mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-16 23:01:43 -08:00
65 lines
2.0 KiB
Markdown
65 lines
2.0 KiB
Markdown
# AWS - EC2 Unauthenticated Enum
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
## EC2 & Related Services
|
|
|
|
Check in this page more information about this:
|
|
|
|
{{#ref}}
|
|
../aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/
|
|
{{#endref}}
|
|
|
|
### Public Ports
|
|
|
|
It's possible to expose the **any port of the virtual machines to the internet**. Depending on **what is running** in the exposed the port an attacker could abuse it.
|
|
|
|
#### SSRF
|
|
|
|
{{#ref}}
|
|
https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html
|
|
{{#endref}}
|
|
|
|
### Public AMIs & EBS Snapshots
|
|
|
|
AWS allows to **give access to anyone to download AMIs and Snapshots**. You can list these resources very easily from your own account:
|
|
|
|
```bash
|
|
# Public AMIs
|
|
aws ec2 describe-images --executable-users all
|
|
|
|
## Search AMI by ownerID
|
|
aws ec2 describe-images --executable-users all --query 'Images[?contains(ImageLocation, `967541184254/`) == `true`]'
|
|
|
|
## Search AMI by substr ("shared" in the example)
|
|
aws ec2 describe-images --executable-users all --query 'Images[?contains(ImageLocation, `shared`) == `true`]'
|
|
|
|
# Public EBS snapshots (hard-drive copies)
|
|
aws ec2 describe-snapshots --restorable-by-user-ids all
|
|
aws ec2 describe-snapshots --restorable-by-user-ids all | jq '.Snapshots[] | select(.OwnerId == "099720109477")'
|
|
```
|
|
|
|
If you find a snapshot that is restorable by anyone, make sure to check [AWS - EBS Snapshot Dump](https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/index.html#ebs-snapshot-dump) for directions on downloading and looting the snapshot.
|
|
|
|
#### Public URL template
|
|
|
|
```bash
|
|
# EC2
|
|
ec2-{ip-seperated}.compute-1.amazonaws.com
|
|
# ELB
|
|
http://{user_provided}-{random_id}.{region}.elb.amazonaws.com:80/443
|
|
https://{user_provided}-{random_id}.{region}.elb.amazonaws.com
|
|
```
|
|
|
|
### Enumerate EC2 instances with public IP
|
|
|
|
```bash
|
|
aws ec2 describe-instances --query "Reservations[].Instances[?PublicIpAddress!=null].PublicIpAddress" --output text
|
|
```
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
|
|
|
|
|