WEAPONIZING THE AWS CLI FOR PERSISTENCE

Summary from the TLDR InfoSec newsletter

The AWS CLI allows users to define command aliases that can run arbitrary bash commands. A limitation that previous work faced when trying to abuse aliases was that if an attacker overwrote a command (such as `aws sts`) with a malicious alias, they could not call the original command. This post introduces a one-liner that dynamically modifies the alias file to restore the original command so it can be used in the malicious alias and then restores the malicious alias after running.