dsnap
A tool for enumerating and downloading EBS snapshots
Install
Enumerating Snapshots
You need the AWS action ebs:ListSnapshotBlocks
Downloading Snapshots
You need the AWS action ebs:GetSnapshotBlock
With Access to the AWS Account
So long as the snapshot exists in an AWS account you have access to, you can download it
Without Access to the AWS Account
If you don't have credentials for an AWS account where the public snapshot is, you can't download it
To resolve this, first copy the snapshot from the target account to your account
Then you can download it locally with dsnap
Alternatively, you can create an ec2 in your account and use this snapshot which may be beneficial depending on the snapshot size / your download speeds
Mounting the Snapshot for Local Inspection
If you decide to download the snapshot locally (rather than run it on an EC2) then we need to mount it
Mounting the snapshot is like attaching a USB drive to your computer. You have access to all the files on the drive but it's not running the operating system.
We take the start point of the
ext4
partition (227328
) and multiply it by the sector size (512
bytes), which gives us an offset value of116391936
. This offset tells the operating system where to begin reading the partition within the disk image. Without specifying the correct offset, the operating system might attempt to read from the wrong location—such as the partition table or unallocated space—causing errors or preventing access to the file system.
Now we can access the snapshot
You'll notice the files and directories are all owned by
root
since we had to use sudo to mount thisWe have a few options, the easiest being to switch to the
root
user
Or you can change ownership of the mount directory to our current user (parallels for me)
Change it back to root if you want
Running the Snapshot in a Local Docker Container
Dsnap can spin up a local docker container to run the snapshot from but I haven't had luck getting this to work on an Apple Silicon mac (though I haven't tried for over a year)
Resources
Last updated
Was this helpful?