Penetration Test / Red Teaming / Purple Team
  • whoami
  • PowerShell for Pentesters
  • Azure AD Penetration Test
    • Intro
    • Initial Access
      • Bypassing MFA with Evilginx2
    • Enumeration
    • Privilege Escalation
    • Tools
  • AWS Penetration Test
    • Intro [WIP]
    • Enumeration
    • Initial Access
    • Privilege Escalation
    • Tools
  • Hackthebox WriteUps
  • Purple Team Exercise
    • Intro
  • Container Security
    • Docker Image Security
    • Docker Basic Commands
      • Docker-Related Attack Vectors
    • Podman Basic Commands
    • Container Breakouts
      • Containerd Attacks
    • Multi Container Setup
    • Securing Docker
Powered by GitBook
On this page
  • IAM Privilege Escalation
  • EC2 Privilege Escalation
  1. AWS Penetration Test

Privilege Escalation

Pacu tool

run iam__bruteforce_permissions

IAM Privilege Escalation

Lists all managed policies that are attached to the specified IAM user :

aws iam list-attached-user-policies --user-name user-name

Retrieves information about the specified managed policy : 

aws iam get-policy --policy-arn policy-arn

Lists information about the versions of the specified managed policy :

aws iam list-policy-versions --policy-arn policy-arn

Retrieves information about the specified version of the specified managed policy :

aws iam get-policy-version --policy-arn policy-arn--version-id version-id

Add an inline policy document that is embedded in the specified IAM user :

aws iam put-user-policy --user-name Username--Policy-name PolicyName--policy-document file://Policy.json

Lists the names of the inline policies embedded in the specified IAM user :

aws iam list-user-policies --user-name user-name

AWS IAM Privilege Escalation – Methods and Mitigation

**Privilege Escalation Methods **
**Required Permission **

Attaching a policy to a user

iam:AttachUserPolicy

Attaching a policy to a group

iam:AttachGroupPolicy

Attaching a policy to a role

iam:AttachRolePolicy

Creating a new user access key

iam:CreateAccessKey

Creating a new login profile

iam:CreateLoginProfile

Updating an existing login profile

iam:UpdateLoginProfile

Creating an EC2 instance with an existing instance profile

iam:PassRole ec2:RunInstances

Creating/updating an inline policy for a user

iam:PutUserPolicy

Creating/updating an inline policy for a group

iam:PutGroupPolicy

Creating/updating an inline policy for a role

iam:PutRolePolicy

Adding a user to a group

iam:AddUserToGroup

Updating the AssumeRolePolicyDocumentof a role

iam:UpdateAssumeRolePolicy sts:AssumeRole

Passing a role to a new Lambda function, then invoking it

iam:PassRole lambda:CreateFunction lambda:InvokeFunction

Updating the code of an existing Lambda function

lambda:UpdateFunctionCode

EC2 Privilege Escalation

Get Information about user identity / role identity :

aws sts get-caller-identity

Lists all managed policies that are attached to the specified IAM user :

aws iam list-attached-user-policies --user-name user-name

Retrieves information about the specified version of the specified managed policy :

aws iam get-policy-version --policy-arnpolicy-arn--version-id version-id

Get-Information about instance id :

curl http://169.254.169.254/latest/meta-data/instance-id

Lists the instance profiles :

aws iam list-instance-profiles

Attach an instance profile with a role to a EC2 instance: : 

aws ec2 associate-iam-instance-profile --instance-id InstanceID --iam-instance-profile Name=ProfileName
PreviousInitial AccessNextTools

Last updated 2 years ago