Package: dsnap
dsnapUtility for downloading EBS snapshots using the EBS Direct API's.Blog Post:Downloading and Exploring AWS EBS Snapshots.This is used as a library by thePacumoduleebs__download_snapshots.Check out thePacu integrationsection to get an idea of the tradeoff's between the using this vs the Pacu module.RecordingInstallPyPi%pipinstall-Upip
%pipinstall'dsnap[cli]'Command Reference%dsnap--help
Usage:dsnap[OPTIONS]COMMAND[ARGS]...AutilityformanagingsnapshotsviatheEBSDirectAPI.

Options:--regionREGIONSetstheAWSregion.[default:us-east-1]--profilePROFILESharedcredentialprofiletouse.--install-completion[bash|zsh|fish|powershell|pwsh]Installcompletionforthespecifiedshell.--show-completion[bash|zsh|fish|powershell|pwsh]Showcompletionforthespecifiedshell,tocopyitorcustomizetheinstallation.--helpShowthismessageandexit.

Commands:createCreateasnapshotforthegiveninstancesdefaultdevicevolume.deleteDeleteagivensnapshot.getDownloadasnapshotforagiveninstanceorsnapshotID.initWriteoutaVagrantfiletemplatetoexploredownloadedsnapshots.listListsnapshotsinAWS.IAM PermissionsNot all these permissions are strictly necessary, for example if you provide an existing snapshot ID with thegetcommand you'll only needebs:ListSnapshotBlocksandebs:GetSnapshotBlock. The rest of the permissions are either
used to find volumes and snapshots based on instance ID's, create temporary snapshots if none exist or for use with thecreateanddeletecommands.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ebs:ListSnapshotBlocks","ebs:GetSnapshotBlock","ec2:DescribeSnapshots","ec2:DescribeInstances","ec2:DescribeVolumes","ec2:DeleteSnapshot","ec2:CreateSnapshot","ec2:CreateTags"],"Resource":"*"}]}ExamplesListing Snapshots%dsnaplistId|OwnerID|State
snap-0dbb0347f47e38b96922105094392completedDownloading a Snapshot%dsnapgetsnap-0dbb0347f47e38b96
OutputPath:/cwd/snap-0dbb0347f47e38b96.imgIf you don't specify a snapshot  you'll get a prompt to ask which one you want to download:%dsnapget0)i-01f0841393cd39f06(ip-172-31-27-0.ec2.internal,vpc-04a91864355539a41,subnet-0e56cd55282fa9158)SelectInstance:00)vol-0a1aab48b0bc3039d(/dev/sdb)1)vol-0c616d718ab00e70c(/dev/xvda)SelectVolume:0Nosnapshotsfound,createone?[y/N]:y
CreatingsnapshotforInstance(s):i-01f0841393cd39f06/dev/sdb,Volume:vol-0a1aab48b0bc3039d
Waitingforsnapshottocomplete.
OutputPath:/cwd/snap-0dbb0347f47e38b96.img
Cleaningupsnapshot:snap-0543a8681adce0086Mounting in VagrantNote: Vagrant does not offer any guarantee's of seperation between the guest and the host. It shouldn't considered a security boundry like most VM's.This requires virtualbox to be installed. dsnap init will write a Vagrantfile to the current directory that can be used to mount a specific downloaded snapshot. Conversion to a VDI disk is handled in the Vagrantfile, it will look for the disk file specified in the IMAGE environment variable, convert it to a VDI usingVBoxManage convertdd. The resulting VDI is destroyed when the Vagrant box is, however the original raw .img file will remain and can be reused as needed.%dsnapinit
%IMAGE=snap-0543a8681adce0086.imgvagrantup
%vagrantsshMounting With DockerThis uses libguestfs to work directly with the downloaded img file.Build Docker Container%gitclonehttps://github.com/RhinoSecurityLabs/dsnap.git
%cddsnap
%makedocker/buildRun Guestfish Shell%IMAGE=snap-0dbb0347f47e38b96.imgmakedocker/runThis will take a second to start up. After it drops you into the shell you should be able to run commands like ls, cd, cat. However worth noting they don't always behave exactly like they do in a normal shell.The output will give you the basics of how to use the guestfish shell. For a full list of command you can runhelp --list.Below is an example of starting the shell and printing the contents of /etc/os-release.%IMAGE=snap-0dbb0347f47e38b96.imgmakedocker/run
dockerrun-it-v"/cwd/dsnap/snap-0dbb0347f47e38b96.img:/disks/snap-0dbb0347f47e38b96.img"-w/disksmount--ro-a"snap-0dbb0347f47e38b96.img"-m/dev/sda1:/

Welcometoguestfish,theguestfilesystemshellforeditingvirtualmachinefilesystemsanddiskimages.

Type:‘help’forhelponcommands‘man’toreadthemanual‘quit’toquittheshell

><fs>cat/etc/os-releaseNAME="Amazon Linux"VERSION="2"ID="amzn"ID_LIKE="centos rhel fedora"VERSION_ID="2"PRETTY_NAME="Amazon Linux 2"ANSI_COLOR="0;33"CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2"HOME_URL="https://amazonlinux.com/"As a Librarydsnap is also meant to be used as a library, however for this purpose it is worth keeping in mind this is an early version and it is still being developed. The interfaces will likely change as new functionality is added.We'll do our best to make sure we follow SemVer versioning to avoid any breaking changes in minor and patch versions.Related toolsPacu IntegrationThis project is used byPacuin theebs__download_snapshotsmodule.
The primary benefit of using the Pacu module is to reduce unnecessary API call's, as a tradeoff it doesn't have some
niceties that are included with dsnap.For example the Pacu module reuses snapshots gathered fromebs__enum_volumes_snapshots, this prevents looking up snapshots more often then needed. At the moment it does not support some dsnap features like creating temporary snapshots or searching for snapshots by instance ID, this however may change in the future.Other Interesting ToolsPlease keep in mind that we can't vouch for the following tools. However, we felt they were worth mentioning here.ebs-direct-sec-toolsIn particular thescansecretsanddiffsecretscommands are interesting because instead of mounting the snapshots they scan the raw image for secrets directly.DevelopmentFor CLI development make sure you include thecliextra shown below. You'll also want to invoke the package by using python's-m(shown below) for testing local changes, the dnsap binary installed to the environment will only update when you run pip install.Setup%gitclonehttps://github.com/RhinoSecurityLabs/dsnap.git
%cddsnap
%python3-mvenvvenv
%.venv/bin/activate
%python-mpipinstall'.[cli]'Running With Local Changes%python-mdsnap--helpLinting and Type Checking%makelintTesting%maketest