# AWS - Lambda Persistence {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ## Lambda For more information check: {% content-ref url="../../aws-services/aws-lambda-enum.md" %} [aws-lambda-enum.md](../../aws-services/aws-lambda-enum.md) {% endcontent-ref %} ### Lambda Layer Persistence It's possible to **introduce/backdoor a layer to execute arbitrary code** when the lambda is executed in a stealthy way: {% content-ref url="aws-lambda-layers-persistence.md" %} [aws-lambda-layers-persistence.md](aws-lambda-layers-persistence.md) {% endcontent-ref %} ### Lambda Extension Persistence Abusing Lambda Layers it's also possible to abuse extensions and persist in the lambda but also steal and modify requests. {% content-ref url="aws-abusing-lambda-extensions.md" %} [aws-abusing-lambda-extensions.md](aws-abusing-lambda-extensions.md) {% endcontent-ref %} ### Via resource policies It's possible to grant access to different lambda actions (such as invoke or update code) to external accounts:
### Versions, Aliases & Weights A Lambda can have **different versions** (with different code each version).\ Then, you can create **different aliases with different versions** of the lambda and set different weights to each.\ This way an attacker could create a **backdoored version 1** and a **version 2 with only the legit code** and **only execute the version 1 in 1%** of the requests to remain stealth.
### Version Backdoor + API Gateway 1. Copy the original code of the Lambda 2. **Create a new version backdooring** the original code (or just with malicious code). Publish and **deploy that version** to $LATEST 1. Call the API gateway related to the lambda to execute the code 3. **Create a new version with the original code**, Publish and deploy that **version** to $LATEST. 1. This will hide the backdoored code in a previous version 4. Go to the API Gateway and **create a new POST method** (or choose any other method) that will execute the backdoored version of the lambda: `arn:aws:lambda:us-east-1::function::1` 1. Note the final :1 of the arn **indicating the version of the function** (version 1 will be the backdoored one in this scenario). 5. Select the POST method created and in Actions select **`Deploy API`** 6. Now, when you **call the function via POST your Backdoor** will be invoked ### Cron/Event actuator The fact that you can make **lambda functions run when something happen or when some time pass** makes lambda a nice and common way to obtain persistence and avoid detection.\ Here you have some ideas to make your **presence in AWS more stealth by creating lambdas**. * Every time a new user is created lambda generates a new user key and send it to the attacker. * Every time a new role is created lambda gives assume role permissions to compromised users. * Every time new cloudtrail logs are generated, delete/alter them {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}