gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2025-12-12 07:40:49 -08:00
Code Issues Packages Projects Releases Wiki Activity

Update aws-sagemaker-persistence.md

Browse Source
This commit is contained in:
Ben
2025-07-15 17:07:58 -05:00
committed by GitHub
parent 7b475f151e
commit 3662845c9c
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/pentesting-cloud/aws-security/aws-persistence/aws-sagemaker-persistence.md
View File

@@ -1,6 +1,11 @@
# AWS - SageMaker Lifecycle Configuration Persistence
## Overview of Persistence Techniques
This section outlines methods for gaining persistence in SageMaker by abusing Lifecycle Configurations (LCCs), including reverse shells, cron jobs, credential theft via IMDS, and SSH backdoors. These scripts run with the instance’s IAM role and can persist across restarts. Most techniques require outbound network access, but usage of services on the AWS control plane can still allow success if the environment is in 'VPC-only" mode.
#### Note: SageMaker notebook instances are essentially managed EC2 instances configured specifically for machine learning workloads.
## Required Permissions
* Notebook Instances:
```
@@ -17,7 +22,7 @@ sagemaker:UpdateUserProfile
sagemaker:UpdateSpace
sagemaker:UpdateDomain
```
#### Note: SageMaker notebook instances are essentially managed EC2 instances configured specifically for machine learning workloads.
## Set Lifecycle Configuration on Notebook Instances