# AWS - EBS Privesc

{{#include ../../../../banners/hacktricks-training.md}}

## EBS

### `ebs:ListSnapshotBlocks`, `ebs:GetSnapshotBlock`, `ec2:DescribeSnapshots`

Un attacker con quei permessi potrà potenzialmente **scaricare e analizzare localmente gli snapshot dei volumi** e cercare informazioni sensibili al loro interno (come secrets o source code). Trova come farlo in:

{{#ref}}
../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md
{{#endref}}

Altri permessi potrebbero essere utili come: `ec2:DescribeInstances`, `ec2:DescribeVolumes`, `ec2:DeleteSnapshot`, `ec2:CreateSnapshot`, `ec2:CreateTags`

The tool [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) performs this attack to **estrarre le password da un domain controller**.

**Potential Impact:** Privesc indiretto individuando informazioni sensibili nello snapshot (potresti anche ottenere le password di Active Directory).

### **`ec2:CreateSnapshot`**

Any AWS user possessing the **`EC2:CreateSnapshot`** permission can steal the hashes of all domain users by creating a **snapshot of the Domain Controller** mounting it to an instance they control and **exporting the NTDS.dit and SYSTEM** registry hive file for use with Impacket's secretsdump project.

You can use this tool to automate the attack: [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) or you could use one of the previous techniques after creating a snapshot.

{{#include ../../../../banners/hacktricks-training.md}}
