AWS - S3 Persistence
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For more information check:
AWS - S3, Athena & Glacier EnumWhen the encryption process is done the user will use the KMS API to generate a new key (aws kms generate-data-key) and he will store the generated encrypted key inside the metadata of the file (python code example) so when the decrypting occur it can decrypt it using KMS again:
Therefore, and attacker could get this key from the metadata and decrypt with KMS (aws kms decrypt) to obtain the key used to encrypt the information. This way the attacker will have the encryption key and if that key is reused to encrypt other files he will be able to use it.
Although usually ACLs of buckets are disabled, an attacker with enough privileges could abuse them (if enabled or if the attacker can enable them) to keep access to the S3 bucket.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
