Skip to content

Commit 9651594

Browse files
FrichettenFrichetten
authored
Merge pull request #464 from biggie-linz/main
Create enumerate_services_via_aws_backup.md
2 parents 8f9ae84 + 04657f2 commit 9651594

1 file changed

Lines changed: 211 additions & 0 deletions

File tree

‎content/aws/enumeration/enumerate_services_via_aws_backup.md‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
---
2+
author_name: biggie_linz (@biggie_linz)
3+
title: Enumerate services via AWS Backup
4+
description: Enumerate AWS services via AWS Backup
5+
---
6+
<div class="grid cards" markdown>
7+
- :material-account:{ .lg .middle } __Original Research__
8+
9+
---
10+
11+
[Enumeration via the AWS Backup service](https://acacialabs.net/enumeration-via-the-aws-backup-service/) by [biggie_linz](https://x.com/biggie_linz).
12+
</div>
13+
14+
# Enumeration of services via AWS Backup
15+
## Overview
16+
17+
An attacker with permissions of at least `backup:List*` or `backup:Describe*` permissions can enumerate the AWS Backup service to potentially find critical resources in an AWS account without needing to use traditional, well-monitored and heavily scrutinised reconnaissance commands for individual services.
18+
19+
The AWS Backup service supports the following resource types:
20+
21+
- Aurora
22+
- AWS CloudFormation
23+
- Amazon DocumentDB
24+
- DynamoDB
25+
- DynamoDB with AWS Backup advanced features
26+
- Amazon EBS
27+
- Amazon EC2
28+
- Amazon EFS
29+
- Amazon Redshift
30+
- Redshift Serverless
31+
- Amazon RDS
32+
33+
We can use the AWS CLI to enumerate the AWS Backup service to learn more about these services within a target account, should the target be utilising the AWS Backup service to perform backups of these services.
34+
35+
## Why do we care?
36+
37+
The AWS Backup service can reveal interesting information to attackers such as:
38+
39+
- **The resources that the target account really cares about (and those they don't really care about but backup anyway)** - the Backup service is not enabled by default, and as such, an administrator must specifically enable it and configure it. This means that the resources that are backed up are likely of importance and warrant further review.
40+
- **Reveals strategies for tagging and resource naming** - e.g. is the target using tags like `Enviromnent=production` vs `Environment=Prod` or using something totally different like `Tier=Critical`
41+
- **Mapping of resources** - when we query the Backup service we can see the breadth of services that the organisation is using.
42+
- ***Timing information** - we can see when backups do run, and how long they are retained for.
43+
- **We don't need to rely on calling heavily monitored enumeration commands for individual services.***
44+
45+
## Attack
46+
47+
### Enumerating backed up resources
48+
49+
**Viewing all resources that have been backed up**
50+
51+
`aws backup list-protected-resources`
52+
53+
**This one is probably the most interesting in this article** - this command returns an array of resources that have been successfully backed up by Backup, including the time the resource was saved, an Amazon Resource Name (ARN) of the resource, and a resource type.
54+
55+
```
56+
{
57+
"Results": [
58+
{
59+
"ResourceArn": "arn:aws:rds:ap-southeast-2:[REDACTED]:db:database-1",
60+
"ResourceType": "RDS",
61+
"LastBackupTime": "2025-05-04T21:43:01.687000-07:00",
62+
"ResourceName": "database-1",
63+
"LastBackupVaultArn": "arn:aws:backup:ap-southeast-2:[REDACTED]:backup-vault:Default",
64+
"LastRecoveryPointArn": "arn:aws:rds:ap-southeast-2:[REDACTED]:snapshot:awsbackup:[REDACTED]"
65+
}
66+
]
67+
}
68+
```
69+
70+
Note that this will only show resources that __have been backed up in the past, and not resources that are yet to be backed up__.
71+
72+
### Enumerating resources within Backup Plans
73+
74+
**Enumerating Backup Plans**
75+
76+
`aws backup list-backup-plans`
77+
78+
As the operation implies, this will list the Backup Plans for the account.
79+
80+
In the following snippet we can see some interesting details such as:
81+
82+
