Loot Public EBS Snapshots

This beginner-friendly lab demonstrates the risk of publicly shared Amazon EBS snapshots and how an attacker can exploit them. Starting as a low-privileged intern user, you enumerate an unencrypted public snapshot, create a volume from it in your own account, mount it, and recover hardcoded credentials that unlock a sensitive S3 bucket.

Huge Logistics runs an assume-breach exercise and hands you the basic AWS credentials of a fresh intern. Your goal is to gain situational awareness, find weak spots, and see how far you can elevate access from that humble entry point.

• Basic Linux command line knowledge
• An AWS account for restoring the snapshot
• AWS CLI configured with the provided keys

• Establish situational awareness with sts get-caller-identity and IAM user policy enumeration
• Enumerate EBS snapshots and inspect the createVolumePermission attribute
• Identify publicly shared (Group=all) and unencrypted snapshots
• Create an EBS volume from a public snapshot and attach it to your own EC2 instance
• Mount the volume and search the filesystem for secrets and hardcoded AWS credentials
• Pivot with recovered credentials to loot a sensitive S3 bucket
• Apply mitigations and detection guidance for public snapshot exposure

Public EBS snapshots have exposed data across thousands of AWS accounts, with published research finding tens of thousands of public snapshots leaking source code, SSH keys, PII, and credentials. A single mistakenly public, unencrypted snapshot can hand an attacker the keys to sensitive systems.