mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-28 21:53:15 -08:00
Update aws-ecs-privesc.md
This commit is contained in:
@@ -199,7 +199,7 @@ aws ecs run-task \
|
||||
|
||||
This scenario is like the previous ones but **without** the **`iam:PassRole`** permission.\
|
||||
This is still interesting because if you can run an arbitrary container, even if it's without a role, you could **run a privileged container to escape** to the node and **steal the EC2 IAM role** and the **other ECS containers roles** running in the node.\
|
||||
You could even **force other tasks to run inside the EC2 instance** you compromise to steal their credentials (as discussed in the [**Privesc to node section**](../Job/aws-ecs-privesc.md#privesc-to-node)).
|
||||
You could even **force other tasks to run inside the EC2 instance** you compromise to steal their credentials (as discussed in the [**Privesc to node section**](aws-ecs-post-exploitation.md#privesc-to-node)).
|
||||
|
||||
> [!WARNING]
|
||||
> This attack is only possible if the **ECS cluster is using EC2** instances and not Fargate.
|
||||
|
||||
Reference in New Issue
Block a user