Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
More info about EFS in:
AWS - EFS EnumRemember that in order to mount an EFS you need to be in a subnetwork where the EFS is exposed and have access to it (security groups). Is this is happening, by default, you will always be able to mount it, however, if it's protected by IAM policies you need to have the extra permissions mentioned here to access it.
elasticfilesystem:DeleteFileSystemPolicy|elasticfilesystem:PutFileSystemPolicyWith any of those permissions an attacker can change the file system policy to give you access to it, or to just delete it so the default access is granted.
To delete the policy:
To change it:
elasticfilesystem:ClientMount|(elasticfilesystem:ClientRootAccess)|(elasticfilesystem:ClientWrite)With this permission an attacker will be able to mount the EFS. If the write permission is not given by default to everyone that can mount the EFS, he will have only read access.
The extra permissionselasticfilesystem:ClientRootAccess and elasticfilesystem:ClientWrite can be used to write inside the filesystem after it's mounted and to access that file system as root.
Potential Impact: Indirect privesc by locating sensitive information in the file system.
elasticfilesystem:CreateMountTargetIf you an attacker is inside a subnetwork where no mount target of the EFS exists. He could just create one in his subnet with this privilege:
Potential Impact: Indirect privesc by locating sensitive information in the file system.
elasticfilesystem:ModifyMountTargetSecurityGroupsIn a scenario where an attacker finds that the EFS has mount target in his subnetwork but no security group is allowing the traffic, he could just change that modifying the selected security groups:
Potential Impact: Indirect privesc by locating sensitive information in the file system.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
