TencentGoat: An Intentionally Vulnerable Tencent Cloud Environment

TencentGoat: An Intentionally Vulnerable Tencent Cloud Environment

Speakers: Muhammad Yuga Nugraha, DevOps Engineer

Conference: Cloud Village

YouTube: https://www.youtube.com/watch?v=QZstdpqchxA

Overview

In an insightful talk at Cloud Village, Muhammad Yuga Nugraha introduced TencentGoat, an intentionally vulnerable environment designed to explore security weaknesses within Tencent Cloud. As Tencent Cloud rapidly expands its footprint across Asia, particularly in Indonesia, Singapore, Thailand, and Vietnam, there's a growing need for security professionals to understand its unique architecture and potential vulnerabilities. Nugraha, a DevOps engineer with extensive experience across major cloud providers, highlighted the motivation behind TencentGoat: to demonstrate that fundamental cloud security issues persist across all platforms, even if the service names and implementation details differ.

The project serves as a crucial learning tool, filling a significant gap in publicly available security research for Tencent Cloud. Unlike more established providers like AWS, GCP, and Azure, Tencent Cloud's security landscape is less documented and understood by the broader security community outside of Asia. TencentGoat aims to demystify these aspects, providing a hands-on platform for security researchers and practitioners to learn how common attack techniques, such as exposed object storage, Server-Side Request Forgery (SSRF), remote code execution, and privilege escalation, manifest in the Tencent Cloud ecosystem. This initiative is particularly timely given Tencent Cloud's substantial investments and strategic partnerships in the region, making it an increasingly attractive target for both legitimate businesses and malicious actors.

Background

▶ Watch: Introduction and speaker's unique cloud background (0:00)

Tencent Cloud, a relatively newer entrant on the global cloud stage compared to its Western counterparts, has been making significant strategic investments and gaining traction, particularly in the Asia-Pacific region. Muhammad Yuga Nugraha's motivation for building TencentGoat stemmed directly from this observable growth. He noted Tencent's substantial investment of approximately $500 million USD in Indonesia for data centers, signaling a clear intent to expand rapidly and broadly across Asia. This expansion is further solidified by partnerships with major local companies like Goto (a "super app" platform similar to Uber), Telkomsel, banking and payment gateway Dana, and Duangu (an education technology company).

A compelling factor driving adoption of Tencent Cloud, as highlighted by Nugraha, is cost efficiency. He cited the example of the 99 Group, which reported a 55% reduction in cloud costs after migrating to Tencent Cloud. This economic advantage, combined with the strategic partnerships, suggests a future where Tencent Cloud will host a significant portion of critical infrastructure for businesses in the region. However, this rapid growth and adoption have not been met with a proportional increase in public security research or understanding. Most security tools, best practices, and knowledge bases are heavily skewed towards AWS, GCP, and Azure, leaving a critical knowledge gap for Tencent Cloud.

Nugraha, identifying himself as a DevOps engineer rather than a dedicated security professional, embarked on the TencentGoat project to address this very gap. His core motivations were threefold:

1. Demonstrate Universal Cloud Security Issues: To prove that fundamental security vulnerabilities, while manifesting differently, are inherent to all cloud providers, not just the "big three."
2. Gain Understanding and Learning: To personally delve deep into Tencent Cloud's services, understanding their behavior and how they compare to more familiar platforms.
3. Fill the Research Gap: To create a publicly available resource that aids others in learning about Tencent Cloud security, given the scarcity of existing materials.

TencentGoat draws inspiration from a lineage of similar "Goat" projects (e.g., AWSGoat, GCPGoat, KubernetesGoat, EntraGoat) that provide intentionally vulnerable environments for hands-on learning. The entire environment is built using Terraform, emphasizing a simple, infrastructure-as-code approach to deploying the vulnerable scenarios. This foundational work is crucial for preparing the security community for the increasing prevalence of Tencent Cloud environments.

Key Findings

▶ Watch: Real motivation: Cloud security issues persist across all providers (5:10)

The talk meticulously demonstrated that core cloud security issues are not exclusive to any single provider but rather universal, differing primarily in the specific service names, API calls, and configuration nuances. Nugraha's exploration of Tencent Cloud through TencentGoat yielded several key findings and reinforced common vulnerability patterns:

1. Service Parity with Different Nomenclature: Tencent Cloud offers services that are functionally equivalent to those found in AWS or GCP, but with distinct names. For instance:

• Cloud Access Management (CAM) is Tencent Cloud's equivalent of AWS IAM.
• Cloud Virtual Machine (CVM) is analogous to AWS EC2 instances or GCP Compute Engine.
• Cloud Object Storage (COS) functions similarly to AWS S3 or GCP Cloud Storage.
• Tencent Container Registry (TCR) parallels AWS ECR or GCP Container Registry.

