signer for signing and modifying HTTP requests (6:05)

The insights provided by OCInferno and Scott Weston's research reveal several critical defensive implications for organizations operating within Oracle Cloud Infrastructure:

1. Understand the Dual IAM Model: Defenders must recognize that OCI's IAM is not monolithic. The interplay between Identity Domains and traditional OCI IAM policies creates a complex authorization landscape. A user's effective permissions are a combination of both, and a compromise in one layer can lead to privilege escalation in the other.
2. Audit Identity Domain Roles Rigorously: The IDCS application and its associated roles (e.g., "User Administrator," "Security Admin") are powerful. Organizations must meticulously audit who is assigned these roles within each identity domain. The principle of least privilege should be strictly applied; only necessary personnel should have these administrative permissions.
3. Monitor Identity Domain Administrative Actions: Implement robust logging and monitoring for actions performed by identity domain administrators. Specifically, alert on:

• Changes to user email addresses within an identity domain.
• Password resets for users.
• Two-factor authentication (2FA) resets for users.
• Changes to identity domain group memberships.
• These actions, especially when performed by an identity domain administrator on a user with high OCI IAM privileges, are strong indicators of potential compromise or lateral movement.

1. Enforce Strong Authentication and Access Controls for Identity Domain Admins: Given the power of identity domain roles, the accounts holding these permissions are high-value targets. They should be protected with:

• Mandatory strong multi-factor authentication (MFA).
• Dedicated administrative accounts, separate from regular user accounts.
• Conditional access policies that restrict access to specific IP ranges or devices.
• Regular rotation of credentials for these accounts.

1. Correlate Identity Domain and OCI IAM Permissions: Security teams need tools and processes to understand the full scope of permissions for any given user or group by correlating their identity domain roles with their traditional OCI IAM policies. Tools like OCInferno, with its BloodHound integration, can be invaluable for visualizing these complex relationships and identifying potential privilege escalation paths proactively.
2. Review Compartment and Identity Domain Hierarchy: The hierarchical nature of compartments and the segregation offered by identity domains can be a double-edged sword. While intended for logical isolation, misconfigurations in this hierarchy can inadvertently expand the blast radius of a compromise. Ensure that administrative roles and policies are scoped as narrowly as possible within the hierarchy.
3. Stay Updated on OCI Security Best Practices: Oracle regularly updates its security guidance. Defenders should continuously review and implement the latest best practices for OCI IAM and identity domain management to mitigate emerging threats and vulnerabilities.

By understanding these nuances and implementing proactive defensive measures, organizations can significantly reduce their exposure to the unique lateral movement techniques possible within Oracle Cloud Infrastructure.

Key Takeaways

• OCI's IAM is Distinctive: Unlike AWS or GCP, OCI features a unique dual authorization model involving traditional OCI IAM policies and Identity Domains with their own application-level roles.
• Identity Domain Roles are Powerful Pivots: Pre-existing administrative roles within Identity Domains (e.g., "User Administrator"), tied to the hidden IDCS application, can be leveraged to reset passwords and 2FA for other users.
• Lateral Movement Path Identified: An attacker with identity domain administrative privileges can compromise a user with high OCI IAM resource access, effectively pivoting from an identity domain scope to broad OCI resource control.
• OCInferno Fills a Tooling Gap: Scott Weston's OCInferno toolkit provides essential offensive capabilities for OCI, including comprehensive enumeration, policy parsing, and BloodHound graphing to visualize complex IAM relationships and privilege escalation paths.
• Defenders Must Audit and Monitor Identity Domains: Organizations need to rigorously audit assignments of identity domain administrative roles and monitor for suspicious activities like user email changes, password resets, and 2FA resets within identity domains.
• Complexity Demands Specialized Tools: The sentence-based policy syntax and the intricate interplay of OCI's IAM components necessitate specialized tools like OCInferno to effectively assess and secure OCI environments.

About the Speaker(s)

Scott Weston is an experienced security professional with a focus on cloud offensive security. Known by his handle "Web and Brew" on social media platforms, he has a history of developing open-source tools and giving talks on cloud security for major providers. His previous work includes GC Pwn, a popular offensive security tool for Google Cloud Platform (GCP), which he has continuously enhanced with features like BloodHound graphing. Weston's expertise spans AWS, GCP, and now OCI, where he has been actively involved in researching and disclosing vulnerabilities, indicating a deep commitment to improving cloud security postures across various platforms. His work on OCInferno demonstrates his dedication to creating practical, impactful tools for the security community.