Cloud metadata service abuse via ICMP¶

Attack pattern¶

Every cloud instance can reach a metadata service at a fixed link-local address, and that service hands out configuration and, too often, credentials to anything on the instance that asks. The trust is in the position, not the caller, so an attacker who has landed on an instance is treated as the instance itself. ICMP enters as the reconnaissance around that trust, mapping what is reachable inside the instance’s network view before the credential-bearing request goes in, on a channel the HTTP-focused controls do not watch.

1. Cloud metadata service abuse [OR]

    1.1 IMDS exploitation [OR]
    
        1.1.1 ICMP-based IMDSv1 queries
            1.1.1.1 AWS instance metadata service discovery via ICMP
            1.1.1.2 Metadata endpoint reachability confirmation via ICMP
            1.1.1.3 Instance role credential extraction once the endpoint is confirmed
            1.1.1.4 User data retrieval over the HTTP metadata API
            
        1.1.2 Instance metadata service discovery
            1.1.2.1 Cloud provider metadata endpoint identification
            1.1.2.2 Metadata service version detection via ICMP
            1.1.2.3 Regional metadata service discovery
            1.1.2.4 Multi-cloud metadata service enumeration
            
        1.1.3 Cloud credential harvesting
            1.1.3.1 Temporary security credential extraction
            1.1.3.2 IAM role information gathering
            1.1.3.3 Access key ID and secret key harvesting
            1.1.3.4 Session token collection over the HTTP metadata API
            
    1.2 Serverless SSRF attacks [OR]
    
        1.2.1 ICMP-triggered serverless SSRF
            1.2.1.1 Lambda function metadata service access via ICMP
            1.2.1.2 Cloud function metadata exploitation
            1.2.1.3 Serverless environment credential harvesting
            1.2.1.4 Function-as-a-service metadata compromise
            
        1.2.2 Container metadata service access
            1.2.2.1 Kubernetes pod metadata service targeting
            1.2.2.2 Container role credential extraction
            1.2.2.3 Docker container metadata exploitation
            1.2.2.4 Container orchestration platform metadata access
            
        1.2.3 Kubernetes API server targeting
            1.2.3.1 API server discovery via ICMP techniques
            1.2.3.2 Service account token harvesting
            1.2.3.3 Cluster metadata extraction
            1.2.3.4 Kubernetes role-based access control bypass
            
    1.3 Cloud network reconnaissance [OR]
    
        1.3.1 VPC metadata discovery via ICMP
            1.3.1.1 Virtual private cloud configuration analysis
            1.3.1.2 Subnet and routing table information gathering
            1.3.1.3 Network access control list enumeration
            1.3.1.4 Cloud router configuration discovery
            
        1.3.2 Cloud security group mapping
            1.3.2.1 Security group rule inference through ICMP responses
            1.3.2.2 Network security policy enumeration
            1.3.2.3 Inbound and outbound rule discovery
            1.3.2.4 Implicit deny rule identification
            
        1.3.3 Service endpoint discovery
            1.3.3.1 Private service endpoint identification
            1.3.3.2 Cloud service interface discovery
            1.3.3.3 API gateway endpoint enumeration
            1.3.3.4 Load balancer and proxy service mapping
            
    1.4 Metadata service evasion [OR]
    
        1.4.1 Hop limit manipulation
            1.4.1.1 TTL/hop limit adjustment for local metadata access
            1.4.1.2 Route manipulation to reach metadata services
            1.4.1.3 Network namespace traversal techniques
            1.4.1.4 Container escape via metadata service targeting
            
        1.4.2 Protocol conversion attacks
            1.4.2.1 ICMP reachability check preceding the HTTP metadata call
            1.4.2.2 Packet crafting for service communication
            1.4.2.3 Protocol tunnelling through ICMP
            1.4.2.4 Metadata service API call simulation
            
    1.5 Persistence and access maintenance [OR]
    
        1.5.1 Credential persistence techniques
            1.5.1.1 Regular credential refresh through automated queries
            1.5.1.2 Long-lived access maintenance
            1.5.1.3 Token renewal automation
            1.5.1.4 Credential caching and storage
            
        1.5.2 Access expansion methods
            1.5.2.1 Privilege escalation through harvested credentials
            1.5.2.2 Lateral movement using cloud credentials
            1.5.2.3 Cross-account access achievement
            1.5.2.4 Service role assumption attacks
            
    1.6 Cloud provider-specific exploitation [OR]
    
        1.6.1 Multi-cloud metadata targeting
            1.6.1.1 AWS instance metadata service exploitation
            1.6.1.2 Azure instance metadata service targeting
            1.6.1.3 Google cloud metadata service access
            1.6.1.4 Oracle cloud infrastructure metadata exploitation
            
        1.6.2 Provider-specific feature abuse
            1.6.2.1 Cloud-specific metadata field exploitation
            1.6.2.2 Custom metadata service feature targeting
            1.6.2.3 Provider-specific API endpoint discovery
            1.6.2.4 Unique cloud service metadata access

Trusts the position, not the caller¶

The metadata service answers any request from the instance, trusting the position rather than the caller.
Cloud security controls are built around HTTP metadata access, so ICMP-based probing slips past them.
The platform trusts instance-originated traffic by default, which an attacker on the instance inherits.
Cloud monitoring rarely inspects ICMP deeply, so the reconnaissance goes unrecorded.