Understanding these equivalences is crucial for translating security knowledge across platforms.

1. Persistent Misconfiguration Risks in Object Storage: Publicly exposed object storage buckets remain a prevalent and critical misconfiguration. Tencent Cloud's COS buckets, like their counterparts, can be misconfigured to expose sensitive data to the internet, often due to overly permissive policies. A notable difference is Tencent Cloud's bucket naming convention, which appends a user or organization ID (e.g., my-tencent-bucket-12345678) to ensure uniqueness within an account, rather than global uniqueness across the entire cloud.

1. SSRF Vulnerabilities in Metadata Services: Server-Side Request Forgery (SSRF) remains a potent attack vector against cloud instance metadata services. Tencent Cloud's CVM metadata service, accessible via http://metadata.tencentyun.com/latest/meta-data/, functions similarly to AWS IMDSv1. Critically, Tencent Cloud currently lacks an equivalent to AWS IMDSv2, which employs session tokens to mitigate SSRF risks. This absence makes it simpler for an attacker to directly query the metadata endpoint and steal temporary credentials if an SSRF vulnerability exists in an application running on a CVM instance.

1. Remote Code Execution via Cloud Automation Tools: Cloud automation and management tools, while powerful for legitimate operations, can be abused for remote code execution (RCE) if permissions are overly broad. Tencent Cloud Automation Tools (TAT), which shares functional similarities with AWS Systems Manager, allows users with specific permissions (e.g., cam:CreateCommand) to execute arbitrary commands on CVM instances where the TAT agent is installed. This can bypass traditional network access controls like SSH, leading to RCE.

1. Privilege Escalation through PassRole: A common and dangerous pattern for privilege escalation across cloud environments is the ability to pass an existing, highly privileged role to a newly created resource. In Tencent Cloud, the cam:PassRole permission, when combined with cvm:RunInstance, allows an attacker to launch a new CVM instance and attach an existing, over-privileged CAM role to it. This effectively grants the attacker the full permissions of the attached role, even if their original user account had limited access. Nugraha demonstrated this by escalating to an "admin" role often used by "lazy DevOps guys" for provisioning.

These findings collectively underscore that while the specific API calls and service names change, the underlying security principles and common misconfigurations remain constant. Security professionals must adapt their understanding of these patterns to the specific context of Tencent Cloud.

Technical Deep Dive

▶ Watch: TencentGoat design: Inspired by other 'Goat' projects, built with Terraform (6:00)

The core of TencentGoat lies in dissecting specific Tencent Cloud services and demonstrating how common cloud vulnerabilities manifest within them. Nugraha focused on the most frequently used services and their security implications.

Cloud Access Management (CAM)

CAM is Tencent Cloud's identity and access management service, directly analogous to AWS IAM. It governs who can do what within a Tencent Cloud account. Policies are defined in JSON, specifying action (e.g., cos:GetBucket), service name (e.g., cos), resource (e.g., specific bucket ARN-like identifiers called UIBs), and effect (Allow/Deny). Misconfigurations in CAM policies are the root cause of many of the demonstrated vulnerabilities.

Cloud Virtual Machine (CVM)

CVM is Tencent Cloud's compute service, equivalent to AWS EC2 or GCP Compute Engine. CVM instances are the foundation for running applications and often become targets for attackers seeking to gain a foothold or escalate privileges.

Cloud Object Storage (COS)

COS is Tencent Cloud's object storage service, comparable to AWS S3 or GCP Cloud Storage. It's used for storing static files, backups, and other data.

Scenario 1: Exposed Sensitive Data via Public Object Storage (COS)

This scenario highlights a common misconfiguration: publicly accessible storage buckets. In Tencent Cloud, a key distinction from AWS S3 is the bucket naming convention. While AWS bucket names are globally unique, Tencent Cloud appends a user or organization ID to the bucket name (e.g., my-tencent-bucket-12345678). This allows multiple accounts to technically have a bucket named "my-tencent-bucket," but their full identifiers will differ.

