AWS - Lambda Layers Persistence
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
A Lambda layer is a .zip file archive that can contain additional code or other content. A layer can contain libraries, a custom runtime, data, or configuration files.
It's possible to include up to five layers per function. When you include a layer in a function, the contents are extracted to the /opt directory in the execution environment.
By default, the layers that you create are private to your AWS account. You can choose to share a layer with other accounts or to make the layer public. If your functions consume a layer that a different account published, your functions can continue to use the layer version after it has been deleted, or after your permission to access the layer is revoked. However, you cannot create a new function or update functions using a deleted layer version.
Functions deployed as a container image do not use layers. Instead, you package your preferred runtime, libraries, and other dependencies into the container image when you build the image.
The load path that Python will use in lambda is the following:
Check how the second and third positions are occupy by directories where lambda layers uncompress their files: /opt/python/lib/python3.9/site-packages and /opt/python
If an attacker managed to backdoor a used lambda layer or add one that will be executing arbitrary code when a common library is loaded, he will be able to execute malicious code with each lambda invocation.
Therefore, the requisites are:
Check libraries that are loaded by the victims code
Create a proxy library with lambda layers that will execute custom code and load the original library.
When abusing this technique I found a difficulty: Some libraries are already loaded in python runtime when your code gets executed. I was expecting to find things like os or sys, but even json library was loaded.
In order to abuse this persistence technique, the code needs to load a new library that isn't loaded when the code gets executed.
With a python code like this one it's possible to obtain the list of libraries that are pre loaded inside python runtime in lambda:
And this is the list (check that libraries like os or json are already there)
And this is the list of libraries that lambda includes installed by default: https://gist.github.com/gene1wood/4a052f39490fae00e0c3
In this example lets suppose that the targeted code is importing csv. We are going to be backdooring the import of the csv library.
For doing that, we are going to create the directory csv with the file __init__.py on it in a path that is loaded by lambda: /opt/python/lib/python3.9/site-packages
Then, when the lambda is executed and try to load csv, our __init__.py file will be loaded and executed.
This file must:
Execute our payload
Load the original csv library
We can do both with:
Then, create a zip with this code in the path python/lib/python3.9/site-packages/__init__.py and add it as a lambda layer.
You can find this code in https://github.com/carlospolop/LambdaLayerBackdoor
The integrated payload will send the IAM creds to a server THE FIRST TIME it's invoked or AFTER a reset of the lambda container (change of code or cold lambda), but other techniques such as the following could also be integrated:
AWS - Steal Lambda RequestsNote that it's possible to use lambda layers from external accounts. Moreover, a lambda can use a layer from an external account even if it doesn't have permissions. Also note that the max number of layers a lambda can have is 5.
Therefore, in order to improve the versatility of this technique an attacker could:
Backdoor an existing layer of the user (nothing is external)
Create a layer in his account, give the victim account access to use the layer, configure the layer in victims Lambda and remove the permission.
The Lambda will still be able to use the layer and the victim won't have any easy way to download the layers code (apart from getting a rev shell inside the lambda)
The victim won't see external layers used with aws lambda list-layers
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
