From 1c9c12f865b03776e73467cf321c09774f4d9e79 Mon Sep 17 00:00:00 2001 From: Jaime Polop <117489620+JaimePolop@users.noreply.github.com> Date: Sat, 11 May 2024 18:19:26 +0200 Subject: [PATCH] Update aws-ssm-privesc.md Just a brief clarification --- .../aws-security/aws-privilege-escalation/aws-ssm-privesc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md b/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md index 5c5c8dccfb..ddad6296a4 100644 --- a/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md +++ b/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md @@ -71,7 +71,7 @@ In order to start a session you need the **SessionManagerPlugin** installed: [ht #### Privesc to ECS When **ECS tasks** run with **`ExecuteCommand` enabled** users with enough permissions can use `ecs execute-command` to **execute a command** inside the container.\ -According to [**the documentation**](https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/) this is done by creating a secure channel between the device you use to initiate the “_exec_“ command and the target container with SSM Session Manager.\ +According to [**the documentation**](https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/) this is done by creating a secure channel between the device you use to initiate the “_exec_“ command and the target container with SSM Session Manager. (SSM Session Manager Plugin necesary for this to work)\ Therefore, users with `ssm:StartSession` will be able to **get a shell inside ECS tasks** with that option enabled just running: ```bash