The vulnerability arises when a COS bucket is configured with a policy that grants public read access. An example policy permitting public listing and retrieval of objects might look like this (conceptual, based on the talk's description):

When such a policy is in place, an unauthenticated attacker can make HTTP requests to the bucket's endpoint (e.g., https://my-tencent-bucket-12345678.cos.ap-guangzhou.myqcloud.com/) to list its contents (GetBucket) or download specific objects (GetObject), resulting in an XML response detailing the bucket's contents, similar to AWS S3. If sensitive data resides in these buckets, it becomes publicly exposed.

Tencent Container Registry (TCR)

TCR is Tencent Cloud's managed container image registry, analogous to AWS ECR or GCP Container Registry. It stores Docker images and other container artifacts. While not directly exploited in the presented scenarios, its presence implies potential misconfigurations related to image access and supply chain security.

Scenario 2: Stealing CVM Metadata Credentials via SSRF

This is a classic cloud vulnerability where an attacker, having achieved Local Code Execution (LCE) on an application running on a CVM instance (e.g., through a web vulnerability), leverages an SSRF to interact with the instance's metadata service. The metadata service provides information about the instance and, critically, temporary security credentials for attached roles.

In Tencent Cloud, the metadata service endpoint is http://metadata.tencentyun.com/latest/meta-data/. An attacker can make a request to http://metadata.tencentyun.com/latest/meta-data/cam/security-credentials/ to retrieve the name of the attached CAM role. For example, if a role named cost-list-bucket-ro (a read-only role for COS) is attached, the attacker would then query http://metadata.tencentyun.com/latest/meta-data/cam/security-credentials/cost-list-bucket-ro to obtain temporary SecretId, SecretKey, and Token credentials.

Nugraha emphasized a critical difference: Tencent Cloud's metadata service operates like AWS IMDSv1, meaning no session token is required to access metadata. This makes it a more straightforward target for SSRF attacks compared to AWS IMDSv2, which introduces a token-based authentication mechanism.

Once the temporary credentials are exfiltrated, the attacker needs a way to use them. Since there isn't a direct argument in the metadata service to interact with COS, the attacker would typically install the Tencent Cloud CLI (TCLI). The TCLI then needs to be configured with the stolen SecretId, SecretKey, and Token. Crucially, to assume the role attached to the CVM, the TCLI's configuration needs to specify cos:mode: cpm-role. This allows the CLI to understand and leverage the instance's attached role. With the TCLI configured, the attacker can then execute commands like tcli cos lscp to list all COS buckets accessible by the assumed role, demonstrating full control over the role's permissions.

Scenario 3: Remote Code Execution (RCE) via Tencent Cloud Automation Tools (TAT)

Tencent Cloud Automation Tools (TAT) is Tencent Cloud's equivalent of AWS Systems Manager. It allows for remote management and execution of commands on CVM instances, provided the TAT agent is installed on the instance.

This scenario demonstrates RCE when a user account has specific, but seemingly limited, CAM permissions: cam:CreateCommand and cam:InfoCommand. While these permissions don't directly grant SSH access or instance creation, they can be abused.

The attack flow involves:

1. Enumerating Instances: The attacker first needs to identify a target CVM instance ID. This can be done using the qcloud-cvm-cli DescribeInstances command if the user has appropriate read permissions.
2. Executing Command: With the instance ID, the attacker can use the qcloud-tat-cli CreateCommand command. This command requires the region, instance ID, and the command to execute. For example, qcloud-tat-cli CreateCommand --region ap-guangzhou --instance-id ins-xxxxxxxx --command "ls -al /" would execute a directory listing command.
3. Retrieving Output: The output of the command can be retrieved using qcloud-tat-cli InfoCommand.

This method allows an attacker to bypass network restrictions (like closed SSH ports or bastion hosts) and achieve RCE on the CVM, as long as the TAT agent is running and the user has the cam:CreateCommand permission. This opens avenues for installing reverse shells, adding SSH keys, or exfiltrating data.

Scenario 4: Privilege Escalation via CVM PassRole

This is a potent privilege escalation technique, common across cloud providers, where a user with limited permissions can gain higher privileges by launching a new resource with an existing, more powerful role attached. In Tencent Cloud, this involves the cvm:RunInstance permission combined with cam:PassRole.

Nugraha demonstrated this with a scenario where a "lazy DevOps guy" had provisioned a highly privileged role, such as terraform-provisioning-role, which effectively granted admin access. An attacker with the seemingly benign cvm:RunInstance permission, coupled with cam:PassRole, can exploit this.

