AWS - EBS Snapshot Dump
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Note that dsnap will not allow you to download public snapshots. To circumvent this, you can make a copy of the snapshot in your personal account, and download that:
For more info on this technique check the original research in https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/
You can do this with Pacu using the module ebs__download_snapshots
Mount it in a EC2 VM under your control (it has to be in the same region as the copy of the backup):
Step 1: A new volume of your preferred size and type is to be created by heading over to EC2 –> Volumes.
To be able to perform this action, follow these commands:
Create an EBS volume to attach to the EC2 instance.
Ensure that the EBS volume and the instance are in the same zone.
Step 2: The "attach volume" option is to be selected by right-clicking on the created volume.
Step 3: The instance from the instance text box is to be selected.
To be able to perform this action, use the following command:
Attach the EBS volume.
Step 4: Login to the EC2 instance and list the available disks using the command lsblk.
Step 5: Check if the volume has any data using the command sudo file -s /dev/xvdf.
If the output of the above command shows "/dev/xvdf: data", it means the volume is empty.
Step 6: Format the volume to the ext4 filesystem using the command sudo mkfs -t ext4 /dev/xvdf. Alternatively, you can also use the xfs format by using the command sudo mkfs -t xfs /dev/xvdf. Please note that you should use either ext4 or xfs.
Step 7: Create a directory of your choice to mount the new ext4 volume. For example, you can use the name "newvolume".
To be able to perform this action, use the command sudo mkdir /newvolume.
Step 8: Mount the volume to the "newvolume" directory using the command sudo mount /dev/xvdf /newvolume/.
Step 9: Change directory to the "newvolume" directory and check the disk space to validate the volume mount.
To be able to perform this action, use the following commands:
Change directory to /newvolume.
Check the disk space using the command df -h .. The output of this command should show the free space in the "newvolume" directory.
You can do this with Pacu using the module ebs__explore_snapshots.
Any AWS user possessing the EC2:CreateSnapshot permission can steal the hashes of all domain users by creating a snapshot of the Domain Controller mounting it to an instance they control and exporting the NTDS.dit and SYSTEM registry hive file for use with Impacket's secretsdump project.
You can use this tool to automate the attack: https://github.com/Static-Flow/CloudCopy or you could use one of the previous techniques after creating a snapshot.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
