AWS - KMS Persistence

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

KMS

For mor information check:

pageAWS - KMS Enum

Grant acces via KMS policies

An attacker could use the permission kms:PutKeyPolicy to give access to a key to a user under his control or even to an external account. Check the KMS Privesc page for more information.

Eternal Grant

Grants are another way to give a principal some permissions over a specific key. It's possible to give a grant that allows a user to create grants. Moreover, a user can have several grant (even identical) over the same key.

Therefore, it's possible for a user to have 10 grants with all the permissions. The attacker should monitor this constantly. And if at some point 1 grant is removed another 10 should be generated.

(We are using 10 and not 2 to be able to detect that a grant was removed while the user still has some grant)

# To generate grants, generate 10 like this one
aws kms create-grant \
    --key-id <key-id> \
    --grantee-principal <user_arn> \
    --operations "CreateGrant" "Decrypt"

# To monitor grants
aws kms list-grants --key-id <key-id>

A grant can give permissions only from this: https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.