I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked before. The thing is, I'm not sure that first the Amazon RDS Instance is accessible from the internet (specifically any IP), and I'm not sure how I could get the ip of the RDS instance (--hostname returns internal 172.x.x.x address). I'm wondering if there is anything I can do to further escalate the vulnerability.
Two options come immediately to mind -
You can learn more by Googling 'sql injection exfiltration', but generally, this involves using SQL primitives that make DNS lookups or HTTP connections. You can build a query that selects data from a table and injects it into a host lookup to a domain that you control; then your DNS server will see the data.
This option takes advantage of the fact that while you may not have a good route to the database, it probably has some sort of route outbound. DNS, especially, is indirect and can be used even if the DB server itself has zero Internet access.
Front End Leverage
If the database (and credentials accessible within) are backend for a front end web UI that is accessible over the network, then you can use the information to get into the app, which may be just as useful as getting into the database.
You can go ahead and report this directly to Amazon, see https://aws.amazon.com/security/vulnerability-reporting/ and it would be good to know what the follow up is from them.