- `BackupPlanId` - more on this later,
83+
- `BackupPlanName` - this may let on naming strategies used by the target.
84+
85+
```
86+
{
87+
"BackupPlansList": [
88+
{
89+
"BackupPlanArn": "arn:aws:backup:ap-southeast-2:[REDACTED]:backup-plan:31[REDACTED]da",
90+
"BackupPlanId": "31[REDACTED]da",
91+
"CreationDate": "2025-05-04T21:16:24.813000-07:00",
92+
"VersionId": "OT[REDACTED]E4",
93+
"BackupPlanName": "prod-backups",
94+
"CreatorRequestId": "7e[REDACTED]99"
95+
}
96+
]
97+
}
98+
```
99+
100+
**Enumerating the Backup Plan's details**
101+
102+
`aws backup get-backup-plan --backup-plan-id <BACKUP-PLAN-ID>`
103+
104+
where:
105+
106+
- `BACKUP-PLAN-ID` is the `BackupPlanId` from the previous command.
107+
108+
This command provides some more information on the specified Backup Plan.
109+
110+
Specifically, it provides insights in to:
111+
112+
- Timings - `ScheduleExpression`
113+
- Retention policies - `Lifecycle`
114+
- Naming schemes - `RuleName`, `TargetBackupVaultName`, `RecoveryPointTags`
115+
116+
```
117+
aws backup get-backup-plan --backup-plan-id 31[REDACTED]da
118+
{
119+
"BackupPlan": {
120+
"BackupPlanName": "prod-backups",
121+
"Rules": [
122+
{
123+
"RuleName": "DailyBackups",
124+
"TargetBackupVaultName": "Default",
125+
"ScheduleExpression": "cron(0 5 ? * * *)",
126+
"StartWindowMinutes": 480,
127+
"CompletionWindowMinutes": 10080,
128+
"Lifecycle": {
129+
"DeleteAfterDays": 3
130+
},
131+
"RecoveryPointTags": {},
132+
"RuleId": "4c[REDACTED]43",
133+
"CopyActions": [],
134+
"ScheduleExpressionTimezone": "America/Los_Angeles"
135+
}
136+
]
137+
},
138+
"BackupPlanId": "31[REDACTED]da",
139+
"BackupPlanArn": "arn:aws:backup:ap-southeast-2:[REDACTED]:backup-plan:31[REDACTED]da",
140+
"VersionId": "OT[REDACTED]E4",
141+
"CreatorRequestId": "7e[REDACTED]99",
142+
"CreationDate": "2025-05-04T21:16:24.813000-07:00"
143+
}
144+
```
145+
146+
**Enumerating resources targeted for backups in a given Backup Plan**
147+
148+
First, we must find the `SelectionId` of our Backup Plan:
149+
150+
`aws backup list-backup-selections --backup-plan-id 31[REDACTED]da`
151+
152+
```
153+
{
154+
"BackupSelectionsList": [
155+
{
156+
"SelectionId": "e9[REDACTED]fc",
157+
"SelectionName": "rds-prod",
158+
"BackupPlanId": "31[REDACTED]da",
159+
"CreationDate": "2025-05-04T21:17:47.318000-07:00",
160+
"CreatorRequestId": "c0[REDACTED]53",
161+
"IamRoleArn": "arn:aws:iam::[REDACTED]:role/service-role/AWSBackupDefaultServiceRole"
162+
}
163+
]
164+
}
165+
```
166+
167+
We can then use the `SelectionId` to find the resources that will be targeted as a part of this Backup Plan (note: this can be tag-based and/or ARNs). Note that even if the backup job has not yet run the resources will still be shown:
168+
169+
```
170+
{
171+
"BackupSelection": {
172+
"SelectionName": "rds-prod",
173+
"IamRoleArn": "arn:aws:iam::[REDACTED]:role/service-role/AWSBackupDefaultServiceRole",
174+
"Resources": [
175+
"arn:aws:rds:ap-southeast-2:[REDACTED]:db:database-1"
176+
],
177+
"ListOfTags": [],
178+
"NotResources": [],
179+
"Conditions": {
180+
"StringEquals": [],
181+
"StringNotEquals": [],
182+
"StringLike": [],
183+
"StringNotLike": []
184+
}
185+
},
186+
"SelectionId": "e9[REDACTED]fc",
187+
"BackupPlanId": "31[REDACTED]da",
188+
"CreationDate": "2025-05-04T21:17:47.318000-07:00",
189+
"CreatorRequestId": "c0[REDACTED]53"
190+
```
191+
192+
In the above snippet we can see the potential existence of a likely production RDS instance, `database-1`, that we previously were not aware of.
193+
194+
## Detection strategy
195+
196+
**Calls to `ListProtectedResources`**
197+
198+
Organisations can flag calls to the `ListProtectedResources` event where it is:
199+
200+
- Invoked by IAM role/user not used for backup,
201+
- Invoked outside backup windows, or
202+
- From a new IP/geolocation.
203+
204+
**Enumeration burst patterns**
205+
206+
Look for bursts of calls to APIs to do with the Backup service, such as:
207+
208+
- `ListBackupVaults`
209+
- `ListBackupPlans`
210+
- `ListBackupSelections`
211+
- `ListProtectedResources`

0 commit comments

Comments
 (0)