cloud-iam-deep

Name: cloud-iam-deep
Author: elementalsouls

3.0kstars461forks

How to install cloud-iam-deep?

elementalsouls/claude-bughunter/cloud-iam-deep

$npx -y skills add elementalsouls/Claude-BugHunter --skill cloud-iam-deep

Installs into the current project.

Summary

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP serv

Files · 1

View on GitHub

SKILL.md

1	## When to use
2
3	Trigger when:
4	- A cloud credential surfaces (key, secret, token, JSON file)
5	- SSRF chain reaches IMDS / metadata endpoint
6	- APK / git-leak reveals embedded cloud key
7	- Recon shows public S3/GCS/Azure-blob with permissions you can verify
8	- A Kubernetes API or service-account token is exposed
9	- Post-RCE on a cloud-hosted instance — pivot to cloud control plane
10
11	Do NOT use for:
12	- On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)
13	- Web2 vulns that happen to be on AWS — use the relevant `hunt-*` skill
14
15	---
16
17	## Credential identification (first 60 seconds)
18
19	```bash
20	# AWS access key patterns
21	AKIA[0-9A-Z]{16} # IAM user access key (long-term)
22	ASIA[0-9A-Z]{16} # STS temporary credential
23	AGPA[0-9A-Z]{16} # IAM group
24	AIDA[0-9A-Z]{16} # IAM user (user-id)
25	AROA[0-9A-Z]{16} # IAM role
26	ANPA[0-9A-Z]{16} # Managed policy
27
28	# AWS secret pattern (40-char base64-ish — context required)
29	[A-Za-z0-9/+=]{40} # AWS secret access key
30
31	# Azure
32	AccountKey=[A-Za-z0-9+/=]{86} # Storage account key
33	client_secret pattern + UUID # Azure AD app credential
34
35	# GCP service account JSON
36	{
37	"type": "service_account",
38	"project_id": "...",
39	"private_key_id": "...",
40	"private_key": "-----BEGIN PRIVATE KEY-----..."
41	}
42
43	# K8s SA token (JWT format — decode to confirm)
44	eyJhbGciOiJSUzI1... # decode kid claim to see issuer
45	```
46
47	---
48
49	## AWS — read-only validation (the safe first step)
50
51	```bash
52	# Set credential
53	export AWS_ACCESS_KEY_ID="AKIA..."
54	export AWS_SECRET_ACCESS_KEY="..."
55
56	# 1. WHO am I?
57	aws sts get-caller-identity
58	# Returns: UserId, Account, Arn
59	# Arn tells you: IAM user vs role, account ID, name
60
61	# 2. WHAT can I do? (the privesc question)
62	# Try common read-only first — failures still inform you
63	aws iam list-users 2>&1 \| head -5
64	aws iam list-roles 2>&1 \| head -5
65	aws iam list-policies 2>&1 \| head -5
66	aws iam list-groups 2>&1 \| head -5
67
68	# 3. WHAT policies are attached to me?
69	aws iam list-attached-user-policies --user-name <self>
70	aws iam list-user-policies --user-name <self> # inline policies
71	aws iam list-groups-for-user --user-name <self>
72
73	# 4. Service-by-service surface
74	aws ec2 describe-instances --max-items 1 2>&1 \| head
75	aws s3 ls 2>&1 \| head -10
76	aws lambda list-functions --max-items 5 2>&1 \| head
77	aws rds describe-db-instances --max-items 5 2>&1 \| head
78	aws secretsmanager list-secrets --max-results 5 2>&1 \| head
79	aws ssm describe-parameters --max-results 5 2>&1 \| head
80
81	# 5. Audit any cross-account / external trust
82	aws iam list-roles --query 'Roles[?contains(AssumeRolePolicyDocument.Statement[0].Principal.AWS, `arn:aws:iam::`)]' 2>&1 \| head -20
83	```
84
85	---
86
87	## AWS privesc patterns (24+ documented — `iam_privesc` techniques)
88
89	Quick lookup — if you have any of these IAM actions, escalate via the listed technique:
90
91	\| You have \| Escalate via \|
92	\|---\|---\|
93	\| `iam:CreateAccessKey` \| Create access key on any user → impersonate \|
94	\| `iam:CreateLoginProfile` \| Set a console password on a user → login \|
95	\| `iam:UpdateLoginProfile` \| Reset console password on a user \|
96	\| `iam:AttachUserPolicy` \| Attach AdministratorAccess to self \|
97	\| `iam:AttachGroupPolicy` \| Attach AdministratorAccess to a group you're in \|
98	\| `iam:AttachRolePolicy` + sts:AssumeRole \| Attach to a role you can assume \|
99	\| `iam:PutUserPolicy` \| Inline AdministratorAccess to self \|
100	\| `iam:PutGroupPolicy` \| Inline policy on a group \|
101	\| `iam:PutRolePolicy` \| Inline on a role you can assume \|
102	\| `iam:AddUserToGroup` \| Add self to admin group \|
103	\| `iam:UpdateAssumeRolePolicy` + sts:AssumeRole \| Modify trust to allow self \|
104	\| `iam:CreatePolicyVersion` \| Create v2 of an attached policy with admin \|
105	\| `iam:SetDefaultPolicyVersion` \| Switch attached policy to admin versio