The attack steps include:

1. Identify High-Privilege Role: The attacker first enumerates existing CAM roles and identifies a highly privileged one (e.g., terraform-provisioning-role).
2. Create New CVM with Role: Using the qcloud-cvm-cli RunInstances command, the attacker provisions a new CVM instance. Crucially, during instance creation, the attacker specifies the identified high-privilege role using the --role-name parameter.
3. Inject User Data: The attacker can also inject user data (similar to AWS user data) during instance creation to automatically install tools, add SSH keys, or configure the instance for remote access.
4. Access New Instance: Once the CVM is launched, the attacker can SSH into it (using the injected key) or use other remote access methods.
5. Assume Elevated Privileges: From within this new CVM, the attacker can now assume the attached terraform-provisioning-role, gaining all its permissions. This was demonstrated by installing the TCLI and then using it to list all instances (tcli cvm lscp) and COS buckets (tcli cos lscp), proving full control over resources accessible by the high-privilege role.

This scenario underscores the critical importance of the cam:PassRole permission. Granting PassRole effectively means that any user or service that can launch a resource can also assume the permissions of any role they are allowed to pass.

Demo / Proof of Concept

▶ Watch: Understanding Tencent Cloud: Key services and AWS/GCP parallels (6:40)

Muhammad Yuga Nugraha included a compelling video demonstration of the Privilege Escalation via CVM PassRole scenario, illustrating the practical execution of this attack vector within Tencent Cloud. The demo meticulously walked through the steps an attacker would take, starting from a user with limited privileges and culminating in full administrative access.

The demonstration began by showing a user account, run-instance-user, with restricted permissions. The initial enumeration of roles revealed a critical misconfiguration: a highly privileged role named terraform-provisioning-role, which, as implied by its name and confirmed by its broad permissions, effectively had administrative access across the Tencent Cloud environment. This role represented the "lazy DevOps guy" scenario, where excessive permissions were granted for provisioning purposes.

The core of the attack involved leveraging the qcloud-cvm-cli RunInstances command. The attacker, possessing the cvm:RunInstance permission (to create instances) and, critically, the cam:PassRole permission (to attach an existing role to a new instance), proceeded to launch a new CVM. During this instance creation, the attacker specified the terraform-provisioning-role as the role to be attached to the new CVM. Furthermore, the attacker injected their SSH public key into the CVM's user data, ensuring immediate SSH access upon instance boot-up.

After the CVM was successfully provisioned and assigned a public IP address, the attacker SSH'd into the new instance. Inside the compromised CVM, the attacker installed the Tencent Cloud CLI (TCLI), a crucial tool for interacting with Tencent Cloud services. With TCLI installed and configured to leverage the CVM's attached terraform-provisioning-role, the attacker executed commands like tcli cvm lscp (to list all CVM instances in the project) and tcli cos lscp (to list all Cloud Object Storage buckets). The successful execution of these commands, which would have been impossible with the run-instance-user's original limited permissions, visually confirmed the successful privilege escalation. The attacker had effectively bypassed their initial restrictions and gained the full administrative power of the terraform-provisioning-role.

This clear and concise demonstration underscored the severity of misconfigured cam:PassRole permissions and the ease with which a seemingly minor initial access can be escalated to full control over a Tencent Cloud environment.

Defensive Implications

▶ Watch: Scenario 1: Exposed object storage and unique bucket naming convention (8:00)

Understanding the vulnerabilities demonstrated in TencentGoat is paramount for securing environments hosted on Tencent Cloud. Defenders must proactively implement robust security measures, focusing on principles that are universal to cloud security but adapted to Tencent Cloud's specific services and APIs.

1. Implement Least Privilege: This is the most critical defense.

• CAM Policies: Scrutinize all Cloud Access Management (CAM) policies. Grant users and services only the absolute minimum permissions required to perform their functions. Avoid wildcard * permissions where possible, and be specific about actions and resources.
• cam:PassRole: Strictly control the cam:PassRole permission. This permission should be granted with extreme caution and only to trusted entities, and ideally, restricted to a very limited set of roles that can be passed. Never allow a low-privileged user to pass a highly privileged role.
• TAT Permissions: Restrict cam:CreateCommand and cam:InfoCommand to specific CVM instances or instance tags. Do not grant broad permissions that allow command execution on all instances.

