AWS - ECS Post Exploitation
ECS
For more information check:
Host IAM Roles
In ECS an IAM role can be assigned to the task running inside the container. If the task is run inside an EC2 instance, the EC2 instance will have another IAM role attached to it. Which means that if you manage to compromise an ECS instance you can potentially obtain the IAM role associated to the ECR and to the EC2 instance. For more info about how to get those credentials check:
Note that if the EC2 instance is enforcing IMDSv2, according to the docs, the response of the PUT request will have a hop limit of 1, making impossible to access the EC2 metadata from a container inside the EC2 instance.
Privesc to node to steal other containers creds & secrets
But moreover, EC2 uses docker to run ECs tasks, so if you can escape to the node or access the docker socket, you can check which other containers are being run, and even get inside of them and steal their IAM roles attached.
Making containers run in current host
Furthermore, the EC2 instance role will usually have enough permissions to update the container instance state of the EC2 instances being used as nodes inside the cluster. An attacker could modify the state of an instance to DRAINING, then ECS will remove all the tasks from it and the ones being run as REPLICA will be run in a different instance, potentially inside the attackers instance so he can steal their IAM roles and potential sensitive info from inside the container.
The same technique can be done by deregistering the EC2 instance from the cluster. This is potentially less stealthy but it will force the tasks to be run in other instances:
A final technique to force the re-execution of tasks is by indicating ECS that the task or container was stopped. There are 3 potential APIs to do this:
Steal sensitive info from ECR containers
The EC2 instance will probably also have the permission ecr:GetAuthorizationToken allowing it to download images (you could search for sensitive info in them).
Last updated
