AWS - RDS Persistence

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

RDS

For more information check:

{% content-ref url="../aws-services/aws-relational-database-rds-enum.md" %} aws-relational-database-rds-enum.md {% endcontent-ref %}

Make instance publicly accessible: `rds:ModifyDBInstance`

An attacker with this permission can modify an existing RDS instance to enable public accessibility.

{% code overflow="wrap" %}

aws rds modify-db-instance --db-instance-identifier target-instance --publicly-accessible --apply-immediately

{% endcode %}

Create an admin user inside the DB

An attacker could just create a user inside the DB so even if the master users password is modified he doesn't lose the access to the database.

Make snapshot public