1. Secure Cloud Object Storage (COS):

• Default Private: Configure COS buckets to be private by default. Public access should only be enabled when absolutely necessary and after a thorough security review.
• Restrict Access Policies: Regularly audit bucket policies to ensure they do not inadvertently grant name/cos:GetBucket, name/cos:GetObject, or name/cos:PutObject permissions to * (all principals). Use specific principal identifiers (e.g., specific CAM users or roles) for access.
• Encryption: Enable encryption for all sensitive data stored in COS buckets, both at rest and in transit.

1. Mitigate Server-Side Request Forgery (SSRF) Risks:

• Input Validation: Implement stringent input validation and sanitization for all user-supplied data in applications running on CVM instances to prevent SSRF vulnerabilities.
• Network Firewalls/Security Groups: Configure network access control lists (ACLs) or security groups on CVM instances to explicitly block outbound connections to the metadata service domain (metadata.tencentyun.com) unless absolutely required by the application. This is a crucial layer of defense given Tencent Cloud's lack of an IMDSv2 equivalent.
• Web Application Firewalls (WAFs): Deploy WAFs to detect and block common SSRF patterns in HTTP requests.
• Network Segmentation: Isolate applications that handle external input into separate subnets with strict egress filtering.
• Monitoring: Monitor network traffic from CVM instances for suspicious outbound connections to the metadata service IP or domain.

1. Secure CVM Instances:

• Patching and Updates: Ensure CVM instances are regularly patched and updated to fix known vulnerabilities in the operating system and installed software.
• Agent Security: If using Tencent Cloud Automation Tools (TAT), ensure its agent is updated, properly configured, and its permissions are restricted.
• User Data Security: Be cautious about what is passed in user data during instance creation, especially sensitive information like SSH keys or credentials. Use secure methods for secret management.

1. Continuous Monitoring and Auditing:

• Cloud Auditing: Utilize Tencent Cloud's auditing services (e.g., CloudAudit) to log all API calls and configuration changes. Regularly review these logs for suspicious activities, especially related to CAM policy changes, instance creation, and object storage modifications.
• Vulnerability Scans: Conduct regular vulnerability assessments and penetration tests against your Tencent Cloud environment and applications.
• Automated Policy Checks: Implement automated tools to periodically check CAM and COS policies for misconfigurations and deviations from security baselines.

By adopting these defensive strategies, organizations can significantly reduce their attack surface and enhance the security posture of their Tencent Cloud deployments, even as the platform continues to evolve.

Key Takeaways

• Cloud Security is Universal: Fundamental security issues, such as misconfigured permissions, exposed data, and SSRF, are present across all cloud providers, including Tencent Cloud, though their implementation details and service names differ.
• Tencent Cloud's IMDS Lacks IMDSv2 Protections: Tencent Cloud's CVM metadata service operates without the session token mechanism found in AWS IMDSv2, making it more susceptible to direct SSRF attacks for credential exfiltration.
• cam:PassRole is a Critical Privilege Escalation Vector: Granting the cam:PassRole permission to users or services, especially in conjunction with cvm:RunInstance, can lead to severe privilege escalation if an attacker can attach an existing high-privilege role to a new instance.
• Overly Permissive Automation Tool Access Leads to RCE: Broad cam:CreateCommand permissions for Tencent Cloud Automation Tools (TAT) can enable attackers to achieve remote code execution on CVM instances, bypassing traditional network access controls.
• Public Object Storage Remains a Top Misconfiguration: Improperly configured Cloud Object Storage (COS) buckets continue to be a common source of sensitive data exposure, emphasizing the need for strict access policies and regular audits.
• Embrace Least Privilege and Continuous Monitoring: Implementing the principle of least privilege for all CAM policies and maintaining continuous monitoring and auditing of cloud configurations are essential for securing any Tencent Cloud environment.

About the Speaker(s)

Muhammad Yuga Nugraha is a DevOps Engineer based in Singapore, originally from Indonesia. Despite humbly stating that he's "not a security guy," his work clearly demonstrates a deep practical understanding of cloud security. He has extensive experience working with various cloud providers, including AWS, GCP, Oracle Cloud Infrastructure (OCI), and currently, Tencent Cloud. He expresses a keen passion for "anything related with the cloud," which motivated him to build TencentGoat to explore and share knowledge about Tencent Cloud's security landscape. His background as a DevOps engineer provides him with a unique perspective on the practical challenges and misconfigurations that can arise in cloud environments.