Hint: it's not LS0t, but close.
This is an old one from the archives.
AWS EKS was logging ServiceAccount tokens in plaintext, the very same used to AssumeRoleWithWebIdentity, or connect to the kubernetes API server.
This occurred for us between March 2020 and May 2021.
| import sys | |
| import pprint | |
| import struct | |
| import socket | |
| import ssl | |
| from time import sleep | |
| # Standard "HELLO" message for TDS | |
| prelogin_msg = bytearray([ 0x12, 0x01, 0x00, 0x2f, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x06, 0x01, 0x00, 0x20, | |
| 0x00, 0x01, 0x02, 0x00, 0x21, 0x00, 0x01, 0x03, 0x00, 0x22, 0x00, 0x04, 0x04, 0x00, 0x26, 0x00, |
