# Eliminating Dangling Elastic IP Takeovers with Ghostbuster

Dangling DNS records pointing to released AWS elastic IPs let attackers reclaim the IP and take over subdomains, claiming certs and stealing cookies.

- Payout: Research
- Severity: high
- Program: AWS
- Write-up by: Assetnote
- Disclosed: 2024-01-02
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/eliminating-dangling-elastic-ip-takeovers-with-ghostbuster
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-eliminating-dangling-elastic-ip-takeovers-with-ghostbuster
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:research platform:research sev:high tech:aws technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** AWS EC2 elastic IPs and Route53/Cloudflare DNS records
**Root cause:** DNS records pointing to EC2 elastic IPs are not removed after the instance is destroyed or reassigned a new IP, leaving the record pointing at an IP the attacker can reclaim from the AWS pool.
**Steps:**
1. Enumerate target subdomains and resolve their A records to IPs.
2. Repeatedly allocate and release elastic IPs from the AWS pool (`lottery` approach) until obtaining an IP matching a target subdomain's A record.
3. Attach the reclaimed IP to attacker-controlled EC2 infrastructure.
4. Serve content on the subdomain, complete ACME TLS challenges to claim SSL certs, and listen on all ports for traffic still sent to the subdomain.
**How found:** After failing to detect EIP allocation via timing analysis on EC2 APIs over three months, pivoted to the allocation/deallocation lottery approach, then to enumerating owned AWS accounts' EIPs and cross-checking DNS records (Ghostbuster).
**Exploitation:** Attacker cycles elastic IP allocations until landing on an IP still referenced by a victim's dangling DNS record, then binds it to their own instance to control the subdomain, obtain TLS certs via ACME, capture residual traffic, and steal HTTPOnly cookies scoped to *.domain.com for one-click account takeover.
**Escalation:** Cookie scoping to *.domain.com turns subdomain control into account takeover; cert issuance and full-port listening widen data capture.
**Insight:** Timing side-channels on cloud control-plane APIs to infer resource allocation are worth probing but often fail; instead, enumerate your own account's allocated IPs and diff against DNS A records to find dangling references deterministically.

## Proof of concept (copied exactly from the original report)

**Ghostbuster scan command with Cloudflare token**

```
❯ ghostbuster scan aws --cloudflaretoken whougonnacall

Obtaining all zone names from Cloudflare.
Obtaining DNS A records for all zones from Cloudflare.
Obtained 33 DNS A records so far.
Obtaining Route53 hosted zones for AWS profile: default.
Obtaining Route53 hosted zones for AWS profile: account-five.
Obtaining Route53 hosted zones for AWS profile: account-four.
Obtaining Route53 hosted zones for AWS profile: account-four-deploy.
Obtaining Route53 hosted zones for AWS profile: account-two-deploy.
Obtaining Route53 hosted zones for AWS profile: account-one-deploy.
Obtaining Route53 hosted zones for AWS profile: account-three-deploy.
Obtaining Route53 hosted zones for AWS profile: account-six.
Obtaining Route53 hosted zones for AWS profile: account-seven.
Obtaining Route53 hosted zones for AWS profile: account-one.
Obtained 124 DNS A records so far.
Obtaining EIPs for region: us-east-1, profile: default
Obtaining IPs for network interfaces for region: us-east-1, profile: default
Obtaining EIPs for region: us-east-1, profile: account-five
Obtaining IPs for network interfaces for region: us-east-1, profile: account-five
Obtaining EIPs for region: us-east-1, profile: account-four
Obtaining IPs for network interfaces for region: us-east-1, profile: account-four
Obtaining EIPs for region: us-east-1, profile: account-four-deploy
Obtaining IPs for network interfaces for region: us-east-1, profile: account-four-deploy
Obtaining EIPs for region: us-east-1, profile: account-two-deploy
Obtaining IPs for network interfaces for region: us-east-1, profile: account-two-deploy
Obtaining EIPs for region: us-east-1, profile: account-one-deploy
Obtaining IPs for network interfaces for region: us-east-1, profile: account-one-deploy
Obtaining EIPs for region: us-east-1, profile: account-three-deploy
Obtaining IPs for network interfaces for region: us-east-1, profile: account-three-deploy
Obtaining EIPs for region: us-east-1, profile: account-six
Obtaining IPs for network interfaces for region: us-east-1, profile: account-six
Obtaining EIPs for region: us-east-1, profile: account-seven
Obtaining IPs for network interfaces for region: us-east-1, profile: account-seven
Obtaining EIPs for region: us-east-1, profile: account-one
Obtaining IPs for network interfaces for region: us-east-1, profile: account-one
Obtained 415 unique elastic IPs from AWS.

Takeover possible: {'name': 'takeover.assetnotecloud.com', 'records': ['52.54.24.193']}
```