aws-s3-persistence.md

AWS - S3 Persistence

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

S3

For more information check:

{% content-ref url="../aws-services/aws-s3-athena-and-glacier-enum.md" %} aws-s3-athena-and-glacier-enum.md {% endcontent-ref %}

KMS Client-Side Encryption

When the encryption process is done the user will use the KMS API to generate a new key (aws kms generate-data-key) and he will store the generated encrypted key inside the metadata of the file (python code example) so when the decrypting occur it can decrypt it using KMS again:

Therefore, and attacker could get this key from the metadata and decrypt with KMS (aws kms decrypt) to obtain the key used to encrypt the information. This way the attacker will have the encryption key and if that key is reused to encrypt other files he will be able to use it.

Using S3 ACLs

Although usually ACLs of buckets are disabled, an attacker with enough privileges could abuse them (if enabled or if the attacker can enable them) to keep access to the S3 bucket.

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}