Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated Lambda exploitation article #414

Merged
merged 1 commit into from
Aug 20, 2024
Merged

Updated Lambda exploitation article #414

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion content/aws/exploitation/lambda-steal-iam-credentials.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ IAM credentials can be accessed via reading `/proc/self/environ`.
!!! Note
In the event that /proc/self/environ is blocked by a WAF, check if you can read the environment variables of other processes. This can be done by reading /proc/#/environ where '#' is some number often between 1 and 20.

In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the [runtime interface](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html). Unlike IAM credentials, this data is accessible over standard SSRF at `http://localhost:9001/2018-06-01/runtime/invocation/next`.
In addition to IAM credentials, Lambda functions also have event data that is passed to the function when it is started. This data is made available to the function via the [runtime interface](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-api.html). Unlike IAM credentials, this data is accessible over standard SSRF at `http://169.254.100.1:9001/2018-06-01/runtime/invocation/next`. Additionally the environment variable `AWS_LAMBDA_RUNTIME_API` stores the IP address and port of the runtime interface as well.

This will include information about what invoked the Lambda function and may be valuable depending on the context.

Expand Down