People who liked this also viewed

6 picks

Type

cloud-iam-deep

3.0kstars461forks

View on GitHub

How to install cloud-iam-deep?

elementalsouls/claude-bughunter/cloud-iam-deep

$npx -y skills add elementalsouls/Claude-BugHunter --skill cloud-iam-deep

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## When to use
2
3	Trigger when:
4	- A cloud credential surfaces (key, secret, token, JSON file)
5	- SSRF chain reaches IMDS / metadata endpoint
6	- APK / git-leak reveals embedded cloud key
7	- Recon shows public S3/GCS/Azure-blob with permissions you can verify
8	- A Kubernetes API or service-account token is exposed
9	- Post-RCE on a cloud-hosted instance — pivot to cloud control plane
10
11	Do NOT use for:
12	- On-prem-only environments (use AD attack skills — but those are out of scope per external-only boundary)
13	- Web2 vulns that happen to be on AWS — use the relevant `hunt-*` skill
14
15	---
16
17	## Credential identification (first 60 seconds)
18
19	```bash
20	# AWS access key patterns
21	AKIA[0-9A-Z]{16} # IAM user access key (long-term)
22	ASIA[0-9A-Z]{16} # STS temporary credential
23	AGPA[0-9A-Z]{16} # IAM group
24	AIDA[0-9A-Z]{16} # IAM user (user-id)
25	AROA[0-9A-Z]{16} # IAM role
26	ANPA[0-9A-Z]{16} # Managed policy
27
28	# AWS secret pattern (40-char base64-ish — context required)
29	[A-Za-z0-9/+=]{40} # AWS secret access key
30
31	# Azure
32	AccountKey=[A-Za-z0-9+/=]{86} # Storage account key
33	client_secret pattern + UUID # Azure AD app credential
34
35	# GCP service account JSON
36	{
37	"type": "service_account",
38	"project_id": "...",
39	"private_key_id": "...",
40	"private_key": "-----BEGIN PRIVATE KEY-----..."
41	}
42
43	# K8s SA token (JWT format — decode to confirm)
44	eyJhbGciOiJSUzI1... # decode kid claim to see issuer
45	```
46
47	---
48
49	## AWS — read-only validation (the safe first step)
50
51	```bash
52	# Set credential
53	export AWS_ACCESS_KEY_ID="AKIA..."
54	export AWS_SECRET_ACCESS_KEY="..."
55
56	# 1. WHO am I?
57	aws sts get-caller-identity
58	# Returns: UserId, Account, Arn
59	# Arn tells you: IAM user vs role, account ID, name
60
61	# 2. WHAT can I do? (the privesc question)
62	# Try common read-only first — failures still inform you
63	aws iam list-users 2>&1 \| head -5
64	aws iam list-roles 2>&1 \| head -5
65	aws iam list-policies 2>&1 \| head -5
66	aws iam list-groups 2>&1 \| head -5
67
68	# 3. WHAT policies are attached to me?
69	aws iam list-attached-user-policies --user-name <self>
70	aws iam list-user-policies --user-name <self> # inline policies
71	aws iam list-groups-for-user --user-name <self>
72
73	# 4. Service-by-service surface
74	aws ec2 describe-instances --max-items 1 2>&1 \| head
75	aws s3 ls 2>&1 \| head -10
76	aws lambda list-functions --max-items 5 2>&1 \| head
77	aws rds describe-db-instances --max-items 5 2>&1 \| head
78	aws secretsmanager list-secrets --max-results 5 2>&1 \| head
79	aws ssm describe-parameters --max-results 5 2>&1 \| head
80
81	# 5. Audit any cross-account / external trust
82	aws iam list-roles --query 'Roles[?contains(AssumeRolePolicyDocument.Statement[0].Principal.AWS, `arn:aws:iam::`)]' 2>&1 \| head -20
83	```
84
85	---
86
87	## AWS privesc patterns (24+ documented — `iam_privesc` techniques)
88
89	Quick lookup — if you have any of these IAM actions, escalate via the listed technique:
90
91	\| You have \| Escalate via \|
92	\|---\|---\|
93	\| `iam:CreateAccessKey` \| Create access key on any user → impersonate \|
94	\| `iam:CreateLoginProfile` \| Set a console password on a user → login \|
95	\| `iam:UpdateLoginProfile` \| Reset console password on a user \|
96	\| `iam:AttachUserPolicy` \| Attach AdministratorAccess to self \|
97	\| `iam:AttachGroupPolicy` \| Attach AdministratorAccess to a group you're in \|
98	\| `iam:AttachRolePolicy` + sts:AssumeRole \| Attach to a role you can assume \|
99	\| `iam:PutUserPolicy` \| Inline AdministratorAccess to self \|
100	\| `iam:PutGroupPolicy` \| Inline policy on a group \|
101	\| `iam:PutRolePolicy` \| Inline on a role you can assume \|
102	\| `iam:AddUserToGroup` \| Add self to admin group \|
103	\| `iam:UpdateAssumeRolePolicy` + sts:AssumeRole \| Modify trust to allow self \|
104	\| `iam:CreatePolicyVersion` \| Create v2 of an attached policy with admin \|
105	\| `iam:SetDefaultPolicyVersion` \| Switch attached policy to admin versio

People who liked this also viewed

6 picks

Type